IR 05000269/1993032

Insp Repts 50-269/93-32,50-270/93-32,50-287/93-32, 50-369/93-31,50-370/93-31,50-413/93-35 & 50-414,respectively on 931213-17.Violations Noted.Major Areas Inpected:Licensee Safeguards Info Program to folow-up on Licensee Repts

ML20059F745
Person / Time
Site:	Oconee, Mcguire, Catawba, McGuire
Issue date:	01/06/1994
From:	Masnyk O, Mcguire D NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II)
To:
Shared Package
ML20059F725	List: IR 05000269/1993032 ML20059F720
References
50-269-93-32, 50-270-93-32, 50-287-93-32, 50-369-93-31, 50-370-93-31, 50-413-93-35, 50-414-93-35, NUDOCS 9401140137
Download: ML20059F745 (13)

Text

.. . - -

"

o UNITED STATES

[eacc,% NUCLEAR REGULATORY COMMISSION 3' . 4 REGloN 11

1. E 101 MARIETTA STREET, N.W., SUITE 2900 7e :j ATLANTA, GEORGIA 303234199

\...../ 1 Report No /93-35, 50-414/93-35, 50-369/93-31, 50-370/93-31, 50-269/93-32, 50-270/93-32 and 50-287/S3-32 )

i Licensee: Duke Power Company l P. O. Box 1007 Charlotte, NC 28291 Docket Nos. 50-413 and 50-414 License Nos. NPF-35, NPF-52 i 50-369 and 50-370 NPF-9, NPF-17 50-269, 50-270, and 50-287 DPR-38, DPR-47, i and DPR-55 ;

Facility Names: Catawba 1 and 2, McGuire 1 and 2, and Oconee 1, 2 and 3 >

Inspection Conducted: December 13-17, 1993 Inspector: hAl$h }M hinsch l-6-7f Orysia M. Masn.k, Safegl J ards Specialist Date Signed Approved by: s % /!6h David R. McGuire, Chief Date Signed Safeguards Section Nuclear Materials Safety and Safeguards Branch Division of Radiation Safety and Safeguards SUMMARY  !

Scope:

This special, announced inspection was conducted in the area of the licensee's Safeguards Information Program to follow up on the licensee's reports of the -

Computer Aided Design System and Oconee Safeguards event Results:

In the areas inspected, three apparent violations of regulatory requirements were identified, all dealing with the failure to control Safeguards Information as follows:

(93-35-01,93-31-01,93-32-01) Failure to control Safeguards Information at l the computer center in the General Offic (93-35-02,93-32-02) Failure to control Safeguards Information at various times at the Oconee and Catawba facilitie (93-32-03) Failure to control Safeguards Information at the Oconee facility outside of the Protected Are PDR ADOCK 0500026 G PDR

,

These violations were identified by the licensee and appropriately logged or reported as required by 10 CFR 73.71. Some of the Safeguards Information that was compromised is considered significan .

a.

k

_ ._ _ . _ _ _ - _ _ _ ____

.

O j

REPORT DETAILS I Persons Contacted Licensee Employees I i

• G. Addis, Human Resources, Catawba i

'

• Byers, Security Support Supervisor, Catawba P. Colianni, Nuclear Production Engineer, Nuclear Licensing Services

• • D. Durham, Technical Specialist, Oconee )

• R. Eller, Licensing Services, General Office

'

• • T. Godfrey, Security Support Supervisor,'McGuire  :

'

D. Jennings, Lead Auditor, Nuclear Services Division

• • T. Keener, Security Manager, McGuire

• J. Lowery, Regulatory Compliance, Catawba

• T. Lowery, Security Technical Specialist, Oconee j

• • M. Melter, Technical Specialist, Oconee ,

• J. Roach, Security Manager, Catawba .)

• • M. Satterfield, Security Support Supervisor, Oconee i Other licensee employees contacted during this inspection included engineers, security force members, and administrative personne U. S. Nuclear Regulatory Commission j

• R. Fruedenberger, Senior Resident Inspector, Catawba

• Attended exit interview

• • Monitored exit interview by teleconference

. This special, announced inspection was conducted to review Duke Power l Company's Safeguards Information Program. The licensee's program was !

assessed to verify compliance with 10 CFR 73.21, the Safeguards Information Rule, which is further-delineated in NUREG-0794, Protection of Unclassified Safeguards Information, dated October 198 Computer Aided Draftina System Event Background The licensee's program for the protection of Safeguards Information is spelled out in the Nuclear Generation Division, Power Generation Group, Nuclear Policy Manual 206, Safeguards and Information Control, Revision 0, dated November 1, 1992. It applies to all departments and locations within Duke Power Company that maintain documents containing Safeguards Information and applies to licensee employees and contractors. This procedura generally follows 10 CFR 73.21 and NUREG-0794, but contains some items specific to Duke Power Company such as: (a) Individuals who i

l

.

.

may have access to Safeguards Information listed on the !

Safeguards Information List, and a list of individuals who meet the screening and training prerequisites. This list is maintained in electronic form by the Manager, Nuclear Access and Fitness For Duty, Human Resources Power Grou (b) In addition to GAS approved Class 6 containers, the utility utilizes containers or steel filing cabinets equipped with a r steel locking bar and a Government Service Administration ;

(GSA) approved combination padlock, but these types of containers are maintained in a Controlled Access Area (CAA) ,

if located outside of the protected area. The procedure goes on to define a CAA and explain how it is established ,

'

and maintaine (c) The use of computer systems or magnetic medium is allowed in closed systems and requires the 3 information to be protected against unauthorized disclosur Duke Power Ccmpany provides two hand-outs pertinent to the ;

control of Safeguards Information. A pamphlet entitled

~

" Protection of Safeguards Information," Revision 3, is given to all employees with access to Safeguards Information and defines their responsibilities. A pamphlet entitled

" Security Guidelines for Personal Computers" contains, among other topics, a discussion of how to protect information within the compute . Summary of Licensee's Investigation and NRC Findinas On March 25, 1993 and April 1, 1993, the licensee made a one-hour call concerning a loss of control of Safeguards Information at the Duke Corporate Office dealing with Safeguards Information material for all three Duke Power sites. This was discussed in Licensee Event Report (LER)93-501, dated May 24, 1993 with a supplement dated April 22, 1993, for the Oconee Site and LER 93-S01 dated April 22, '

1993, and supplement dated May 24, 1993 for the Catawba site. The inspector found that these reports were made in a timely and appropriate fashion. The licensee advised that they were initiating a investigatio NRC representatives agreed that the licensee could provide all additional information on this event in the investigation report to be reviewed during a NRC inspection at the conclusion of the licensee's investigation. A summary of the licensee's investigation and NRC's findings from.this inspection is l detailed belo ;

On March 24, 1993, at approximately 1:00 p.m., an !

Engineering Services employee at the McGuire Nuclear Station was working with the Network Field Manager (NFM) system (not Safeguards secured) which allows the user to access drawings via computer. This individual was authorized access .to Safeguards Information. He was able to access a drawing containing Safeguards Information. He proceeded to clear ,

his computer and began advising others of the problem. The '

persons advised included a Designer, the Document ;

. .

~

,

y 3 j Controller, and Safeguards, Security and Compliance personnel. Catawba and Oconee site personnel were also i advised. A search of archive tapes was initiated. As Safeguards Information was found it was secured or delete ,

Suspected cartridges at the College Street Center were !

degaussed or secure Further investigation disclosed that Safeguards Information drawings for all three nuclear sites were found within the Information Management group files at-the Duke Power General Offic ,

A Computer Aided Drafting System (CADS) provides automated

'

drafting services for Duke Power personnel. Since 1976 this system was used for working with security drawings. The '

system was designed to utilize digitized drawings on tape in which they could be retrieved for later drawing revision '

Security drawings were to be identified as Safeguards Information and stored on a protected tape in an authorized container. At its inception, the CADS was a contained system. As personal computers came into use by individuals j outside of the CADS area, the CADS Section became more of an archiving section. The CADS Section was building a database for retrieval by system users. Individuals who worked with security drawings were supposed to identify the drawings as Safeguards Information so that they could be properly ,

store The licensee's investigation disclosed that since 1978, users had failed to flag drawings as Safeguards Information and these drawing were saved on the routine tapes, not protected as Safeguards Information. -0ther drawings that contained Safeguards Information that were used in the System were properly identified and protecte Between 1975 and 1991 the CADS provided automated drafting services. Starting in 1987, when personal computers came into use, the CADS Section would copy files from its archive tapes to a Personal Computer (PC) floppy disk and dispense these for use to licensee individuals outside of the CADS area. The CADS Section would also receive floppys and archive them onto tape. In 1991 the CADS Section was partially disbanded, with the remaining staff working with archiving and retrieval of drawings. In 1989 the CADS was connected to a network. File backup transmissions are completed through hard connected data links maintained by '

Duke Power. The McGuire drawings were loaded to the system and available to users in June of 1992, but were not accessible until November of 1992 when a user friendly system was installed. At the time of this-inspection the Catawba drawings were loaded but the system was not i available to users. Oconee had no files loaded and the '

system was not available to users. However, there were numerous magnetic tape cartridges, some of which contained i

.

s Safeguards Information, unknown to Duke Power, stored at the College Street Computer Center. Safeguards Information tapes are stored in approved containers at the Wilkinson Boulevard Storage facilit On March 25, 1993, a list was generated by the Information Technology Division of suspect drawings for revie Evaluations of the drawings were accomplished and the licensee determined that the McGuire and Oconee drawings were of a nature such that disclosure did not provide a significant threat. The Catawba drawings were found to contain some significant Safeguards Information and a one-hour call to the NRC was mad On March 30, 1993, the licensee requested the sites to generate a list of drawings that could be on the CAD ,

On April 1,1993, a list of other drawings that contained Safeguards Information were sent to the sites for revie Significant Safeguards Information was found for the Oconee facility and a one-hour call was made to the NR Subsequent review disclosed significant Safeguards t Information for the McGuire facility. As previously discussed, the notifications to NRC were timel The licensee concluded that Safeguards Information was ,

improperly marked, controlled, and stored on nine-track magnetic tapes, magnetic tape cartridges, optical disks, or '

computer systems and that Safeguards Information was improperly handled via electronic files in the CADS area intermittently from 1976 until discovery in 1993. Based on a review of the licensee's investigation, the inspector concurred with the licensee's conclusio ;

The licensee ide-tified several root causes for the proble The existing CADS work process was modified to accommodate Safeguards Information drawings, but the system allowed security jobs to be worked without being afforded Safeguards protection, subsequently Safeguards Information was stored improperl The process of informing the CADS File Manager of the files to be archived was not controlled by a written procedure and changed over tim The practice of archiving subsequent revisions of a drawing file to the same archive tape was a CADS workplace practice. Once a drawing was improperly archived, it continued to be saved in the same fashio .

5

,

-

Individuals working with Safeguards Information had numerous opportunities' to identify uncontrolled Safeguards Information and failed to do so and correct the proble There was inadequate review and awareness of the CADS work process by Safeguards Information Document Controller The licensee stated that it was unlikely that an unauthorized person gained access to the information stored on archive tapes in the CADS area. This is based on the l number of files and the way the drawings are identifie Also the system is an old and unique system, not in use ,

commercially today. If an individual took a tape from the storage facility, it is unlikely that it could be accessed on equipment currently in use. The CADS area is relatively small with only a few entrances, which are locked at nigh *

The individuals trained in the use of the retrieved equipment are authorized access to Safeguards Informatio The inspector verified the information in the licensee's assessment of the tapes' vulnerability but also determined that the licensee could not positively identify those individuals who accessed the database at the McGuire facility. The CADS facility does not have positive access controls in place. Also, the licensee is not sure of the numbers, if any, of floppy disks that were given out that contained Safeguards Informatio This situation was first identified on March 24, 1993 at approximately 1:00 p.m. by a McGuire Nuclear Station employee. The licensee completed its preliminary investigation on April 1, 1993. Uncontrolled Safeguards Information computer files were located and either destroyed or secured, and the files were evaluated to determine the level compromised. Security force personnel were informed of this event and instructed to maintain an enhanced awareness of the site protective systems. The licensee made a notification to the NRC Operations Center which was followed up by LER 50-269/93-S01 dated April 22, 1993, and supplemented on May 24, 1993 and LER 50-413/93-S01 dated April 22,1993 and supplemented on May 24, 199 An ,

investigation into this event was completed by Nuclear I Licensing Service Each site performed an evaluation of the drawings improperly stored at the General Office Computer Center. The report for Catawba is dated April 5,1993, and documents the results of Catawba's review conducted by Engineering and Security personnel. It concluded that some drawings were stamped Safeguards Information which did not contain Safeguards Information, that some drawings were outdated,

,

- - -

.

'

and that some were of low significance. Some information was categorized as significant. Reports for McGuire dated April 1, 1993 and for Oconee dated April 12, 1993, had the same conclusion The inspector reviewed the licensee's evaluations of the drawings that were included in the CADS data base. Based on the review, and following discussion with security, licensing, and engineering personnel, the inspector concurred with the conclusion that some of the drawings >

could be considered significan A corrective measure identifisd in the LERs was to have the Safety Assurance Groups, Audit Section, conduct a comprehensive assessment of all aspects of the Safeguards Information program at Duke Power Company. This audit was conducted from October 11, 1993 through November 30, 1993 at all three nuclear sites and in the General Office. The report was issued on December 14, 1993, during the course of this inspection, and is currently under review by licensee security and management personnel. The scope of the audit was as follows: "1) identif "ation and location of Safeguards Information throughout the entire company, 2) Safeguards access prerequisites satisfied for personnel

'

working with Safeguards Information, 3) prope classification of Safeguards Information, 4) physical protection of Safeguards Information including a review of all storage locations currently in use throughout the company, 5) protection of Electronic Safeguards Information, ,

including a review of PC applications, mainframe application, Security Computer System applications, electronic transmittal of data, and data encryption efforts, and 6) evaluation of program adequacy, including employee knowledge and understanding of the program." Within the .

scope of the assessment there were a total of 25 '

observations, seven of which were documented in the site's Safeguards Event Logs. There were also 16 recommendation Licensee personnel advised, that where needed, corrective actions were implemented to correct- problems identifie Long term corrective measures are under review. The inspector advised that the audit findings and recommendations would be reviewed during subsequent inspections in order to provide Duke Power Company an opportunity to review the audit findings and implement actions as neede Previously, on December 12, 1987, an event that involved the transmission of Safeguards Information electronic word processing files across unprotected lines which was made possible by the installation of a system that backed up word processing files was reported to the NRC. These transmitted files were stored on unmarked magnetic tapes in containers

.

.

not designed for the storage of Safeguards Information and not properly secured. The licensee's LERs for the current event conclude that the root cause for the 1987 event "was the failure to recognize the consequences of modifying a computer system that processed Safeguards Information and the failure to adequately inform the system users of the modification. " They further concluded that "the root cause of this event, although having similar results, was different and, therefore, this is not considered a recurring event." The inspector determined that the previous corrective measures could not have reasonably prevented this violation from occurring. The licensee's previous corrective measures consisted of retraining personnel who handled Safeguards Information and the development of a :

" Computer Awareness Handbook." During the course of the previous investigation the licensee identified and secured the affected tapes containing Safeguards Information. The CADS is a separate stand alone system, which was not integrated into the Duke computer systems until recentl The storage area in question was not the same area as the l one involved in the current event. A search of the storage i I

area in question would not have disclosed this problem since the Safeguards Information was stored on tapes whose markings would not disclose the nature of the information therei CFR 73.21(c)(1) requires the licensee to limit access to Safeguards Information to personnel with a "need to know." 10 CFR 73.21(d)(2) requires Safeguards Information to be stored in a locked security storage container when not in use. 10 CFR 73.21(g)(3) requires Safeguards Information to be transmitted only by protected telecommunications circuits. The failure to protect Safeguards Information at the Duke Power General Office, by failing to store it properly,- failing to control access to it and by allowing it to be transmitted by unprotected telecommunications circuits is an apparent violation of regulatory requirement (93-35-01, 93-31-01, and 93-32-01). i B. Miscellaneous Safeauards Events Oconee Events Review of documentation and discussion with security personnel disclosed the following problems with the protection of Safeguards Information at the Oconee facilit On July 9,1992, an Instrument and Electronics (I&E)

supervisor found an unsecured Safeguards container in a file room within the protected area. The licensee found that the container was unsecured from some time in the morning until ,

found at 9:35 p.m., and determined that the contents were

'

not significan I&E supervisors were briefed on the importance of securing containers. On January 18, 1993, at 1:57 a.m., a security officer found an unsecured Safeguards l

.

.

.

.

Information safe in a vital area within the protected are The safe contained information utilized to make software changes to the Security Computer and badging informatio The licensee could not determine how long the safe had been unlocked. I&E personnel were briefed on the proper protection of Safeguards Information. The licensee felt this violation was repetitive. On January 20, 1993, ,

security personnel found that a Quality Assurance audit team '

had left several Safeguards Information documents unattended in a security training classroom inside of the protected

'

area. This information consisted of. the Security Plan and procedures. The infoemation was unsecured for a short tim !

The auditors were counseled on the requirements of protecting Safeguards Information. On February 11, 1993, at approximately 9:17 a.m., the security section was made aware of the following situation. On February 9,.1993 an NRC report containing Safeguards Information was received at the site and was'sent to the Vice President's office which is ,

located outside of the protected area. The secretary opened the envelope containing the report and routed the report in ,

a station mail envelope (perforated and twist tie secured) ,

to Regulatory Compliance who received the report on February 11, 1993. As a corrective measure, the secretary was placed on the list of Safeguards Document Controllers and received ;

Safeguards Information training. On February 23, 1993 at l approximately 5:00 p.m., security personnel were advised that two I&E procedures containing Safeguards Information !

were missing. The information contained in the documents could also have been determined from observing the Protected Area perimeter. The licensee could not determine who was :

responsible for the loss of the documents. I&E personnel were counseled on the need to keep Safeguards Information under control. I&E supervisors issued a memo dated April 12, 1993, to help ensure that Safeguards Information is controlled properly. A memo was issued by the Security Department on February 18, 1993, identifying the previous events and emphasizing the need to properly handle and protect Safeguards Information. An acknowledgement was required from all Site Safeguards Document Controllers. A Security Reminder on this topic was published in station publications. A security memorandum was issued to security personnel on February 18, 1993, with an acknowledgement required. Eight additional personnel were designated Document Controllers to enhance handling of Safeguards ,

Informatio On April 26,1993, at 10:46 a.m., security personnel discovered a container containing security plans cod i procedures unsecured within the training area which is i located inside the protected area. The container had been open since approximately 6:00 The trainers were 1

!

l l

!

'

!

l

!

!

reminded of the proper protective measures for Safeguards Informatio On November 19, 1993 at approximately 2:30 p.m., Safeguards Information consisting of a list of combinations for all Safeguards Information containers for the Engineering and ;

Document Control sections, was left on a desk until i discovered on November 22, 1993 at 0730 hours0.00845 days <br />0.203 hours <br />0.00121 weeks <br />2.77765e-4 months <br />. This area is located outside of the protected area. Upon discovery all combinations were changed. The list was mixed in among other paper ?. Catawba Events Review at the Catawba station disclosed the following events. On August 8, 1992, Safeguards Information was being ,

copied when the machine jammed. The individual making ',

copies thought all copies were cleared from the machine, but

'

additional copies were found the next day at 6:15 a.m., in a tray at the copier. It was turned over to the document l control desk where it was stored in an envelope until August 25, 1993, at 9:50 a.m., when it was recognized as Safeguards Information. These offices are located outside the protected area. On December 21, 1992, at 7:45 a.m., an individual at the Engineering Document Control desk ,

discovered Safeguards Information in an interoffice envelope which had laid on a desk since December 18, 1992. The information had not been properly transmitted. The responsible individual was retrained on methods of handling Safeguards Information. On December 22, 1992, at approximately 7:00 a.m., mechanical maintenance individuals found a security journal mixed in with their work information packet. The journal was dated December 20, 1992. This was attributed to a mistake made at the copie The journal has se.bsequently been declassified. On January 27, 1993, two pages were found missing from a copy of the Physical Security Plan. The licensee determined the pages were probably inadvertently shredded when the plan was updated. On April 27. 1993, a page was found missing from the Physical Security Plan. The same conclusion as above was drawn. On August 16, 1993, Safeguards Information was found in a desk drawer in a file that was received from the General Office. The file contained three pages of an i outdated Physical Security Plan dated March 10, 1988. The licensee assumed the information was unsecured since that ,

dat '

These events were identified by the licensee and properly logge '

10 CFR 73.21(c)(1) requires the licensee to limit access to Safeguards Information to personnel with a "need to know."

10 CFR 73.21(d)(2) requires Safeguards Information to be stored in

,

.

.

a locked security container when not in use. 10 CFR 73.21(g)(1)

requires Safeguards Information to be packaged to preclude disclosure when transmitted. Failure to adhere to these requirements is an apparent violation. (93-35-02,93-31-02,and 93-32-02). Oconee Event: Failure to Control Safeguards Information Outside cf the Protected Area At 10:15 a.m., on December 6, 1993, a Safeguards Information container, located at the Oconee Complex Document Control Area, outside of the protected area, was found unlocked by a licensee employee. This individual was authorized access to Safeguards Information. The handle on the safe was in a position for the safe to be locked, but the combination dial was not turned to secure the safe. The safe had the appearance of being secure The building is afforded normal office building security measures, however, not all the personnel with access to the building are cleared for Safeguards Information. Due to.the nature of the material compromised the licensee attempted a one-hour call via the Emergency Notification System, but it was out of order. A call was made using the commercial phone system. The licensee's ,

investigation disclosed that the safe was probably unsecured for approximately one month. The licensee has now initiated a check list to ensure that this container is secured each day. The licensee advised that the container held all the Oconee security related engineering drawings, the vendor description of the Eaton System, the " WIN" Margin Analysis, the input / output summary, miscellaneous security drawings for on-going modifications, the vital area analysis and plant system flow charts, the independent spent fuel storage installation (ISFSI) Security Plan, the CCTV Switcher Modification Design Basis documents, the 1989 vehicle bomb threat analysis, and system descriptions of microwaves, CCTVs, access control system, annunciators, cargo access portals, locks, and powe A review of the contents of the safe disclosed that the information compromised can be considered significant Safeguards Information. The event is further exacerbated by the safe's location outside the protected area and the possibility of access to the material by ,

unauthorized person '

10 CFR 73.21(c)(1) requires the licensee to limit access to Safeguards Information to personnel with a "need to know." 10 CFR 73.21(d)(2)

requires Safeguards Information to be stored in a locked security container when not in use. This failure to control Safeguards Information is an apparent violation. (93-32-03).

3. Exit Interview The inspection scope and results were summarized on December 17, 1993, with those persons indicated in Paragraph The inspector described

.

l l

the areas inspected and discussed in detail the inspection results. The licensee was advised that three apparent violations were noted. The ;

first dealt with unprotected Safeguards Information at the General '

Office in Charlotte. This was discussed in LER 296/93-S01 for Oconee and 50-413/93-S01 for Catawba. The second apparent violation dealt with an unsecure Safeguards Information container outside of the protected ,

area at the Oconee facilit This is discussed in LER 50-269/93-S0 .

'

The third apparent violation dealt with several miscellaneous Safeguards Information problems at Oconee and Catawba. The inspector noted the licensee's audit, which was performed in response'to the first apparent '

violatio Licensee personnel advised that this report was still under review, but that immediate recommended corrective measures had been implemented and that long term measures would be evaluated. Dissenting comments were not received from the license ,

,

i