ML071730280

G20070420/LTR-07-0414/EDATS: SECY-2007-0203 - Sen. Richard G. Lugar Ltr. Security at Nuclear Plants - Palo Verde

ML071730280
Person / Time
Site:	Palo Verde
Issue date:	06/26/2007
From:	Reyes L NRC/EDO
To:	Lugar R US SEN (Senate)
Taylor R, EDO, 301-415-2240
Shared Package
ML071730271	List: ML071730280
References
EDATS: SECY-2007-0203, G20070420, LTR-07-04174, SECY-2007-0203
Download: ML071730280 (2)

Text

June 26, 2007 The Honorable Richard G. Lugar United States Senate Washington, D.C. 20510

Dear Senator Lugar:

On behalf of the U.S. Nuclear Regulatory Commission (NRC), I am responding to your letter dated June 4, 2007, regarding NRC actions related to the unauthorized access and use of computer software by a former employee of the Palo Verde Nuclear Generating Station. You specifically requested NRCs findings and views regarding this incident in order to follow up with an email you received from Mr. Dan Vandre on April 23, 2007.

I would first like to mention that the Department of Justice is continuing its work relating to this case, and that the NRC is coordinating with the Federal Bureau of Investigation with respect to these efforts. In October 2006, the NRC was notified of a cyber-intrusion at the Web site of a vendor performing work for the Palo Verde nuclear power plant. Upon notification, the NRC commenced a review of the alleged intrusion and coordinated with Federal law enforcement officials. The NRC verified that the software was limited to information relating to a simulator, which is used to train control room operators, and could not be used to operate the plant. The software did not divulge sensitive security-related information, such as Safeguards or Classified Information. Our assessment concluded that the software compromise does not put the facility at risk for sabotage, and we did not, nor do we currently have, any specific concerns regarding security at the Palo Verde site. In addition, Palo Verde has taken corrective actions to enhance its protocols for terminating access to company and vendor software when an employee terminates employment. These actions were verified by the NRC. We note that, in any event, there are multiple layers of defense required by NRC regulations to ensure that conditions adverse to public health or safety, the common defense or security, and the environment do not occur.

Please contact me should you have any further questions.

Sincerely,

/RA/

Luis A. Reyes Executive Director for Operations

June 26, 2007 The Honorable Richard G. Lugar United States Senate Washington, D.C. 20510

Dear Senator Lugar:

On behalf of the U.S. Nuclear Regulatory Commission (NRC), I am responding to your letter dated June 4, 2007, regarding NRC actions related to the unauthorized access and use of computer software by a former employee of the Palo Verde Nuclear Generating Station. You specifically requested NRCs findings and views regarding this incident in order to follow up with an email you received from Mr. Dan Vandre on April 23, 2007.

I would first like to mention that the Department of Justice is continuing its work relating to this case, and that the NRC is coordinating with the Federal Bureau of Investigation with respect to these efforts. In October 2006, the NRC was notified of a cyber-intrusion at the Web site of a vendor performing work for the Palo Verde nuclear power plant. Upon notification, the NRC commenced a review of the alleged intrusion and coordinated with Federal law enforcement officials. The NRC verified that the software was limited to information relating to a simulator, which is used to train control room operators, and could not be used to operate the plant. The software did not divulge sensitive security-related information, such as Safeguards or Classified Information. Our assessment concluded that the software compromise does not put the facility at risk for sabotage, and we did not, nor do we currently have, any specific concerns regarding security at the Palo Verde site. In addition, Palo Verde has taken corrective actions to enhance its protocols for terminating access to company and vendor software when an employee terminates employment. These actions were verified by the NRC. We note that, in any event, there are multiple layers of defense required by NRC regulations to ensure that conditions adverse to public health or safety, the common defense or security, and the environment do not occur.

Please contact me should you have any further questions.

Sincerely,

/RA/

Luis A. Reyes Executive Director for Operations DISTRIBUTION: G20070420/LTR-07-0414/SECY-2007-0203 EDO R/F AO R/F LReyes MVirgilio WKane DAsh VOrdaz Cyr/Burns BMallet RZimmerman JDyer Region IV RTaylor JRaber Package: ML071730271 OFFICE OEDO/CA OEDO/CA NSIR Region IV OGC NAME JRaber RTaylor RZimmerman BMallet LChandler DATE 06/22/07 06/22/07 06/22/07 06/22/07 06/22/07 OFFICE DEDIS OCA EDO NAME DAsh RSchmidt LReyes (BKeeling for)

DATE 06/26/07 06/26/07 06/26/07 OFFICIAL RECORD COPY