VR-SECY-19-0046, Options for a Long-Term Alternative to the Nuclear Energy Institute Composite Adversary Force
| ML19282B690 | |
| Person / Time | |
|---|---|
| Issue date: | 10/09/2019 |
| From: | Commissioners NRC/OCM |
| To: | Annette Vietti-Cook NRC/SECY |
| References | |
| SECY-19-0046 | |
| Download: ML19282B690 (10) | |
Text
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 October 9, 2019 SECRETARY COMMISSION VOTING RECORD DECISION ITEM:
TITLE:
SECY-19-0046 OPTIONS FOR A LONG-TERM ALTERNATIVE TO THE NUCLEAR ENERGY INSTITUTE COMPOSITE ADVERSARY FORCE The Commission acted on the subject paper as recorded in the Staff Requirements Memorandum (SRM) of October 9, 2019.
This Record contains a summary of voting on this matter together with the individual vote sheets, views and comments of the Commission.
Enclosures:
- 1. Voting Summary
- 2. Commissioner Vote Sheets cc: Chairman Svinicki Commissioner Baran Commissioner Caputo Commissioner Wright OGC EDO PDR
~yd}~-~
Annette L. Vietti-Cook Secretary of the Commission
VOTING
SUMMARY
- SECY-19-0046 RECORDED VOTES NOT APPROVED DISAPPROVED ABSTAIN PARTICIPATING COMMENTS DATE Chrm. Svinicki X
X 09/26/19 Cmr. Baran X
X 10/01/19 Cmr. Caputo X
X 09/24/19 Cmr. Wright X
X 09/30/19
TO:
FROM:
SUBJECT:
POLICY ISSUE NOTATION VOTE RESPONSE SHEET Annette Vietti-Cook, Secretary CHAIRMAN SVINICKI SECY-19-0046: Options for a Long-term Alternative to the Nuclear Energy Institute Composite Adversary Force.
Approved XX Disapproved Abstain Not Participating COMMENTS:
Below XX Attached None I approve the staff's recommended Option 1, in light of the staff's conclusion that the industry is capable of developing and providing a credible adversary force that can replicate the characteristics outlined in the design basis threat.
Nothing in this vote should be interpreted as indicating approval or disapproval of matters currently under consideration by the Commission in SECY-18-0110.
/19 Entered on "STARS" Yes _d No_
TO:
FROM:
SUBJECT:
Approved POLICY ISSUE NOTATION VOTE RESPONSE SHEET Annette Vietti-Cook, Secretary Commissioner Baran SECY-19-0046: Options for a Long-term Alternative to the Nuclear Energy Institute Composite Adversary Force.
Disapproved X
Abstain Not Participating COMMENTS:
Below Attached X
None Entered in "STARS" Yes X
No
% ATURE Jr:;, /1/,,
DATE
Commissioner Saran's Comments on SECY-19-0046, "Options for a Long-term Alternative to the Nuclear Energy Institute Composite Adversary Force" Beginning in 2004, each nuclear power plant in the country used the Composite Adversary Force (CAF) managed by the Nuclear Energy Institute (NEI) to provide a mock attack force for NRC's force-on-force physical security exercises. NextEra and Entergy ended their memberships with NEI in early 2018 and are no longer using the NEl-managed CAF. Instead, NextEra and Entergy established a separate Joint Composite Adversary Force (JCAF) comprised of staff from the two utilities' nuclear reactor fleets for use during force-on-force exercises at their plants.
In this paper, the NRC staff provides three options for a long-term alternative to a nation-wide CAF managed under an NEI contract. The options are: (1) one or more industry-managed contractor mock adversary forces; (2) a single nation-wide mock adversary force provided by a private contractor managed by NRC; or (3) a single nation-wide mock adversary force provided by the West Virginia National Guard Critical Infrastructure Protection Battalion under an agreement with NRC.
To be clear, the first option is not a continuation of the status quo. It opens the door to a proliferation of industry-run mock adversary forces. In fact, the NRC staff explicitly contemplates licensees creating their own company-specific mock adversary forces. This is not the right way to conduct force-on-force inspections. An adversary force for a plant comprised entirely of the plant owner's employees presents a clear conflict of interest. It is hard to see how this approach would meet the requirements of Section 170D of the Atomic Energy Act, which requires NRC to conduct force-on-force exercises and to "mitigate any potential conflict of interest that could influence the results."
Fundamentally, force-on-force exercises are NRC inspections, and it makes sense for NRC inspectors or entities working for NRC to be performing them. Although the CAF has generally performed well over the years, it was always odd to have an industry contractor executing a key aspect of an NRC physical security inspection. The nation-wide CAF at least drew members from many utilities across the country and did not allow a CAF member to participate in a force-on-force exercise at his or her home plant. If NRC permits an expanding number of mock adversary forces, those attributes that helped mitigate conflicts of interest would fade away.
As a result, NRC needs to move in a different direction, one that avoids obvious conflicts of interest and recognizes that force-on-force exercises are NRC inspections. A single nation-wide mock adversary force provided by an NRC private contractor would be a reasonable approach. But it could pose its own conflict-of-interest challenges if the private contractor hired by NRC was also employed by one or more licensees to provide security services at nuclear power plants. Concerns of this sort were raised in 2004 when NEI contracted with Wackenhut to provide a CAF "because the same company would be providing both the adversaries and the defending security forces at many sites."1 Those concerns contributed to Congress enacting Section 170D, with its focus on mitigating conflicts of interest, as part of the Energy Policy Act of 2005.
The West Virginia National Guard Critical Infrastructure Protection Battalion is widely recognized as an expert in vulnerability assessments for critical infrastructure across the United 1 SECY-19-0046, Enclosure 1 at 1.
1
States. The battalion is interested in performing this service for NRC and could provide a well-trained mock adversary force at lower cost than either an industry-managed force or an NRC private contractor. Moreover, tapping a National Guard unit would avoid any actual or perceived conflicts of interest. This approach would provide a completely objective adversary force focused exclusively on the national interest. The agreement between NRC and the West Virginia National Guard would ensure the continued availability of the mock adversary force in the event that the unit is mobilized.
For these reasons, I approve entering into an agreement with the West Virginia National Guard Critical Infrastructure Protection Battalion to provide a single mock adversary force for force-on-force exercises at every operating nuclear power plant in the country (Option 3).
2
TO:
FROM:
SUBJECT:
POLICY ISSUE NOTATION VOTE RESPONSE SHEET Annette Vietti-Cook, Secretary Commissioner Caputo SECY-19-0046: Options for a Long-term Alternative to the Nuclear Energy Institute Composite Adversary Force.
Approved X Disapproved Abstain Not Participating COMMENTS:
Below Entered in STARS Yes X
No ---
Attached X
None
Commissioner Caputo's Comments on SECY-19-0046 Options for a Long-Term Alternative to the Nuclear Energy Institute Composite Adversary Force This paper provides an assessment and recommendations for a long-term alternative to the NEI managed Composite Adversary Force (CAF) used in NRC-conducted force-on-force (FOF) security inspections. When Entergy and NextEra ended their membership with NEI in February 2018, they lost access to the NEI-managed CAF for force-on-force (FOF) inspections. As a result, Entergy and NextEra developed their Joint Composite Adversary Force (JCAF). In March 2018, the staff submitted COMSECY-18-0004, detailing the recommendation to accept the JCAF as an alternative to the NEI-managed CAF to support FOF exercises at NextEra and Entergy sites in 2018 and 2019 while other long-term options were identified. The Commission approved the staffs recommendation and directed the staff to provide a notation vote paper with an assessment and options for a long-term alternative. Specifically, this paper provides the Commission with options for a long-term Mock Adversary Force (MAF) for use during force-on-force (FOF) inspections.
The staff provides three options to support NRC-conducted FOF exercises:
Option 1 - One or more industry-managed MAFs: This option would allow the industry to implement and manage the MAFs for use during NRC-conducted FOF exercises.
Option 2 -
A single NRC-provided MAF: The NRC would contract with an independent vendor to create a single MAF.
Option 3 -
A single NRC-provided MAF: The NRC would execute an agreement to utilize the West Virginia National Guard to create a single MAF.
To support the options in this paper, the staff also completed an assessment of the JCAF. The staff concluded that the methods utilized by NextEra and Entergy to develop the JCAF provided for a MAF that is consistent with the design basis threat (DBT) adversary characteristics. The staff also concluded that the JCAF either met or exceeded established NRC performance standards during FOF inspections.
The staff reviewed the three MAF options and recommends Option 1. This option would allow the industry to continue to use the JCAF and the NEI-managed CAF or, alternatively, add MAFs, return to a single industry-managed MAF, use a fleet MAF, a MAF provided through an alliance with other sites and/or fleets, or a MAF provided by a vendor. The staff has determined the industry is capable of developing and providing a credible adversary force that can replicate the characteristics outlined in the DBT. The NRC would provide oversight to ensure that MAF teams meet the NRC performance standards and to ensure separation and independence between the MAF team and the site's guard force during exercises. The approval of any new MAF would include NRC review and approval of the proposal, NRC review of the implementation plan and final NRC approval prior to the MAF being utilized in an NRC-conducted FOF exercise.
I concur with the staffs recommendation and approve Option 1. I arri, however, concerned with the staffs brief consideration of whether any of the three proposals constitutes a backfit. 10 C.F.R. § 50.109 defines a backfit as "the modification of or addition to... procedures or organization required to... operate a facility; any of which may result from... the imposition of a regulatory staff position interpreting the Commission's regulations that is either new or
different from a previously applicable staff position." The staff interprets this definition to exclude each option because there would be no change in the requirements to participate in FOF exercises and the change would not result in a new staff position interpreting NRC regulations. I find this interpretation to be overly narrow.
I agree with the staff that Option 1 does not constitute a backfit. Option 1 maintains the status-quo by authorizing one or more industry-managed MAFs. As I mentioned above, this follows the process implemented by the industry and approved by the staff following Entergy's and NextEra's departure from NEI. There is no change, and thus no backfit. But Options 2 and 3 are clearly changes, and thus the staff should have conducted a detailed backfit analysis that examined whether those Options provided a substantial increase in safety and were cost-justified.
Staff clearly places great emphasis on there being no changes to the requirement that a licensee participate in a FOF exercise. And it is true that regulatory guidance (i.e. the staffs proffer of an acceptable way to meet a regulatory requirement) does not constitute a requirement in and of itself, and thus does not trigger the backfit rule. But we are not dealing with regulatory guidance here. We are dealing with staffs proposal regarding implementing the only acceptable process for a licensee to conduct and participate in FOF exercises that are required to meet the regulatory requirements in Part 73 and for the agency to meet its statutory requirements in the Atomic Energy Act Section l 70D. I therefore disagree with the staff that these options do not constitute b*ackfits.
Since Option 1 does not constitute a backfit, the staff need not supplement SECY-19-0046 with a detailed backfit analysis. However, the staffs disregard for the paper's backfit implications and lack of a detailed backfit analysis is disheartening, given the recent agency-wide refresher training on backfit. I encourage the staff, particularly the Office of Nuclear Security and Incident Response, to be diligent in its backfit determinations and to determine whether another round of training is needed.
TO:
FROM:
SUBJECT:
POLICY ISSUE NOTATION VOTE RESPONSE SHEET Annette Vietti-Cook, Secretary Commissioner Wright SECY-19-0046: Options for a Long-term Alternative to the Nuclear Energy Institute Composite Adversary Force.
Approved X
Disapproved Abstain Not Participating COMMENTS:
Below X
Attached None I approve the staff's recommendation to implement Option 1, which allows the use of one or more industry-managed Mock Adversary Forces (MAFs). I commend the staff on its thorough, transparent, and methodical analysis of this matter. The staff's criteria were logical and applied sensibly in assessing each option.
The staff based its recommendation on the industry's demonstration of successfully implementing an alternative MAF. In particular, the staff determined that the Joint Composite Adversary Force (JCAF) has "met NRC expectations for providing a credible and reliable adversary team" and "there has been no indication of an actual conflict of interest with the JCAF." The staff made this assessment by conducting direct oversight of the JCAF during selection, training, and qualification; rehearsal exercises; NRG-conducted force-on-force planning week; and NRG-conducted training, rehearsal, and exercise week. Therefore, the staff should use a comparable level of oversight when assessing any newly-proposed MAFs to ensure that they represent an acceptable alternative to existing MAFs. I appreciate the staff's discussion of the differing views on the recommendation. I share some of the concerns raised and agree that the NRC should revisit establishing a single NRG-provided MAF if the indust(Y no longer maintains a MAF.
~ -
~
- 0 n Entered in STARS
~~
Yes \\/
SIGNATURE ;
No DATE9/3 0 1.J1