ML20137L827

Reg Guide 5.15,Rev 1, Tamper-Indicating Seals for Protection & Control of Snm

ML20137L827
Person / Time
Issue date:	03/31/1997
From:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:
References
TASK-*****, TASK-RE REGGD-05.015, REGGD-5.015, NUDOCS 9704070324
Download: ML20137L827 (8)

Text

_ _ _ _ _ _ - _ _ _

U.S. NUCLEAR REGULATORY COMMISSION Revision 1

$[eow%()

REGULATORY GU DE March 1997 OFFICE OF NUCLEAR REGULATORY RESEARCH REGULATORY GUIDE 5.15 (Draft issued as DG-5005)

TAMPER INDICATING SEALS FOR THE PROTECTION AND CONTROL OF SPECIAL NUCLEAR MATERIAL A. INTRODUCTION quires that, before exiting a material access area, con-tainers of contaminated wastes must be tamper-sealed The Nuclear Regulatory Commission requires cer-by at least two individuals who do not have access to tain licensees to use tamper-indicating devices for ma-material processing and storage areas and who work terial control and accounting (MC& A) and for physical and record their findings as a team, security of special nuclear material (SNM). In 10 CFR Part 70," Domestic Licensing of Special Nuclear Mate.

In 10 CFR Part 74," Material Control and Account-rial," paragraph 70.51(e)(1)(i) requires that licensees ing of Special Nuclear Material," paragraph a'uthorized to possess and use SNM of moderate strate.

74.59(f)(2)(i) requires that licensees authorized to gic significance or more than one effective kilogram of possess and use formula quantities of SSNM develop strategic special nuclear material (SSNM) in irradiated procedures for tamper-safing containers or vaults con-fuel reprocessing operations maintain, among other taining SSNM not in process.

things, procedures for tamper-safing containers or For safeguarding SNM of low strategic signifi-vaults containing SNM not in process.

t cance, the use of tamper-indicating seals is specifically In 10 CFR Part 71," Packaging and Transportation required only during transit (see 10 CFR 73.67(g)(iii)).

of Radioactive Material," paragraph 71.43(b) requires Nonetheless, licensees subject to 10 CFR 74.31 and that "The outside of a package must incorporate a fea-74.33 often find it convenient and economical to ensure l

ture, such as a seal, which is not readily breakable, and long-term validity of MC&A measurements by i

which, while intact, would be evidence that the package tamper-safing the container in which the material is has not been opened by unauthorized persons."

stored, thereby avoiding the expense of verifying the container's SNM content.

l In 10 CFR Part 73,"Physica! Protection of Plants and Materials," paragraph 73.26(g)(3) requires that This guide describes features of security seal sys-l SSNM be shipped in containers that are protected by tems and types of seals that are acceptable to the NRC tamper-indicating seals. Also,10 CFR 73.46(c)(5)(ii) staff for tamper-safing containers of SNM. Compliance requires that certain SSNM be stored in tamper-with this guide is not required; existing systems or indicating containers. Further,10 CFR 73.46(d)(10) re-commitments in NRC-approved fundamental nuclear ownc ar ot taioav acines in. oma....u.a m m. oiio.mo t.n nro.o o..,on.

a.u-w c.u.a u., io a eb... m..

to m. puu.ua, m.o,m..

p> y bon m., mode.ccept.ba, to th. NRC.t.M for.npl.,n.emnD.p.afr parts d to Com-1 Po r Re.ctors 8 Products me..m..gul u e.cc.a.r tion., t chr.que, u d,by th..t.# m.v.tu.ung.p.afic prob 6.m.,o,,p.o..

2,An arch.W T.s,t A,e.ct, ors

,7 h< f op I

Tr.n.portete n a.o ny. uRC n.,

oi.pp c.t.c,i.

3

,,,..no.,.,,..c,.,

occup,,,on., s.,,,n e

gq.r.

ig

.nd 6an.

out m

=g.;mog.,.; =no...

n. io ~

e.m, cm

.n

.Ch0,,

b

$2;;;;,*;;aama=",~.W.',"s".,a : t.

) p"m.

u

..,.- co, nt.,.c

.,o,, m.,um c_2km=.===-

51=5R5t=======

J c**-o"'-"'"**'"'***'-**=*2'a;;":?.~Jl::';

' ;* "a tC:'L'"L"e""." ="4""J".0%"O*" "'

9704070324 970331 01 ?

PDR

material control plans and physical security plans need (fingerprint) of the seal makes such replacements not be modified to correspond with this regulatory obvious.

guide.

FUNCTION OF A SEALING SYSTEM

.The m. formation collections c(mtained in this regu-latory guide are covered by the requirements of 10 CFR A sealing system consists of (1) the seals them-Parts 70, 71, 73, and 74, which were approved by the selves,(2) the procedures, techniques, and devices used Office of Management and 13udget, approval numbers in ccmtrolling seals, including procuring, documenting, 31504)009,31504)008,31504)002, and 31504)123, storing, distributing, and, where appropriate, finger-respectively. The NRC may not conduct or sponsor, and printing the seals, as well as selecting the point of ap-a person is not required to respond to, a collection ofin-plication, (3) applying, removing, and identifying the

~ formation unless it displays a currently valid OMB con-seals, and (4) judging whether entry or tampering has trol number.

occurred.

IL DISCUSSION The objective of a tamper-indicating sealing sys-tem is to provide assurance that no tampering or entry In 10 CFR 74.4, tamper-safing is defined as "the occurred while the seal was on the container. Therefore, use of devices on containers or vaults in a manner and at for MC&A purposes, the measurements made before a time that ensures a clear indication of any violation of sealing, or for nondestructive analysis after sealing, are the integrity of previously made measurements of spe-still valid. The degree of confidence in a tamper-cial nuclear material within the container or vault." Us-indicating sealing system will vary directly with the ef-ing this definition, a tamper-indicating seal is a device fort required to defeat the seal and inversely with the used to detect unauthorized removal of material.

motivation for defeating it. If a scheme for diversion of Note that the phrase " container or vault" is used the contents requires undetected tampering with the I

here in a broad sense. It includes all containers and se-sealed object, the seal presents an added obstacle that makes the diverter undertake extra activities. The I

cured storage enclosures for which the application of a chance that the diverter will make a mistake and be de-tamper-indicating seal to the container or enclosure can tec'ted is therefore increased.

be used to detect unauthorized access to the SNM with-in.

In order to use seals properly, the licensee needs to develop procedures that address (1) the control of ac-TAMPER-INDICATING SEALS cess to tamper-indicating seals, (2) the unique identifi-cation of each seal, (3) records of the date, time, and Wrious types of seals have been developed to meet person who applied each seal to a container or vault, specific requirements. Seals must be inspected to de-and (4) other pertinent records of all such seals (this termine whether entry into the container or vault or may include attesting documentation, see the appendix tampering has occurred, as opposed to an active detec-to this guide).

tion alarm that indicates when entry or tampering is oc-curring. Seals, when broken, are difficult to reassemble LIMITATIONS OF SEALING SYSTEMS without leaving signs of tampering. Seals also have unique identification characteristics that show evi-The most successful methods of attack on sealing dence of any attempt at forgery.

systems are those exploiting the weaknesses of the seal-ing system rather than the tamper-indicating seal itself.

Diff.erent types of seals have essentially the same A seah.ng system would fail at the seal if the seal could elements, but different oroperties. A key property of seals is trangibility, that is, they are easily broken. A be opened and re-closed without leaving any marks to indicate tampering.

seal i< not expected to present a serious obstacle to entry or te mpering, and for that reason it is usually a weak ob-A sealing system that depends on blank seals being stn.ction that can be ove.come with small mechanical unavailable to the adversary can fail if the supplier of effort. In the past, the strategy was to make it very diffi-the seals or one of his employees can be persuaded to cult for unauthorized persons to obtain seals from the provide replicates to a diverter. This type of failure pre manufacturer, in order to prevent cover-ups by replac-supposes a weakness in the identification of the seals.

ing broken seals with new ones. With sophisticated Therefore, all users of seals should require assurance modern seals, the unique identification characteristic from the manufacturer of the seals that the seals are 5.15 - 2

unique, that the seals will not be supplied to other users, Use of Pressure-Sensitive Seals on Containers for On-and that the masters will be c<mtrolled.

site Storage of Special Nuclear Material."1 Steel Padlock Seal A scaling system can fail if the administrative con.

trols are not adequate in the following areas.

The steel padlock seal is a one-time seal that is de-stroyed when removed. The most secure design at pres-o 'Iheinf.ormation taken and recorded at the time of ent requires a hammer to drive a hardened steel shackle seal applicatm.n is madequately protected, enah-into a steel block.. Flu.s seal is very rugged and may be ling a diverter to forge documentation to support or used when accidental damage is likely and a lock is also cover the diversion.

needed. Unlike other tamper-indicating seals, th.is seal o 'Ihe selection of the application point for the seal.

was designed to be used as a serious obstacle to entry.

ing device does not provide assurance that it will

.lype E CupMire Seal indicate tampering.

The Type E seal consists of two metallic cups and o The method of postmortem examination of the seal wire. The ends of a loop of wire are passed through the is not sulficient to detect a defective or compro-hasp (one of the cups) and crimped together. The two mised seal.

cups are then pushed together, enclosing the crimped ends of the wire.

o The location and method of seal application makes A fingerprint of the seal may be artificially created the seals vulnerable to accidental damage, provid-by inscribing scratches on the inside surfaces of the ing a history of such incidents that might be used to se I; the scratches are photographed before the seal is conceal a willful attack.

applied. At the container inspection point, the seal is re-o inspection of the container's outer surface (or the moved and sent to a laboratory for analysis and compar-walls or barriers of an enclosed storage area) is not ison with the original photograph. The seal is destroyed suf ficitnt to detect unauthorized access or penetra-in the examination. The Type E seal, when finger-tion that bypassed the seal.

printed, is considered a high-security seal. Defeating the seal would require penetration and repair tech-

,o The information being protected (such as SNM niques that would not leave any visible evidence under content), for SSNM or SNM of moderate strategic a microscopic examination of the surfaces. While the significance, is not attested to by at least two indi-seal could be defeated by cutting and rejoining the wire viduals at the time of seal application, or the infor-without leaving marks, the use of multi-strand wire mation being protected for SNM of low strategic makes undetectable rejoining difficult.

significance is not attested to by at least one indi-Car /Itall End Seal vidual at the time of seal application.

The car / ball end seals are steel strap seals. A latch-ing mechanism, a piano-wire loop that captures both l

SEALS USED FOR SAFEGUARDING SNM cnds of the strap, is located inside a crimped ball at one end of the strap.The tipof the sealis designed toextend l

This guide describes six commercially available through the lock housing and can be easily viewed l

seals that comprise a very broad range of capabilities; through a special sight-inspection hole in the housing.

these seals are acceptable to the NRC for safeguarding

'lhe company's name, logo, and sequential serialized SNM. These seals are the pressure-sensitive seal, the identifiers can be embossed on the seal strap.

steel padlock seal, the type E cup-wire seal, the car / ball Once the car / ball end seal is m place, it should be end seal, the active fiber optic seal, and the passive fiber checked to ensure that there is a proper amount of end optic seal. Other seals may be approved on a case-by-play m. the latching mecham.sm. Ihe seal is destroyed case basis.

l l

when it is removed for examination. The person con-ducting the postmortem examination should compare

) Pressure-Sensithe Seal the removed seal to a sample seal and carefully inspect Guidance on the testing, control, and application of Ende corica of reguimiory guides. both acine and draft. rnay be obtained free at charge by wntmg the ofrice or Administration. Attn: Distnbution pressure-sensitive seals for the onsite storage of SNM and sen ces secnon, ussac. washington. oc 20555. or by tax :

is provided in Regulatory Guide 5.10, " Selection and pm ytis.2260.

5.15 -3

I the exterior and interior surfaces to detect forgery. The saw.The shackle and the block should each carry a seri-ball housing should be opened to verify that all the in-alized identifier.

ternal parts are present.

1.3 Type E seals, provided the crown-like clasping

• P#

E Fiber Optic Seal Systems cup. The wire passing through the hasp of the enclosure Fiber optic seal systems consist of fiber optic loop to be sealed should be a stainless steel cable with a material, seal bodies, and a seal signature reader.

minimum of 19 strands.

verifier.Two types of fiber optic seal systems are com-1.4 Car / ball end seals, provided the steel-strap seat mercially available, (1) active reusable and (2) passive is installed according to the manufacturer's instruc-single use. Active reusable systems are primarily used tions. The ball housing should be opened in the post-in the transportation of nuclear materials. The system is mortem examination to verify integrity.

active in the sense that its electronic seal body sends an 1.5 Active fiber optic seals, provided an external encoded digital pulse stream :hrough the fiber optic housm.gis installed around the body of the active seal to loop to check for continuity. This design enables the

""'"I P""

8 P " ""I""""

detection and recording of the time, date, and duration ber h>op. The fundamental nuclear material control of each fiber loop event, whenever the digital signal is plan should include a battery replacement schedule; mterrupted. Opening the fih-Lop or removing the fi-batteries are not to be replaced when the seal is in use.

ber term. nation from the receptacle results in an',open,,

indication. An external housing around the seal body is 1.6 Passive fiber optic seal, provided the seal necessary to prevent inadvertent opening of the loop.

reader-verifier device provides clear images for inspec-Seal-tampering information is obtained by attaching tion comparisons.

the seal to a reader and retrieving the stored contents of 2.

SEALING SYSTEM the seal. This reading is done in situ, without affecting the seal's integrity.

A sealing system should include the following fea-tures to be acceptable to the NRC staff.

Passive single-use seal fiber optic systems are pri-2.1 uter surface f the seal should carry a se-marily used in long-term storage of nuclear materials.

rialized identifier and the name, logo, or initials of the

'The fiber optic cable can be cut in the field to any length, up to 30 meters. The cable ends are inserted into org niz tion using the seal. The lettering and number-ing should be readable and should be engraved, a one-piece seal body. The seal body contains a serrated blade that, when pressed in place, severs a portion of the molded, punched, or otherwise applied in a way that.

prevents removal or alteration of the letters and num-cable fibers in a random manner. This unique signature can be viewed and recorded by a seal reader at the loop bers without leaving apparent damages. The seals termination. The seal is verified by comparing the should be sequentially numbered with sufficient alpha-image obtained during the inspection visit to the image numeric or numeric symbols to prevent duplication of obtained when the seal was initially installed.

symbols in use at the facility.

2.2 A seal should be applied to a container in a C. REGULATORY POSITION manner that ensures the contents cannot be removed from the sealed container without compromising the integrity of the seal or the container. A seal should be 1.

ACCEPTABLE SECURITY SEALS applied immediately after the samples and data have The six types of security seals identified below are been taken to identify and measure the contents of the acceptable to the NRC staff for use in ensuring detec-container. For nondestructive analysis measurements, tion of unauthorized tampering or entry and in ensuring the measurement may be taken after the sealis applied.

the accountability of SNM.

2.3 The design and construction of a seal should J

1.1 Pressure-sensitive seals as described in Regu-ensure that disassembly and reassembly of the seal latory Guide 5.10, " Selection and Use of Pressure-would result in obvious indications of tampering that Sensitive Seals on Containers for Onsite Storage of are detectable by the examination techniques recom-Special Nuclear Material."1 mended for the seal.

1.2 Padlock seals, provided they are made of hard-2.4 A seal should be resistant to, or be protected ened steel that is capable of resisting cutting by a hack-against, the effects of the environment or rough treat-5.15 - 4

f ment that would be detrimental to the seal components such as the container item number; location number or and could give false indications or destroy any indica-area; the dates, times, and reasons for application and tions of tampering.

removal of the seals; the signatures of the individuals responsible to MC&A management for the data and for 2.5 Seals should only be available to, applied by, applying and removing the seal, and a description of and removed by persons designated by, or acceptable t any discrepancy that is observed in the sealed contents.

and responsible to, MC&A management. Procedures should be established to control access to seal and seal 2.7 Written procedures should be prepared that records, and to limit this access to a minimum number cover the control, application, documentation, ex-of people. The procedures should ir,clude timely up-amination, and reconciliation of seals. If the examina-dates of the access lists. The unused seals and the seal tion is made by a person other than the custodian re-records should be maintained by a custodian in a secure moving the seal, procedures should be established to location. Removed seals should be destroyed in a man-maintain the chain of custody of the removed seal.

ner that prevents reuse and provides no materials or par-2.8 Samples from every batch of seals received tial components that can be used for counterfeiting.

from the seal supplier should be retained for future ref-2.6 Records of all seals, by serialized identifica-erence and comparison in case of detected tampering.

tion, should be retained after application. These records Samples should be maintained by a custodian and should include all pertinent data on the sealed contents, should be kept in a secure h> cation.

l l

l l

l l

l 5.15 - 5 lL

sammm.

APPENDIX DECIARATIONS ON TIIE CIIARACTERISTICS OF TAMPER-INDICATING SEALS For each tamper-inoicating seal that is applied, 7.

Upon replacement of a broken outer container seal, documentation should be provided that attests to all the a statement that the integrity of the inn' r items re-e following characteristics that are applicable.

mains intact.

1.

Any identifiers such as numbers on the container, 8.

A statement that material is not concealed or item, or seal numbers, shielded within the equipment or container to avoid detection.

2.

The type and form of the material within the 9.

Whenever a container is resealed, a statement of container.

the quantity of material added or removed from the 3.

A statement that only the material stated in Num.

container; zero quantities should be noted.

ber 2 above was placed in the container during

10. A statement on the status of the current vault or loading.

storage area contents relative to any change in the 4.

A statement that nothing has been aJded or re-SNM inventory.

moved from the container since the loading or

11. The quantity of the material as determined by non-since breaking the previous seal.

destructive assay.

5.

The gross weight of the container, with units.

12. A statement that nothing has been added to or re-moved from the container during continuous 6.

The net weight of the material, with units.

surveillance.

l 5.15 - 6

r s

VALUE/ IMPACT STNTEMENT A draft value/ impact statement was published with the draft of this guide when it was published for public comment (Task DG-5005, January 1996). No changes were neces-sary, so a separate value/ impact statement for the final guide has not been prepared. A copy of the draft value/ impact statement is available for inspection or copying for a fee in the NRC's Public Document Room at 2120 L Street NW., Washington, DC, under Task DG-5005.

l l

1 Printed on recycled paper Federal Recycling Program

)

5.15 - 7 d

N UC WL E

P A A EN S

A H R L

I Y O N R T

U E

F G

N FF T GI OC OUT R A LE PL

,N AD R B T

NU D

S AS C O T TI R A E N E

2 Y T US 0 CE SS 5

S

,E 5O 5

M MM 300 IS 1

S I

O N

WIDIU1 AWONS2 SFCF 0 HNUON5 I MRR5 N5EMC5 Gr,NA 0 T2TT06 O4 II4 N.COR2 ONM1 N

5 T&

R OR LE 2 C

DO 1

FR S SD B KS D

C M

G M

2 T

0 5

5 5

T S

p TIF AR GS E T AC SN NL D A S

FS E

EM SA PsP A

ID i

1l!

!