IV. Physical Protection Concepts

General Approach
Requirements for Physical Protection of Nuclear Material in Use and Storage
Requirements for Physical Protection Against Sabotage at Facilities
Requirements for Physical Protection During Transit of Nuclear Materials

General Approach

401. A system may be defined as a collection of components or elements designed to achieve an objective. The designer of any system should have the system's ultimate objective in mind. The ultimate objective of a nuclear physical protection system is to prevent the theft of nuclear materials or sabotage of nuclear materials or facilities.

402. Theft and sabotage can be prevented in two ways: by deterring threats or by defeating them should groups or individuals attempt to steal nuclear materials or sabotage nuclear facilities. Deterrence is achieved by implementing a physical protection system that criminals/terrorists perceive as too difficult to defeat; the physical protection measures make the protected nuclear material or facility an unattractive target.

403. In Section 5 of INFCIRC 225 Rev.3, the stated goals of physical protection against theft and sabotage are combined without a clear distinction made between the protective objectives of each. While protection against both theft and sabotage requires consideration of a number of factors (including the threat, the potential consequences of malevolent activities involving nuclear materials, the facility layout, hardware, on-site guard force size, training and procedures and the off-site response force size, timeliness and capabilities), the protection philosophy differs. For theft, the primary objective is to protect against unauthorised individuals obtaining access to nuclear material and removing it from the facility. For sabotage the primary objective is to prevent attackers from even gaining access to the material or vital equipment. While similar concepts are employed for detection and assessment of a potential intrusion, the use of delay features and emergency procedures, including the response force philosophy, can be quite different. For protection against theft, the use of penetration delay in barriers securing the material provides time for the on-site guard force to call for assistance, and contain or delay the attackers until the arrival of the off-site response force. For protection against sabotage, the use of delay features is needed at the time of intrusion, or sufficient distance to the target is needed, to allow time for the on-site guard force or off-site response force to interpose themselves between the attackers and the material or vital equipment in order to preclude access to the potential sabotage targets.

404. In order for a physical protection system to counter a threat to steal nuclear material or sabotage nuclear material or activities, it should perform the following primary functions:

• Deter
• Detect
• Assess
• Delay
• Respond

405. Detection is the discovery of an attempted or actual intrusion which could have the objective of stealing or sabotaging nuclear material or facilities. Detection can be accomplished by sensors or personal observation, for example by an employee or guard. In a narrow sense, detection is a physical phenomenon, i.e., a sensor or person determines that something is wrong at a given location. To be useful, detection needs to be coupled with an assessment of what has been detected. Did a sensor detect an animal or a person? Was the sensor triggered by weather conditions to give a nuisance alarm? Is the person seen (detected) by an entrance guard assessed as someone authorized to enter the facility, or does the individual pose a threat to the facility?

406. Sensors are an important part of a detection system. By activating alarms they provide an indication of an activity that requires assessment. The ultimate goal of any detection system is to maximize the probability of detection while minimizing the rate of nuisance alarms. This can be accomplished by providing a continuous line of detection using multiple and complementary sensors.

407. Assessment is frequently provided through closed circuit television (CCTV) coverage of each sensor sector, complemented by visual checks from guards, either static or mobile. In addition to determining the cause of a detection alarm, assessment should provide specific details such as what, who, where, when, and how many. This information is vital if the response force is to react effectively.

408. A communication, alarm and CCTV display centre, frequently called a central alarm station (CAS), is required to collate detection and assessment information and communicate it to response forces. A reliable communications system between the CAS and the guard force and off-site response force is an essential part of a physical protection system. The CAS should be hardened, i.e., constructed and located in such a manner so as to allow it to continue operating at all times, even when under attack.

409. Delay is the third function of a physical protection system. Since it is usually not possible to maintain a sufficient number of guards at all points to provide immediate protection against all types of threats, some form of delay is needed to slow down intruders in order to provide the guards time to react after the intrusion has been detected and to call for assistance. This delay can be achieved by such measures as barriers, fences, walls, and locks. Delay should slow the intruders sufficiently to provide time for the guards to interpose themselves between the attacker and his target and using force, including weapons where guards are armed, to stop or delay the attack before the intruders can accomplish their objective.

410. Guards and the off-site response force need to respond more rapidly to prevent sabotage than to prevent theft. They may be able to prevent an attacker from removing nuclear material from a site even though he is able to access the material; but to prevent sabotage, the guards and/or the response force needs to stop the attacker before he can access the nuclear material or a vital piece of equipment that could be sabotaged to cause a radiological release. The speed with which knowledgeable attackers could attack a facility and damage critical equipment could negate the effectiveness of an off-site response for protection against sabotage. Delay barriers or mechanisms may not provide sufficient delay time for an effective off-site response. Therefore, guards should be self-sufficient during the critical early stages of an attack. If a facility requires assistance from an off-site response force for protection, a "time-line" analysis should be conducted to determine if the response force could provide a timely response. Moreover, periodic exercises which include the off-site response force could be conducted to establish the effectiveness of such a response and be utilized as a tool to develop, correct or modify facility defensive strategies.

411. Guards and off-site response forces need to survive in order to prevent an intruder from accomplishing his objective. Many factors contribute to guard and off-site response force capability and survival including tactical planning, weapons, training and exercises. Drills should be conducted to demonstrate their effectiveness and improve response capabilities. Consideration may be given to the strategic placement of defensive barriers to provide cover for the guards and response force attempting to interdict an attack.

412. An effective physical protection system has several specific characteristics. Besides being compatible with a facility's safety system, the physical protection system should provide:

• Defence in depth;
• Minimum consequence of component failure;
• Balanced protection; and
• Graded protection in accordance with the significance or potential radiological consequences of the material.

413. Defence in depth means that for an attacker to accomplish his objective, he should be required to avoid or defeat a number of different protective devices in sequence. For example, an attacker might have to penetrate two or more separate barriers before gaining access to a reactor control room. From a facility standpoint, defence in depth eliminates dependency on one barrier or system (which might fail at the critical period) to counter an attack. The effect produced on an attacker by a physical protection system that provides defence in depth will be to:

• Increase uncertainty about the physical protection system (and thus possibly deter an attack);
• Require more extensive preparation prior to attacking the facility (with the associated greater risk of these preparations being discovered before the attack);
• Require different techniques and different tools to penetrate barriers; and
• Create additional steps that could cause the attacker to fail or abort his attack.

414. Minimum consequence of component failure is an important physical protection system characteristic because it is unlikely that a complex system will ever be developed and operated that does not experience some component failure during its lifetime. Causes of component failure in a physical protection system can range from environmental factors to tampering by an attacker. It is important that contingency plans are provided so that the system can continue to operate effectively in the event of component failure. Redundant equipment that takes over automatically is highly desirable in some cases. An example is an emergency power supply that activates automatically should the primary power source fail.

415. Balanced protection implies that no matter how an attacker attempts to accomplish his objective, he will encounter effective elements of the physical protection system. For example the building fabric that surrounds a reactor control room may consist of:

• Walls, floors, and ceilings of several types;
• Doors of several types; equipment hatches in floors and ceilings; and
• Heating, ventilating, and air conditioning openings with various types of grilles.

416. For a completely balanced system, the minimum time to penetrate each of these barriers would be equal, and the minimal probability of detecting penetration of each of these barriers should be equal. However, complete balance is probably not possible or necessarily desirable. Certain elements, such as walls, may be extremely resistant to penetration, not because of physical protection requirements, but because of structural or safety requirements. The penetration delay provided by doors, hatches, and grilles may be considerably less than that provided by the walls and yet still be adequate if designed as a barrier to provide an appropriate amount of delay. The delay element is extremely important when developing a defensive strategy for sabotage contingencies. Although there are very few systems which can stop or sufficiently delay a well-equipped attacker, strategically placed delay barriers can provide sufficient time for response force arrival and successful interdiction.

417. There is no advantage in over designing by, for example, installing a costly vault door that would take several minutes to penetrate with explosives, if the wall were corrugated asbestos which could be penetrated in a few seconds with hand tools. Both the walls and the doors should provide the appropriate level of protection.

418. Features designed to protect against one form of threat should not be eliminated because they overprotect against another threat. The objective should be to provide adequate protection against all threats on all possible paths and to maintain a balance with other considerations, such as cost, safety, and structural integrity.

Requirements for Physical Protection of Nuclear Material in Use and Storage

419. The primary objective in protecting against theft is to prevent an attacker from gaining access to the nuclear material and removing it from an authorised area. To aid in limiting access to the nuclear material, INFCIRC/225/Rev.3 recognises the need for defence in depth and prescribes several protective layers: Protected Area, Inner Area, and "strong room". The designation of a Protected Area around buildings containing Category I and II quantities of nuclear material accomplishes a number of objectives. The Protected Area barrier should normally consist of a physical barrier which demarcates the area of protective concern, limits access to the buildings, and provides some delay to any attempted intrusion. The Protected Area barrier could be a fence, a separate solid wall, a building wall or a combination of barriers, with openings secured with material of sufficient strength that the integrity of the barrier is not lessened by any opening. Access into the Protected Area should be controlled and limited to only those with a valid need whose trustworthiness has been predetermined [5.3.3]. Consideration should be preferably given to searching individuals and vehicles prior to their entering the Protected Area to ensure that they are not introducing any items that could be used to commit or assist theft, particularly if an Inner Area is located within the Protected Area. The search should detect items that could be concealed in the vehicle or on the body, as well as hand carried items. Vehicles, individuals, or any items exiting the Protected Area should be searched to ensure that nuclear material is not being removed from the area [5.2.5/5.3.5/5.3.6]. (It is preferable that means used to detect the unauthorised removal of nuclear material are located as close as possible to where the nuclear material is held, for example at the Inner Area boundary, as this is usually more effective than at a more outer boundary). Since vehicles are very difficult to search and could aid an attacker in quickly escaping with material from the facility, the objective should be to prohibit, escort or tightly control their access in the Protected Area [5.2.6/5.3.7]. 

420. Intrusion detection and assessment should be conducted at the Protected Area barrier with the objective of detecting any intrusion by stealth or force with a high degree of confidence so that the on-site guards and/or off-site response force can be notified and emergency procedures implemented as soon as possible [5.2.12/5.3.12]. The objective of the intrusion detection system should be to detect any intruder going over, through or under the Protected Area barrier. Actions should be taken to identify and correct any conditions that contribute to false/nuisance alarms of the intrusion detection system. Assessment of an intrusion detection alarm needs to be done promptly so as to determine if an actual intrusion has occurred. The assessment process is aided by having clear areas around the intrusion detection equipment and on either side of the Protected Area barrier so as to provide an unobstructed view of the area. Adequate illumination is important to allow observation and assessment after dark by patrolling guards and/or those operating CCTV monitors. Care should be taken when designating building walls as Protected Area barriers so that there is an appropriate area outside the building wall for intrusion detection and assessment. 

421. The objective of Inner Areas is to provide another layer of access control, detection and delay around Category I quantities of nuclear material. Inner Areas should provide additional penetration delay in order to prevent the area being penetrated before the arrival of an effective response. Any openings should be of sufficient strength such that the integrity of the wall is not lessened by the opening beyond what is needed to provide appropriate delay. The aim should be to minimize the access points to one. Whenever the Inner Area is unoccupied the access door(s) should be locked and alarmed. If an emergency exit is necessary, then it should always be alarmed [5.2.13]. CCTV cameras should preferably cover the exterior of these doors in order to assist assessment of any alarm condition and enable monitoring of the area when the Inner Area is occupied. 

422. Access to the Inner Area should be limited to only those individuals who have a legitimate need for access and whose trustworthiness has been predetermined [5.2.3]. Individuals granted access to the Protected or Inner Area should be positively identified and should meet entry criteria before being badged or permitted entry. Control measures should be in place to initiate response measures to deny unauthorized entry. The objective of the badge should be to provide an easy and quick means to distinguish whether an individual is an employee or a visitor, whether they are authorized unescorted access, and to what areas access has been approved. Badges should be visibly displayed on all individuals at all times. Picture badges for employees aid in positive identification and different types of badges aid in distinguishing different levels of access. Visitor badges should clearly distinguish visitors from employees and indicate that an escort is required. Badges should be difficult to counterfeit and should preferably remain on-site at all times [5.2.4].

423. Visitor-escort ratios should be limited to that which enables the escort to exercise positive control over the location and actions of the visitors. To protect against the insider threat, whenever the Inner Area is occupied the area should be under constant surveillance [5.2.7]. The objective should be that activities of any authorised employee are always monitored by at least one other knowledgeable, authorised employee in order that unauthorized activities on the part of one can be immediately detected and reported. 

424. Category I quantities of nuclear material should be stored within a "strong room" when not undergoing processing [5.2.14]. The objective of the "strong room" should be to provide sufficient penetration delay to prevent entry by any one act in a forced entry attempt, except if such an act would both destroy the barrier and render the nuclear material inside incapable of being removed, or delay entry long enough for the arrival of a response force capable of preventing the theft. When nuclear material is undergoing processing it is recommended that consideration be given to keeping the material in locked compartments or locked/sealed process equipment except when personally attended. When the "strong rooms" are not occupied, it is recommended that they be locked and protected with an intrusion detection system (preferably supplemented by CCTV) which will alarm upon entry of individuals anywhere into the area, and upon movement of an individual within the area. When material processing areas are not occupied it is recommended that they be patrolled in a random manner by guards or be protected with an interior intrusion detection system (preferably supplemented by CCTV). 

425. All keys, key-cards, combinations and related equipment used to control access to a Protected Area, Inner Area or "strong room" should be protected and controlled on-site to prevent unauthorized use and to reduce the possibility of system compromise. A written record should be kept of all individuals having access to or possession of such items [5.2.10/5.3.10]. Whenever there is evidence that a key, key-card, combination or related equipment has been compromised, it should be changed. Upon termination of employment of any employee with access to any key-card, combination or related equipment, it is recommended that it be changed. 

426. Procedures should be established and strictly followed for the transfer of nuclear material. Employees should always be alert to any unauthorized activities involving nuclear material and immediately report the information to appropriate authorities [5.2.9/5.3.9]. Nuclear material should be protected while it is being transferred between Inner Areas at a level that would provide comparable protection to that provided within an Inner Area. Movement of material between Protected Areas should be protected in compliance with requirements for nuclear material in transit taking into consideration such factors as distance, protective arrangements provided for the facility as a whole and the threat environment [5.2.11/5.3.11].  

427. A guard force should be established which provides 24-hour coverage and is trained to perform security related functions such as controlling access, searching, patrolling, detecting and responding to indications of theft [5.2.15].

Requirements for Physical Protection Against Sabotage at Facilities

429. States should define a hazardous level of radiological consequences resulting from an act of sabotage for which physical protection measures above normal industrial security are needed. Existing national nuclear safety standards and accident scenarios are good references in defining this level. Depending on the potential radiological impact to the public from a malevolent release, the State can require that physical protection measures to protect against theft of Category I, II or III standards be applied at the facility without regard to that which would normally be required for the nuclear material held if protected in accordance with the categorisation table. The extent of the physical protection measures required should correspond to the level of possible off-site impact and relative risk of radiological consequences [3.2.5.3]. 

430. The layout and design of the facility should be taken into account in designing the physical protection system to provide protection against radiological sabotage [4.3.2]. Areas containing any equipment, systems or devices, the failure or destruction of which, alone or in combination, could lead to a radiological release which could directly or indirectly endanger public health and safety need to be identified as Vital Areas [5.1.3]. Equipment or systems which would be required to function to protect public health and safety following such failure or destruction also could be considered to be vital. States may agree that these Vital Areas should be protected to the same standards as a Protected Area. Because of the possibility of malevolent actions by those authorised access to the facility, Vital Areas will require additional measures to limit and control authorised access to these areas. This can be achieved by both administrative, physical and technical measures [5.1.2].

431. Consideration should be given to searching individuals prior to entering a Vital Area to ensure that they are not introducing any items that could be used to commit sabotage. The search should detect items, such as explosives, that could be concealed on the body, as well as hand carried items. Consideration should be given to excluding vehicles from Vital Areas. If vehicles must enter these areas, they should be searched prior to entry.

432. Keys and key cards concerned with the protection of Vital Areas should be kept under special management to limit access to authorised individuals and they should not be removed from the facility.

433. The visitor-escort ratio should be limited to that which enables the escort to exercise positive control of the location and actions of the visitors. Doors providing direct access to vital equipment should be locked wherever possible. Emergency exits should be secured and all doors fitted with alarms to detect unauthorised opening. 

434. The barrier of the Vital Area should mark the perimeter of the area and deter intruders. The degree of delay to be provided by this barrier should take account of the State's threat assessment. The objective should be to delay any attempted intrusion into the Vital Area until the arrival of an adequate response force which is able to contain and control the attackers.

435. It is preferable that the surveillance of the Vital Areas be assisted by an electronic detection system acting in combination with a system for verifying and assessing the situation by the guard force. Additional patrols may be necessary to detect intrusion and to be able to respond in a timely manner.

436. There should be specially trained personnel (preferably part of the guard force) available to operate the electronic equipment used in the physical protection system. There should be a separate and adequately protected room where it is possible to monitor the condition and status of all the physical protection equipment and which is able to communicate with the guard force and the off-site response force. 

437. When establishing physical protection measures, there should be frequent consultations with those responsible for nuclear material safety to ensure that physical protection measures do not adversely affect the associated nuclear material safety. Conversely those responsible for nuclear material safety should consult with those responsible for physical protection when safety operations change to the extent that physical protection systems or protective strategy needs modification [5.1.3].

Requirements for Physical Protection During Transit of Nuclear Materials

438. Nuclear material is probably most vulnerable to theft and sabotage when it is being transported between facilities when the usual protective measures cannot be applied. It is therefore important that compensatory measures be provided "in depth", so that for an attacker to accomplish his objective, he would be required to defeat a number of these measures in sequence [6.1.1]. The protection measures which may be applied to provide this defence in depth are:

• Limiting advance knowledge of transport operations and protecting the confidentiality of this information (in part, through predetermining the trustworthiness of all individuals involved in the transportation);
• Providing as appropriate escorts (or guards) for the shipment who are able to communicate with response forces, either directly or through a communications centre monitoring the movement;
• Transporting packages inside closed and locked vehicles, railway wagons or holds of ships (with vehicles involved in movements of Category I quantities of nuclear material preferably being designed to resist forcible attack and equipped with immobilisation devices);
• Locking or sealing packages and ensuring, where necessary, that the package design takes account of the potential for sabotage; and
• Having plans in place for response and recovery operations in the event of any threatened or actual theft or sabotage of nuclear material in transit.

439. The competent authority should define requirements for the physical protection of nuclear material in transit, taking into account the particular circumstances prevailing in the State [3.2.4.1]. This is necessary in order that those involved in planning the transportation of nuclear material may know, at least in broad terms, the physical protection requirements which will need to be incorporated into any shipment plan. In defining these requirements, the competent authority will not only wish to take account of the recommendations in Chapter 6 of INFCIRC/225/Rev.3, but should also take account of State's obligations to comply with the requirements of the Convention on the Physical Protection of Nuclear Material for nuclear material in international transportation and/or any commitments made by the State (either as a supplier, or as a recipient under the terms of a Supply Agreement) to protect nuclear material in accordance with Annex C of the Nuclear Suppliers Group Guidelines (INFCIRC/254/Rev.2). In addition, the competent authority should consider in defining these requirements what steps need to be taken from the outset to ensure appropriate protection of detailed information concerning proposed transport operations. Knowledge of the schedule and route, in particular of Category I and II shipments, should be strictly limited to the minimum number of persons necessary. Any wider dissemination of this information to other official bodies should be made as close to the time of departure as possible so as to reduce the risk of compromise and these bodies requested to keep the information confidential [3.2.7.1/6.1.2(f)/6.1.3]. If secure communications are not available, the introduction of codes for information on dates and places of shipments should be considered [6.2.12.3].

440. In three important areas, load carriers, escorts and communications, the competent authority will wish to define more clearly than INFCIRC/225/Rev.3 the State's physical protection requirements to take account of local circumstances, including the State's assessment of the threat. Particularly where Category I material is involved, there is a close inter-relationship between these three areas to ensure that the escort can summon immediate assistance from a response force who will arrive before attackers have time to remove the nuclear material, hijack the vehicle carrying it, or carry out an act of sabotage leading to a radiological release. The larger and better armed the escort, the less likelihood there is of it being overwhelmed. However, where there are constraints on the size or arming of the escort, then increased dependency must be placed on providing a load carrier that is capable of resisting forcible attack or hijacking until the expected arrival of the response forces. 

441. The competent authority should establish a minimum size of an escort for each of the various modes of Category I transport and its distribution between load vehicles and escort vehicles. States are encouraged to use armed escorts to the extent that laws and regulations permit [6.2.9.1]. This may involve coordinating the provision of armed guards through another State body such as the police. It may be decided that escorts are required also for the transport of other categories of nuclear material, depending upon local circumstances. Although it is recommended that a single designated vehicle should be used for each Category I consignment in order to concentrate the material into one vehicle [6.3.2.2], this may not always be possible because of the size of the load. The competent authority may wish to stipulate that where additional load vehicles are required, they are limited in number for any one shipment and that escort numbers are increased accordingly. Whereas it is recommended that shipments of Category I material by sea should be accompanied by one or more escorts [6.3.4.1], experience suggests that as voyages tend to last protracted periods, sufficient escorts should be provided to ensure that at least one (and preferably more than one) escort is on duty at all times in order to maintain communications with response forces and keep surveillance on the cargo hold and surrounding seas. 

442. When armed escorts are not used for Category I shipments, compensatory measures should be applied [6.2.9.1]. These compensatory measures should be designed to delay an attacker long enough for the response force to arrive and thus prevent successful theft or sabotage. Essentially they consist of barriers which provide delay to attackers attempting to gain access to the nuclear material and immobilisation (or disabling) systems which further delay any attempt to hijack the load vehicle. Even where armed escorts are used, vehicles preferably should be specially designed to provide penetration delay and be equipped with an immobilisation (or vehicle disabling) system in order to provide the defence "in depth" explained in paragraphs 443-4 below [6.3.2.1].

443. Delay may be provided by constructing the load compartment of the vehicle, train or ship similar to a "strong room" through the use of armour plating and other barrier materials to delay or mitigate a forcible or explosive attack. The door to the compartment should be of similar standard fitted with multiple locking pins and special locks. Nuclear material packages may be further secured within the compartment by cargo tie-down systems, and packages designed to provide thermal protection against the consequences of an explosive or ballistic attack.

444. In order to prevent attackers from simply driving a captured vehicle away, the driver's cab should also be made secure through armouring and the fitting of special locks and the vehicle should be fitted with at least one immobilisation system operated from the driver's cab for use in an emergency. Systems available include ones that cut off the fuel supply, lock the gears or the wheels, disable the accelerator or shut-off the air brakes. Any immobilisation device fitted preferably should be of a design that is not capable of being disengaged easily and quickly. 

445. INFCIRC/225/Rev.3 recommends that domestic physical protection measures should include communication facilities between a vehicle carrying Category I or II material and the shipper, receiver and/or a designated agent [6.2.8.1/6.4.7.1]. As for international shipments [6.2.11.1/6.2.11.4/6.4.8.1/6.5.5.1], the purpose of communications between the vehicle/train/ship/aircraft carrying the nuclear material and a central communications centre is to enable the latter to monitor the continued integrity of the shipment and relay emergency reports to designated response forces. It is the responsibility of competent authorities to ensure that a suitably manned and equipped communications centre to monitor Category I and II shipments is established by the shipper, receiver, transport company involved or an independent State authority. Current technology now makes it possible to install an automatic data transmission tracking system on load carriers which enables a communications centre to note and investigate immediately any unplanned stops or deviation from the planned route. These tracking systems may incorporate short pre-assigned data messages which can be transmitted in an emergency by the driver or on-board escort. However, it is important in the case of Category I shipments that the escort is able also to communicate verbally by radio, mobile telephone or satellite system to the communications centre in order to provide detailed information in the case of emergencies. It is also advantageous if the escort is able to communicate directly by radio with designated response forces in an emergency. 

446. INFCIRC/225/Rev.3 also recommends that radio communications should be established between the Category I load vehicle and the escort vehicle [6.3.2.6]. Prudent practice would indicate that there should be at least two escort vehicles, one to provide close protection to the load vehicle and a second adopting a stand-off position, equipped to raise the alarm direct with the communications centre in the event of an attack. In the case of rail movements (6.3.3.2), prudent practice would suggest that the escorts on the train are able to communicate with the train driver in order to establish the reason for, and anticipated duration of, unscheduled stops. (Reference to a "goods train" in 6.3.3.1 means a freight train which does not carry passengers. If the use of trains for Category I shipments is necessary, a dedicated freight train should be used, the use of passenger trains not being encouraged because of the opportunities this would present to a potential attacker). 

447. In addition to keeping shippers and receivers updated concerning the progress of a shipment, the communication centre has a key role in alerting response forces to any emergency. It is the role of the competent authority to ensure that emergency procedures are prepared to handle effectively any possible threat to nuclear material in transit [6.1.1]. This involves ensuring that armed response forces are identified who are prepared to arrive rapidly enough to prevent the unauthorised removal or sabotage of a Category I shipment [6.2.10.1/6.2.11.1] and who may rapidly recover a lost Category II or III shipment [6.4.8.1/6.5.5.1]. States are also responsible for arranging, at the request of other States, recovery actions in the event of a loss of an international shipment of nuclear material within their territory [6.2.11.2/6.4.8.2/6.5.5.2]. States Party to the Convention on the Physical Protection of Nuclear Material are required to identify and make known their central authority having responsibility for physical protection and for coordinating recovery and response operations in the event of any act, or credible threat, to steal or sabotage nuclear material. The IAEA circulates details of these central authorities on a regular basis.

448. The recommendations in Chapters 3 and 6 of INFCIRC/225/Rev.3 are not made in sequence with the steps necessary to plan, approve and execute a shipment of nuclear material. To put these in a more chronological order, the relevant recommendations for a Category I international shipment are summarised in the following paragraphs. Relevant recommendations for Category I domestic shipments and Category II/III domestic and international shipments follow in the same chronological order. 

449. Responsibility for planning the shipment rests with the owner of the nuclear material (or his designated agent), acting in conjunction with the shipping facility, any transport company to be used (6.2.6.2), and the receiving facility. In doing so, the owner should take account of the principles listed in 6.1.2/6.2.3.1 by which the objectives of sound physical protection may be assisted. The plan will need to comply with regulations of the sending State and the requirements of its competent authority, and of the regulations and requirements of the receiving State and of other States which are transited [6.2.3.2]. 

450. In drawing up contracts or agreements for the shipment, it is important that the point at which responsibility for physical protection is transferred from one transport authority to another is clearly stated [6.2.12.1]. This will not necessarily coincide with the point at which legal ownership of the material is transferred, but it will determine whether the shipper or receiver (or even a third party) and its State has the responsibility for the physical protection of the material, the maintenance of communications, the arrangements for dealing with an emergency and the arrangements for recovery if needed. Under the terms of the Convention on the Physical Protection of Nuclear Material, each State Party is required to ensure as far as practicable that nuclear material within its territory, or on board a ship or aircraft under its jurisdiction is protected to prescribed levels. This indicates that the point of handover of responsibility for air and sea shipments will be dictated by the flag of the carrier, as a States will assume or have continuing responsibilities in international waters or airspace for nuclear material carried on its ships or aircraft. Contracts or agreements should contain provisions for the appropriate degree of advance notice to be provided of shipments so that physical protection arrangements may be made by the parties involved [6.2.12.2]. 

451. Although in cases where physical protection is adequately covered by regulations, advance authorization for routine shipments is not required [6.2.2.1], it would be prudent for the competent authority to require physical protection plans for all shipments (or series of identical shipments) to be submitted for approval in advance. Experience suggests that it is rarely possible for existing regulations to cover every contingency [6.2.2.2] and liaison will be necessary with other State bodies and relevant overseas competent authorities. The competent authority may wish to undertake a security survey on part of the route or the mode of transport to be used. Additionally, the competent authority or relevant State body should consider whether (or, if a State Party to the Convention on the Physical Protection of Nuclear Material, will require assurances that) the material will be adequately protected during international nuclear transportation, perhaps before granting an import or export licence. Paragraph 3.2.1.4 of INFCIRC/225/Rev.3 provides examples of satisfactory assurances that this will be the case. 

452. In reviewing plans for proposed shipments, the competent authority should consider whether the package to be used requires to be assessed for its resistant to acts of sabotage (4.3.2). The competent authority should also consider the implications of the proposed point of handover of physical protection responsibility from it's State to that of the recipient (or third party) State [6.2.11.1/6.2.11.2/6.2.11.4]. For road and rail movements, this may involve reaching agreement with the State whose border is to be crossed concerning the exact point at which handover will take place, e.g. at which State's border control post. For air movements, advance arrangements may need to be made with States en route in whose territory emergency diversion airports have been identified for cooperation in protecting the nuclear material if the diversion airport is required. For sea shipments through international waters, the competent authority will require to be satisfied that adequate arrangements have been made regarding maintenance of communications throughout voyage and that response forces have been designated for both international and foreign territorial waters. Close liaison will be necessary therefore with relevant overseas competent authorities before the shipment, and relevant communication links established for use immediately prior to and during the shipment. 

453. In granting consent to the proposed shipment, the competent authority may lay down specific limitations and conditions related to the particular circumstances [6.2.2.2]. It is the responsibility of the licensee/operator to whom approval or a licence for the shipment has been given by the competent authority to issue written instructions in advance to those persons responsible for physical protection during the shipment [6.2.6.1]. The competent authority should coordinate the issue of satisfactory written instructions by other external bodies involved in protecting the nuclear material in transit (such as police escorts). 

454. Shortly prior to commencing the shipment, the shipper should confirm details and timings of the proposed shipment with the receiving facility and obtain prior confirmation of its readiness to accept delivery at the designated point of handover [6.2.1.1/6.2.1.2]. The competent authorities of the States involved and designated response forces should also be informed of the timetable of the shipment by the shipper directly or through the competent authority. (The Convention on the Physical Protection of Nuclear Material requires the responsible State Party to inform States in advance if nuclear material is expected to transit through their territory other than through their territorial waters or airspace). 

455. Physical protection of the shipment should be undertaken in accordance with the approved shipment plan and associated written instructions, taking into account the regulations and any specific conditions stipulated by the State competent authorities through whose territory the shipment is transported. Competent authorities are encouraged to carry out periodic security audits of shipments in order to confirm that physical protection arrangements conform to applicable requirements [3.2.1.3/3.5.1]. 

456. If road movements cannot be completed without overnight stops, or if there is a requirement to place nuclear material in temporary storage en route (for instance at a transfer point), then the material should be protected in a manner consistent with that employed to protect it in use and storage at a facility. For Category I shipments, this involves the establishment of a temporary protected area (or the use of an existing protected area at a nuclear facility) to which access is restricted and which is under surveillance by guards who are in close communication with off-site response forces. If the material is to remain on the load vehicle, then the vehicle should immobilised in order to deter or delay any unauthorised movement. Temporary storage arrangements should be approved in advance by the competent authority as part of the shipment plan [6.1.2(c)/6.3.2.5]. 

457. Finally the receiver should check the integrity of the packages at the point of handover and notify the shipper/owner immediately of their safe arrival. At the same time the escort should notify the communications centre of the handover of the packages to the receiver [6.2.7.1]. If there have been any incidents or unscheduled delays during transit, a review of physical protection arrangements should be carried out in order to evaluate their effectiveness and identify any necessary improvements which may be made to optimize their effectiveness during future shipments.