|
Publication Date: 1/1/74
Pages: 4 Date Entered: 2/22/84 Title: SECURITY SEALS FOR THE PROTECTION AND CONTROL OF SPECIAL NUCLEAR MATERIAL January 1974 U.S. ATOMIC ENERGY COMMISSION REGULATORY GUIDE DIRECTORATE OF REGULATORY STANDARDS REGULATORY 5.15 SECURITY SEALS FOR THE PROTECTION AND CONTROL OF SPECIAL NUCLEAR MATERIAL A. INTRODUCTION Paragraph 70.51(e) of 10 CFR Part 70, "Special Nuclear Material," requires that certain licensees authorized to possess at any one time special nuclear material (SNM) in a quantity exceeding one effective kilogram maintain, among other things, procedures for tamper-safing containers or vaults containing SNM not in process, control of access to devices and records of the date and time of application of each device to a container or vault, unique identification of each such item, and other pertinent records of all such items. Paragraph 73.30(c) of 10 CFR Part 73, "Physical Protection of Plants and Materials" requires, among other things, that SNM be shipped in containers which are sealed by tamper-indicating type seals and that, except under certain conditions, the outermost container or vehicle also be sealed by tamper-indicating type seals. Paragraph 73.41(c) requires, among other things, that each licensee keep records of shipments of SNM subject to the requirements of this part, including seal descriptions and identification and that such information be recorded prior to shipment. This guide identifies features of security seal systems and describes types of seals that are generally acceptable to the Regulatory staff for tamper-safing of SNM. B. DISCUSSION Security Seals A security seal is a passive device used to detect tampering or entry. Various types have been developed to meet specific requirements. The different types of seals retain essentially the same elements but with varied emphasis. A property common to all types of seals is frangibility. A seal is not expected to present a serious obstacle to entry or tampering, and for that reason it is usually a rather weak mechanical obstruction which can be overcome with small effort. Some seals, such as those utilizing sealing wax, are brittle. This property of seals is, in certain cases, intentionally enhanced, as in the case of prestressed glass containers used as seals to define a secure volume. Here, the stored energy serves to shatter the glass if excessive force is used. In some metallic seals, notches are cut so that if one attempts to bend back the essential part of the seal to reclose it, the metal breaks from fatigue along the notched part. Seals are passive devices requiring inspection to indicate whether entry or tampering has occurred. An unalarmed glass door is a seal in the sense that it is frangible and passive. On the other hand, the wall of a vault is a passive barrier but is not frangible and is therefore not commonly considered to be a seal. Seals are nonreversible in the sense that once broken, they are difficult to reassemble without leaving signs of the reclosing. Seals are identifiable, in that it is possible to add unique identification characteristics, allowing detection of whether the seal is the one originally applied and not a forgery. This property, however, is sometimes replaced by limiting the availability either of the seals in the unapplied state or of some part of the sealing procedure. Resorting to limitations on availability to replace identification procedures is now recognized to be a poor practice. This is probably one of the most important evolutionary changes observed in seals. It appears that, in early sealing wax seals, the main emphasis was on protection of the tool used for impressing the hot sealing wax. Similarly, for some currently available seals, such as lead seals, emphasis is placed on the difficulty of obtaining replicas of crimping tools and on the inability of unauthorized persons to obtain seals from the manufacturer. However, in sophisticated modern seals, the emphasis is on the unique identification characteristics (fingerprint) of the seal.. Function of a Sealing System Seals are devices which are applied at convenient places to detect tampering and entry. Sealing systems consist of the seals themselves and the sets of procedures, techniques, and devices used in procuring, storing, and fingerprinting the seals; selecting the point of application; applying, removing, and identifying the seals; and judging whether entry or tampering has occurred. The objective of utilizing a sealing system is to provide a level of assurance that no tampering or entry occurred during the period that the seal was applied. The degree of confidence in a seal system will vary directly with the effort required to defeat the seal and inversely with the motivation for defeating it. If the scheme used by a would-be diverter of the contents requires undetected tampering with the sealed object, the seal will present an added obstacle for the diverter which will require him to undertake extra activities. The chance that he will make a mistake and be detected is therefore increased. An intangible effect of a sealing system is the psychological one of informing would-be diverters that security measures are being taken, thus deterring acts by weakly motivated people. Limitations of Sealing System The methods of attack on sealing systems that are potentially the most successful are those exploiting weaknesses of parts of the sealing system other than the seal itself. Although a sealing system would fail at the seal if the seal could be opened and reclosed without leaving any identifying marks that would indicate tampering, this would be difficult even in the case of lead seals which are normally considered relatively unreliable. Opening and closing the seal without leaving marks is difficult because of work hardening of the lead. Seals of a more sophisticated type are virtually impossible to open without leaving some indication of tampering. A sealing system that depends on a lack of availability of blanks to the adversary can fail if the supplier of the seals or one of his employees can be persuaded to produce a set of replicas. This also presupposes a weakness in the method of identification used in the sealing system. In recognition of this problem, all manufacturers of seals make the point in their sales literature that precautions are taken to prevent delivery of unauthorized orders of blanks. Sealing systems that depend on a lack of availability of blanks can also fail if it is possible to steal blanks from the storage area. Again, this presupposes some weakness in the identification method. A sealing system can fail if new seals are not properly protected. Assume that an inspector brings a supply of seals previously fingerprinted at the home office. A diverter replaces some of the seals with forgeries, which the inspector, not having fingerprinting capability in the field, unsuspectingly installs in the plant. The diverter breaks the forged seals, gains access to the protected material, and applies the good seals previously stolen from the inspector. The inspector later removes the seals and sends them to the home office for the post-mortem examination that certifies their identity. A sealing system can fail in the method of fingerprinting if the type and detail of information about the seal taken and recorded at the time of application are inadequate to make forgery by a diverter unattractive. In the case of sealing systems using lead seals, the fingerprinting is normally restricted to markings made at the time of application by means of the engraved dies of the sealing press. Such a die can be reproduced from an old seal. Another method of defeating any fingerprinting system is to substitute false records of fingerprints in the files of the sealing agency. The selection of the point of application of the seal in a sealing system can lead to weakness if the containment membrane is not tamperproof. For instance, sealing the door of a truck might be useless if access can be gained by unbolting the door at the hinges. The method of post-mortem examination of the seal can lead to failure of the system if the examination is not sufficiently thorough. A complete examination of the removed seal is required if the seal is to serve fully in the detection of tampering. A sealing system can fail if the ways the seals are applied make them vulnerable to accidental damage since a history of such incidents might be used to conceal a few willful attacks. In particular, some seals used on shipping containers can be easily damaged during normal handling. In some cases plant operators request advance authorization to break some seals in emergency situations when inspectors will not be available to witness the operations. In either case, an inspector could be facing a broken seal, a plausible explanation, and some unsafeguarded material. Types of Seals Commercially Available Some types of security seals are being made in large numbers and have found use in industry for tamperproofing such things as utility meters, tanks of bonded liquor, and oil wells. These seals vary widely in reliability, and the simpler ones probably will not find an application in safeguarding nuclear materials. A brief description of some types of seals follows. Lead Seal. Various types of lead seals are in common use. Essentially, a lead seal consists of a small block of lead with holes for the passage of the sealing wire. The wire is passed through the closure hasp on the container and then through the holes in the lead, which is then compressed so as to embed the wire. Self-Locking Padlock Seal (Plastic). This seal uses an elastic wire which passes through the hasp and is inserted in a plastic block shaped in such a way that, once the wire springs into position, the wire cannot be removed without tearing or deforming the plastic. Notched Metal Seal. This seal is a metal strip which is notched. The strip is passed through the hasp and bent at the notch. To remove the seal requires bending the metal strip at the notch again which results in breakage. Self-Locking Padlock Seal (Steel). This seal is a sturdy lock-type seal. A U-shaped shackle is passed through the hasp and is then inserted into a steel block; expansion rings inside the block fall into grooves in the shackle ends when the shackle is properly seated. Wire Lock Seal. This seal uses a serrated wire that is passed through the hasp and whose ends are inserted into holes in a metal box with spring teeth locking onto the serrations of the wire. Boxcar Seal. This type is the typical railroad boxcar seal employing a metal strap which is passed through the hasp. Both pads of the strap are locked together inside a metal box at the time of closure. Type E Seal. This seal consists of two metallic parts that, when snapped together, form a closed box about the knot on the wire passing through the hasp. Pressure-Sensitive Seal. This seal has paper or plastic backing on one surface of which is a layer of adhesive. After proper application, this type of seal is difficult to remove without an indication that tampering has occurred. Seals for Use in Safeguarding of SNM Of the seals commercially available, three are sufficiently reliable for use in safeguarding SNM. These seals are (1) the pressure-sensitive seal, (2) the steel padlock seal, and (3) the type E seal. The pressure-sensitive seal recommended for use in onsite storage of SNM is described in Regulatory Guide 5.10. The steel padlock seal is a one-time padlock seal that is destroyed when removed. The most secure design at present appears to be the one requiring a hammer to drive a hardened steel shackle into a steel block. This seal is very rugged and may have use in some situations where accidental damage may be likely and where a lock is also needed. The type E seal is a seal in which a fingerprint may be artificially created by scratches inscribed on the inside surfaces of the seal. The scratches are photographed before application of the seal. Later, at the container inspection point, the seal is removed and sent to a laboratory for analysis and comparison with the original photograph. The seal is destroyed in the examination. A disadvantage is the undesirable time lapse in getting the seal to the laboratory for the post-mortem examination and in getting the report back to the custodian who removed the seal. The type E seals when fingerprintes are considered high-security seals. Defeating the seal by forgery would require accurate reproduction of internal surface details to such a degree that differences would not be distinguishable in a macrophotographic comparison. Defeating the seal by surreptitious attack would require penetration and repair techniques that would not be visibly evident under microscopic examination of the surfaces. The seal could be defeated by cutting and rejoining the wire without leaving marks. However, the use of multistrand wire makes unnoticeable rejoining difficult. At present, there appears to be no known form of attack by which the type E seal when fingerprinted can be defeated. Other seals based on fiber optics and on cast plastics using photographic fingerprints are under development but not in common use. In general, such systems involve a field assembly and check of the fingerprint. Further development and evaluation are needed before they can be recommended. C. REGULATORY POSITION 1. The three types of security seals identified below are generally acceptable to the Regulatory staff for use in protection and control of SNM: a. Pressure-sensitive seals as described in Regulatory Guide 5.10, "Selection and Use of Pressure-Sensitive Seals on Containers for Onsite Storage of Special Nuclear Materials." b. Padlock seals. These seals should be made of hardened steel that is capable of resisting cutting by a hacksaw. The shackle and the block should each carry a serial number. c. Type E seals. The brass crown-like clasping device of this type of seal should be soldered to the brass top of the cylindrical cup. The bottom of the cylindrical cup should be copper. The interior surfaces of the cup, top and bottom, should have a unique fingerprint applied. The wire passing through the hasp of the enclosure to be sealed should be a stainless steel aircraft cable. This cable is fabricated of a minimum of nineteen strands of wire. 2. An acceptable sealing system should include the following considerations: a. The outer surface of a seal should carry a serial number and the name or initials of the organization using the seal. The lettering and numbering should be readable and should be engraved, molded, punched, or otherwise applied in a way that prevents removal or changing of the numbers without leaving apparent damage. The seals should be sequentially numbered with sufficient alphameric or numeric symbols to prevent duplication of numbers in use at that facility. b. A seal should be applied to a container in a manner that ensures that the contents cannot be removed from the sealed enclosure without destroying the seal or breaking into the enclosure. A seal should be applied immediately after the samples and data to identify and measure the contents have been taken. c. The design and construction of a seal should ensure that disassembly and reassembly of the seal result in apparent residual indications of tampering detectable by the post-mortem examination techniques recommended for the seal. d. A seal should be resistant to or be protected against the effect of the environment or rough treatment which would be detrimental to the seal components and would destroy any indications of tampering. e. Seals should be available to and applied and removed by only designated individuals responsible to material control and accounting management. Removed seals should be disposed of in a manner to prevent reuse. f. Precise records of each and all seals by serial number should be kept and, after application, should include data on the sealed contents. Such records should include dates and times of application and removal of the seals, the signatures of the individuals responsible to material control and accounting management for the data and for applying and removing the seal, and any discrepancy that is observed in the sealed contents. g. Written procedures should be prepared covering the control, application, documentation, and post-mortem examination of seals. If the post-mortem examination is made by a person other than the custodian removing the seal, procedures should be established to maintain the chain of custody of the removed seal. h. Samples of every batch of seals received from a seal supplier should be retained for future reference and comparison in case of detected tampering. 3 |