Partnerships and Information Sharing in President Obama's Executive Order on Cyber Security

President Obama at 2013 SOTU

Yesterday President Obama signed an Executive Order aimed at helping nation harden its critical infrastructure against cyber attacks, and introduced it to the nation as part of his State of the Union address.

The Order states, "We can achieve these goals through a partnership with the owners and operators of critical infrastructure to improve cybersecurity information sharing and collaboratively develop and implement risk-based standards."

The partnership model has a history of success, and it is prudent to continue and support this model.

The nuclear power industry has an active partnership with the U.S. Department of Homeland Security specifically geared toward enhancing the security of commercial users of nuclear materials.

Under HSPD-7, the industry established the Nuclear Sector Coordinating Council (NSCC), and the government established the Government Coordinating Council (GCC). These groups meet quarterly under the Critical Infrastructure Partnership Advisory Council (CIPAC) framework.

The NSCC/GCC provides an instrumental forum for organizations engaging in civilian uses of nuclear materials in the U.S. to discuss security issues and work together with our federal partners to enhance security and resilience.

The order also discusses the importance of information sharing. I could not agree more. The nuclear power industry in the U.S. has a proven record of responding in a timely manner to identified threats to the safe operations of our facilities.

Information sharing is integral to establishing a robust cyber security program. As I discussed in a previous blog post on nuclear power plant cybersecurity, our plants have been actively addressing the cyber threat for over 10 years.

The first questions that must be answered when establishing a security program are:

What must be protected?
What must it be protected from?

Information sharing has been instrumental in helping us stay on top of what we must be prepared to defend against.

Under the NSCC/GCC framework, the nuclear sector receives quarterly threat briefings at the SECRET level. The DHS also conducts monthly sector-specific unclassified threat briefings.

So, at a high level, the EO is moving in the right direction. But we cannot lose sight of good work already done.

This new emphasis on the adoption of cyber security practices must consider the existing regulatory frameworks and voluntary initiatives that are already in place.Complexity is the enemy of security. Streamlining and minimizing burden on private entities ensures that resources remain available to respond to real threats.

Ensuring that any new cyber security guidance, practices, or policies does not overlap or duplicate existing practices is essential. For addition details, please consult the NEI backgrounder on Cyber Security.

POSTSCRIPT: The Nuclear Energy Institute’s chief nuclear officer and senior vice president, Anthony R. (Tony) Pietrangelo, made the following comment about the cyber security executive order signed Tuesday by President Obama.

Tony Pietrangelo

“Commercial nuclear energy facilities are well protected from possible cyber threats. The nuclear energy industry has been implementing and improving cyber security controls since 2002, and the federal agency that oversees the nation’s nuclear energy facilities—the Nuclear Regulatory Commission—has established regulations that thoroughly monitor and inspect cyber security at all U.S. reactors.

“To ensure our constant readiness, the industry participates with government agencies to be aware of and assess its readiness for emerging cyber threats. Our facilities are essentially cyber islands, in that safety and control systems are not connected to business networks or the Internet. Unlike industries for which two-way data flow is critical, nuclear power plants do not require incoming data flow.

“Nuclear plants also are protected from grid instability, with multiple backup power supplies that provide for safe shutdown of a reactor in the event of a power blackout. Given that the NRC appropriately exercises authority over the protection of nuclear plant systems from potential cyber threats, it would be counterproductive to have dual oversight of these facilities.”

Activists' Claims Distort Facts about Advanced Reactor Design

Below is from our rapid response team . Yesterday, regional anti-nuclear organizations asked federal nuclear energy regulators to launch an investigation into what it claims are “newly identified flaws” in Westinghouse’s advanced reactor design, the AP1000. During a teleconference releasing a report on the subject, participants urged the Nuclear Regulatory Commission to suspend license reviews of proposed AP1000 reactors. In its news release, even the groups making these allegations provide conflicting information on its findings. In one instance, the groups cite “dozens of corrosion holes” at reactor vessels and in another says that eight holes have been documented. In all cases, there is another containment mechanism that would provide a barrier to radiation release. Below, we examine why these claims are unwarranted and why the AP1000 design certification process should continue as designated by the NRC. Myth: In the AP1000 reactor design, the gap between the shield bu...

How many nuclear plants does it take to meet the world's energy needs?

Several weeks ago Joshua Pearce at Clarion University in Pennsylvania released a study titled “ Thermodynamic limitations to nuclear energy deployment as a greenhouse gas mitigation technology .” In the study he stated... nuclear energy production would have to increase by 10.5% per year from 2010 to 2050 to both replace fossil-fuel-energy use and meet the future energy demands. This line, of course, made the headlines and has been picked up by several outlets and blogs . When looking into his calculations for this statement, he made one assumption error that overstated the above sentence by nearly a factor of three. Page 121, Section 4.1 of the study states: Richard Smalley pointed out that in 2004, the global economy consumed the equivalent of 220 million barrels of oil per day, which converted into electricity terms is the equivalent of 14.5 TeraWatts (TW), or 14,500,000 MegaWatts (MW) (2005). … With a nuclear plant having about 1000 MW (1 GW) of capacity, we would need 14,500...

What Happens During a Refueling Outage?

You may have noticed over the past few weeks that a number of nuclear plants are shut down for refueling outages or are resuming operations after just returning from one. This type of routine outage usually occurs in the spring or fall when electricity demand is low so that nuclear reactors can replace about one-third of the spent fuel rods with new fuel and conduct other routine maintenance and repairs at the plant. To get a better sense of how refueling works at a nuclear energy facility, I spoke with Marcus Nichol, NEI’s senior project manager for used fuel storage and transportation, and asked him to explain the basics. Why does a nuclear plant need to replace one-third of its fuel? Nichol: The main purpose of a refueling outage is to replace older fuel that is depleted—meaning it can no longer efficiently produce energy from nuclear fission reactions—with new fuel. This “used fuel” has typically been used in the reactor for four-and-a-half to six years before it is pe...

NEI Nuclear Notes

Search This Blog