REPORT ON THE IMPLEMENTATION OF IAEA SAFEGUARDS

• Document Type: CREST
• Collection: General CIA Records
• Document Number (FOIA) /ESDN (CREST): CIA-RDP86T00303R000500700038-1
• Release Decision: RIPPUB
• Original Classification: S
• Document Page Count: 49
• Document Creation Date: December 22, 2016
• Document Release Date: September 17, 2010
• Sequence Number: 38
• Publication Date: November 17, 1981
• Content Type: REPORT

STAT
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
,C,VO
Next 1 Page(s) In D
'CIO
ocument Denied
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 uucm crnADATCr1 CDAM CAI/`I nC11DCC
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
sue
Mr. Harry R. Marshall, Jr.
Principal Deputy Assistant Secretary
for Oceans and International
Environmental and Scientific Affairs
U. S. Department of State
Washington, DC 20520
Dear Mr. Marshall:
kFAC I
The Commission is today sending to appropriate congressional committees the
attached letter, forwarding the "Report on the Implementation of IAEA
Safeguards" recently prepared by an NRC staff member, along with the NRC staff's
commentary on that report and an updating addendum. The original report was
previously provided to Assistant Secretary Malone and other Executive Branch
officials by Commissioner Gilinsky.
Sincerely,
t,Q
.. ~ . -4p~
JJapffi R. Shea, Director
Office of International Programs
Enclosure:
As stated
cc: Richard T. Kennedy, DOS
Paul Wolfowit:, DOS
Fred C. Ikle, DOD
Harold Bengelsdorf, DOE
Norm Terrell, ACDA
Multiple sources
Ciassitied by-.
ri Declassify
NATIONAL SECURITY INFORMATION M%am ,M..m,, ^ ^ , or on 1QUK 13 , ,.tl
Unauthorized disclosure subject to WHEN SEPARATED FROM ENC:.ittllRE?iassirter:
Administrative and Criminal sanctions ENTIRE TEXT
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 hn /nnlr. bO
t.,00303R000500700038-1
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RnDP86Tn
.
;ommissioner Gilinsky
~
The Honorable Alan Simpson, Chairman
Subcommittee-on Nuclear Regulation
Committee on Environment and Public Works
United States Senate
Washington, D.C. 20510
Dear Mr. Chairman
Commissioner Bradford
Commissioner Ahearne
Commissioner Roberts
S. J. Chilk (wo/encls)
L. Bickwit, OGC
F. Remick, OPE
H. K. Shapar, ELD
R. Burnett, NMSS
J. R. Shea
J. B. Devine
W. J. Dircks
(S) In connection with the Commission's obligation to keep the Congress fully
and currently informed, I have enclosed a report on International Atomic
Energy Agency (IAEA) safeguards by a former NRC employee (Enclosure 1).
The author was employed as an IAEA safeguards inspector from summer 1977
to summer 1980, following which he was employed by the NRC utbil resigning
in July of this year.
(S) Although we recognize IAEA employees agree not to divulge this type of
information, even after-they leave the IAEA, the Commission believes we are
obligated to inform you once we have such information. Obviously, we have
not shared the report with the IAEA.
(U) The Commission's staff has reviewed the report in light of its relevant
experience and has prepared a commentary, with an updated addendum, which
is also enclosed for your information (Enclosures 2 and 3).
(U) This information is being provided to other appropriate congressional
committees.
Sincerely,
Nunzio J.
Chairman
NATIONAL SECURITY INFORMATION
Unauthorized disclosure subject ta
Administrative and Criminal sanction3
Enclosures:
1. Report on IAEA Safeguards (S)
2. Staff Commentary (S)
3. Addendum to Staff Commentary (S) GE
Pal ladino
I
cn
4 o
??Nt u
0 .0
V) CL
C
CS
Z ai
, I
CL)
E
. I
U N
00g Z?
Criss; ,~c 3Y i pl a Sour~ES...~w
DeclassifY_M 8/4/2001
Review (Dal
Derivative Classifier:
nded by -RDS-3
e
t
x
e
Reason for. Extension orei n
elations . . err=-4
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
ENCLOSURE 1
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
SECRET 3M ivo
(ENTIRE TEXT) This document consists of___ a
No. o f copies, Series
REPORT ON THE IMPLEMENTATION OF
IAEA-SAFEGUARDS
1. INTRODUCTION
The purpose of this report is to provide an inspector's insight into IAEA
safeguards, based upon 7 years as a domestic safeguards inspector with the
U.S. Atomic Energy Commission's Division of Nuclear Materials Safeguards and
the successors of that organization in the AEC and NRC, 3 years as an.inter-
national safeguards inspector with the IAEA, and, in addition, several years as
an NRC headquarters staff member.
The concept has been advanced at high levels that a country's signature of the
NPT is the principle aim of IAEA safeguards. This report is only concerned
with the technical aspects of IAEA safeguards inspection activities, and does
not address such broad issues.
The concept has also been advanced that IAEA safeguards are of more value than
is apparent by virtue of their technical value per se. This may be true where
a State does not understand the rr.eans by which safeguards are applied. In my
experience, the representatives of the state systems and the operators of the
installations know exactly how effective international safeguards are and how
the international safeguards system can be defeated. I can only address the
technical capability to safeguard nuclear materials.
2. ORGANIZATION OF IAEA
The Board of Governors of the IAEA, on which 34 States are represented, is the
principal authority which influences the policy of the Agency. Voting is on a I I Z
03
one-member one-vote basis, so that less populous countries have as much influence
,l
as more populous ones. In terms of budget, however, a large proportion of
to J
funding is provided by the U.S., and the U.S. also provides additional monies c {
t'i
and technical assistance to the Agency. (Signed) WHm J. Dlrtkt
Classified By( aci
NATIONAL SECURITY INFORMATION SECRET_ (Original Authority)
Declassify t N
1-1 or on SS K z coo r
Unauthorized disclosure subJ sotto ? Reyievc LDwA cm ; . ?. ' c
Adr,.,, ct.-at_iva and Criminal sanctions. .._
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
The Agency's Inspectorate is very responsive to concerns of the countries
which it inspects. A complaint via the Board of Governors can end or alter
the career of an Agency employee. Thus, the Inspectorate is controlled by the
Inspected. A "diplomacy above all else" or "don't push your luck" mentality
prevails.
Another point of interest about the IAEA organization in the Department of
Safeguards is that nationals of the country inspected have access to inspection
reports, seals, seal records, etc., that concern their own countries. For
example, I once had to explain a report that I had written to an individual
responsible for clearing it from the country that the report concerned.
Although the IAEA takes modest steps to avoid this, it is unavoidable under
the present controls.
Finally, it should be noted that the IAEA does not teach languages to inspectors
and does not assist inspectors to learn the language of the country which he
inspects: The IAEA operates in four official languages of the United Nations
and on a semiofficial basis in German. Often the inspector cannot communicate
with the party being inspected, except via a representative of the national
authority or Euratom, who is conducting a parallel inspection. This occurs
more often than not, I would estimate. A result of language difficulties is
poor communications. For example, failure of an operator to carry out a
commitment made to an inspector may be blamed on not having understood.
3. MISSIONS TO THE AGENCY
Member countries of the Agency provide liaison to the Agency by way of their
Missions to the Agency. Some countries have a special staff for this purpose,
such as the U.S. One of the comments one hears in Vienna is that "You can't
get anything done around here without going to your Mission." As an example
of this, I witnessed a case where a non-U.S. inspector was promoted to P-5
(ca. $55,000 p.a. tax free) while I was on inspection travel with him. He
received two telegrams of congratulation concurrently. One of these came from
his Section Head at the Agency; the other came from his Mission.
SECRET
1-2
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
In my experience, I discerned inadequancy in the safeguards area. Most U.S.
inspectors did not feel supported by the U.S. Mission.
4. SUBSIDIARY ARRANGEMENTS
A country that has signed the NPT in time concludes an agreement with the IAEA
modeled after INF/CIRC 153. This agreement specifies in greater detail than
that found in the NPT how safeguards are to be applied in the state. In
addition to this agreement, subsidiary arrangements are concluded which specify
how safeguards are to be applied. These subsidiary arrangements consist of a
general part and of detailed attachments which specify how safeguards are to
be applied to "facilities" and to "other locations" where nuclear material is
present in small quantity.
4.1 Design Information
The facility attachments are concluded on the basis of "design information"
(DI) submitted by the State. In my experience, the headquarters review of the
DI and its field verification has been inadequate.
The Agency has the right to carry out DI verification, but often only three
weeks notice may be required to be given before an installation receives
nuclear material from the time the DI is submitted. Thus, a review of the DI
may not be possible and may not be permitted. Such a review is important in
many types of installations, to assure that there are no undeclared diversion
routes, connections to sampling stations, by-pass lines, etc. For example,--
once a reprocessing plant becomes radiologically contaminated, there is no
further chance for a DI review. I am not aware of any DI review of any
reprocessing plant.
Also, many tank calibrations in a reprocessing plant can be performed only
before an area becomes contaminated. Although verification and witnessing of
tank calibration is not a design information review activity per se, it can
only be performed before nuclear material is introduced. Due to the short
time interval between the submittal of the design information and the intro-
duction of nuclear material, as well as because the plant operator simply does
SECREt
1-3
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
not permit the witnessing of the calibrations, the verification activity is
only rarely carried out by the IAEA. This lack of assurance of tank calibra-
tions introduces an additional uncertainty in the quantities of nuclear material,
transfered and in inventory.
In the case of facilities involving sensitive information, such as reprocessing
plants and enrichment plants, DI review is typically not permitted, although
newsmen may be given tours. This shows the seriousness with which the IAEA is
regarded in the real world.
Another shortcoming in the design information is its completeness. For example,
in comparing the information on piping and tanks available at one reprocessing
plant, WAK, with that provided for another, the PNC reprocessing plant, one
finds that the PNC information is orders of magnitude more'detailed than in
the WAK case. In comparison, the WAK data is scant and probably inadequate.
This is because the diversion paths and falsification scenarios possible in a
reprocessing plant can only be addressed with complete knowledge in hand
regarding by-pass and recyle routes, and storage locations.
In spite of, or without regard to, the adequacy, completeness, or examination
of the design information, negotiations are conducted to conclude a facility
attachment, to specify how an installation will be safeguarded. The country
may, however, fail to agree with the Agency on the facility attachment. Years
may pass.
4.2 Facility Attachment
When the facility attachment (F/A) is concluded, it is a consensus document which
may permanently emasculate efforts to safeguard the installation. For example,
the "actual required inspection effort" (ARIE) agreed to may be barely enough
to cover scheduled visits and may leave no time to resolve discrepancies or
complete tasks that took longer than anticipated. And ARIE is taken very
seriously. Quite often, ARIE is about 10% of "maximum required inspection
effort" (MRIE), which is specified in the "Blue Book."
Another area, particularly in the case of bulk handling and reprocessing
plants where the F/A falls short is in not requiring that a "tag list or "list
1-4
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
of inventory items" showing the gross, tare, net, element, and fissile isotope
weights be made available after the "physical inventory taking" (PIT) of the
operator of the installation. This tag list would be used by the inspector in
his physical inventory verification (PIV). Since a tag list is often not
required, very often the inspector is left to take the inventory, rather than
to verify it. This is an often impossible task for the inspector, due to his
limited time and manpower.
When a tag list is required by the F/A, the specific bits of information
required, such as element and isotopic weights, are not called for. Again,
the inspector is defeated. The reason the inspector is defeated in such
circumstances is that where the operator provides the tag list only after the
inspector completes his verification activities, the operator is in the position
to correctly report those items that he observed the inspector to have verified,
but to falsify the reporting of those items that the inspector did not verify.
Thus, the operator is in a position to falsify the material balance.
Typically, a stratified list of items on inventory is required prior to the
PIT, for planning purposes. A record of actions taken during the physical
inventory including a list of batch data is required. The list of batch data
need not be available at the PIV, and further, is usually inadequate as a
basis for verification, because individual items are usually not listed.
Unfortunately, the distinction between PIT and PIV is often not comprehended.
Another shortcoming of the F/A is that it usually includes a clause such as,
"inspection shall be by observation of the State authority's inspection only,
unless observation is inadequate to permit the drawing of independent conclusions."
This clause frequently leads to haggling and loss of precious time during the
inspection as to what activities are actually permitted by the F/A, and often,
to the failure of the inspector to carry out necessary activities.
The shortcomings mentioned above are not an exhaustive list, but should serve
to illustrate that the inspector is often doomed from the start by an inadequately
negotiated facility attachment.
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
,CURL
4.3 Subsidiary Arrangements-General Part
This part of the subsidiary arrangements specifies how a State formally reports
the inventory and transfer activity to the IAEA. There are various categories
of "inventory changes" permitted. One of these is the "measured discard."
Usually there is a specified limit on the amount of measured discards which
may be discarded by the operator; such a limit may be, for example, 0.01 Kg
effective per month per bulk handling or reprocessing installation, of material
that is "disposed of in such a way that is not suitable for further nuclear
use." When the amount exceeds the limit, the state is required to consult with
the Agency before discarding takes place. Since the quantities and physical
form of nuclear material reported to have been disposed of are typically not
verified because the discards occur at times when no inspector is present, a
credible diversion path is constituted by measured discards. This situtation
is compounded in severity, it would seem, in a country such as FRG, where all
waste is transferred to'a central waste handling facility, which is not subject
to IAEA safeguards. Once the waste goes to the central facility, pending
resolution of the ultimate disposal of waste issue, it is "out of sight, out
of mind." Why IAEA is not permitted to inspect such a waste handling facility
is unclear. At the time that the nuclear material is sent to such a facility,
it often is suitable for further nuclear use.
Another category of waste removal is "retained waste." Retained waste is
defined as "nuclear material which is generated from processing or an operational
accident, which is deemed to be unrecoverable for the time being, but which-is
stored." Waste in this category, without regard to quantity, may be transferred
out of inventory. Such waste no longer appears in the operator's book inventory
records and is not reported to IAEA in the physical inventory list after the
operator's physical inventory taking. Only by searching back to the time the
transfer to retained waste occurred would a record be found. It is, therefore,
"out of sight, out of mind." Considerable quantitites of "retained waste" are
stored at some bulk handling installations, but are not periodically verified by
an IAEA inspector.
SECRET
, 1-6
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
5. RECORDS AND REPORTS
Under this heading, I discuss the records of the installation and the reports
that are submitted by the installation via the State (or regional authority
such as Euratom) to the Agency.
5.1 Records
The Agency requires a system of records and reports in the facility attachment.
The records are of two kinds, namely, (1) accounting records and (2) operating
records.
I saw great differences between the quality of the accounting records from
State to State and, within a State, from installation to installation.
I found, for example, that in FRG the records were not organized conveniently
in the sense that in"order for the inspector to perform a simple audit of the
records, considerable time had to be wasted to summarize the activity that
occurred since the previous visit. For example, in one major facility, the
records were kept according to financial account. There were about 300 of
these. There was no general ledger summarizing activity in the several hundred
accounts, but there were numerous transactions within and between accounts. I
found that to effectively carry out my audit, I had to create my own general
ledger. During each inspection, I wasted several days in this activity. The
facility simply saw no need to keep a general ledger, for its purposes. The
point is that the operator or the State can cause the inspector to waste a lot
of his limited time.
With regard to operating records, I also found deficiencies. For example, in
one facility, there was no record kept of the final disposition of plutonium
samples. Such samples were said to be returned to the process. But, one
would expect a record kept showing date, time, and identity of the reintroduced
SECRET
1-7
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 CIA-RDP86T00303R000500700038-1
 c rr+DR
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
samples. The Agency simply does not concern itself with material control at
that level of detail.
5.2 Reports
I noted that neither in FRG nor in Japan, nor elsewhere as far as I know, did
a system of material transaction reports exist, such as does exist in the U.S.
with the form NRC/DOE-741. This system is effective, in that serially numbered
forms are issued by the shipper of nuclear material and are acknowledged by
distribution of return copies by the receiver. These forms are matched by
computer in the U.S. system to detect material missing in transit and to flag
shipper-receiver differences. In the absence of such a system, an item missing
in transit or shipped to an unauthorized recipient could go undetected.
The Agency system, however, requires the reporting of transactions to the
Agency one month after the month in which they occurred. One way to detect
material missing in transit or not shipped to the stated recipient, after the
fact (but rather shipped to an unauthorized or undeclared recipient), is to
compare each shipment declared as shipped in the monthly report with each
shipment declared as received. When I arrived at the Agency in 1977, I found
that this was being done in summary form, well after the fact, by a clerk, in
the case of Japan under the Far East Section. However, with the advent of
magnetic tape reporting with NPT in January, 1978, this comparison, known as
"running the transit accounts," became the responsibility of the Section for
Data Processing Operations, Division of Safeguards Information Treatment, in
the Department of Safeguards. This Section has responsibility for all NPT
reporting. It was claimed that it was impossible to run the transit accounts
because sufficient design information for all installations to permit preliminary
error screening of reports had not been provided by the inspectors. Thus, the
emphasis changed from accounting to that of the use of the computer as a
device of interest in its own right. At a later date, it was claimed that
transit accounts could not be run because batch numbers provided by shippers
were not always the same as batch numbers provided by receivers. Another
problem, in the case of EURATOM reporting, was that France did not report to
the Agency except for the one facility under safeguards, so that transactions
SECRET
1-8
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
between France and another EURATOM country could not be checked. Thus, for a
variety of reasons, I was repeatedly told that the transit accounts could not
be run. It was our belief, in EURATOM section of IAEA, however, that transit
accounts were run by EURATOM, EEC, Luxembourg prior to the dispatch of the
monthly reports to the Agency. On one occasion, I was granted a special,
nonroutine check of transit accounts, due to absence of supporting records.
At that point, DIT was willing to entertain a special request. Several months
elapsed in the course of running transit accounts for a single installation.
I learned that there were shipments and receipts that did not match. We
informed EURATOM, Luxembourg, who replied that they had not detected this due
to a computer malfunction. This episode lead me to believe that Luxembourg
was not running transit accounts either. Thus, the Agency had, and presumably
still does not have, any routine assurance that a stated shipment to an instal-
lation within a State or a group of States, such as EURATOM, ever arrived. That
is, with limited exception, when the Agency checks the reports of installation X,
it does not compare those reports with the reports of other installations which
reported transactions with installation X. Thus, it only verifies the internal
arithmetic consistency of installation X's reports, in effect, treated in
isolation.
Another problem area for the Agency has been its Advance Notification of Inter-
natidn Transfer reports. These are not always reconciled either. And, when
they are reconciled, they often don't agree, due to inability to match shipper's
and receiver's reports.
Finally, the DOE sends copies of Form NRC-DOE-741 for international transfers
to the IAEA. These also are gracefully allowed to pile up "in the corner."
It seems that the IAEA does not need them.
6. INSPECTIONS
Although I have discussed inspections in other sections of this report, I will
provide some background here as to what an inspection consists of and what it
can and cannot do for various types of facilities.
SECRET
1-9
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
During my employment with the IAEA, the types of installations that I inspected
included reprocessing plants, conversion and fuel fabrication facilities (bulk
handling facilities), reactors. and critical facilities of various types, and
laboratories.
The approach that I will employ here is to explain first how IAEA safeguards ^
generally, comment briefly on the generic safeguards techniques, and then
explain how safeguards are applied at various types of facilities.
6.1 How NRC Safeguards Generally
INF/CIRC 153, The Structure and Content of Agreements Between The Agency and
States Required in Connection With the Treaty on the Non-Proliferation of
Nuclear Weapons, popularly known as the "Blue Book," articles 28, 29, and 30,
provides the following statement:
28. The Agreement should provide that the objective of safeguards
is the timely detectio of diversion of significant quantities of
nuclear material from peaceful nuclear activities to the manufacture
of nuclear weapons or of other nuclear explosive devices or for pur-
poses unknown, and deterrence of such diversion by the risk of early
detection.
29. To this end the Agreement should provide for the use of material
accountancy as a safeguards measure of fundamental importance, with
containment and surveillance as important complementary measures.
30. The Agreement should provide that the technical conclusion of
the Agency's verification activities shall be a statement, in respect
of each material balance area, of the amount of material unaccounted
for over a specific period, giving the limits of accuracy of the
amounts stated.
It is important to note that in the context of article 28, "diversion" should
not be equated with "removal." This is an important distinction, because
typically, an Agency inspector is concerned with diversion in the narrow sense
as removal.
With regard to article 29, one sees that the basis of IAEA safeguards is:
1. material accountancy
2. containment
3. surveillance
SECRET
1-10
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 e rr+DC1
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
6.2 Material Accountancy
In practice, "material accountancy" refers to the means by which the Agency
verifies the presence of nuclear material that should be present at an installa-
tion based upon records and reports. This system is, in itself, made difficult
because the reports occur several months after the actual movement of nuclear
material. Thus, the Agency's material accountancy typically consists of veri-
fication of the arithmetic correctness of the operator's records, verification
of the authenticity of the records by means of shipping documents and the like
furnished the operator, and several months after the fact, cross-comparison
of this information with reports of the same operator, which he sent via his
national system to the Agency on magnetic tape. As mentioned previously, the
Agency has thus far found it virtually impossible to inter-compare an operator's
reports with reports of any other operator, to verify the veracity of the
reports, especially in the case of States under NPT.
Article 30 refers to"the so-called MUF statistic, which is the operator's
statement of the amount of nuclear material, based upon his physical inventory
taking, that is apparently discrepant from the amount that is supposed to
present, based upon his records over a period of time. The LE (MUF) is
typically not calculated, although the Agency has good intentions of calculating
an approximate LE (MUF) in the future.
Very rarely the Agency calculates a D statistic, which is the inspector's MUF,
based upon his verification of the operator's statement. This is typically
incomplete, because the inspector rarely, if ever, measures all components-of
the operator's material balance closure and does not possess the information
necessary to perform a realistic calculation. The Agency just does not have
the manpower to do much verification and often does not have time to take as
many samples, even with a willing operator, as it believes necessary, of even
the ending inventory component.
In the best of all possible worlds, the MUF statistic is the closest that the
Agency verifies the material balance. In reality, it falls very far short of
what is intended, because of holes in the system which provide the MUF.
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
Because of the inherent difficulties of the MUF statistic, the Agency has
attempted to implement a system of "timely detection" at sensitive facilities.
Such implementation is, at the present time, far beyond the capabilities of
the Agency to implement and beyond the willingness of the countries to undertake.
It goes beyond the Blue Book, some believe, and would require massive amounts
of sampling and verification, and real-time knowledge of the amounts of nuclear
material moving between installations, rather than after the fact notification.
At the present time, such efforts are only in their early stages.
6.3 Containment and Surveillance Measures
Article 29 also refers to containment and surveillance measures. At the
present time, this refers primarily to seals in the containment category, and
cameras in the surveillance category.
In the case of seals, the Agency mainly uses the so-called "IRS Type-E" seal.
This seal has been around for a long time, and as early as about 10 years ago,
efforts were underway by at least one foreign government to "break it." The
seal has been "beefed up" by the Agnecy, but is basically an old device that
requires labor intensive "post-mortem" examination, which'verifies that the
seal removed is the same one that was originally emplaced, rather than a
counterfeit. The post-mortem examination is not necessarily capable of
determining whether the seal was sureptitiously opened and then reassembled.
The Agency also uses paper seals. According to expert authority, these seals
are useful for only a few hours at best, because they can be removed and
replaced, and also because they can be duplicated by a good printer.
There are several other seals around, but none of these have been used, except
in limited tests.
In any case, a second basic shortcoming of the use of seals is that the item
sealed can often be accessed by bypassing the seal.
SECRET
1-12
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 cF(RE1
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
Camera surveillance is of two types. One is the film camera, such as an 8mm
Minolta. These are typically used in pairs in a sealed enclosure. They are
set, in a power reactor, to each snap a picture at 15- or 20-minute intervals,
so that, at best, there is only 7 to 10 minutes between snaps. These are
intended to detect movements of large items, such as a cask bearing fuel
assemblies.
The other type of camera is the TV camera, which turns on at predetermined
intervals and snaps 8 or so frames.
Generally, the quality of pictures obtained is extremely poor. Further, there
have been numerous failures. There have been significant improvements recently
in reliability, but failures still occur at an alarming rate.
One scenario, which has appeared in several literary sources, is the placement
of a photograph of the viewed scene in front of the camera. This is plausible,
because the illumination level normally changes as lights are turned off and
on, and the frames typically jump around. But there are also more sophisticated
ways to defeat the camera.
A basic difficulty associated with containment and surveillance devices is
that-the device is not under the continuous observation of the inspector, as
would be an alarm system in an industrial setting.
In my experience, another basic difficulty with both film type and TV type
surveillance is that the image is often typically not clear enough to be
meaningful. Typically, many activities occur on the film that are rather
baffling. Also, people stand in front of the camera and barriers are erected
that block the view. The camera may be moved. The lights may go out. And,
often, the camera simply fails. Further, the interval between pictures is
intended to protect against a known scenario, such as a cask movement to
remove fuel, where it is assumed that the Agency really knows how long the
activity will take, so that the movement would be caught on film, whereas it
might not really be known.
SECRET
1-13
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
JLVn'.
6.4 Safeguards at Specific Types of Installations
6.4.1 Reprocessing Plants
During my employment with the IAEA, I inspected at the reprocessing plants of
PNC at Tokai Mura in Japan, GWK (WAK) at Karlsruhe in FRG, and once, COGEMA at
Cap de la Hague in France. The first two facilities were under "continuous"
inspection regimes. The latter facility only stored fuel under safeguards,
but had not reprocessed any of it. Basically, uncertainties associated with
reprocessing plants involve, at best, a several per cent uncertainty of MUF.
At worst, a lot of other possibilities open up, including the possibility that
an installation might reprocess undeclared irradiated fuel, or understate the
plutonium content of the declared fuel. One installation was rumored to have
posessed an undeclared, never used, natural uranium storage pond, for example.
In a reprocessing plant, therefore, one should look for hidden fuel as well as
account for declared fuel-. But the Agency does not attempt to find undeclared
fuel. For example, if a plant operator says that no fuel will be processed
for one month, the Agency will stop sending inspectors for a month.
In the case of understating the plutonium content of the input dissolver
solution, the scenario would entail diverting some of the input dissolver
solution to avoid measuring it in the input accountability tank. At a later
time, the diverted solution would be transferred from its location in, say, a
tank of the rework system, where it had been stored, to the extraction and
purification systems, in order to extract the plutonium, at a time when the
plant was declared "down" and not under inspection. The uranium solution
needed to make up for the diverted uranium contained in the divertered dissolver
solution would be replaced from uranium in storage, since uranium quantities
are known from fuel element manufacturer's data. This type of scenario is
simply not covered by IAEA safeguards. IAEA rather bases its safeguards
primarily on operator's data supplemented by camera surveillance. I know of
no case where recycle acid was verified, for example, or where valves were
sealed to prevent undeclared transfers. Samples are taken of the input and
output solution, but are drawn from sample ports that have not been verified
by design information review, so that one can't be certain where the sample
SECRET
1-14
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
came from. Further, the samples are handled in the plant by the operator and
may be prepared by the operator, before shipment to Vienna. In one case, the
operator and country refused to allow shipment of samples for a year on the
grounds that it was illegal due to the absence of an approved shipping container.
Finally, after the samples had been in the operator's control for a year, the
Agency was asked if they could be discarded, because they had been standing so
long. The Agency agreed.
In addition, because the samples must be diluted before shipment, analytical
accuracies are reduced at Seibersdorf.
In the case of the COGEMA facility, there is no input accountability tank, so
that input accountability will probably have to be based on reactor data.
An independent means of assessing the plutonium content of spent fuel is by
burnup calculations and isotopic correlation techniques. Unfortunately,
burnup calculations,-which require verification of reactor operator's data, is
not even done on an occasional basis by the Agency. Neither are isotopic
correlation techniques applied. The Agency simply takes the word of the
operator as to the plutonium content of the spent fuel and checks that against
what it finds at the reprocessing plant, subject, of course, to the limitations
of that finding.
6.4.2 Research Reactors
In the case of research reactors, as in power reactors, the potential exists
for undeclared breeding of plutonium and/or U-233. In the research reactors
that I inspected, of which there were several, there were no containment or
surveillance measures provided to address these possibilities, nor am I aware
of any measures which would have been effective. Typically, research reactors
are inspected infrequently, perhaps once annually. The Agency's camera surveil-
lance would be unable to distinguish between irradiation of fertile material
samples to produce plutonium or U-233 and irradiation of medical samples, for
example, even if a camera could run unserviced for one year.
SECRET
1-15
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86TOO303ROO0500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
One medical use of research reactors, incidentally, is irradiation of highly
enriched uranium to produce molybdenum-99, which is extracted and decays to
technecium-99. The Tc-99 is used for medical scanning for tumors. After
irradiation, most of the U-235 still remains in the target, which is typically
mixed in concrete, prior to ultimate disposal. The highly enriched uranium
could be extracted, however, as a potentially attractive source of kilogram
quantities of weapons grade material prior to the mixing with concrete. This
extraction would probably not be detected by IAEA safeguards, since an IAEA
inspector may only visit such an installation annually for one day.
6.4.3 Critical Facilities
One critical facility which I visited contained hundreds of kilograms of low
exposure, weapons grade plutonium. A facility of this type is sensitive from
the abrogation scenario standpoint where, under some sort of immediate threat,
the country simply takes-possession of all the nuclear material for immediate
manufacture into nuclear weapons components. About 100 Kg of this material
was under IAEA seal. During biweekly "time detection" inspections, the inspectors
would visually check the type E seals on this material, in spite of the fact
that these seals can be counterfeited, so that only post-mortem examination at
headquarters is meaningful. I once demonstrated to the operator and the
inspection team leader that, due to the absence of some needed holes in the
lid and body of the container, the sealing system was inadequate; the containers
could be opened, the material removed, and the lid replaced simply by removing
two bolts, without disturbing the seal. I also brought up this problem in
Headquarters upon return from mission. However, this situation was not corrected,
possibly because Agency personnel had collaborated with the operator on the
method by which the seal would be applied in the first place and felt partially
obligated to go along with the outcome, when the operator said that the holes
could not be drilled.
The method of safeguarding a major critical facility entails monthly sampling
and remeasurement of unsealed fuel plates. The fuel plates can be remeasured
to within about 3% by NDA. Perhaps 1% of the material could be removed by,
say, drilling or remanufacture of the plates, without detection likely but
SECRET
1-16
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
this type of scenario is considered unlikely. Chemical analysis by the agency
for highly accurate measurement of a suspect fuel plate is not foreseen in the
usual facility attachment.
6.4.4 Power Reactors
Power reactors are of various types, and can be classified according to whether
on- or off-line refueled, types of moderator and coolant, whether natural or
enriched uranium, etc. On-line refueled reactors are considered more sensitive
and safeguarding was primarily by counting all fuel elements and check of
serial numbers against the invoice of unirradiated fuel elements. Identifica-
tion of serial numbers on spent fuel is usually impossible. Although there is
work underway, especially in Canada, to automatically count fuel elements,
this was not done in my experience. Counting of power pulses on a chart was
the means of verifying the number of fuel elements changed in the core in one
instance, but "noise" pulses on the chart made this of dubious value. Camera
surveillance was intended for loadout pond, to detect undeclared loadout of
irradiated fuel by that route.
In the case of off-line refueled reactors, camera surveillance was used in the
spent fuel pond area to detect undeclared loadout and seals were employed on
the reactor head and/or at the entrance gate to the spent fuel pond between
refuelings. Fuel elements were counted and serial numbers on unirradiated
fuel elements were verified at inspections. In both cases, physical inventories
occurred at annual to 18-month intervals. Nondestructive assay verification
was permitted at that time. Inspection frequency ran from 3-month to 6-month
intervals.
Verification of reactor operating history was by reviewing strip charts of
power, steam flow, temperature, or neutron flux. Typically, a maximum of two
charts were permitted to be reviewed. Access to the control room was not
permitted. Rather, the charts would be removed and brought to the inspector
for review in a meeting room.
SECRET
1-17
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 CIA-RDP86T00303R000500700038-1
 - rile r-r
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
The possibility of irradiation of additional fuel contained in normally nonfuel-
bearing structural components of the fuel assemblies was not covered by the
inspection approach of power reactors, although this has been discussed in a
report on technical assistance to the Agency by the U.S. The possibility of
an adaptation to facilitate the irradiation of fertile fuel by other means was
also not covered. For example, there is no close inspection of the reactor
vessel prior to operation or at the time of maintenance to detect a shuttle
system. Burnup calculations to determine the amount of plutonium in spent
fuel were not verified, nor were power monitoring devices verified.
6.4.5 Fuel Fabrication, Conversion, and Unirradiated Scrap Recovery
This part of the fuel cycle centers around the fabrication of fuel for the
various types of reactors and critical assemblies.
In larger facilities, the IAEA makes approximately monthly inspections of one
day duration, performs an annual physical inventory verification of several
days' duration and, where large quantitites of direct use material are present,
more frequent inspections may be made. A basic difficulty that I observed
here are unwillingness to take samples and ship them to the Agency's Seibersdorf
Laboratory, on the grounds of cost or shipping regulations. In one European
installation that I was aware of, the operator wanted $1000 per sample from
the Agency. A problem that I encountered was unwillingness to allow the
Agency to use nondestructive assay equipment that required small radioactive
sources in their operation. The operator claimed that national regulations
did not permit the presence of those particular sealed sources in his plant=,
in spite of the presence of large quantities of plutonium. In that installation,
the operator and State had refused to permit the Agency to apply timely detection
continuous inspection at the facility by virtue of its contention that inspection
was limited by the Blue Book to flow and inventory key measurement points. As
a result, the Agency "punished" the State by reduced inspection to 2- or
3-month intervals. In this case, the State did agree after several years to
the timely detection inspections on a trial, informal basis to parts of the
facility. But, without full cooperation and a serious investment in computer
hardware and extensive accurate measurements, which I have yet to see, timely
detection is of limited value.
SECRET
1-18
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 UPMH
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
The Agency's approach to verification is based upon a report, BNWL-1852,
"Example of Verification and Acceptance of Operator Data - Low Enriched Uranium
Fabrication Plant," Battelle Pacific Northwest Laboratory, Richland, Washington,
August 1974. This report provides the framework for the concept of verification
of strata of flows into and out of the plant, as well as in beginning and
ending physical inventories. A material balance for a period of time is
formed by the plant operator from the following components on the right side
of the equation:
MUF = BI + A - R - SR = EI
Where = MUF = material unaccounted for
BI = beginning physical inventory
A = additions to inventory
R = removals from inventory
SR = shipper-receiver difference
EI ending physical inventory
If everything could be measured perfectly and there were no mistakes or
unaccounted for losses or diversion, MUF would come out equal to zero for a
material balance period. But due to normally occurring errors of measurement,
MUF ids typically not zero, but indicates apparent "loss" or "gain." The idea
is to determine whether the MUF is only due to measurement error or also due
to unaccounted for loss, diversion, or a mistake.
Normally, the components of the material balance will be composed of severa-l
strata each. For example, BI may be composed of good substrate material, the
product material which is manufactured from the substrate, scrap, and waste.
The Agency, ideally, verifies each stratum of each component of the material
balance. In reality, it seldom is able to verify each component. In any
case, it attempts to detect a diversion of a significant quantity of nuclear
material by verifying a sufficient number of items in each stratum to provide
a desired power of detection, (1-B), of the loss of a significant quantity
with a tolerable false alarm rate, a. A theorem is derived which addresses
the problem of whether the diversion of a significant quantity, if "partitioned
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
across" (took place in) more than one stratum, would be detected with adequate
power. The theorem shows that, if diversion were partitioned across more than
one stratum, the power of detection would be as great as or greater, by virtue
of a defect being found in at least one stratum, than if the diversion of the
significant quantity had occurred all in one stratum.
The falacy inherent in this approach is that there will often be at least one
defect due to a mistake. Thus, if any mistake is found, the Agency must alarm
to the hypothesis of diversion by partitioning. And there are often false
alarms (mistakes). This is even more serious when one considers that the
country is the adversary, so that partitioning across all installations in a
country must be assumed if any alarm occurs. Since it is patently not feasible
to alarm to the possibility of diversion by partitioning across the State when-
ever a mistake is found, the conclusion that one reaches is that the Agency is
incapable of detecting the diversion of a significant quantity or of several
significant quantities, by partitioning, in any State with a moderate to large
nuclear energy establishment.
7.0 What Materials This Report Has Concerned
IAEA safeguards are aimed at the control of certain direct-use materials,
namely: high enriched uranium, U-233, and plutonium; and certain indirect-use
materials, namely: low enriched, natural, and depleted uranium and thorium
which can be converted to direct-use materials. IAEA safeguards do not control
uranium ore, neptunium, and a number of other materials which are controlled
in the United States by DOE and/or the NRC. Uranium ore, for example, can be
converted rather simply to uranium in a form that is an indirect-use material.
Absence of its control is probably one of the glaring weaknesses of international
safeguards today.
A large LWR produces roughly 15 Kg of neptunium-237 per year, according to the
NASAP study. The unmoderated, spherical, critical mass of neptunium-237 is
roughly 60 Kg. Its control will probably be required in the future.
SECRET
1-20
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
8.0 Summary
In this report, I have attempted to describe how IAEA safeguards work and some
of their weaknesses. I have not addressed all issues; there are many which are
presently the subject of R&D efforts by several countries, for example. But I
hope that I have identified some of them. I think that it is clear at this
point that there are not many simple solutions and that a great deal of effort
and commitment of all parties will be required to address these issues.
SECRET
1-21
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
ENCLOSURE 2
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
JbvfI. _ _.
This document consists oL 18 pages
ENTIRE TEXT NoLofopies, SeriesjZ
STAFF COMMENTARY ON MORGAN REPORT
Executive Summary
At the request of Commissioner Gilinsky, E. R. Morgan wrote a report based on
his experience as an IAEA inspector between the summers of 1977 and 1980. The
purpose of his report was to provide insight into IAEA safeguards. In particular,
he addressed the technical capability of the IAEA to safeguard nuclear material.
In his report, Morgan highlights a number of problem areas in the implementation
of IAEA safeguards:
--Inadequate verification of facility design information
--Negotiated limitations on inspection effort in facility attachments (as well
as shortage of available inspectors)
--Differences in quality of accounting records as well as operating records
--Inadequate use of accounting reports sent to the IAEA
--Incomplete MUF analysis by the IAEA
--Deficiencies in containment and surveillance equipment
--Lack of cooperation by facility operators and States in implementing IAEA
safeguards
--Deficiencies in IAEA safeguards approaches for particular types of facilities
(especially reprocessing plants, research reactors, and fuel fabrication/
conversion plants)
--Limitations on IAEA control of certain types of nuclear material (i.e., uranium
ore, neptunium, and waste material)
--Waste removal as a credible diversion path
--Lack of language training for field activities
As indicated in the staff's review of the annual IAEA Safeguards Implementation
Report (SIR) and in other reports prepared for the Commission, the NRC is already
generally aware of the IAEA safeguards implementation problems the report
discusses. Although Morgan has provided additional specificity, he does not
identify any additional significant problem areas. As indicated in the SIRs
and the staff's comments on the SIRs and on Morgan's report, some of these
problems seriously impact the IAEA's ability to effectively implement IAEA
safeguards. While we know that some of the particular problems still exist,_we
do not have sufficient information to enable us to confirm whether all the
identified specific problems continue to exist.
Memo from Shea to Dircks
Classified By A1 d 8/381
0 Declassify _ Q /-A /2ff1
^
Review
Derivative Classifier:
A RDS-3
b
RATIONAL SECURITY INFORMATION
Unauthorized disclosure subject to
SECRET
y_._------
Extende
Reason for Extension For i an -
Ad, Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
JtLAC1
Staff has no comments.
2. Organization of IAEA
The report mentions a particular case where an IAEA staff member was responsible
for clearing on an inspection report pertaining to his own country. Staff under-
stands that the IAEA tries to keep an individual's responsibility for his own country
to a minimum, e.g., inspectors are not permitted to do inspections in their own
country (coincidentally, this is not the practice by EURATOM). On occasion, an
individual may necessarily undertake certain responsibilities or require access to
certain information related to his own country. This is handled on a "need-to-know"
basis.
The report also notes that the IAEA does not provide language training to
inspectors although there have been poor communications in the field as a result of
language difficulties. Staff understands that the IAEA practice is to hold
individual staff members responsible for being proficient in at least one of the
four official languages of the IAEA. Member States may carry out business in one
of these languages. For other languages a translator may be used. Staff is unaware
of the degree to which problems have been caused by language differences. To the
knowledge of the staff, the IAEA does not formally provide language training to
inspectors.
3. Missions to the Agency
Staff has no comments.
4. Subsidiary Arrangements
4.1 Design Information
The first step in the application of IAEA safeguards to a facility is the
completion, by the facility operator or the State, of a Design Information
Questionnaire (DIQ). This information is to include (a) identification of the
facility, (b) a'description of the general arrangement of the facility, including
the form, location, and flow of nuclear materials, (c) a description of facility
features relating to material accountancy, containment and surveillance, (d) a
description of the existing and proposed procedures for nuclear material accountancy
and control, and (e) other information relevant to the application of safeguards, in
particular organizational responsibility for material accountancy and control
(IUFCIRC/153, paragraphs 43 and 44). The IAEA reviews this design information in
c (RFT
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
' 1CV1~4~
order to develop the facility attachment and safeguards approach. In addition, the
IAEA has the right, established in each safeguards agreement, to physically examine
the facility and process equipment to verify that the design information provided
is accurate and complete.
In his report, Morgan states that "[i]n my experience, the headquarters review
of the DI (design information) and its field verification has [sic] been inadequate."
In this regard he cites the following:
1) because the General Part of the Subsidiary Arrangements may permit the DIQ
to be provided only three weeks before the facility receives nuclear material, "a
review* of the DI may not be possible and may not be permitted;"
2) Morgan is "not aware of DI review* of any reprocessing plant;"
3) "many tank calibrations in a reprocessing plant can be performed only before
an area becomes contaminated," and verification of the tank calibration "is only
rarely carried out by the IAEA;"
4) at facilities involving sensitive information (e.g., reprocessing and enrich-
ment plants) "DI review* is typically not permitted, although newsmen may be given
tours;" and
5) the design information provided for the WAK reprocessing plant (FRG) "is
scant and probably inadequate."
With regard to the first point, design verification can only be accomplished
after the IAEA has reviewed the DIQ and had an opportunity to become familiar with
particulars of the facility design. For any bulk handling plant, the review alone
is a substantial undertaking. To the extent that the Subsidiary Arrangements-
General Part requira the State to provide design information only three weeks before
the facility receives nuclear material, the IAEA might be precluded from properly
verifying the design information. The staff does not have any information as to the
provisions ofmost NPT parties' Subsidiary Arrangements regarding when design
information must-'be provided. While the staff does not have access to most of these
documents, and does not know about the degree of compliance with the requirements
they establish, in the two cases where we do know the time limits established, they
are longer. The NPT Subsidiary Arrangements-General Part for the Safeguards Agree-
ment between the IAEA, EURATOM, and the non-nuclear weapons states members of
EURATOM require design information to be provided,"no later than 30 days before
the facility is scheduled to go into operation." The "model" Subsidiary Arrangements
for the IAEA's Project Accounting Comparability Exercise (PACE)** provides that
design information for new facilities is to be provided "[n]ormally not later than
180 days before the facility is scheduled to receive for the first time nuclear
material or safeguarded items."
*In this section the report uses the term "review" when "verification" is apparently
intended.
**PACE is a project to develop Subsidiary Arrangements based on INFCIRC/66-ty0e
safeguards agreements which will provide for full-scope safeguards comparable to
NPT-type safeguards; Taiwan is currently the only country with PACE type
Subsidiary Arrangements in force.
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
3MM
With regard to the report's second point, the IAEA routinely reviews design
information for completeness at headquarters before inspectors go into the field
to verify it. We understand this practice was followed for the four reprocessing
plants in EURATOM?and Japan, except for certain sensitive design information for
WAK which was reviewed on site.
With respect to the third point, staff notes that tank calibrations can be
accurately performed even when the tank has been contaminated. For example, at-.-the
Tokai-Mara reprocessing plant, tank calibration has been performed several times,
including just recently.
As to the fourth point;-that design verification typically is not permitted at
facilities involving sensitive information, although we know that there have been
such problems in the past, the staff has no information as to whether this is a
current problem. However, there remains the question of whether IAEA inspectors
should be permitted access to the cascade hall of gas centrifuge enrichment plants
in view of the sensitive information which is visually ascertainable. Both Japan
and the Urenco partners (which operate the only gas centrifuge enrichment plants
currently subject to safeguards) have indicated their desire to establish, con-
sistent with the terms of their safeguards agreements (see INFCIRC/153, paragraph
45(b)(iv)), "a special material balance area around a process step involving
commercially sensitive information." The U.S. has taken the same position regarding
the Portsmouth, Ohio gas centrifuge enrichment plant (which, when it is completed,
will be eligible for safeguards under the US/IAEA Safeguards Agreement). Establish-
ing such a special material balance area would require that the IAEA agree that its
inspectors be denied access to that special material balance area (the cascade
hall). There is currently an on-going informal Hexapartite group examing the whole
question of how to safeguard gas centrifuge enrichment plants. It consists of the
Urenco partners (the U.K., the Netherlands, and the Federal Republic of Germany),
Japan, the U.S., and Australia. The safeguards inspectorates of EURATOM and the
IAEA participate as observers.
With regard to the fifth point, that the design information for the WAK
reprocessing plant in the FRG "is scant and probably inadequate," we would only
note that this plant was one of the first reprocessing plants for which the -IAEA
received design information. (Its Facility Attachment entered into force June 1,
1978.) By today's standards, the design information provided to the IAEA might be
considered by some to be inadequate. We are not aware of specific problems regarding
the completeness of design information for other reprocessing plants.
4.2 Facility Attachments
The facility attachment is the document ("attachment" to the Subsidiary
Arrangements - General Part) which establishes the rights and obligations of the
IAEA and the operator with respect to the application of IAEA safeguards to that
facility. Each facility attachment is negotiated between the IAEA and the State
(often with the facility operator's participation). Although the IAEA uses its
most recent "model" facility attachment for each type of facility, there are
CrrDCT
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
variations among facility attachments due primarily to changes in the "model"
facility attachment and safeguards technology over time, the inclination and
ability of the State and operator to extract concessions from the IAEA during
negotiations, and differences in facility design and duration.
The report notes that facility attachments for some facilities have been pending
for substantial periods of time (years in some important cases) because the State
(and the operator) do not agree to provisions which the IAEA considers important
or necessary. This is principally the case with gas centrifuge enrichment plants
(as discussed above) and several unique facilities in the FRG. INFCIRC/153 estab-
lishes more extensive (and intrusive) safeguards rights before the facility attach-
ment is in force ("ad hoc" inspections) than for the.''routine"-inspections conducted
under the terms of a facility attachment. However, the IAEA generally has not been
inclined to exercise these more extensive inspection rights fully, and in particular
not to do so as a means of pressuring the State to agree to a facility attachment.
As the report notes, the facility attachment specifies the "actual routine
inspection effort" (ARIE) by the IAEA, which "may leave no time to resolve discrepan-
cies or complete tasks that took longer than anticipated." The ARIE, to our knowledge,
always has been less than the "maximum routine inspection effort" (MRIE) provided for
in INFCIRC/153 type agreements. The subject of IAEA inspection effort levels and
inspection frequency will be discussed in a separate paper currently being prepared
in response to Commission Gilinsky's request during the June 17 Commission meeting
on SECY-81-170.
. In this section, Morgan also observes that IAEA inspectors usually must conduct
a physical inventory verification without a "tag list" or comparable list of the
materials and items in the facility, including weights, quantities, and locations.
When the IAEA conducts an inspection for purposes of physical inventory veri_fi.cation:;-::?
it may be done either simultaneously with the operator's. Dhysical inventory taking or
afterwards. In either case, the IAEA needs a "list of inventory items" (LII),
variously referred to as a "tag list" or "pre-physical inventory list", for purposes
of planning the inspection and for facilitating the inspection when it is carried
out, especially for bulk handling facilities, where the inventory may be large and
complex.
Since safeguards agreements do not explicitly require this .type.of,)reporti'ng, the
vast majority of facilities do not provide an LII to the IAEA. In certain specific
cases (e.g. all LWRs in EURATOM.), the IAEA has achieved stipulation in the facility
Attachments that an LII be prepared in advance of the physical inventory taking (but
not necessarily provided for the IAEA before its physical inventory verification).
Therefore, the inspection activities are planned after the inspectors''. arrive on site
and receive an LII or enough information to serve the purpose of an LII. However,
even in the cases where an LII is provided to the IAEA, the type and amount of
information (batch data, including weights, isotopic compositions, etc.) are not
specified. Consequently, the data may be incomplete and of limited use; or if
comprehensive raw data are provided, a computer may be necessary for the IAEA to
derive the specific information (e.g. stratification) necessary for the inspection.
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 I
..V- nnPT
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
Morgan also cites as a shortcoming, that Facility Attachments usually include a
clause such as, "inspection shall be by observation of the State authority's
inspection only, unless observation is inadequate to permit the drawing of indepen-
dent conclusions." This phrase reflects the desire of EURATOM and Japan that the
IAEA take account of their strong state systems of accounting and control in its
verification activities. In the case of the multi-national EURATOM system, this
approach is implemented through "joint-team" concept.
The "joint-team" approach developed followinq an expression of concern. by EURATOM
member-states that IAEA safeguards would duplicate EURATOM safeguards and ultimately
undermine the necessity and importance of EURATOM safeguards. The safeguards
approach which ultimately developed recognized the fact that EURATOM has an extensive
system for nuclear material accounting and control and that the IAEA should "take
due account of the technical effectiveness of the State's system." Japan utilized
a "most favored nation" approach to achieve the inclusion of similar provisions in
its facility attachments. It can be seen how negotiation of responsibilities for
certain inspection activities by a joint-team might lead to "haggling and loss of
precious time." However, the Agency recognized the value of a strong State System
of Accounting and Control when developing the IAEA's safeguards approach and is
obligated under NPT Agreements(cf. INFCIRC/153, paragraphs-7,31, and 81) to take
such systems into account.: Without more specific information the staff is not
able to assess the degree to which this affects the IAEA's ability to reach
independent conclusions.
4.3 Subsidiary Arrangements - General Part
In NPT-type safeguards, the Subsidiary Arrangements - General Part specifies
those details of safeguards which apply to the State (such as the form and structure
of reports to the IAEA) and those practices and procedures which apply to all
facilities and installations in the State. In this section the report.describes the
accounting and inspection practices for the waste materials produced at bulk handling
plants, which may be handled either as "measured discards" or as "retained waste",
and expresses concern about the lack of verification by the IAEA of these waste
materials.
Each facility that handles nuclear material in bulk form (as opposed to item
forms, e.g., fuel assemblies) is permitted to discard up to a specified quantity.
of nuclear material each month as measured discards without consulting the IAEA.
(The precise limit is prescribed for each facility in its facility attachment.)
Measured discards are nuclear material contained in waste products which result from
facility operations and which are not, in practice (which usually is to say, not
economically), recoverable. The IAEA has the right to verify measured discards, but,.
as Morgan notes, it rarely does so, apparently due to lack of resources. In the FRG,
all measured discards are transferred to one of two central waste handling facilities
where the materials are held pending ultimate disposal. Contrary to Morgan's state-
ment, the IAEA has the legal right to apply safeguards to both these facilities, but
it is the staff's understanding that, lacking a safeguards approach for such facilities
and apparently deeming them to be of secondary concern (see INFCIRC/153, paragraph
6(c)),facility attachments have not been negotiated for these facilities and the IAEA
has not conducted any inspections of them.
SECRET .
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22: CIA-RDP86T00303R000500700038-1
i vim....--? -
"Retained waste" consists of the same sort of materials as go into measured
discards, but are retained on-site instead of being discarded. Retained wastes
are removed from the reported inventory after notification to the IAEA. As with
measured discards, retained wastes are subject to inspection at the time they, are
declared to be waste. The IAEA may verify retained wastes at a future date only
if the retained waste is returned (by a paper "inventory change") to the reported
inventory.
5. Records and Reports
In this section the report describes some of the differences among facilities
and States in the quality of record-keeping and reporting systems. The comment.-about
one facility which maintained its materials accounts as some 300 separate financial
accounts provides an example of where a good SSAC could facilitate IAEA verification
activities, and how a poorly organized set of records can complicate audit functions.
It must be noted that the SIR has not identified significant concerns about record-
keeping. In this connection, however, the Secretariat has recently published
(December 1980) recommended "Guidelines for States' `Systems of Accounting for and
Control of NucleartHaterials" prescribing the organization and functions of an SSAC
with respect to obligations arising from a safeguards agreement with the IAEA.
Morgan also describes the IAEA's problems with "running the transit accounts",
or tracking transfers of nuclear material from country to country on the basis of
the reports provided by each country.. Problems with the quality and timeliness of
reporting by many states of their imports and exports have been described in several
SIRs. In addition to serious deficiencies in the . reporting.. of many States, it is
the staff's impression that some of the problem is due to the IAEA's own procedures
for processing such information.
6. Inspections
.
6.1 How NRC [sic]*** Safeguards Generally
Staff has no comment
6.2 [Material Accountan
In this section Morgan observes that much of the IAEA material accountancy consists
of verifying the arithmetical correctness of the operator's records and verifying the.
"authenticity" of the records on the basis of other documentation provided by the
operator. An inspector performs two basic functions, auditing the operator's records,
and obtaining independent measurements to verify the types and quantities of nuclear
material actually present in the facility. The latter activity includes calibrating
***C ear y,IIIAEA"was intended.
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
JtVKt I -
the operator's scales and other measurement equipment which the IAEA uses, making
independent measurements on-site with IAEA instruments and standards, and obtaining
samples of material for laboratory analysis. Although the intent of the first
several paragraphs in this section of the report is not entirely clear, it may be
to call attention to the IAEA placing a large degree of emphasis on auditing records
relative to that placed on independent measurement of nuclear material. Staff
reviews of the annual SIR and its Technical Annex make clear that the IAEA conducts
only partial verification of nuclear material, as a result of limited resources
and capabilities.(Section 6.4.1, on reprocessing plants, returns to this thesis that
IAEA safeguards are too dependent on data provided by the operator and not
sufficiently based on independent verification by the inspector.)
Morgan's statements that the Agency typically does not calculate either the D
statistic (which is the MUF predicted by the comparison of the operator's reported
data with the inspector's measurement data) or the limit of error on MUF (which
provides the statistical, and only, basis for determining the probability that the
operator's MUF represents routine measurement errors and minor operating losses, as
opposed to potential diversion) are consistent with SIR information and the staff's
understanding of actual IAEA practices in many, or possibly most, instances. Staff
notes that the ability of the IAEA to effectively apply the D statistics is hindered
by the lack of measured material balances at bulk handling facilities as well as the
failure to conduct physical inventories at the frequencies specified in the facility
attachments. Regarding the statement that "the Agency just does not have the manpower
to do much verification and often does not have time to take as many samples, even
with-a willing operator, as it believes necessary, of even the ending inventory
component," see also our comments on Section 6.4.5.__
6.3 Containment and Su rvei 11 ance Measures
Containment and "surveillance measures are used by the IAEA to maintain continuity
of knowledge over nuclear material in discrete item forms (such as canisters or fuel
rods) in order to preserve the integrity of prior measurements, and to monitor
facility equipment to preclude or detect undeclared flows of nuclear material..
Containment measures essentially consist of seals, and surveillance consists-of either
film or television cameras with recorders.
Seals
As the report notes, the IAEA relies primarily on the IRS E-type seal (as do NRC
and EURATOM). In his comments, Morgan states that "as early as about 10 years ago,
efforts were underway by at least one foreign government to'break it'(the E-type seal)."
The Brookhaven National Laboratory did a study in the late 1960's for the LAEA on the
tamper-resistance of this seal, and recommended changes in the procedures for its
application and verification. Following this the IAEA modified the seal to make it
more tamper-indicating. The staff is not aware of any attempts by other countries to
develop procedures to subvert this seal (although possibly EURATOM might have given
some thought to potential weaknesses of this seal as part of its independent work on
the use of seals in safeguards). We are checking this point with the Executive Branch.
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
JCI,R[ ~
The report also mentions the problems with verifying E-type seals, stating that
"post-mortem examination is not necessarily capable of determining whether the seal
was surreptitiously opened and then reassembled." This statement is supported by
the following description of these seals, contained in a 1979 IAEA report entitled
"A Review of Security Seals and Sealing Systems":
[The E-type seal] has most of the attributes required of a seal
except for some of major importance. The first is that because
it is a standard type of seal used all over the world it could
be readily replaced by another identical seal. Although it can
have specific internal markings, these are not unique and could
be reproduced on a substitute seal. The second major disadvan-
tage is that the seal identity must be determined by removing
the seal and returning it to Headquarters for examination. This
process can take anywhere from weeks to months. Another dis-
advantage is that tamper resistance of the seal itself is
questionable.
In addition to the E-type seal, the IAEA uses paper seals. These seals are used
when, for example, during the course of a physical inventory verification, the
inspector wishes to seal something for a short period of time (hours to several
days). The IAEA staff report referred to above provides the following evaluation of
paper seals:
This seal is considered to have limited tamper resistance but is
considered acceptable for short time use when it would be difficult
to replace or successfully remove it in the time available. Its
cost is very low and it is very easy to carry and store.
The paper seal has many advantages for sealing containers, rooms,
or items which can be sealed by a strip across a joint. Aside
from its limited tamper resistance one disadvantage is its
difficult handling, particularly with gloves. The protective
sheet is difficult to remove and the seal tends to tear easily
when being installed (this is one of the tamper resistant
features). It is also felt that because it is easily damaged
it could suffer inadvertent damage due to normal handling.
The IAEA, the U.S. and several other countries have research and development
programs to produce more secure seals. To date, these programs have produced seals
which are significantly more reliably tamper-indicating but which are also sub-
stantially more expensive and, for some systems, much more cumbersome to use. None
of these seals has yet reached the commercial production stage.
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
-10-
Finally, Morgan states that "a second basic shortcoming of the use of seals is
that the item sealed can often be accessed by bypassing the seal." (In another
section of his paper Morgan describes an instance where seals were applied to a
container in such a way that the container could be opened without breaking the
seal.) If applied properly, seals cannot be bypassed without clear evidence of the
attempt unless extraordinary measures are undertaken. Obviously mistakes in seals
application are made from time to time.
Cameras
With respect to surveillance, the report notes a number of problems with the
effectiveness of both film camera units ( which normally consist of two commercial
8-millimeter film cameras for redundancy, sealed in a common housing) and television
camera units (which consist of a television camera and a magnetic tape recorder
similar to commercial home units). The problems Morgan identifies with cameras can
be summarized as:
- picture quality is often quite poor,
- failures are frequent,
- there are various ways to defeat cameras,
- the units are "not under the continuous observation of the inspector,"
cameras may be moved,
cameras are sometimes blocked,,
- in many cases the IAEA does not actually know how long the illicit activities
to be detected would actually take (hence the chosen picture frequency may be
wrong).
As both the staff and the Commission are aware, the reliability of the camera
systems have improved significantly, "but failures still occur at an alarming rate,"
as the report notes. The SIR for 1980 states that the failure rate for film
cameras during 1980 was 12% (compared to 10% in 1979.) Cable Vienna 04686 of May 21
(Secret Exdis) for the IAEA states that for cameras tested before re-installation
at LWRs in EURATOM, the failure rate is 30% during the testing.
The picture quality of both types of cameras remains another serious concern.
Film cameras are very sensitive to fluctuations in light levels, such as will* occur
whenever working lights are installed or moved. Television cameras can be blinded
by working lights being directed (inadvertently or otherwise) at the camera. We
understand that on a number of occasions there have been problems with film being
fogged by radiation. In addition, as Morgan notes and as Roger Richter pointed
out in his Senate testimony, in some situations it may be difficult or impossible
to interpret the actions recorded on the film (remembering that the camera takes
pictures at intervals, one is not watching a continuous sequence). The camera's
field of view may also be blocked or partially blocked by activities it is meant
to record, or by activities that are not clear from the film.
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 lr~wwl+`M
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
The staff is not aware of any cases in which IAEA cameras have been moved by
an operator. Any such movement would be highly unusual, and would require some
justification based on the safe operation of the facility.
There are certainly methods to subvert or fool cameras, including the popular
scenario of placing a large photograph of the camera's routine field of view
before the lens. As the report explains, each camera takes a picture at intervals.
It is the staff's understanding that, while the average interval between pictures
will be adjusted according to where the camera is installed, the actual interval
between any two pictures is randomly determined by the timer. Thus, while the
operator may know that the camera unit takes an average of one picture every 10
minutes, or whatever, he cannot be sure when the next picture will be taken even
if he has detected when the last one was taken.
The fact that IAEA cameras are timed to take pictures at random intervals
would seem to respond to some degree to Morgan's concern that the IAEA ,might not
really know how long a particular illicit activity (such as loading spent fuel
into a cask) might take. Clearly, the time normally required to perform a given
task will be longer, in,some cases much longer, when performed for legitimate
purposes than when the risk of detection must be minimized, and thus health and safety
procedures are omitted. However, these times can be reasonably estimated in most
cases, and the necessary number of repetitions to divert a significant quantity****
of SNM would run a high probability of being detected by randomly and frequently
tripped cameras.
The report states that "[a] basic difficulty with containment and surveillance
devices is that the device is not under.the continuous observation of the inspector."
The purpose of containment and surveillance devices is to provide some assurance
as to the continued status of materials or equipment in the absence of inspectors.
Although camera units are sealed to detect tampering,this detection is not immediate,
but only after the seal is removed during a subsequent inspection and then examined
at headquarters.
6.4 Safeguards at Specific Types of Installations
6.4.1 Reprocessing Plants
In this section the report makes the following observations about the application
of safeguards at reprocessing plants:
****As deffned by the IAEA, a significant quantity (or SQ) is 8 kilograms of plutonium
(total element) or uranium-233 (total isotope), or 25 kilograms of U-235 contained in
uranium enriched to 20% or more.
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 wr 'flr1r
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
- 12 -
1) Uncertainties of MUF are, at best, only several percent;
2) Undeclared irradiated fuel might be processed without IAEA detection;
3) The plutonium content-of declared fuel may be understated;
4) Sample verification is inadequate; and
5) Independent assessment of plutonium content of spent fuel is not performed.
The operators' measurement uncertainties at reprocessing plants are a concern
because they may be large. However, a number of studies have indicated that per-
formance should be better than "several percent" at commercial reprocessing plants.
Staff notes that Morgan made his observations on the basis of a small commercial
plant (WAK) and values obtained during the startup operations at Tokai-Mura, both
characterized by small throughput where relative values of MUF in terms of "percent"
tend to be sizable. Nevertheless, staff believes that measurement uncertainties
will be a continuing problem at reprocessing plants.
With respect to the second observation, about the possibility of processing
undeclared fuel, staff agrees that any safeguards approach should include provisions
for detecting such activities. The presence of undeclared fuel is less likely to
occur in NPT-countries where the IAEA is charged with the responsibility of applying
safeguards to all nuclear material in peaceful nuclear activities than in a country such
as India, where only part of the nuclear material processed at a reprocessinq plant'
is actually subject to IAEA accounting and surveillance; undeclared material is
processed outside of IAEA safeguards. In its safeguards approach, the IAEA does
include measures to detect the misuse of facilities and equipment. In recent years,
the IAEA's overall safeguards conclusions in annual reports have included statements
with regard to the misuse of facilities or equipment, "under certain agreements,"
i.e. non-NPT type, as well as diversion of declared nuclear material. Staff agrees
with the report's conclusion that "one should look for hidden (undeclared) fuel as
well as account for declared fuel" at reprocessing plants. However, there are some
limitations deriving from the IAEA Statute with regard to the scope of IAEA activities
in this area.
In regard to the third observation, scenarios for understating the plutonium
content of the input dissolver solution are generally recognized by the IAEA. In
its safeguards approach, the IAEA considers such diversion concerns as liquid
bypassing the accountability tank, unrecorded transfers from the accountability
tank and incorrect statements of recycle acid containing undeclared uranium and/or
plutonium (cf. "INFCE The Present Status of IAEA Safeguards on Nuclear Fuel
Cycle Facilities", INFCE/SEC/11). It is our understanding that safeguards approaches
for reprocessing plants do include consideration of scenarios which would lead to
understatement of values for input dissolver solution.
With regard to the fourth observation, the report identifies deficiencies in
verification of input and output solutions, and of recycled acid. The general
problem of verifying design information was discussed in the commentary on Section
4.1. As a general practice, the IAEA must rely on the operator for taking and
preparing samples for shipment, usually under the observation of an inspector.
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
- 13 -
The staff has been aware for some time of the problems cited by Morgan regarding
the shipment of samples to the Safeguards Analytical Laboratory (SAL) in Vienna.
The staff provided its analysis of the sample shipment problems which the IAEA was
experiencing in a March 30, 1980 memorandum (SUBJECT: RESPONSE TO COMMISSION
QUESTIONS IN CONNECTION WITH LIBRARY OF CONGRESS REPORT OF S. NAKICENOVIC) to
Commissioners Gilinsky and Bradford. In that memorandum, the staff noted that
restrictions on the air transport of plutonium and the lack of an appropriate
shipping container ;-were responsible for such sample shipment problems. Efforts
to alleviate these problems through the dilution of samples and other more advanced
approaches were also noted.
Shipment of samples from facilities subject to safeguards continues to be a
generic problem affecting the implementation of safeguards. The 1980 SIR states
that "the arrival of inspection samples at SAL during 1980 was subject to serious
delays, with the situation deteriorating once again." The most seriously affected
were plutonium bearing samples. Regulatory constraints, the availability of suitable
shipping containers, export licensing, and questions relating to payment for
sampled materials are cited as the limiting factors. The 1980 SIR also notes
efforts by the IAEA and Member States to mitigate these problems through the
development of analytical'techniques which use micro-samples, consultations regarding
regulatory and financial questions, the development of a lightweight air transport-
able container, and the development of non-destructive assay techniques which would
enable inspectors to perform preliminary measurements at the facility.
Staff also has been aware of at least some of the occasions where Agency samples
have been discarded after extended holding periods. The decisions of the Agency in
such situations to agree to discarding samples appear to be reasonable because the
shelf-life of samples is often far less than a year. This is especially true in the
case of plutonium. Of course, these situations are undesirable in that serious gaps
in verification are incurred.
The final observation from this section of the report is related to assessment
of plutonium generation in irradiated fuel and involves consideration of a number
of coupled technical issues. The IAEA has under investigation a number of methods
to verify plutonium generation and content of irradiated fuel, including burnup
calculation and isotope correlation techniques. All of these are subject to
considerable measurement uncertainty. The staff is not aware of the degree to which
any of these techniques are applied to verify the content of irradiated fuel. Some
form of independent verification is needed for safeguards purposes.
6.4.2 Research Reactors
In this section Morgan states that, in the research reactors he inspected,
there were no containment or surveillance measures provided to address the possible
undeclared breeding of plutonium or uranium-233. We are aware that the safeguards
approach for research reactors, except for a few large reactors, does not normally
include camera surveillance measures, although seals may be used more routinely.
SECRET.
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 i
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
- 14 -
This lack of widespread use of surveillance cameras reflects the IAEA's main
inspection goal at research reactors. As stated in the SIR for 1980, the main
inspection goal is "to detect the absence of fuel items (assemblies, rods, bundles,
plates, pins, etc.) containing one or more [significant quantities] of safeguarded
nuclear material within the timeliness guidelines." The safeguards approach which
has been developed to achieve this inspection goal places emphasis on those facilities
possessing one significant quantity or more of nuclear material. It is at some of
these facilities (but apparently not all) that the IAEA installs surveillance cameras.
The decision to install cameras is highly facility specific and depends on such
factors as the amount of material present, the purpose of the facility, and such
core parameters as the power and neutron flux level.
In a June 18, 1981 report by Warren Donnelly of the Congressional Research
Service, the Iraqi Tamuz-1 research reactor, with a design power level of 40 megawatts
(thermal), was estimated to be capable of producing no more than one kilogram;, of
plutonium per year at normal levels of operation. Donnelly estimated a likely pro-
duction rate of 6 to 10 kilograms of plutonium (approximately one significant quantity)
per year if the reactor were operated solely to produce plutonium. Operation in
this manner would require much more frequent refueling than would normal operation.
Assuming that these estimated production rates are accurate (the Executive Branch
has stated that Donnelly's estimates coincide with its own), one can see that the
clandestine production of significant quantities of plutonium in research reactors
with power levels less than 40 MW (th) would be exceedingly difficult, if not
impossible in the majority of research reactors which are less than 1 MW (th). The
importance of this point can be demonstrated by a brief survey of the rated power
capacities of research reactors and critical assemblies under IAEA safeguards.
The IAEA Annual Report for 1980 indicates that 175 research reactors and critical
assemblies were under IAEA safeguards or contained safeguarded nuclear material.
Only twelve of the 175 facilities have power levels of 40 MW (th) or more, of the
163 with rated power levels of less than 40 MW (th), 107 are rated at less than 1 MW
(th) and another 48 are rated at between 1 and 10 MW (th). The vast majority of
research reactors do not have power levels sufficient to breed anything close to a
significant quantity of plutonium per year. For this reason, as well as the diffi-
culties of interpreting pictures of research activities at such reactors, the_IAEA
places little emphasis on the use of cameras to detect clandestine plutonium produc-
tion at these reactors.
6.4.3 Critical Assemblies
This section of the report observes that a critical facility, containing hundreds
of kilograms of low exposure weapons grade plutonium "is sensitive from the
abrogation scenario standpoint where, under some sort of immediate threat, the country
simply takes possession of all the nuclear material for immediate manufacture into
nuclear weapons components." This particular scenario has long been recognized.
More generally, there are several scenarios, the realization of which could result in
the termination of safeguards on sensitive materials in many countries. For example,
an NPT party may renounce the treaty, giving the required 90 days notice and statement
of reason.
SECRET_
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 nrnnr~
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
- 15 -
Morgan's scenario regarding the "drilling or remanufacture" of critical facility
fuel plates in order to divert a small percentage of the plutonium or HEU are, to a
degree, credible. Non-destructive assay (NDA) equipment, including that used by the
IAEA, is not 100% accurate. However, while the resultant margin of error could
theoretically be utilized to conceal a diversion of material, such a scenario ignores
the fact that if a significant number of the plates which the IAEA measured contained
just 99% of the declared quantity of material, there would be a systematic negative
bias in the data, easily detected as a difference in the mean of the measurements from
the declared quantities. Even so, a State willing to undertake this tedious task
and maintain the quality control necessary to ensure that the optimal amount of
material (and certainly no more) is removed from each plate might escape detection.
However, at the largest critical assembly in a non-nuclear weapons state, this scenario
would net the diverter no more than 3.3 kilograms of plutonium and 5.8 kilograms of
HEU (these being 1% of the total inventory), substantially less than one significant
quantity of either material. For this reason, and given that the countries with
large critical assemblies also have pilot enrichment and reprocessing capabilities,
the staff does not consider this to be a realistic scenario.
With regard to the reports observations on seals in this section, see the staff'.s
comments on section 6.3.
6.4.4 Power Reactors
For safeguards purposes, there are two basic types of nuclear power reactors,
those frequently refuelled (a number of times a week) while the reactor continues
to operate, and those which are refuelled very infrequently when the reactor is
off-line. On-line refuelled reactors are generally heavy water reactors (principally
CANDUs), and off-line reactors are light water reactors (LWRs). Safeguarding LWRs is
relatively straight-forward, generally consisting of a physical inventory verification
each time the reactor is opened for refuelling, with cameras and seals to monitor
the reactor head and spent fuel pond in the interim. Safeguards for on-line refuelled
reactors remain a serious problem for the IAEA. As the report notes, identification
of fuel elements by serial number is usually impossible at on-line fuelled reactors,
both because the serial numbers are often obscured by the effects of irradiation in
the core and because of the way the fuel is discharged and stacked in the spent fuel
pool. The spent fuel is stacked so that many elements cannot be verified. Unstack-
ing would be a major job requiring substantial time and effort on the parts of both
the facility operator and the IAEA inspectors. Canada is developing machines to
count fuel elements as they are discharged from the core (the installation of a
prototype fuel bundle counter on the KANUPP reactor in Pakistan has been the subject
of recent cable traffic).
The report also identifies concerns that a State could locate fuel for breeding
plutonium in structural elements of the reactor which are not normally designed for
such a purpose, and thereby conceal such illicit diversion. The IAEA has contracted
with Argonne National Laboratory to study these and related adaptations of reactors
for diversion. The status of this project is not known.
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 SECRE 1
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
- 16 -
While at the reactor site, all uranium and all bred plutonium remain in the
fuel elements, which are safeguarded on an item accounting basis. Burnup calcu-
lations (estimates), are, as Morgan states, only infrequently verified at the
reactor facility. These calculations do not become important for safeguards pur-
poses until the fuel is shipped to a reprocessing plant, at which point the burnup
calculations can be conformed when the spent fuel is finally reprocessed and the
recovered plutonium and uranium are measured. At this point the burnup calculations,
although the best available independent estimate of plutonium and uranium input, do
not provide the degree of accounting precision which is to be desired. Power
monitors, although the subject of frequent interest, are not currently used by the
IAEA, even though the U.S. has developed a power monitor (based on gross neutron
flux monitoring) for the IAEA.
6.4.5 Fuel Fabrication, Conversion, and Unirradiated Scrap Recovery
In describing the application of safeguards to these bulk handling facilities,
the report describes a variety of problems with recalcitrant facility operators,
such as operator reluctance to draw and ship requested safeguards samples, excessive
charges for sample material, and claims that the operators license does not permit
possession at his-facility of sealed sources (which contain byproduct or special
nuclear material) which inspectors need to calibrate or otherwise operate non-
destructive assay (NDA) equipment. Recalcitrant operators can be a real impediment
to safeguards inspections, as indicated in several SIRs. Historically, one of the
proposed solutions to this type of problem is to strengthen the IAEAs limited
range of sanctions. Currently the IAEA staff raises such matters with the national
authorities, who may either lack the appropriate framework (i.e., regulations) for
applying sanctions or may not be inclined to impose sanctions on operators.
The staff notes that the formula on page 1-19 for material unaccounted for
contains a typographical error. The formula should read:
MUF= BI+A - R- SR- EI
(with all terms defined as described there).
In describing the use of the MUF equation for IAEA inspection purposes, Morgan
states that the inspector "seldom is able to verify each component" of the equation.
As he explains, each component of the equation consists of several strata (each
stratum consists of all material of a particular type, for example all UF6 or all
uranium oxide power. in that equation component). For a variety of reasons the IAEA
inspector is frequently unable to verify each stratum of each component of the material
balance, and when any one stratum of a component is not verified, that component
remains unverified. The principal reasons for the inability of the IAEA to verify
all strata of each component historically have been:
SECRE F
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
4UNET
- 17 -
- Insufficient number of inspectors to permit a team large enouch to carry out
all necessary verifications at the time of physical inventory verification
(for beginning and ending inventories values) as well as between physical
inventory verifications (for the additions to inventory and removal from
inventory);
- Insufficient equipment or techniques to measure all types of material in
the strata;
- Insufficient information from the operator about the nuclear material to make
a meaningful measurement; and
- Insufficient statistical methods and procedures for selecting samples on a
statistically meaningful basis.
The report expresses concern about detecting a diversion "partitioned across"
several installations (and strata) within a country. In past staff reviews of the
SIRs, it has been clear that the IAEA has had difficulty in-drawing conclusions
for each facility type and especially for States as a whole. Staff is aware that
the IAEA currently is focusing its attention on being able to analyze diversion for
States as a whole in addition to analyzing individual facilities.
7. What Materials This Report Has Concerned
The report notes that certain forms of source material are before the starting
point of safeguards, and that these forms of source material can be converted to
direct use materials (that is, high enriched uranium, uranium-233, or plutonium).
INFCIRC/153 defines that starting point-of safeguards as "[w]hen any nuclear material
of a composition and purity suitable for fuel fabrication or for being isotopically
enriched leaves the plant or the process stage in which it has been produced, or
when such nuclear material, or any other nuclear material produced at a later stage
in the nuclear fuel cycle, is imported into the State" (paragraph 34(c)). (As INFCIRC/
66-type safeguards are not full-scope safeguards, but apply only to specifically
agreed to nuclear.facilities and/or materials, no starting point is specified, but
as a policy matter the same starting point is used for determining whether particular
material is eligible for INFCIRC/66-type safeguards.) Thus, while the IAEA is informed
of imports and exports of yellowcake and thorium compounds, it has no basis for
verifying the condition or use of these materials until the State informs the IAEA
that the material has been processed into a form suitable for fuel fabrication or
enrichment. There is no obligation on the part of the State to inform the IAEA of
indigenous yellowcake or thorium compounds that remain within the State until they
are converted to forms suitable for fuel fabrication or enrichment.
While this aspect of NPT-type safeguards can clearly be construed to constitute
a "loophole" in certain scenarios, it would be a vast undertaking for the IAEA to
attempt to verify all uranium and thorium holdings in all NPT parties. Some starting
point for safeguards must be established. In developing INFCIRC/153 it was deter-
mined that the point described strikes a balance between the relative utility of the
material for proliferation purposes and the magnitude of the undertaking involved to
adequately verify the status of the material.
SECREI
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
- 18 -
Finally, Morgan notes that neptunium-237, which is produced in reactors along
with plutonium (and at approximately one-tenth the rate of plutonium), could
theoretically be used to fabricate a nuclear explosive. While the bare sphere
critical mass of neptunium-237 is on the same order of magnitude as that of HEU,
there are several reasons whyt it has not, to date, been of either international
or domestic safeguards concern. One reason may be that there is no history of
commercial neptunium separation. More importantly, as stated in a recent DOE
memorandum:
neptunium-237 has a daughter which emits gammas with high
energy levels. This means that neptunium is hot, and when
it is collected in the kilogram quantities sufficient for
a nuclear device, it is extremely hot. This factor makes
working with and stockpiling of neptunium for nuclear
explosives extremely hazardous.
In addition, while the neptunium-237 in spent fuel may be separated by
reprocessing the fuel, this involves a process at least as complex as that for
separating plutonium. Thus any diverter capable of obtaining neptunium-237 is
also capable of obtaining approximately ten times as much plutonium from the same
spent fuel, which (because of the greater bare shpere critical mass of neptunium-
237) could be used to fabricate on the order of 100 times as many explosive devices,
and the plutonium, for all its difficulties in handling, is apparently easier to
fabricate into weapons. However, since the technology for separating neptunium
exists, we should continue to watch for indications for such activities in other
countries.
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
ENCLOSURE 3
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 QCY ^ A 1001 nrr%DCT "'Document No.
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1 3ges
Addendum P:o. of__!1_copies, Series
to
Staff Commentary on Morgan Report
1. "rNlationals of the country inspected have access to inspection reports,
seals, seal records, etc., that concern their own country." (p. 2) In our Commentary
on the Morgan report 'the staff noted that "Ed-In occasion, an individual may
necessarily undertake certain responsibilities or require access to certain
information related to his own country." Particularly in cases where only one or
two staff positions perform a particular function for the whole Inspectorate, it
will be difficult or impossible to keep an individual from direct access to and
responsibility for "inspection reports, seals, seal records, etc." concerning his
own country. In these circumstances the individual's responsibilities as an
international civil servant could come into apparent or real conflict with his
allegiance to his country. In the latter case, the integrity of the international
safeguards system itself could be seriously jeopardized.
2. "Another shortcoming in the design information is its completeness." (p. 4)
As we indicated in the Commentary, the general standard as to what constitutes
adequately detailed design information has evolved in recent years towards
requiring more detail. In the case of facilities which have been under safeguards
for more than a few years, a related issue, is-the adequacy of the IAEA system
for formally recording design information and maintaining records of all such
information.
3. -"When the facility attachment is concluded, it is a consensus document which
may pe1-manently emasculate efforts to safeguard the installation." (p. 4) As
noted in the staff Commentary, individual facility. attachments reflect the "model"
facility attachment (and thus the accepted safeguards approach) current at the
time of negotiation, with some variations due to concessions extracted by a particular
state, or differences in facility design and operation. Once a facility attach-
ment has been agreed.tco, many states have been quite reluctant to renegotiate to
afford the IAEA rights or access not originally provided for. As the IAEA's
understanding of what activities are necessary to adequately safeguard a particular
type of facility has developed, the Agency has found that old facility attachments
do not afford it the right to collect information or place surveillance equipment
as now deemed necessary. In addition, in the case of most safeguards agreements
based on INFCIRC/66/Rev. 2, the safeguards agreement itself does not provide
for the use of containment/surveillance equipment, even as "complementary measures."
The right to use such equipment must either be provided for in renegotiated facility
attachments or under the guise of test and evaluation programs. So long as the
safeguards approaches for particular types of facilities continue to develop in
Classified by Multiple sources
Declassify 10/01
or on
NATIONAL SECURITY INFOR1ljTI0N
"t""`i7ed disc(rsure subject to
s,
Review
-iiVe classifier:
Extended by DRIB tJ
Reason for Extensi6A Intelligence
information
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
T
 >tJ L
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22: CIA-RDP86T00303R000500700038-1
the direction of more equipment and more detailed information, while many states
continue to take a very narrow legalistic view of the rights afforded the IAEA
in safeguards agreements and facility attachments, old agreements will constrain
the application of safeguards, and sometimes render safeguards ineffective.
4. In his discussion of material accountancy (section 6.2), Morgan seems to
call attention to the large degree of emphasis placed on auditing records
relative to that placed on the independent measurement of nuclear material,
that is, the concentration on evaluating the consistency of all accounting
documentation without necessarily verifying independently the basic data contained
in those documents. Morgan makes this point in connection with safeguards at
bulk-handling facilities. However, it has recently become apparent that, in
a facility handling large numbers of discrete items (such as fuel elements in a
CANDU reactor or a large critical assembly), the same problems can exist. In
facilities with a large flow of discrete items (such as a CANDU reactor), the
lack of a method for independently verifying the number of fuel elements entering
and leaving the core would render the consistency of records relatively meaningless.
Containment/surveillance devices installed at the facility, so long as they are
properly installed and do not fail, will provide substantial assurance that all
fuel elements which enter the reactor are either in core or have been placed in
the spent fuel pool. However, when containment/surveillance devices fail and
continuity of knowledge is lost, assurance that no diversion has occurred can
only be established by a complete re-inventory of the fuel.
5. A "basic shortcoming of the use of seals is that the item sealed can often
be accessed by bypassing the seal." (p. 12) That is, the seal is only as good
as the integrity and tamper-indicating properties of the surrounding containment.
The staff Commentary noted that: "If applied properly, seals cannot be bypassed
without clear evidence of the attempt unless extraordinary measures are undertaken.
Obviously mistakes in seals application are made from time to time." This
is obviously true of 3ther containment/surveillance devices, such as dosimeter
yes/no-monitors, as well_._;
6. "There have been significant improvements recently in [camera] reliability,
bL-t failures still occur at an alarming rate." (p. 13) Failure rates for movie
cameras were provided in the staff Commentary. These failure rates indicate
that camera failures, resulting in loss of continuity of knowledge regarding
the nuclear material, remain. a serious deficiency in IAEA safeguards. Apparently,
even redundant equipment sometimes fails.
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 CIA-RDP86T00303R000500700038-1
7. "One scenario... is the placement of a photograph of the viewed scene in
front of the camera. ...But there are also more sophisticated ways to defeat
the cameras." (p. 13) In the case of TV camera - video recorder systems, a
more sophisticated version of this scenario is to tap into the transmission
cable and feed a picture from some source other than the IAEA camera. (But
see paragraph 8 below.)'
8. A "basic difficulty associated with containment and surveillance devices
is that the device is:'not under the continuous observation of the inspector,
as would be an alarm system in an industrial setting." (p. 13) In the case
of cameras, and other surveillance equipment, some form of tamper-indication is
necessary to maintain the integrity of the equipment. Apparently IAEA TV
camera systems do not have this feature (although, as noted in the Commentary,
movie camera units are sealed with IAEA seals), thus requiring that scenarios
such as that discussed above be considered serious possibilities.
9. "Also, people stand in front of the camera and barriers are erected that
block the view. The camera may be moved. The lights may go out." (p. 13) As
noted in the Commentary, a camera's field of view is sometimes blocked by the
operator without first having informed the IAEA of the activity and the need
to block the camera. Maintenance work is an example of legitimate activities
which require temporarily blocking a camera, but, by the terms of NPT-type
subsidiary arrangements, the IAEA is to be informed of such activities before
they occur, except in emergencies, in which case the IAEA is to be informed promptly.
However, in the case of INFCIRC/66-type safeguards agreements, where the subsidiary
arrangements normally do not contain any provision for containment/surveillance
measures other than seals, and cameras- have been installed on. an "experimental"
or "test" basis, the state would have no legal obligation to inform the IAEA
in advance of such operations. Thus, some states with facilities subject to
safeguards under INFCIRC/66-type safeguards agreements could easily block cameras
temporarily and resist any implication that this violated the safeguards agreement.
10- "Further, the samples [of nuclear material] are handled in the plant by
the operator, and may be prepared by the operator before shipment to Vienna." (p. 15).
In addition, there. is a comparable point about camera films and tapes: that
tfiese are frequently deemed (in the facility attachment) to be the property of
the operator and cannot be removed from the site, thus requiring that all develop-
ment,review, and storage of the film be at the facility.!
11. Morgan describes how a type of surveillance device (seals) was applied in
a fashion that permitted access to the container without violating the seal.
Morgan notes that he discussed this problem both with the inspection team leader
and with people (he does not indicate who) at IAEA Headquarters. "However, this
situation was not corrected, possibly because Agency personnel had collaborated
with the operator on the method by which the seal would be applied in the first
SECRET
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
 A
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1
place and felt partially obligated to go along with the outcome, when the operator
said that the holes could not be drilled." (p. 16) Cases where IAEA inspectors,
including section chiefs, were involved in the incorrect application of
containment/surveillance equipment, or other safeguards deficiencies, at a
particular facility, constitute a serious problem which existing IAEA management
procedures do not adequately address.
12. "In both cases, physical inventories occurred at annual to 18-month intervals.
Nondestructive assay verification was permitted at that time. Inspection frequency
ran from 3-month to 6-month intervals." (p. 17) It is not clear what Morgan
refers to when he begins "in both cases," as this statement appears in a paragraph
which otherwise describes safeguards for off-line refuelled reactors (LWRs), but
the only "other case" which could be relevant is that of on-line refuelled reactors
(such as CANDUs), discussed in the previous paragraph of his report. Each such
physical inventory normally does not include 'a verification of spent fuel elements
which were previously inventoried and for which "continuity of knowledge" has
been maintained in the interim by cameras or other containment/surveillance equip-
ment. When containment/surveillance fails and continuity of knowledge is lost,
a complete re-inventory of the spent fuel pool is necessary. For CANDU reactors,
which utilize large numbers--of relatively small fuel elements, such re-inventory
can be an arduous and lengthy exercise. When questions about Pakistani intentions
arose in 1979, it took-more than a year to arrange for and conduct a physical
inventory of the contents of the reactor's spent fuel pool.
SECRP'
Declassified in Part - Sanitized Copy Approved for Release 2011/12/22 : CIA-RDP86T00303R000500700038-1