Source: http://thefederalregister.com/2012/10/25/2012-26288.html
Timestamp: 2017-12-12 12:01:28
Document Index: 220919376

Matched Legal Cases: ['art 30', 'art 32', 'art 35', 'art 70', 'art 73', 'art 2', 'art 10']

[NRC-2012-0254; EA-12-147]
In the Matter of Licensee Identified in Attachment 1 and all Other Persons Who Obtain Safeguards Information Described Herein; Order Imposing Requirements for the Protection of Certain Safeguards Information (Effective Immediately)I
The Licensee, identified in Attachment 11 to this Order, holds a license issued in accordance with the Atomic Energy Act of 1954, as amended, (AEA) by the U.S. Nuclear Regulatory Commission (NRC or the Commission), authorizing it to possess, use, and transfer items containing radioactive material quantities of concern. The NRC intends to issue a security Order to this Licensee in the near future. The Order will require compliance with specific Additional Security Measures to enhance the security for certain radioactive material quantities of concern. The Commission has determined that these documents will contain Safeguards Information, will not be released to the public, and must be protected from unauthorized disclosure. Therefore, the Commission is imposing the requirements, as set forth in Attachments 2 and 3 to this Order and in Order EA-12-148, so that the Licensee can receive these documents. This Order also imposes requirements for the protection of Safeguards Information in the hands of any person,2 whether or not a licensee of the Commission, who produces, receives, or acquires Safeguards Information.
The Commission has broad statutory authority to protect and prohibit the unauthorized disclosure of Safeguards Information. Section 147 of the AEA grants the Commission explicit authority to "* * * issue such orders, as necessary to prohibit the unauthorized disclosure of safeguards information * * *." This authority extends to information concerning the security measures for the physical protection of special nuclear material, source material, and byproduct material. Licensees and all persons who produce, receive, or acquire Safeguards Information must ensure proper handling and protection of Safeguards Information to avoid unauthorized disclosure in accordance with the specific requirements for the protection of Safeguards Information contained in Attachments 2 and 3 to this Order. The Commission hereby provides notice that it intends to treat violations of the requirements contained in Attachments 2 and 3 to this Order, applicable to the handling and unauthorized disclosure of Safeguards Information, as serious breaches of adequate protection of the public health and safety and the common defense and security of the United States.
The Licensee and all other persons who obtain Safeguards Information must ensure that they develop, maintain and implement strict policies and procedures for the proper handling of Safeguards Information to prevent unauthorized disclosure, in accordance with the requirements in Attachments 2 and 3 to this Order. The Licensee must ensure that all contractors whose employees may have access to Safeguards Information either adhere to the Licensee's policies and procedures on Safeguards Information or develop, or maintain and implement their own acceptable policies and procedures. The Licensee remains responsible for the conduct of their contractors. The policies and procedures necessary to ensure compliance with applicable requirements contained in Attachments 2 and 3 to this Order must address, at a minimum, the following: the general performance requirement that each person who produces, receives, or acquires Safeguards Information shall ensure that Safeguards Information is protected against unauthorized disclosure; protection of Safeguards Information at fixed sites, in use and in storage, and while in transit; correspondence containing SafeguardsInformation; access to Safeguards Information; preparation, marking, reproduction and destruction of documents; external transmission of documents; use of automatic data processing systems; removal of the Safeguards Information category; the need-to-know the information; and background checks to determine access to the information.
Accordingly, pursuant to Sections 81, 147, 161b, 161i, 161o, 182 and 186 of the Atomic Energy Act of 1954, as amended, and the Commission's regulations in 10 CFR 2.202, 10 CFR Part 30, 10 CFR Part 32, 10 CFR Part 35, 10 CFR Part 70, and 10 CFR Part 73,it is hereby ordered, effective immediately, that the licensee identified in attachment 1 to this order and all other persons who produce, receive, or acquire the additional security measures identified above (whether draft or final) or any related safeguards information shall comply with the requirements of attachments 2 and 3.
Once a participant has obtained a digital ID certificate and a docket has been created, the participant can then submit a request for hearing or petition for leave to intervene. Submissions should be in Portable Document Format (PDF) in accordance with the NRC guidance available on the NRC's Web site athttp://www.nrc.gov/site-help/e-submittals.html.A filing is considered complete at the time the documents are submitted through the NRC's E-Filing system. To be timely, an electronic filing must be submitted to the E-Filing system no later than 11:59 p.m. Eastern Time on the due date. Upon receipt of a transmission, the E-Filing system time-stamps the document and sends the submitter an email notice confirming receipt of the document. TheE-Filing system also distributes an email notice that provides access to the document to the NRC's Office of the General Counsel and any others who have advised the Office of the Secretary that they wish to participate in the proceeding, so that the filer need not serve the documents on those participants separately. Therefore, applicants and other participants (or their counsel or representative) mustapply for and receive a digital ID certificate before a hearing request/petition to intervene is filed so that they can obtain access to the document via the E-Filing system.
A person filing electronically using the agency's adjudicatory E-Filing system may seek assistance by contacting the NRC Meta System Help Desk through the "Contact Us" link located on the NRC Web site athttp://www.nrc.gov/site-help/e-submittals.html,by email atMSHD.Resource@nrc.gov,or by a toll-free call at 1-866-672-7640. The NRC Meta System Help Desk is available between 8 a.m. and 8 p.m., Eastern Time, Monday through Friday, excluding government holidays.
Attachment 1: Applicable Materials Licensees RedactedAttachment 2--Modified Handling Requirements for the Protection of Certain Safeguards Information (SGI-M) General Requirement
Information and material that the U.S. Nuclear Regulatory Commission (NRC) determines are safeguards information must be protected from unauthorized disclosure. In order to distinguish information needing modified protection requirements from the safeguards information for reactors and fuel cycle facilities that require a higher level of protection, the term "Safeguards Information--Modified Handling" (SGI-M) is being used as the distinguishing marking for certain materials licensees. Each person who produces, receives, or acquires SGI-M shall ensure that it is protected against unauthorized disclosure. To meet this requirement, licensees and persons shall establish and maintain an information protection system that includes the measures specified below. Information protection procedures employed by State and local police forces are deemed to meet these requirements.
The Atomic Energy Act of 1954, as amended, explicitly provides that any person, "whether or not a licensee of the Commission, who violates any regulations adopted under this section shall be subject to the civil monetary penalties of section 234 of this Act." Furthermore, willful violation of any regulation or order governing safeguards information is a felony subject to criminal penalties in the form of fines or imprisonment, or both.See sections 147b. and 223 of the Act.
Access to SGI-M beyond the initial recipients of the order will be governed by the background check requirements imposed by the order. Access to SGI-M by licensee employees, agents, or contractors must include both an appropriate need-to-know determination by the licensee, as well as a determination concerning the trustworthiness of individuals having access to the information. Employees of an organization affiliated with the licensee's company (e.g., a parent company), may be considered asemployees of the licensee for access purposes.
F. A person to whom disclosure is ordered pursuant to Section 2.744(e) of Part 2 of Part 10 of theCode of Federal Regulations.
Alarm stations, guard posts and guard ready rooms;Engineering or drafting areas if visitors are escorted and information is not clearly visible;Plant maintenance areas if access is restricted and information is not clearly visible;Administrative offices (e.g., central records or purchasing) if visitors are escorted and information is not clearly visible.Protection While in Storage
While unattended, SGI-M shall be stored in a locked file drawer or container. Knowledge of lock combinations or access to keys protecting SGI-M shall be limited to a minimum number of personnel for operating purposes who have a "need-to-know" and are otherwise authorized access to SGI-M in accordance with these requirements. Access to lock combinations or keys shall be strictly controlled so as to prevent disclosure to an unauthorized individual.
Documents containing SGI-M when transmitted outside an authorized place of use or storage shall be enclosed in two sealed envelopes or wrappers. The inner envelope or wrapper shall contain the name and address of the intended recipient, and be marked both sides, top and bottom with the words "Safeguards Information--Modified Handling." The outer envelope or wrapper must be addressed to the intended recipient, must contain the address of the sender, and must not bear any markings or indication that the document contains SGI-M.
SGI-M may be transported by any commercial delivery company that provides nation-wide overnight service with computer tracking features, US first class, registered, express, or certified mail, or by any individual authorized access pursuant to these requirements.Within a facility, SGI-M may be transmitted using a single opaque envelope. It may also be transmitted within a facility without single or double wrapping, provided adequate measures are taken to protect the material against unauthorized disclosure. Individuals transporting SGI-M should retain the documents in their personal possession at all times or ensure that the information is appropriately wrapped and also secured to preclude compromise by an unauthorized individual.
While the NRC is the sole authority for determining what specific information may be designated as "SGI-M," originators of documents are responsible for determining whether those documents contain such information. Each document or other matter that contains SGI-M shall be marked "Safeguards Information--Modified Handling" in a conspicuous manner on the top and bottom of the first page to indicate the presence of protected information. The first page of the document must also contain (i) the name, title, and organization of the individual authorized to make a SGI-M determination, and who has determined that the document contains SGI-M, (ii) the date the document was originated or the determination made, (iii) an indication that the document contains SGI-M, and (iv) an indication that unauthorized disclosure would be subject to civil and criminal sanctions. Each additional page shall be marked in a conspicuous fashion at the top and bottom with letters denoting"Safeguards Information Modified Handling."
In additional to the "Safeguards Information--Modified Handling" markings at the top and bottom of each page, transmittal letters or memoranda which do not in themselves contain SGI-M shall be marked to indicate that attachments or enclosures contain SGI-M but that the transmittal does not (e.g., "When separated from SGI-M enclosure(s), this document is decontrolled").
Documents containing SGI-M shall be removed from the SGI-M category (decontrolled) only after the NRC determines that the information no longer meets the criteria of SGI-M. Licensees have the authority to make determinations that specific documentswhich they createdno longer contain SGI-M information and may be decontrolled. Consideration must be exercised to ensure that any document decontrolled shall not disclose SGI-M in some other form or be combined with other unprotected information to disclose SGI-M.
SGI-M may be processed or produced on an ADP system provided that the system is assigned to the licensee's or contractor's facility and requires the use of an entry code/password for access to stored information. Licensees are encouraged to process this information in a computing environment that has adequate computer security controls in place to prevent unauthorized access to the information. An ADP system is defined here as a data processing system having the capability of long term storage of SGI-M. Word processors such as typewriters are not subject to the requirements as long as they do not transmit information offsite. (Note: if SGI-M is produced on a typewriter, the ribbon must be removed and stored in the same manner as other SGI-M information or media.) The basic objective of these restrictions is to prevent access and retrieval of stored SGI-M by unauthorized individuals, particularly from remote terminals. Specific files containing SGI-M will be password protected to preclude access by an unauthorized individual. The National Institute of Standards and Technology (NIST) maintains a listing of all validated encryption systems athttp://csrc.nist.gov/cryptval/1401/1401val.htm. SGI-M files may be transmitted over a network if the file is encrypted. In such cases, the licensee will select a commercially available encryption system that NIST has validated as conforming to Federal Information Processing Standards (FIPS). SGI-M files shall be properly labeled as "Safeguards Information--Modified Handling" and saved to removable media and stored in a locked file drawer or cabinet.
Attachment 3--Trustworthiness and Reliability Requirements for Individuals Handling Safeguards Information
In order to ensure the safe handling, use, and control of information designated as Safeguards Information, each licensee shall control and limit access to the information to only those individuals who have established the need-to-know the information, and are considered to be trustworthy and reliable. Licensees shall document the basis for concluding that there is reasonable assurance that individualsgranted access to Safeguards Information are trustworthy and reliable, and do not constitute an unreasonable risk for malevolent use of the information.
Mark A. Satorius, Director,Office of Federal and State Materialsand Environmental Management Programs.
ACTION: 2Person means (1) any individual, corporation, partnership, firm, association, trust, estate, public or private institution, group, government agency other than the Commission or the Department of Energy, except that the Department of Energy shall be considered a person with respect to those facilities of the Department of Energy specified in section 202 of the Energy Reorganization Act of 1974 (88 Stat. 1244), any State or any political subdivision of, or any political entity within a State, any foreign government or nation or any political subdivision of any such government or nation, or other entity; and (2) any legal successor, representative, agent, or agency of the foregoing.