Background
The proliferation and availability of information and data has changed the way that we live our lives and the ways that organisations operate. Although much material is privately held, contained and controlled - for example most financial data - massive volumes of information and data are freely available. Public data sources include broadcast TV and radio, websites, publications and reports, maps, satellite imagery, municipal information, academic papers, social media and photography. With effective research and analysis, this open data pool can prove to be a highly exploitable resource - generate valuable insights of considerable commercial and other value.
As the availability of data and information expands, the significance of open sources to security issues is growing. The exploitation of open source material for security purposes is often referred to as Open Source Intelligence (OSINT) or Open Source Information (OSINF) - such open source approaches have clear and direct relevance to nuclear security.
It is important to acknowledge the ‘double-edged sword’ of open sources in relation to security. Openly available information about organisations, facilities and people associated with sensitive activities such as those at nuclear sites can increase security risks. Social media can be a major source of information: internal company structures can be discovered; potential targets can be identified and changes within the company are easily detected by third parties. Public documents on websites can contain metadata from which information about software used, system information or even usernames can be gleaned. Furthermore, information on a partner or clients can be used for a spear phishing attack. By masquerading as the colleague of a partner or client, it is easier for the attacker to exploit an existing relationship of trust.
On the flipside, when utilised effectively, open source techniques can provide great opportunities to pre-emptively spot security risk, identify potential threats and to build stronger security arrangements. Open source approaches should be a key component of nuclear security plans and culture. There is an enormous amount of data – social media, incident databases, extremist messaging, and so on – that can help inform nuclear security practices.
In nuclear safeguards, open sources are increasingly used to support State declarations of nuclear materials and facilities. In particular, open source analysis allows the International Atomic Energy Agency (IAEA) to make use of all available sources of information to address the possibility of undeclared activities. The IAEA may gather information on a State by data mining and reviewing commercial satellite imagery.
In nuclear security, open sources can greatly support both personnel and physical security efforts. One of the most serious security concerns affecting the nuclear sector is that insiders could become radicalised while employed—or that they are already radicalised at the time of hire—and might subsequently use their positions of trust and authority to carry out an attack. Signs of radicalisation are often highly visible in open sources. Social media posts and connections often provide early warning signs of radicalisation.
Weaknesses in physical security arrangements can often be identified from open sources: guarding arrangements, identification of passes, timings of regular vehicle movements. Combined with freely available imagery, maps and other information – virtual reconnaissance can help build attack preparations with low risk of compromise. To limit these physical security risks, it is important that nuclear facilities regularly assess their open source profiles and take steps to actively manage down unnecessary or risky information leakage.
Legal and cultural differences impose restrictions on certain open source activities in some jurisdictions. It is important that those involved in open source work understand their legal obligations and boundaries. Similarly, arrangements around employee information will vary across jurisdictions – often restricting what can be shared and for what purposes.
Objectives
- Describe what is Open Source Information (OSINF) and how it can contribute to strengthening security
- Understand new threats and attack vectors that have developed because of OSINF.
- Review applications of OSINF to help improve security in various sectors.
- Understand how OSINF can be used by nuclear and radioactive source licensees to protect against potential threats.
- Understand how social media information can be used to vet the trustworthiness of employees, keeping in mind variations in legal systems between countries and cultures.
- Understand potential classification issues when open source data becomes analysed, and how to better share OSINF between the regulator and licensee.
- Understand how to present OSINF in a way that will be impactful to senior managers and other key stakeholders.
Webinar Details
The webinar was conducted on Thursday, 16 April 2020 at 16:00 CET.
Duration: 60 minutes
Language: English
Speakers: Chris Budd, Business and Research Manager, Ridgeway Information, UK and Dan Johnson, World Institute for Nuclear Security
Recording: The webinar recording is available to WINS members on the Knowledge Centre area of the WINS website, or directly on the Livestorm webinar platform.
