Tahir Mahmood Azad & Karl Dewey
Although the broad outlines of Pakistan's nuclear weapons' programme are well documented, significant gaps remain in the understanding of the country's nuclear security regime. Nuclear security remains a highly politicised topic, with little robust information available regarding the steps taken to secure the country's nuclear assets. To help “fill the gaps”, this paper places official Pakistani documents, statements, and other open source information, into an analytical framework based on international standards of physical security. Although gaps in understanding remain, this paper finds that, in general, Pakistan has enacted robust security measures to protect its nuclear weapons and nuclear-weapons related infrastructure. Nonetheless, the prevailing perception of Pakistan's nuclear security remains dominated by embarrassing episodes that emphasise the importance of effective nuclear security culture. Based on its findings, this paper also offers policy recommendations which may offer additional confidence about the rigours of the country's nuclear security regime.
Introduction
Since its first nuclear test on 28 May 1998, Pakistan’s nuclear programmes have faced intense international scrutiny. Much of this has focused on Pakistan’s nuclear command, control, and communications (NC3) arrangements, and when nuclear weapons would be used. However, persistent concerns of non-state actors mean significant questions have also been raised about Pakistan’s ability to defend its nuclear assets against attack, theft, and/or sabotage against internal and external adversaries. Nonetheless, assessing Pakistan’s nuclear security regime is difficult – on one hand, Pakistani officials have sought to reassure the international community that the country has codified its NC3 arrangements and improved its nuclear security record. These reforms have been both broad-based, as well addressing specific threats, such as human reliability. As a result, Pakistani officials often issue high-level assurances that the country’s nuclear assets are safe and secure, and assert that national security plans are “fool proof.”Footnote1 However, on the other hand, Pakistan’s limited transparency means that few details are provided to support such claims, whilst the general incentive for counties to portray themselves as responsible nuclear powers means “official statements by governments [in the area of nuclear security] are often dubious if not outright duplicitous.”Footnote2
Navigating the two positions is difficult: large knowledge gaps remain, whilst new analysis is compounded by the relative lack of authoritative sources and shallow discussion. Indeed, writing in 2014, Smith noted that although
[p]arts of Pakistan’s nuclear management system, like its command element, have been reasonably transparent; other parts, like the physical security and surety [i.e. human reliability] elements, have been at best translucent … In many areas, there are only bald assertions that programs and methods have been put into place, with very few details provided.Footnote3Such observations remain true today.
To overcome the scholarly dichotomy, this paper revisits Pakistan’s nuclear security regime, as applied to its nuclear weapons’ programme. The paper reviews the existing literature, placing it within a new methodology based on the IAEA’s Nuclear Security Series (NSS) 13 document – Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 5).Footnote4 Although the guidance outlined in NSS 13 is aimed at civilian facilities, the adapted framework nonetheless allows for a systematic analysis of Pakistani nuclear security efforts and “fill the gaps” in understanding.
After outlining the broad contours of “known” and “unknown” Pakistani security arrangements, this paper uses its NSS 13-derrived methodology to review described Pakistani nuclear measures systematically. Overall, Pakistan has enacted robust security measures to protect its nuclear weapons, and nuclear-weapons related infrastructure, however, various episodes show that vigilance must be maintained. Based on its findings, this paper also offers policy recommendations which may offer ways to strengthen Pakistan’s nuclear security regime and give confidence about the rigours of the regime.
Methodology
Interest in Pakistani nuclear security is not new and there have been numerous notable efforts in this field. Authors such as Khan,Footnote5 Lavoy,Footnote6 Salik,Footnote7 Smith,Footnote8 and Tertrais,Footnote9 have been highly influential. Indeed, their collective analysis provides the basis of contemporary understanding of a broad range of Pakistan’s nuclear affairs, including the country’s evolving doctrine, nuclear command-and-control measures, efforts to improve the country’s physical security measures, and efforts to improve nuclear surety. In contrast, measures such as the NTI’s Nuclear Security Index adopt a much broader framework using 22 variables to produce its security rating.Footnote10
Both quantitative and qualitative approaches have strengths and weaknesses. For example, qualitative analysis of Pakistan’s nuclear security regime focuses on the evolution and drivers of change within the regime, and thus is often limited in its scope and, by necessity, rather descriptive. Quantitative approaches such as the NTI Nuclear Security Index are more comprehensive and allow for cross-country comparison, but there is little transparency on how its ratings are awarded.
Instead, this paper seeks to strike a balance between the two approaches, drawing upon a novel methodology derived from standards outlined by the IAEA’s Nuclear Security Series (NSS) to “fill the gaps” in understanding. Several NSS documents relate explicitly to national security regimes including NSS 20 “Objective and Essential Elements of a State’s Nuclear Security Regime,”Footnote11 and NSS 13 “Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities.” The authors chose NSS 13 as the basis of their comparative approach because it is an established publication directly related to physical protection, and because of its extensive promotion by the IAEA. Although the document is aimed at civilian facilities, such a methodology allows for greater insight than previous scholarly approaches for several reasons.
Firstly, because the NSS offers high-level guidance that individual states can interpret and implement according to their local circumstances, the Fundamental Principles articulated by NSS 13 can be applied to facilities, regardless of a civilian or military role. Secondly, as per Pakistan’s 2010 National Command Authority Act, the National Command Authority (NCA) has the “sole authority” to control all of the country’s nuclear and strategic activities.Footnote12 This includes both civil and military activities, thus through the NCA’s secretariat – the Strategic Plans Division (SPD)Footnote13—there is an institutional link between civilian facilities and military facilities. Thus, as a conduit of knowledge, it is reasonable to assume that the Directorate seeks to simplify its internal standards and carry over best practices, regardless of the civilian-military divide. Lastly, using a comprehensive framework allows for Pakistan’s security regime to be reviewed systematically and wholistically, and avoid undue focus on individual examples of poor practice.
Assessing Pakistan’s nuclear security
In assessing Pakistan’s nuclear security regime, this paper considers four scenarios, namely the security of Pakistan’s nuclear weapons, the risk of the unauthorised removal of nuclear material “with the intent to construct a nuclear explosive device,” the risk of unauthorised access to material “which could lead to subsequent dispersal,” and the risk of sabotage.Footnote14 To protect against the latter three risks, NSS 13 outlines four key elements that a nuclear security regime must incorporate including (i) the protection against unauthorised removal; (ii) the location and recovery of missing nuclear material; (iii) the protection against sabotage; and, (iv) the mitigation and minimisation of any effects of sabotage.Footnote15 To achieve these four objectives, the IAEA recommend nine elements which, when used in combination, contribute towards an effective security regime. These include:
State responsibility
International transport
Assignment of physical protection responsibilities
Legislative and regulatory framework
International cooperation and assistance
Identification and assessment of threats
Risk based physical protection systems and measures
Sustaining the physical protection regime
Planning and preparedness for and response to nuclear security events.
State responsibility
As with civilian requirements, the bedrock of a state’s security regime is the central role of the state in establishing a security regime. Herein, IAEA Fundamental Principle A requires the state to have sole responsibility for the “establishment, implementation and maintenance of a physical protection regime.”Footnote16 In the nuclear weapons context, this principle can be extended to include sites related to the production of nuclear weapons and to nuclear weapons themselves, such that weapons, material and information are always under lawful state control. For this, the authors examine two scenarios: Measures to ensure effective NC3;Footnote17 and measures to ensure the security of weapons and ensure that they can never when they are not supposed to. Measures to protect sensitive nuclear material and sensitive nuclear information are discussed below.
Command, control, and communications
Although NC3 systems vary from state to state, in essence they are “the medium by which the use of nuclear weapons can enter into military operations.”Footnote18 In almost all nuclear-weapon states, NC3 systems are comprised of civil and military leadership, with a robust NC3 system having three traditional characteristics:Footnote19
Tight and exclusive civilian control.
Respond exclusively to a highly centralised hierarchy.
Nuclear weapons must include physical protection against unauthorised assembly, or detonation.
Since “going nuclear” in 1998, Pakistan’s NC3 has undergone considerable development, transforming from a largely ad hoc system to one of centralised control. This has had the benefit of both exerting leadership control over the country’s nuclear weapons and reducing the autonomy of Pakistan’s strategic organisations. This restructuring began on 2 February 2000, when Pakistan instigated its comprehensive nuclear command and control system, also known as, “Strategic Command Organisation (SCO).” Pakistan’s SCO has three tiers consisting of the National Command Authority (NCA); the Strategic Plans Division (SPD); and the Strategic Forces Commands (SFC) which are embedded within the various service arms and are responsible for the operation of the country’s nuclear capabilities. This arrangement was later formalised by the 2010 NCA Act, wherein the NCA was formally vested as the “sole authority” to control the country’s nuclear and strategic assets Figure 1.
Figure 1. NCA structure.
The NCA’s leadership includes top civil and military leadership, with the NCA’s Employment Control Committee (ECC) having the mandate to direct nuclear policy and decision-making. Should the decision be required, the ECC would be responsible for ordering the use of nuclear weapons.Footnote20 Here, ECC orders and authorisation codes (see below) would be directed to the relevant SFCs, via dedicated NC3 channels embedded within the SPD.
Pakistan has been relatively transparent and its command structure is well understood. However, relevant here is whether effective state control would be asserted at all times, and whether there are conditions where weapons could be used without due authorisation? As noted, an effective NC3 system to prevent unauthorised use has three core elements and it is evident that Pakistan meets at least two of the three criteria – i.e. the country has as clear and centralised command system, and measures in place (discussed below) to prevent the unauthorised use of weapons. However, it is less clear whether Pakistan meets the condition of “tight and exclusive civilian control.” This stems from the ambiguity surrounding Pakistani procedures. For example, the ECC is comprised of 10 individuals, including the Prime Minister as Chair. As noted by Tertrais, the ECC has agreed on the principle of unanimity since 2003, although in practice the ECC may only require a “consensus” amongst its members.Footnote21 The difference is significant because in the event of a tied vote, “it is not unreasonable to conclude that the military would [have the casting vote and] be the de facto decision maker.”Footnote22 In theory, this means the military could overrule Pakistan’s elected government although additional systems may be in place to ensure that the military remains subordinate to civilian commanders – significant given the military's history of political intervention. For example, the authoritative Pakistani commentator Feroz Khan notes that, “several sources refer to a system of two separate codes – one civilian, the other military – amounting to a dual key system.”Footnote23 This remains unconfirmed, but should this be the case, it appears Pakistan has made considerable efforts to ensure that the country’s nuclear remain under lawful state control.
Weapons security
Regarding effective state control, the second area considered here is weapons security and the measures taken to ensure that weapons cannot detonate outside of authorised and intended use. Such measures include “positive” controls (i.e. the features and procedures that restrict the release of nuclear forces only when properly authorised) and “negative controls” (i.e. features that inhibit the release or use of nuclear weapons outside of authorised control). During peacetime, examples of negative control include the fact that Pakistan’s land – and air-based nuclear weapons are both de-mated from their delivery systems and are kept in disassembled form. This minimises the chance that an intact weapon could be stolen, as well as forming part of the country’s peacetime nuclear force posture.Footnote24 However, little information is available for the naval leg of Pakistan’s deterrent, currently based on the Babur-3 submarine-launched cruise missile. First test fired in 2017 and described by Pakistan’s Inter-Services Public Relations (ISPR) as a “second strike capability,”Footnote25 because of its naval requirements the Babur-3 is assumed to be pre-mated and contained within a vertical launch system, or similar cannisterised device. Should assembly of its land – or air-based weapons be required, the county appears to have developed numerous systems that represent significant advances from 1998 and its early weapons. Very little is publicly available about the specific aspects of Pakistan’s military safety and security measures, however, senior Pakistani officials occasionally refer to such measures. For example, according to Dr Samar Mubarakmand, a leading Pakistani nuclear scientist, “Pakistan has applied the best nuclear safety and security parameters with indigenously developed advanced safety and security mechanisms to secure its nuclear assets,”Footnote26 and that these mechanisms are similar to those practiced by other nuclear-weapon states.Footnote27 These mechanisms appear to refer to Permissive Action Links (PALs), which were confirmed in 2008 by Retired Brigadier General Naeem Salik, when he noted that the country “has developed its own PAL systems which obviously ensures that even if an unauthorised person gets hold of a weapon, he cannot activate it unless he also has access to electronic codes.”Footnote28 Codes form part of the weapon manufacturing process and codes for use are issued just before use, and inserted via a computerised system.Footnote29 For land-based systems, Pakistan employs a “two-man rule,” even possibly requiring a “three-man rule” on occasion. Although this usually refers to the minimum size of personnel to prevent individuals from being alone on-site, the two/three-man rule here refers to the number of individuals to whom a launch code is divided between such that no-single person had the whole code.Footnote30 Similarly, pilots receive their authentication codes when in-flight.Footnote31 However, as noted, far less information regarding the technical and procedural controls on Pakistan’s sea-based assets are available. This is unfortunate because such systems are likely to be pre-mated and have higher reliance on procedural controls.
For its air – and land-based systems at least, according to Samar, Pakistan’s safety and security parameters were applied after several successful tests and are seen as further enhancing the reliability and credibility of the country’s nuclear management system.Footnote32 In addition to these physical systems, Pakistan undertakes numerous procedural systems – such as the “two-man” rule – in combination with human reliability programmes to reduce the likelihood of theft and use by external actors and insiders alike, and ensure the state control of nuclear weapon assets. Although details remain scarce, the security of Pakistan’s nuclear weapons appears to have tacit endorsement of senior US officials, who are confident that the country’s nuclear weapons are safe and secure.Footnote33
There are other scenarios where nuclear weapons may detonate unintentionally, including accidentally. Although international standards vary, in the US at least, safety standard for nuclear weapons were codified in 1968, by Dr Carl Walske the assistant to the secretary of defense for atomic energy.Footnote34 This codified the probability of a premature nuclear detonation “in the absence of any input except for specified signals (e.g. monitoring and control)” shall not exceed the probability of 1 × 109 in “normal storage and operational environments” and 1 × 106 for “abnormal environments.” As part of this,
Walske also stipulated that all nuclear weapons in the stockpile must be “one-point safe”; that is, the weapon must have a probability of less than one in one million of producing a nuclear detonation if a detonation of the high explosives originates from a single point (as would likely happen in a crash or fire).Footnote35De-mated and disassembled air – and land-based weapons reduces the risk of accidental detonation, although measures taken for sea-based systems are unknown.
Although it may not be possible to match US technical safety and surety standards, especially the process of one-point safety, Pakistan has nonetheless engaged in limited co-operation with the US on best safety and surety practices. This co-operation appears to have begun under the George W Bush administration (2001–08), although it is unclear if co-operation continued after 2011 when US-Pakistani relations took a downward trend. Further clarification on any further steps such as efforts to make their weapons one-point safe, or the presence of Safeing, Arming, Firing, and Fusing (SAFF) procedures which require a weapon “to undergo a specific sequence of changes in altitude, acceleration, or other parameters” before it can be armed, would give greater confidence in this area.
International transport
Part of any nuclear programme requires the transportation of nuclear material and assets, thus IAEA Fundamental Principle B notes that national security regimes must also extend when transporting nuclear material internationally. Clearly Pakistan does not seek to transport its nuclear material or assets internationally although – similar to other nuclear-armed states – the country will need to transport material and equipment internally.
Little information of these operations is available although the prevailing impression is that when transporting by road, Pakistan seeks to mitigate risk by “hiding in plain sight” and that, as a precaution, the Pakistani military “maintain[s] strict secrecy over the location of storage sites and to transport and deploy weapons clandestinely rather than in convoys that have a stronger, highly visible security profile.”Footnote36 The rationale for this is appears to be that “[t]hese security precautions produce fewer visible signs of movements, thereby lowering the risks associated with possible theft of, or attack on, weapons at their most vulnerable point, in transit.”Footnote37 Though such tactics have been criticised for inviting additional risk, it is clear that when transporting material there is more than meets the eye. For example, security requirements for the transportation of civilian nuclear materials are outlined by Pakistan’s “Regulations on Physical Protection of Nuclear Material and Nuclear Installations (PAK/925),” which applies “to all aspects of physical protection of nuclear installations and nuclear material in use, storage and during transport.”Footnote38 Before shipments take place, consignors must enact Transport Security Plans, which include considerations of potential threats via the Design Basis Threat (DBT) process (discussed below).Footnote39 Given that the SPD is responsible for both military and civilian facilities, though not detailed, the authors consider it reasonable to assume that such steps also inform the movement of military-related material.
Moreover, road transportation remains a pragmatic solution to the need to move material and Pakistan is not alone in transporting nuclear material by road, indeed the use of non-descript trucks appears similar to US practice. Here, transportation of nuclear weapon components and material is performed by the Office of Secure Transportation (OST), part of the US Department of Energy.Footnote40
Assignment of physical protection responsibilities
A further requirement of the IAEA’s physical protection regime is the clear delineation of responsibility. Accordingly, “[t]he state should openly define and assign physical protection responsibilities within all levels of involved” and that “Clear lines of responsibility should be established and recorded between the relevant entities especially where the entity responsible for the armed response is separate from the operator.”Footnote41
In accordance with international standards, Pakistan’s evaluation of physical protection standards is informed by its DBT assessment, wherein the capabilities and motivations of non-state actors are considered. The DBT is discussed in more detail below, but at civilian facilities licensees are responsible for developing “capabilities to detect, delay and respond to neutralize threats up to and including the Design Basis Threat.”Footnote42 Given that the SPD is responsible for security operations at both civilian and military nuclear sites, it is reasonable to assume that a common set of security assessments and standards to both particularly because since 2000, Pakistan has operated a strongly centralised organisational structure that, from a security perspective, only distinguishes between civilian and military organisations at the SPD Security Directorate level. This is distinct from national nuclear fuel cycle operations which, despite some overlap in infrastructure (namely fuel fabrication), largely keep civilian and military roles separate.
As noted, Pakistan’s Strategic Plans Division (SPD) is the NCA’s secretariat, located at Joint Services Headquarters. Since its establishment, the Division has become a powerful organ that systematically controls all of Pakistan’s designated strategic organisations Figure 2.Footnote43
Figure 2. Organisations under SPD control (authors).
In addition to implementing NCA decisions, the Division formulates Pakistan’s nuclear weapons’ strategies and controls the country’s NC3 system; as well as engaging in day-to-day activities such as training, education, and briefings on nuclear-related matters. In effect, Pakistan has a centralised administration that controls both military and civilian elements of the country’s nuclear enterprise. One benefit of having a single entity responsible for protecting both military and civilian sites is administrative coherence and procedural standardisation between sites. It also provides a pathway for transferring international best practice from the civilian sphere, into the military sphere. Indeed, in speaking with the authors, Brigadier (R) Dr Naeem Salik, now Senior Research fellow at the Centre for International Strategic Studies (CISS), confirmed that although the Pakistan Nuclear Regulatory Authority (PNRA) has no direct access to classified programmes or weapons-related facilities, the PNRA forwards a checklist of guidelines to the SPD. These are then reviewed by the SPD along with relevant organisations such as Kahuta Research Laboratories (KRL) or the PAEC Figure 3.Footnote44
Figure 3. Organisational structure of SPD. Credit: F. Khan, Easting Grass.
The SPD is a large organisation and within it, responsibilities for overseeing the security of designated strategic organisations are overseen by the SPD’s Security Division, which is headed by a dedicated Two-Star General. Physical security of each designated strategic organisation falls to the Security Division’s various Security Directorates, with responsibility for civilian and military-related sites appearing to be divided at the Directorate level.Footnote45
In this context, Tertrais and Lavoy both visualise Pakistani sites having three “rings” of security. The first is within each facility itself with SPD personnel responsible for physical searches, NMAC protocols, etc.; while the second ring is formed of physical means (Limited Access Areas, physical barriers, etc.).Footnote46 Outside of each site, the third ring of security is provided by a wider intelligence effort. Here, and also contained within the Security Division, are other Directorates responsible for other tasks such as counter-intelligence, and personnel reliability.Footnote47 The Counter Intelligence Directorate “essentially coordinates with all intelligence agencies about any external threats.”Footnote48 This includes the Pakistan’s Inter-Services Intelligence (ISI) Directorate which effectively “forms the outermost ring of security and works closely with the security division.”Footnote49 In this sense, there is a clear delineation of responsibility for roles and responsibilities.
Current force numbers are unavailable although in 2013 the SPD’s Security Directorates collectively deployed an estimated 20,000 personnel, with a projected future strength of 28,000 personnel.Footnote50 This includes a “Special Response Force (SRF) which has a rapid air lift capability based on dedicated aviation resources.”Footnote51
The division between legal and operational responsibilities is similar to other countries such as the UK where operators are legally responsible for PPS provision, but where operational responsibility for civil nuclear sites is ascribed to the Civil Nuclear Constabulary. Here, there is a potential tension between the two entities, and overcoming this depends on a co-operative relationship between the two. Authoritative Pakistani sources note that the two organisations “coordinate closely” and that the two “complement each other by sharing best practices.”Footnote52
Legislative and regulatory framework
As part of their security regime requirements, states are responsible for “establishing and maintaining a legislative and regulatory framework to govern physical protection.”Footnote53 This should include an independent competent authority, as well as a system of evaluation and licencing. On the civilian side, Pakistan’s competent authority is the PNRA. Here, standards of physical protection outlined via regulations PAK/925, which are publicly available and show alignment with international standards such as NSS 13.
Although Pakistan has made its civilian legislative and regulatory framework available, little information is publicly available on the military side. Pakistani officials frequently assert that their security regime conforms with international standards, with its 2020 Nuclear Security Regime document noting that Pakistan “has established a comprehensive and effective national nuclear security regime which is at par with international standards and guidelines.”Footnote54 This can be validated with civilian regulation and given international cooperation with the US (see below) and the centralised nature of the country’s nuclear organisation, it is highly likely that international standards and concepts have diffused across the SPD regardless of whether they are applied to military or civilian sites.
However, whereas civilian facilities are regulated by the PNRA no equivalent department within the SPD has been identified. One possibility is that the SPD’s Evaluation and Analysis Directorate, within the Security Division may fulfil this role. However, this remains unconfirmed, as does the presence as an independent “regulator” for military-related sites. Should one exist, good practice calls for a separation of reporting lines to remove conflicts of interest, i.e. that it is based outside of the SPD, similar to how Pakistan’s Strategic Export Control Division (SECDIV) reports to the Ministry of Foreign Affairs (MFA). Increased transparency over the SPD’s internal inspection and regulatory regime would help give greater confidence that standards are being adhered to.
International cooperation and assistance
Unlike civilian nuclear technology, where states are encouraged to co-operate and assist each other, nuclear weapons’ states face an opprobrium on nuclear proliferation. Pakistan has a chequered proliferation history, with AQ Khan both stealing sensitive information from the Physical Dynamics Research Laboratory, a subcontractor to the URENCO enrichment consortium, and then going on to sell indigenised versions of that technology to North Korea, Iran, and Libya.Footnote55 The 2004 revelation of Khan’s nuclear smuggling was a source of national embarrassment to Pakistan, which has since undertaken numerous measures to prevent similar occurrences. Perhaps the most effective measure has been the rationalisation of the country’s strategic organisations under the NCA, although this predates the 2004 revelation. Previously organisations such as KRL and the PAEC were encouraged to compete against each other to drive forward Pakistan’s national weapon programme and, as such, were given considerable autonomy by successive leaders.Footnote56 This autonomy was a key factor in AQ Khan’s activities thus the subordination of strategic organisations under the NCA effectively reasserts centralised control over the country’s nuclear organisations.
In addition, Pakistan has tightened industry controls, promulgating the Export Control Act on Goods, Technologies, Material and Equipment related to Nuclear and Biological Weapons and their Delivery Systems (Strategic Export Control Act) on 23 September 2004. This strengthened export controls on sensitive and dual use goods/technologies. Additionally, pursuant to the 2004 Act, the Strategic Export Control Division licencing authority was established in 2007 at the MFA. Headed by a Director General, it is organised into three directorates each related to policy, licensing, regulations, and enforcement, including investigations and prosecutions.Footnote57
On the other side of the coin, Pakistan has been offered technologies to help enhance the security of its nuclear weapons. According to Feroz Khan, in 2001, then US Secretary of State Colin Powell offered nuclear security assistance in the form of training and technology transfer, seemingly of safety and security mechanisms such as PALs. According to Khan, “[t]he SPD carefully examined the offer and accepted training but declined technology transfers, which they perceived as intrusive, or likely to compromise program secrecy.”Footnote58 Following this, Pakistan has developed its own system of PALs,Footnote59 while Khan also notes that “[s]ince then, Pakistan has benefited from advanced-level training from U.S. national laboratories and has improved its best practices in accordance with its own security culture.”Footnote60 Although the details of the Pakistan’s safety and security measures for its nuclear weapons programme are largely missing from the open sources, aspects of Pakistan’s engagement until at least 2011 in improving its nuclear management and safety and security matters appears to have been acknowledged by US government officials.Footnote61
Identification and assessment of threats
IAEA Fundamental Principle G notes that “the State’s physical protection should be based on the State’s current evaluation of the threat.”Footnote62 In practice, this necessitates states to regularly produce a national risk assessment that, in turn, informs the Design Basis Threat. The DBT “describes the capabilities of potential insider and external adversaries who might attempt unauthorized removal of nuclear and other radioactive material or sabotage,” and forms the criteria against which an operator’s Physical Protection Systems (PPS) are designed and evaluated against.Footnote63 No single security system is designed to defeat the threat outlined by the DBT, instead security systems have specific Concepts of Operations such as enabling the detection of intruders, providing delay to allow for an effective response. For example, fences are designed to help delay intruders and work in conjunction with other detection measures. If a fence is scaled, but intruders are detected, and sufficiently delayed in the process, that fence has still met its intended purpose – despite being scaled. When various security systems are brought together, they should collectively be able to defeat the threat represented by the DBT. Not all threats are covered by the DBT process, and the state (rather than the operator) is responsible for defeating threats “beyond the DBT.” According to the Pakistani Foreign Ministry, Pakistani PPS has been designed for a 5-D mission, where Pakistani PPS and response forces will deter, detect, delay, defend, and destroy adversaries.Footnote64 Moreover, Pakistani officials also note that the country has comprehensively applied DBT approaches to all “nuclear and radiation facilities and for [the] transportation of nuclear and radioactive material.”Footnote65
In examining the security of Pakistani nuclear sites, many analysts emphasise the country’s trouble with domestic terrorism.Footnote66 Indeed, beginning in the early-2000s Pakistan suffered a wave of terrorism, that saw numerous large scale and high-profile attacks across the country, including at least six attacks involving sites related to the production or basing of nuclear weapons and their personnel:
A November 2007 suicide attack killed seven PAF staff travelling between Mushaf Mir Airbase and the Central Ammunition Depot, Sargodha.Footnote67 Both sites have been associated with Pakistan’s nuclear programme.Footnote68,Footnote69
A double bombing in August 2008 killed 64 people in Wah cantonment.Footnote70 One explosion took place outside the Pakistan Ordnance Factories (POF), which is believed to house the Gadwal Enrichment Plant.Footnote71
In July 2009, a bus carrying KRL workers was attacked by a suicide bomber at Choor Chowk, Peshawar Road.Footnote72
In October 2009, the Minhas air force base in Kamra was attacked.Footnote73 The site is widely assessed to host Pakistani nuclear weapons, although the attacker is reported to have detonated a bomb at “a checkpoint on a road leading to the complex,” rather than the base itself.Footnote74 Pakistani officials deny that the site hosts nuclear weapons.
In December 2010, militants attacked a Pakistan Aeronautical Complex (PAC) school bus, in Kamra.Footnote75 PAC has also been associated with the country’s nuclear programme.Footnote76
In August 2012, the Minhas air force base was attacked again. This time attackers gained access to the air base, damaging one aircraft, but did not reach the hangars.Footnote77
Although unsettling, it should be noted that of the six attacks, only one appears to have involved the penetration of a site’s secure perimeter, with the remaining five attacks focusing on “soft targets” including site perimeters, but also staff and families when travelling. Furthermore, although Pakistan’s PPS may have failed in its deterrence mission, it succeeded in its detect, delay, and defend missions. Despite the high human cost of these attacks, this still protected people and the environment from unacceptable radiological consequences, and/or the theft of nuclear technology, thus was arguably successful in this regard.
Motivating factors also form part of the DBT assessment and it is important to recognise the context and timings of attacks. For example, although Pakistan has long experienced terrorism, attacks escalated significantly between 2008 and 2014. Here, an estimated 11,500 attacks took place across the country, including numerous military and government sites.Footnote78 These were primarily in retaliation to the counter-terror operations being conducted in Pakistan’s then Federally Administered Tribal Areas (FATA, now merged with the Pakistani province of Khyber Pakhtunkhwa) and in the borderlands of Afghanistan. However, the turning point came in 2014 after the Pakistani Taliban – also known as the Tehrik-e-Taliban Pakistan (TTP) – attacked the Peshawar Army Public School, killing more than 130 schoolchildren.Footnote79 This prompted Pakistani authorities to launch Operation Zarb-e-Azb – a comprehensive National Action Plan named after the sword of The Prophet Muhammad – against terrorism and extremist ideology in the country’s Tribal Areas.Footnote80 Since 2014, the numbers of terrorist attacks within Pakistan have fallen significantly,Footnote81 although as noted by the Brookings Institution, terrorism in Pakistan may have declined “but the underlying roots of extremism remain.”Footnote82 As such, Pakistani authorities must remain alert to large scale and high-profile attacks by well organised and equipped adversaries, and continually adapt their DBTs in light of new evidence.
Despite the apparent successes against domestic terrorism, attacks against Pakistan’s nuclear sites and personnel do suggest an area of potential weakness in Pakistan’s security arrangements; particularly as the ability to identify either travel patterns and/or areas where nuclear-related staff congregate could be exploited for coercive means. If staff can be identified for attack, they may also be coerced into becoming “insiders.” Wider intelligence efforts, fall outside of the SPD’s “protective rings,” instead being the responsibility of other intelligence agencies such as the ISI.Footnote83
Insiders have been a real concern to Pakistani authorities. For example, the close relationship between Umma-Tameer-e-Nau (UTN) and al Qaeda and the Taliban raised concerns of a “WMD for hire” network, that would sell nuclear technology to extremist non-state actors.Footnote84 Ostensibly founded for relief and reconstruction activities in Afghanistan, UTN was founded by Pakistani nuclear scientist Sultan Bashiruddin Mahmood. However, in October 2001 Mahmood and Chaudhry Abdul Majeed (a fellow nuclear scientist and UTN founding member) were arrested by Pakistani authorities.Footnote85 It was later revealed that they had discussed nuclear weapons with Osama bin Laden.Footnote86 To prevent insiders, today, in Pakistan applicants undergo vetting procedures before joining sensitive organisations staff, undertaking either the Personnel Reliability Programme (PRP) for military roles, or the Human Reliability Programme (HRP) for civilian roles. Screening involves four of Pakistan’s intelligence agencies and, according to Tertrais, “Unsurprisingly, checks are said to focus on finances and religious beliefs.”Footnote87 Screening is repeated every two years. These programmes have had some impacts – for example, in 2015 Retired Brig Tahir Raza Naqvi noted that staff had been removed as a result of failing PRP requirements.Footnote88 These were presented as examples of successes, rather than failure through the presence of insider threats.
Nonetheless, PRP is not fool-proof. For example, in May 2019 two army officers and one civil officer from a strategic organisation were convicted for spying. This includes engineer Wasim Akram who at the time was employed by NESCOM, where he had a role in developing the Shaheen-II and Shaheen-III missiles.Footnote89 After being investigated for unexplained wealth, Akram went onto implicate Lieutenant General (retired) Javed Iqbal and Brigadier (retired) Raja Rizwan who received 14 years’ imprisonment and the death penalty, respectively.Footnote90 This raises questions about the efficacy of Pakistan’s vetting programme, and whether Pakistan’s periodic security assessments would benefit from additional measures, such as improved nuclear security culture wherein employees (rather than security professionals) form the first level of defence through reporting suspicious activity.
As noted by Sarah Mullen’s pioneering work on nuclear security, “clearance cannot be expected to provide full assurance of future trustworthiness because any number of factors can impair employee stability and reliability after hire.” Instead, “Behavioural observation appears to pick up where screening leaves off by providing a post-employment means of recognizing and dealing with instability or aberrant behaviour in employees.”Footnote91 Such behaviours are only observable within the system of cultural norms and it is likely that only those belonging to the Pakistani culture would accurately identify the difference between a pious individual and one with radical streaks. It is unclear if Pakistani authorities make use of behavioural observation specialist teams. If not, it is most likely that fellow employees will be the first to notice if a fellow employee is acting suspiciously – for example through unexplained wealth – or if there are changes to an individual’s dress code, appearance, vocabulary, social practices, or changes in lifestyle that would indicate a change in social attitudes. As such, to better counter “insiders,” assessing and improving a site’s nuclear security culture will further strengthen these reliability programmes. See Sustaining the physical protection regime section below.
Risk based physical protection systems and measures
As noted, at a minimum, physical protection has three main concepts of operations, namely the detection and delay of intruders, and the aiding of an appropriate response. Each protection function should use a graded approach that “tak[es] into account the current evaluation of the threat, the relative attractiveness, the nature of the nuclear material and potential consequences associated with the unauthorized removal of nuclear material and with the sabotage against nuclear material or nuclear facilities”;Footnote92 and “Defence in Depth” which includes “a designed mixture of hardware (security devices), procedures (including the organization of guards and the performance of their duties) and facility design (including layout)” to achieve this graded approach.Footnote93
Pakistan’s 5-D mission includes
response to, [and] equipment and procedures intended to prevent, detect and extend delay and appropriate response to neutralise a malicious act. This includes installation of intrusion detection systems, access control systems, delay barriers and search systems and Central Alarm Station[s].Footnote94Indeed, although specific details are not discussed, satellite imagery analysis of Pakistani nuclear facilities frequently depicts the security measures in place.Footnote95 In conjunction with its 5-D mission, Pakistan has enacted Nuclear Material Accounting and Control (NMAC) systems since 2003/4, supported by regular and surprise inspections to ensure accountability and verification.Footnote96 These steps are considered holistic and effective by Pakistani authorities, with the MFA describing the national approach as having a “complete methodology encircling physical security, safety, accountability and verification.” (Sustaining The Physical Protection Regime)
After establishing a physical protection regime, states should take steps to ensure that systems are sustainable and effective over time. Sustainability includes four main strands, including culture, quality assurance, confidentiality, and sustainability programmes.
Regarding culture, it is apparent that states may establish robust physical protection measures, but if they are not properly maintained they will become ineffectual. Such issues were key factors at the 2012 break-in of the Y-12 nuclear facility by three elderly anti-nuclear protestors in the United States.Footnote97 To this end, Pakistani officials assert that “a robust security culture” has evolved in Pakistan, which “helps in strengthening and sustaining the national nuclear security regime.”Footnote98 Little official information about Pakistani nuclear security culture has been published, although in 2009 Feroz Khan described the transition from a security culture that emphasised protection from external threats, and was “originally designed to protect the autonomy of the scientists so that their work could continue unhindered” to greater awareness of security culture after 11 September 2001.Footnote99 According to Khan, after the 9/11 attacks Pakistan instigated personnel reliability programmes, systems for NMAC, increased safety and security procedures for weapons and began a Nuclear Security Action Plan (NSAP), overseen by the PNRA.Footnote100 When elaborating on NSAP in 2016, former SPD Head Khalid Kidwai stated that, Pakistan had implemented its NSAP “to manage radioactive sources, secure orphan sources, detect radiation, and prepare for emergencies.”Footnote101
Although noteworthy, nuclear security culture encompasses more than legislative, regulatory and procedural changes and instead reflects a workforce’s attitudes and approaches towards nuclear security. Nuclear security culture is namely “[t]he assembly of characteristics, attitudes and behaviour of individuals, organizations and institutions which serves as a means to support and enhance nuclear security.”Footnote102 As with other states, awareness and curation of this interpretation of nuclear security culture appears to be relatively new in Pakistan, and Feroz Khan’s description of security culture reflects a now-outdated understanding of the term. In accordance with IAEA Fundamental Principle F, “[a]ll organizations involved in implementing physical protection should give due priority to the security culture, to its development and maintenance necessary to ensure its effective implementation in the entire organization.”Footnote103 Indeed, efforts to increase awareness of nuclear security culture have been undertaken in Pakistan’s civilian programme – for example, in April 2018, the PNRA hosted an “International Workshop on Nuclear Security Culture in Practice.”Footnote104 Amongst other objectives, this sought “to highlight the importance of nuclear security culture to ensure an effective nuclear security” and “enhance basic understanding and [sic] concept of the nuclear security culture.”Footnote105 In addition, efforts have been undertaken to sensitise students at an early stage of their career, such as on the Pakistan Institute of Engineering and Applied Sciences’ (PIAS’s) Master of Science in Nuclear Engineering Program.Footnote106
Though further efforts will likely be undertaken, at present the available evidence suggests that curation of nuclear security culture is an under-developed area in Pakistan, as do reviews of websites of key civilian organisations. Although Pak/225 requires that licensees “shall give due priority to the security culture, its development and maintenance necessary to ensure its effective implementation in the entire organization,”Footnote107 there is little public evidence that this has been the case. For example, a review of the PNRA website made few references to culture, mainly in the context of safety culture. A similar result was seen on the PAEC website where a search of the term “culture” saw few returns, with those references also pertaining to safety or quality culture.
In addition, Fundamental Principle J notes that states should establish “a quality assurance policy and quality assurance programmes … with a view to providing confidence that specified requirements for all activities important to physical protection are satisfied.”Footnote108 Here, regulations within PAK/225, requires a “quality assurance policy and quality assurance programme shall be established and implemented with a view to provide confidence that specified requirements for all activities important to physical protection are satisfied.”Footnote109
To help sustain and build its human technical capacity, in 2014 Pakistan announced the creation of its Pakistan’s Centre of Excellence (CoE) in Nuclear Security. The Center consists of three affiliated organisations, but which remain subordinate to various bodies within the SCO. These organisations include:
Pakistan Centre of Excellence for Nuclear Security (PCENS: subordinate to NCA);
National Institute of Safety and Security (NISAS: subordinate to the PNRA); and
Pakistan Institute of Engineering and Applied Sciences (PIEAS: subordinate to the PAEC).
The COE is regarded by Pakistan as “an exceptional” development and as a further demonstration of the country’s commitment to augmenting nuclear safety and security.Footnote110
In addition to establishing training schools, Pakistan has established several specialised laboratories to design and test its security measures. Since 2012, PCENS has hosted specialised laboratories such as the Physical Protection Exterior Laboratory (PPEL – established April 2016) and the Physical Protection Systems Laboratory (PPSL);Footnote111 while NISAS hosts the Physical Protection Interior Laboratory (PPIL), as well as the Radiation Detection Equipment Lab, Interior Intrusion Detection Sensors Lab and an Access Control Systems Lab.Footnote112,Footnote113
To ensure the viability of any security regime, security concepts must extend to information security, and the non-disclosure of information that could compromise physical protection measures. According to the IAEA’s Fundamental Principle L: Confidentiality, “The State should establish requirements for protecting the confidentiality of information, the unauthorized disclosure of which could compromise the physical protection of nuclear material and nuclear facilities.”Footnote114 As noted, Islamabad has severely restricted the autonomy of its strategic organisations – rationalising the traditional PAEC and KRL rivalry, and subordinating both to the SPD. Moreover, like other nuclear-armed countries, Pakistani nuclear scientists are restricted from travelling abroad, and even within Pakistan, and require formal approval before talking about their work.
Lastly, the IAEA recommends that states should “establish a sustainability programme to ensure that its physical protection regime is sustained and effective in the long term by committing the necessary resources.”Footnote115 Within Pakistan considerable effort has gone into such programmes, through the establishment of individual training schools, then their consolidation into the COE. These include efforts to induct new entrants to the nuclear field, while at least one – NISAS – conducts refresher courses for existing staff.
Planning and preparedness
IAEA Fundamental Principle K notes the need for contingency plans “to respond to unauthorized removal of nuclear material or sabotage of nuclear facilities or nuclear material, or attempts thereof.”Footnote116 In the first instance, Pakistani authorities view prevention of theft as the first barrier, and nuclear sites have featured NMAC controls since 2003/4. Additionally, state authorities conduct regular and surprise inspections “to tally material production and waste in order to maintain transparency and accountability,” and, according to Feroz Khan, “special theft – and tamper-proof vehicles and containers are also used,” while both the SPD and PNRA operate radiational detection portal monitors at nuclear sites.Footnote117 These measures all form part of Tertrais and Lavoy’s first security ring.
Though the theft of a nuclear weapon is highly unlikely, and contingency plans for the theft of a nuclear weapon are unknown, the planning and preparation for Pakistan’s civilian programme suggests the country takes contingency planning very seriously. For example, Pakistan’s civilian Regulation 925 notes the requirements for contingency plans for malicious acts such as theft, sabotage, or the release or theft of material. In addition to the likely recovery efforts led by the SPD’s Special Response Force, or wider ISI intelligence operations, the country also engages in routine efforts to further limit the possibility of nuclear or radiological MORC. Within Pakistan, a National Nuclear Detection Architecture (NNDA) regulates authorised imports and exports, as well as serving to help prevent illicit nuclear or radiological trafficking.Footnote118 This reflects a wider “cradle to grave” approach, wherein bodies such as the PNRA have helped develop capabilities for the detection of radiological material. Responsibility for the detection and protection against MORC falls to the PNRA’s Directorate of Physical Protection and Nuclear Security which – according to the IAEA’s 2014 IRRS report – “has its own resources including trained manpower, infra-structure equipped with necessary equipment (including protective equipment and containers), labs, mobile-labs, etc.”Footnote119
Moreover, since 2008 Pakistan has operated a Nuclear Security Emergency Coordination Centre (NuSECC). Based in Islamabad, NuSECC was established under the NSAP and has regional offices in major cities and six emergency-response mobile laboratories to help track any illicit material.Footnote120 For events that may involve a public health risk, Pakistan has established a National Radiation Emergency Coordination Centre (NRECC), which “coordinates for the response to nuclear accidents or radiological emergencies, both nationally and abroad.”Footnote121 According the 2007 PNRA report, the NRECC
centre is equipped with necessary communication channels at national and international levels and is available round the clock to receive emergency notifications. NRECC also has its own Mobile Radiological Monitoring Laboratory (MRML) which is equipped with radiation monitoring equipment, personnel safety equipment and a system of communication with PNRA and other relevant organizations. NRECC and MRML regularly conduct drills and exercises to test their own preparedness and efficiency.Footnote122
Conclusion
After almost 20 years of sincere commitments and efforts, Pakistani officials confidently state that the country has a stout NC3 system and that the country has addressed its nuclear security concerns. Indeed, a systematic review of Pakistan’s nuclear security efforts show that since its early days, the county has moved towards an effective NC3 system, while also reorganising its strategic industries to prevent another AQ Khan-style proliferation network. Moreover, increasing concerns since 2001 have led to a greater emphasis on human reliability, the security of nuclear weapons as well as the sites that support their production and deployment. Nonetheless, several notable gaps in understanding remain including how Pakistan seeks to maintain negative control of its naval nuclear weapons, how standards are audited and assessed within the SPD, and how the country has sought to embed an effective nuclear security culture across all elements of its nuclear estate and related industries.
Perhaps most pressing is the apparent under-development of nuclear security culture in Pakistan. Nuclear security culture has become an increasingly recognised component of nuclear management internationally although available information suggests that Pakistani efforts to improve its overall nuclear security culture are in their initial phases. This will likely increase and mature, particularly as the country’s civilian sector increasingly engages with the concept. However, nuclear security culture goes beyond technical upgrades and security hardware and relies on the support of all stakeholders. There are four major components to enhance nuclear security culture in the country: The government which must define national standards and expectations; Leadership and management of Strategic Organisations that implement and maintain high-standards; Competent Authorities that regulate the nuclear state; and civil society that must hold all to account.
In Pakistan, there is a perception that only strategic organisations are responsible for an effective nuclear security culture, but, in reality, it is achievable only through mutual co-ordination of all factors; the government, strategic organisations, regulatory bodies, and civil society. There are various roles and responsibilities of these components which they perform during different times and situations. A strong nuclear security culture will provide a better chance to all stakeholders to participate with their constructive roles in national nuclear security policy and decision-making according to the global security environment.
Certainly, on the civilian side, as shown by the PNRA efforts on this are being made. This should be encouraged, and any results used to co-ordinate effective response by site leaderships. Publication of any self-assessment surveys will improve transparency and will add further confidence that an effective nuclear security culture is developing within Pakistan. Although a military equivalent will be harder, the authors encourage the SPD to make similar assessments and to continue its engagement with limited transparency because the image of Pakistan’s nuclear security remains heavily tarnished by its embarrassing episodes that continue to inform the prevailing negative perceptions of the country’s overall nuclear security regime.
No comments:
Post a Comment