Steve Hill paces—patrols, really— in front of four projector screens in a classroom at Sandia National Laboratories, outside Albuquerque, New Mexico. He has close-cropped hair, a straight back, and a swaggering demeanor that together suggest he’s either former military or law enforcement. If you were unsure, your doubts dissolve when you hear him call dice “a tool to determine chance-based outcome.”
The phrasing could be right out of a police report. So yeah, he used to be a cop. And now he’s a “high-risk security professional” at Sandia. On this May afternoon, Hill is standing in front of a room crowded with regulators, power-plant employees, research reactor runners, and other types who work with nuclear materials. They’ve come from all over the world to take the lab’s security training course. Through lectures, tech demos, case studies, and hands-on exercises, they learn how best to keep their radioactive stores out of the wrong hands by constructing the strongest possible protections around them. Though used for good purposes at their facilities, uranium and plutonium are uranium and plutonium—if they get out of peaceful hands and into other ones, they can do very real damage.
Hill is giving his trainees instructions for a tabletop exercise in which they will form opposing teams and game out an attack on a fictional nuclear complex, the Lagassi Institute of Medicine and Physics, where a stash of plutonium pulses at the core. The good guys will try to protect it from the bad guys, who will devise a plan to infiltrate. By playing out scenarios on paper, participants can find weak knees in their own site’s design, and dream up ways to brace them.
During my two-day stay, I’m never left alone. My chaperone, a press officer who is not permitted to be more than a few feet from me at any time, leans over and whispers, “This is getting to be more and more like Dungeons & Dragons.” She’s not wrong.
I look around the room at the attendee name cards. Each lists the person’s homeland: Australia, Canada, Congo, Japan, Lithuania, Philippines, Poland, Slovakia, South Africa, United Arab Emirates. Some people here are in charge of security at a specific facility, while others are regulators and policymakers, or plant inspectors.
Yoko Kawakubo, a woman from the Japan Atomic Energy Agency in Tokai, takes studious notes. Back home, she’s in charge of a national training course on nuclear safeguards that serves not just the island, but also emerging Middle Eastern and Asian countries. “I just started,” she tells me later. “I’m new.” And that’s true, but she’s been working for years on other nuclear security projects and on nonproliferation, both especially fraught in the only country where an actual nuclear bomb—dropped by the nation running this course—has detonated.
My attention returns to Hill as he explains the rules of nuclear D&D. Time begins, he says, when the good guys first detect the bad guys trying to penetrate Lagassi. “I have an AK-47,” he says, pretending to be a bad guy. “I’m going to pull it out. Bang-bang. That’s a point of detection.”
Although this seems an obvious detail, the students jot it down in their notebooks. Hill closes with a final thought: “If there are an equal number of good and bad guys, the bad guys will likely win.” Because the bad guys will choose the time, place, and method—all of which they can tailor to suit the facility’s vulnerabilities. “The adversary has the element of surprise,” he says. The class exits and heads toward other rooms, where we’ll play the game.
The exercises are Kawakubo’s favorite part of the course, she tells me. Practice makes perfect, she believes, and there’s only so much of that you get in real life. Plus, she relishes the opportunity to ask questions of people who aren’t new to this. “During lunchtime, I always interrupt my leader,” she says.
Kawakubo and her 49 classmates are far from the first scholars of this strange discipline. In fact, this is the 40th anniversary of the program. Formally called the International Training Course on the Physical Protection of Nuclear Material and Nuclear Facilities, it began in 1978, when Congress passed the Nuclear Non-Proliferation Act. The legislation focused on limiting the breeding of nuclear weapons while simultaneously fostering peaceful uses of atomic energy. That’s a tough balance to manage, because while only some radioactive material is pure enough to be called weapons-grade, nearly any radioactive material can be used to make some kind of weapon.
The act also demands that the U.S.—as the country that officially set off the nuclear-arms chain reaction—shoulder some international responsibility. To wit, “the Department of Energy … shall establish and operate a safeguards and physical security training program,” it declares.
To create and run the course, the DOE looked to its national labs. The government had founded many of the research centers during the Manhattan Project, which developed Little Boy and Fat Man, both dropped on Japan. The labs have since helped create a host of other bombs that were detonated in the desert or still sit in silos. Sandia National Labs generated the nonnuclear parts of that first weapons initiative.
Sandia comprises a sprawling complex, much of it inside the gates of Kirtland Air Force Base. Its low, bland buildings, a mix of brick and cement fashioned into the rectangles popular on 1970s college campuses, spread over open terrain dotted with bunkers and the occasional wind tunnel. To the east, the Sandia mountains—so named because, like the desert, they turn watermelon-pink during sunset—loom over the flat floor, looking like they’re lit from within. This lab leads the others in expertise about physical protection: how to keep people physically away from your valuables—your uranium, your armory, your people. That’s why it hosts this training course. Additionally, the instructors are experts in transportation security, nuclear safeguards, international policy, and risk management.
Nowadays, the course is co-sponsored by the National Nuclear Security Administration, which responds to atomic emergencies around the world, and by the International Atomic Energy Agency, a United Nations–affiliated group that fosters peaceful nuclear technology.
Kawakubo and her peers work on those applications—the kind that make energy for cities and scientific data for physicists. So it’s a little strange for them to contemplate the violence that others could invoke. Kawakubo says that up until the 2011 earthquake that took down the Fukushima reactor, her country was experiencing a nuclear renaissance and people had pretty positive feelings about it. “The fear was not so big for the public in that period,” she says. “We had some kind of mood that we should promote nuclear power.” Fukushima left people feeling warier. And not without reason. Now, Kawakubo has to think through all the other things that could go wrong.
As the five game groups edge toward their tabletops, I decide to use the bathroom before the exercise starts. My chaperone insists she has to come with me and stand outside my stall door. I joke about escaping through the window, and she counters, very seriously, that I’m not allowed in bathrooms with windows, so that won’t be a problem.
We can debate the necessity of restroom guarding, but the course itself is more important than most people realize. It turns out the IAEA has logged 1,174 incidents of confirmed or likely acts of trafficking nuclear material between 1993 (just before it established its database) and 2016. Those are only the ones they know about. Besides that, there have been 1,894 incidents of unauthorized transport of nuclear material. Today, trainees practice on paper how to guard against it.
I follow a group of nine led by Robert Bruneau, a tall guy with a closed-mouth smile, who specializes in the cybersecurity of nuclear power plants. He stands outside the circle of students, who begin to set little plastic Army figurines on a blueprint of the Lagassi Institute—half of them representing the invaders and half the protectors.
On a big sheet of paper taped to the wall, a sample attack plan shows, in neat columns, what the bad guys might do: Drive up, use a ladder to climb the barrier wall, approach the inner facility on foot. The good guys, in their own columns, start to track how they will react. For each step, both sides slide the plastic figures around the blueprint.
When it’s time to get away, a trainee playing one of the bad guys takes Matchbox cars out of a Ziploc bag, and like a child playing Quiet NASCAR, rolls the vehicles toward the facility.
“Wait,” the team referee says. The cars brake. “Are those blue squares buildings?” he asks, referring to shapes on the blueprints.
“Yeah,” the driver says.
“You can’t drive over them,” the referee responds. It’s a strange reminder that this is all just a representation, for pretend. Nonetheless, we still have to follow all the rules.
In another room nearby, led by instructor Matt Erdman, who is a Sandia physical security expert, the bad-guy team’s plan is also taped up, and also involves Matchbox cars: “1. Run to wall 2. Jump wall 3. Into car 4. DRIVE INTO SUNSET.”
Right after I walk into this second scenario, the red (bad) team reaches the inner door and rolls the 10-sided die—the tool to determine chance-based outcome—to reveal whether a gunshot kills a blue team member (yes). Then a blue shoots a red. Roll the die. Red dies. Another die roll. Another blue dies. The bad guys push on, breach the vault, and grab Lagassi’s radioactive material.
Jeana Lee Sablay, a research specialist at Philippine Nuclear Research Institute, picks up the die and tapes it to the red team’s escaping plastic man. “The plutonium,” she explains, smiling.
It is key, students learn, to detect intruders as soon as is possible; the farther away you can see your trespassers coming, the better. Build a better detection system, station more cameras and more guards. Next, they should delay the thieves so as to increase the time between trespass and actual encounter with radioactive material. More walls, more fences, more locked rooms. Separate your valuables so it’s harder for the bad guys to grab and go. That can mean the difference between figures carrying a radioactive die into the world or being carted into court (or coffins, if we’re being morbid). Unfortunately, at the close of this exercise, the bad guys DRIVE INTO SUNSET.
The next day, everyone returns to learn that perhaps the problem isn’t always a red team trying to drive off into the sunset. Perhaps it’s just a guy who wears a red shirt, a guy you see every day, simply doing his job. Until he’s not.
“We want you to understand that there is an insider threat,” says Joel Lewis, a nuclear security specialist from Lawrence Livermore Labs. Also: You could be it. “All of us are insiders at a facility,” he continues. “They’d let us in the gate. We have the potential.”
Take Leonid Smirnov. The engineer had been with the Luch Scientific Production Association in Podolsk, Russia, for 25 years, working on reactors that supplied nuclear material to the country’s space program. In 1993, a time when post-Soviet wages were down and Smirnov was hard up, he read a newspaper article about the value of the kind of highly enriched uranium he handled every day.
He needed a stove. He needed a refrigerator. He had an idea.
He began moving minute quantities of the element into lead-lined jars when his co-workers weren’t looking. He’d take them home, stash them on his porch. He was patient, taking only amounts smaller than the facility’s error margins. When he’d done so more than 20 times, accreting more than a kilogram, he set off for Moscow, confident he’d find a buyer. Instead, authorities apprehended him at the Podolsk train station—not because they suspected him, but because he’d run into neighbors who’d been stealing batteries from their own workplace, and police searched the whole group.
A lot of nuclear villains are like this: not reprobates, merely humans who need something and see a way to get it. The gap between good and bad isn’t as wide as it seems. Which is something the International Training Course slams home hard.
It’s strange to think of a seed like that stuck in the core of our beings, waiting for a critical mass to pop through the surface. After the lecture, we all look at one another, I think, a little more suspiciously, as we leave the classroom and walk toward a facility that, until 2007, held Category I nuclear material—the kind most likely to become part of a missile. Sandia kept the place intact, with its old security measures and radioactivity containers, to help train teams like this one.
Outside, the sun beats down and blinds. We walk past a high fence and through a set of double doors, one of which has a sign warning “there has been an increase in unauthorized disclosures to uncleared individuals.” This building leads to an interior courtyard, where a walkway goes down into the old processing facility. There are metal detectors, badge sensors, pin pads, and guys with guns. This latter aspect is strangely unfamiliar to Kawakubo. She laughs nervously as she edges past them into a poorly lit room. (We learn later the firearms were fake.) A bunch of containers that look like paint cans sit on an industrial metal shelf. Tamper-evident seals resembling blue painter’s tape span their lids, pretending to protect the imaginary radioactive material inside.
This, Lewis says, is the Springfield Processing Plant. The class is to look for something amiss—anything indicating insider tampering. The students poke around, pick up the cans, set them down, and generally try to look busy. Then Kawakubo finds it: a broken seal. She walks over to a scale and discovers that the container is lighter than it should be. Radioactive material is missing—but where has it gone?
The students scour the space for the atoms that, were they real, could kill them. Soon someone finds it in an empty can, ready to be hauled out with the trash.
Lewis urges Kawakubo and her peers to think like criminals and imagine how this room abets theft. If you were an insider, how would you pull a Smirnov? And if you wanted to thwart a Smirnov, how would you do so?
Don’t put your empty cans in the same place as your full ones, the students say. Install more lights. Add cameras to the corners. Wand a Geiger counter over employees when they leave. If there’s an emergency evacuation, wand everyone once they get to the safe room.
“Your security needs to guard against mistakes—because they are exactly what an insider threat will exploit,” another instructor, Michael Tuell, tells us. And what stops people from going rogue isn’t an appeal to their moral compass. It’s knowing there’s a speed trap. “One of the things that helps everybody stay good is their chances of getting caught.”
RELATED: Why can’t we decide what to do about nuclear energy?
As everyone trudges back to the classroom, Kawakubo and I visit an area where Sandia scientists test out security systems for industry and defense organizations. Inside a gravel-covered, fenced rectangle lurks a multitude of physical protection mechanisms. We walk in front of a microwave sensor, which works like the lasers that detect intruders in bank-heist movies. Then there’s a chain-link fence crisscrossed with fiber-optic cable. If you touch it, the light’s path through the cable changes. Pretending to be heisters, we bend it before stepping into the active infrared sensor, which feels for human heat. Beware, the guide warns, the backward-barbed wire.
They don’t just proactively test equipment here, the guard points out. They also demo it to special forces so they can learn how to circumvent these same obstacles—should they, say, encounter a fiber-optic fence while infiltrating an enemy installation.
This unsettling duality—in the potential of raw elements, in the nature of everyday people—had needled me throughout the entire visit. Especially when I would get up after a lecture to toss a coffee cup into the trash can 5 feet away, and my chaperone would shadow me: When people treat you like you’re about to do something wrong—escape through a bathroom window, pocket some plutonium during a fire drill—it almost makes you want to rebel. I felt like running away only because someone treated me like I would. The surveillance made me feel not just like the authorities thought I could be bad, but like I actually might be, or might want to be.
All of us, like this technology, show one of two faces, depending on the circumstances. We could be the defenders or the infiltrators. The protectors or the threat. Plutonium powers spaceships and also explodes over cities. Bombs both defend and kill. Kawakubo smiles at our guide and nods, silent, as she places her hand in front of another sensor. It’s up to her, and her classmates, to make sure the good guys stay good—and win.
This article was originally published in the Winter 2018 Danger issue of Popular Science.
