Testimony before the United Kingdom House of Commons, CBRN Expert Parliamentary Roundtable on Ukraine
I thank the UK House of Commons for its kind invitation to present information on this important issue today to members of Select Committees.
Following from Russia’s invasion of and ongoing war against Ukraine, Ukraine’s civil nuclear energy power infrastructure poses risks that exceed those normally associated with nuclear installations and nuclear and radiological materials. The main concerns are that Russian forces may attack and/or wrest control of nuclear power reactors, directly or indirectly cause a serious or severe nuclear accident, and/or take other actions that may result in the exposure of Ukraine’s population to ionizing radiation.
Since Russia invaded Ukraine on February 24, Russia has validated these concerns by shelling a nuclear research institute in Kharkiv, and by attacking, overrunning, and occupying Europe’s biggest nuclear power station at Zaporizhzhia. Basic information about these events is documented in open sources, including official statements and reports from Ukraine’s State Nuclear Regulatory Inspectorate (SNRIU), from the International Atomic Energy Agency (IAEA), and international media.1 My remarks are intended to informally describe and assess these risks for Select Committee members.
The gravest concern about Russia’s impact on nuclear risk is that Russia might intentionally carry out a cyberattack or a physical attack against a nuclear power plant, thereby unleashing a severe accident. This potential threat must be taken seriously, because Russia has carried out indiscriminate ground and air attacks upon civil infrastructure aimed at Ukraine’s population, and because cyberwarfare against targets in Ukraine including electric power grid installations and systems have been widely attributed to Russian actors and interests. Barring other specific information about Russia’s military aims, however, it would not appear likely that Russia would intentionally destroy a nuclear power plant in Ukraine because doing that would have no military or strategic utility and might result in a radiological contamination of Russian territory.
A nuclear accident might be initiated by reckless actions of Russian forces during occupation or evacuation from a nuclear power station. Alternatively, extremist actors facing defeat and retreat might aim to inflict a traumatic “punishment” on Ukraine. The probability of such an event would depend upon the discipline of personnel and whether personnel have a clear understanding, from orders or instructions, that nuclear risks must be avoided.
Should the war continue unabated for a year or longer, other nuclear threats may emerge. These include the risk that the civilian population will be exposed to radiological sources that may be dispersed and broken by Russian air and artillery attacks on industry installations and hospitals. Also, reactors that Ukraine operates will over time require maintenance, refueling, and transport of equipment, personnel, and nuclear material. Movements of unirradiated and irradiated enriched uranium fuel may be targeted by Russian forces; attacks could interrupt supply of equipment and fuel to their destinations; should irradiated fuel be dispersed, radiation-emitting materials would threaten the environment and the civilian population.
Status of Nuclear Power Plants in Ukraine
Ukraine has 15 Russian-design nuclear power reactors at four locations generating half of Ukraine’s electricity; seven units are currently in operation. All are pressurized water reactors (PWR), designed according to engineering principles followed in most of the world’s nuclear power plants (In the UK at Sizewell B, Hinkley Point C). Most were built during the 1980s and 1990s. The 30-year operating licenses for PWRs have been or will likely be extended, permitting most of them to continue operating through the 2020s and beyond.
Ukraine is a party to the Treaty on the Nonproliferation of Nuclear Weapons, the International Nuclear Safety Convention, and other multilateral nuclear energy understandings and agreements. It is a member of the International Atomic Energy Agency (IAEA) and participates in the IAEA’s regime of nuclear safety and nuclear security reviews, guidance, and standards.
Especially during the last decade Ukraine’s nuclear power plants have been backfitted and upgraded with modern, mostly Western equipment and engineering systems. The oldest units, Rivne-1 and -2 in northwestern Ukraine, date from the 1970s. Unlike the rest of Ukraine’s power reactors these are not equipped with reinforced concrete-steel containments and are therefore more vulnerable to the threat of a severe accident with off-site radiological consequences.
All the reactors are fueled with low-enriched uranium fuel, until now mostly supplied by Russia. Ukraine has worked toward diversifying its fuel sources and spent fuel management through foreign cooperation notably with industry in the United States. Discharged spent fuel is initially stored in pools at reactor sites and until recently Ukraine has shipped PWR spent fuel to Russia for reprocessing (of some Rivne spent fuel) and intermediate storage.
Four decommissioned power reactors are located at Chornobyl, north of Kyiv near the border with Belarus. These were RBMK-design reactors, not PWRs. After a severe accident that destroyed Chornobyl-4 in 1986, the other three units were successively shut down by 2000. The remains of Chornobyl-4 are covered by an engineered “shelter.” The three decommissioned units are being dismantled. At the time of the invasion, spent fuel from these reactors, stored in a pool at the site (ISF-1), was being transferred, in an operation involving conditioning the spent fuel in a hot cell, to a nearby dry storage facility (ISF-2) licensed in 2021; the transfer of all this fuel is planned to be completed by 2030. Finally, the site hosts a new dry storage facility (CSFSF) for spent PWR fuel; it is currently undergoing licensing according to plans by Ukraine to store PWR spent fuel in Ukraine instead of in Russia.
Significant Events Since the Russian Invasion
Beginning on the first day of the invasion on February 24, Russian forces occupied the Chornobyl site, as it stood between the border of Belarus, from where Russian forces invaded, and the capital Kyiv, a prime Russian target. At Chornobyl, Russian forces apparently interfered with routine radiation monitoring and IAEA safeguards activities, and ongoing spent RBMK fuel processing and transport at the site was interrupted. Russian occupiers prevented about 300 personnel from leaving the site, interrupting routine shift operations; power supply to equipment for cooling of stored spent fuel was cut off for five days; sources at the site informed that continuity of safeguards knowledge appeared to be interrupted. In late March Russian forces left the area and in April most routine activities had resumed, however processing and transport of spent fuel has remained suspended. Ukraine’s nuclear power organization has claimed that Russian personnel were exposed to high levels of radiation during digging of trenches at the Chornobyl site; the IAEA, which in April dispatched personnel to the site, has not confirmed this allegation.
In early March Russian forces shelled and overran the Zaporizhzhia station and its six PWRs, prompting return fire from Ukraine National Guard personnel responsible for defending the complex; according to video accounts, Russians ignored warnings from plant personnel and interfered with fire-fighting at a building set ablaze by Russian attacks. According to nuclear security officials Russian occupiers threatened Ukrainian operators with dismissal and replacement by Russian personnel unless Ukrainians declared their loyalty to occupiers; these sources also said that the coolant water intake area of the station had been mined. Ukrainian shift personnel currently remain at work alongside Russian personnel introduced by Russian occupiers; Ukrainian operators have been subject to great duress and, according to SNRIU, its personnel cannot carry out direct safety oversight at the station.
At Kharkiv, Russian forces have repeatedly shelled a nuclear research center hosting a small neutron source installation fueled with a tiny amount of enriched uranium. Some equipment has been damaged, but the neutron source and its fuel so far remain intact.
Cyber and Physical Attacks Against Ukraine’s Nuclear Power Plants
The most potentially serious risks to operating nuclear power plants following from the invasion would be from Russian cyberwarfare activities and from physical attacks, especially with intent to damage or destroy the plants.
Cyberattacks
There is no open source record documenting specific cyberattacks against Ukrainian nuclear power reactors, but there are open accounts attesting to nearly a decade of cyberwarfare against Ukraine’s electric power grid. These attacks have continued since the Russian invasion began, most recently in early April. Perpetrators have used malware identified and described by cybersecurity investigators as “often aligned with Russian political interests.”
As in the case of attacks on Ukraine’s electric power grid, a postulated cyberattack against a nuclear power plant would involve malware taking control of an installation’s operating system, but the aim and the outcome of the cyberattack against a nuclear plant may be very different than an attack against grid infrastructure. Analysis linked above describe the attacks against the power grid as motivated to “send a message to the Ukraine government,” or to “politically destabilize” Ukraine. A Ukrainian cyber security expert said that Russia views such cyberwarfare activities to cut off electric power supply as part of Russia’s “preparation of the battlefield” in the Ukraine.
A cyberattack against an operating nuclear plant may involve use of malware to destabilize the reactor, imitate normal operation, and fool the plant operators to conclude that they do not need to intervene. Such an attack may fail if a plant’s operating systems detect that critical technical parameters have been exceeded. If the attack succeeds, operators may lose control of the plant and not be able to detect or effectively respond to an instigated event that could develop into a severe accident.
It is not publicly known how well-protected Ukraine’s nuclear power plants are from a cyberattack. Russia has full knowledge about the design and operation of nuclear power plant control systems and any software for operating and protecting Ukraine’s nuclear plants that had been installed at the time of power plant construction and initial operation. There may be insiders in the plant organizations who may facilitate a cyberattack. Russia may be unfamiliar with upgraded software and equipment installed after operation of the reactors began, especially during the last decade.
According to open sources, while nuclear plants may be upgraded with advanced equipment to better protect them, especially in older installations a mix of analog and digital systems in the plant might effectively alert operators of discrepancies in indicators about what is happening in the plant, providing the basis for diagnosis and detection. Most or all of Ukraine’s nuclear power plants were initially equipped with analog control systems but systems have been significantly upgraded. Experience in Ukraine with cyberattacks against the power grid suggest that installations are most vulnerable at times when fewer operators are on duty. Mock attack exercises conducted in the U.S. likewise suggested that when two or three reactor control room operators are on duty, it may not be possible for staff to diagnose plant information in near-real time; instead all efforts are concentrated on following formal procedures designed to stabilize the reactor in the case of a transient. When more operators are present, diagnosis can be carried out in near-real time, contributing to the detection of a cyberattack.
Physical Attacks
Until Russia’s invasion of Ukraine, no nuclear power plant has ever been attacked, overrun, and occupied by an invading army. There have been numerous incidents worldwide in which a small number of intruders attempted forced entry into a nuclear power station; according to some unconfirmed accounts, one such attempt took place at the Zaporizhzhia nuclear station in May 2014, when an armed group of 20 nationalists were prevented by security forces from gaining entry into reactor buildings.
When in June 1991 Slovenia declared its independence from the Socialist Federal Republic of Yugoslavia, Slovenia anticipated that its Krsko nuclear power plant might be subjected to attack by Yugoslavian forces. It then took measures to protect the plant after carrying out a threat analysis.
Slovenia identified several options for best mitigating risks associated with a postulated military attack against the installation, based on five critical safety functions:
- Subcriticality
- Core Cooling
- Heat Sink
- Primary System Integrity
- Nuclear Fuel Inventory
Based to large extent upon the specific configuration of the Krsko plant, it was decided that the least complex and most effective response to the threat of a direct military attack would be to shut down the reactor (“cold shutdown”). Slovenia concluded that in any case subcriticality could be maintained by borating of coolant water, that the option of operating in reactor refueling mode to flood the core with water would require provision of electric power for cooling (a potential vulnerability), and that the option of defueling the reactor and moving fuel into a storage pool might degrade safety and security because the pool, unlike the pressure vessel, was not located inside the reactor containment.
Nothing is known from open sources about decision making by Ukraine about what measures may have been taken to mitigate risks from a postulated attack on the Zaporizhzhia station. Before and after Russian attacks, and throughout the subsequent Russian occupation, some of the six PWRs on the site have continued to operate. The station provides one-quarter of Ukraine’s electric power. Before the invasion, most of the above critical safety functions identified in 1991 figured in efforts by Ukraine after the Fukushima accident in Japan in 2010 to upgrade nuclear plants’ defense against extreme external events.
Russian Intentions and Actions
Would Russia deliberately attack a nuclear power plant in Ukraine with intent to cause a severe accident as a means of achieving war aims? Absent credible information about Russia’s intentions, this appears unlikely, particularly if Russia intends to occupy and take permanent control of Ukrainian territory. Regardless of evidence suggesting that Russian forces have conducted the war recklessly and with brutality, Russia would reap no strategic value by destroying a nuclear power plant and unleashing a traumatic catastrophe. Russia could not prevent such an event from contaminating Russian territory with radioactive fallout.
Greater concern may be warranted about the prospect that, in the case of an evacuation or retreat from Ukrainian territory, Russian forces might take extreme actions including carrying out physical attacks or cyberattacks against a reactor in a nuclear power station which Russian forces do not occupy or no longer occupy. This may be a low-probability scenario, but it cannot be excluded. So long as Russian personnel are in control of a nuclear power plant, a cyberattack masterminded or approved by authorities that could cause a severe accident at the installation may not be very likely.
Nowhere in the world is the threat of an attack by invading military forces against a power reactor included in the design basis against which a plant must defend to be licensed for operation, following IAEA guidance. Reactor containments are designed to withstand certain impacts, such as the crash of a fighter aircraft and some explosive charges. Should an invading force intentionally attack a nuclear power reactor, that outcome might be thwarted by the host state’s national defenses, but the reactor containment would not be an ultimate barrier against forces determined to destroy the reactor, if necessary by carrying out repeated strikes.
Concerning the possibility that Russian actors might, independently of government or military instructions, take actions that might cause a nuclear accident, in such a case the behavior of battlefield forces and cyber-capable personnel may depend upon the authority of Russia’s political leadership and military command in enforcing restraint. In any case, the greater the stress imposed by military occupation on Ukrainian nuclear plant operators, the more likely that they will commit errors and that the nuclear safety implication of any mishaps, including any instigated by Russian personnel, will escalate.
Additional Nuclear Risks
The longer the war continues, the greater the likelihood that additional nuclear challenges and risks may arise, related to the need in the Ukraine nuclear energy program for equipment maintenance and reactor fuel cycle management, especially should Ukraine continue to operate its nuclear power plants. At least until recently, Ukraine maintained a running inventory of one forward year’s requirement for fresh nuclear fuel. Without routine oversight, spare parts, and communication and exchanges between the plant and authorities in Kyiv, plant personnel morale will decline and safety risks will rise. Ukraine’s regulator SNRIU has reported since March that it can no longer directly carry out oversight activities at Zaporizhzhia’s six PWRs and it is uncertain if and how pending scheduled maintenance will be performed. According to Ukrainian media, Russian attacks have caused damage at Ukraine’s most important nuclear equipment vendor firms in Kharkiv and Kramatorsk. It is possible that transports of nuclear material, equipment, and other items, necessary in months ahead to provide for safe and continued operation of Ukrainian nuclear power plants, might be targets of artillery and air attacks. Should a transport of spent nuclear fuel be deliberately damaged by an attack, the environment and the civilian population may be exposed to radiation.
Separately, Russia’s war also poses a threat from radiological material in nuclear sources, especially orphan sources that are not subject to regulation and control. During the 2010s, Ukraine estimated that about 500,000 nuclear sources were at large in the country. Since independence Ukraine has worked with the IAEA, other international authorities, and partner governments to account for all nuclear sources in Ukraine and subject them to oversight. Sources in use in Ukraine number in the thousands; Russian attacks on industrial facilities, hospitals, and clinics may scatter and damage sources, posing the threat of radiation poisoning to individuals who may come in contact with any opened sources following attacks.
Notes
1 For example: https://www.bbc.com/news/world-us-canada-60514228; https://www.washingtonpost.com/world/2022/04/01/ukraine-chernobyl-russia-troops-withdraw/ See also updated reports from International Atomic Energy Agency https://www.iaea.org/newscenter/pressreleases/iaea-director-general-statement-on-the-situation-in-ukraine and updated reports from the Ukraine State Nuclear Regulatory Inspectorate https://snriu.gov.ua