Faulty control at the Nuclear Material Control Center

January 22, 2016

Data leaked from Japan nuclear inspection body via Chinese software

http://mainichi.jp/english/articles/20160122/p2a/00m/0na/023000c

Unspecified data leaked from the nonprofit Nuclear Material Control Center in Tokyo last year after an employee installed Chinese-made file sharing software without permission, inviting unauthorized access from a Chinese server, according to people close to the case.

Although the chances of classified information having been leaked are low, the center's lax information control is likely to come under scrutiny.

Under the center's in-house regulations, it was obliged to report the case to the secretariat of the Nuclear Regulation Authority (NRA), but failed to do so, judging the leak did not constitute a threat to nuclear security. The NRA, which oversees the center, is questioning the public interest incorporated foundation about the episode.

According to the NRA secretariat and other sources, the employee belongs to the inspection section of the center's Rokkasho Safeguards Center in Aomori Prefecture. The regional center oversees Japan Nuclear Fuel Ltd.'s spent fuel reprocessing and uranium enrichment plants, Tohoku Electric Power Co.'s Higashidori Nuclear Power Station, and other facilities in Aomori Prefecture. Staffers at the Rokkasho center are in charge of maintaining and managing surveillance cameras and measurement equipment necessary for inspections.

The Rokkasho center's internal documents say the employee in question installed the Chinese-made file sharing software called Xunlei. The Chinese software is used to view video content but presents a high risk of information leaks.

In-house rules ban the use of file sharing software, but the employee installed the Chinese program along with other free software in April last year.

The Nuclear Material Control Center logged 12 cases of unauthorized access alone last September, and found records of data transmissions to a Chinese server. The center has been unable to find out what kind of data was leaked, but suggests that the employee's PC did not contain classified information such as on nuclear materials.

The center has worked with a private company since late August last year to keep constant tabs on communications with the outside as part of measures to fight data leaks. This outsourcing company found out about the unauthorized access, and it is possible the illicit access had been going on since before the beefed-up security policy.

The NRA secretariat employee in charge of safeguards says that the center's failure to notify the agency of the security breach is considered inappropriate, and that the agency plans to have the center tighten information controls. Kenji Murakami, president of the Nuclear Material Control Center, declined to be interviewed, saying he had no time.

Suspected data leak at nuclear inspection body

http://www3.nhk.or.jp/nhkworld/english/news/nuclear.html

Jan. 22, 2016 - Updated 12:31 UTC+1

A Japanese agency in charge of inspecting, analyzing, and processing information about nuclear material management says data may have leaked from one of its computers through file-sharing software.

The Tokyo-based Nuclear Material Control Center said on Friday that the suspected leak of data on inspection equipment occurred last September at Rokkasho Safeguards Center, in Aomori Prefecture, northern Japan.

Officials of the center said a monitoring system detected that unspecified data was being sent to outside computers.

They said an employee at Rokkasho apparently installed the software without knowing it. File-sharing software is prohibited by in-house rules.

The center did not report the case to the government's Nuclear Regulation Authority.

The center is commissioned by the authority to check whether nuclear facilities handle radioactive material properly.

Another computer at Rokkasho Safeguards Center contains important data about where plutonium is stored and when the material has been transported.

The officials said an investigation will look into whether the file-sharing software in question has been installed on other computers, and whether critical data has leaked.