1 Introduction

Since the creation and use of nuclear weapons (NW) in 1945, the risk of proliferation of equipment, materials, and knowledge related to NW has been nearly universally recognized as presenting a grave threat to international peace. The international community has put in place an elaborate architecture of institutional and technical measures to mitigate this risk. The dynamic nature of the proliferation threat requires a myriad of technical and policy solutions to help monitor changes in nuclear inventories, track movements of nuclear material, and verify the ultimate owner, location, and use of nuclear material. Distributed ledger technology (DLT) is one such technical solution under consideration for a variety of national security-related applications. While this book discusses the benefits and drawbacks of using DLT to help address a variety of international security problems, this chapter focuses on the challenges and opportunities associated with using DLT to benefit the nuclear safeguards system.

The chapter begins with a description of the legal underpinnings that dictate whether and how new technologies are accepted for safeguards use. The chapter describes the political challenges inherent in the safeguards system and discusses how political and legal questions have shaped the community’s perceptions of deploying DLT for safeguards use. The chapter ends with a discussion about the different use cases where DLT might be beneficial to safeguards while recognizing the barriers that must be overcome for the technology to be successfully deployed.

2 Overview of International Nuclear Safeguards

Proliferation risks have evolved significantly since NW technology first appeared. Over the years, while a handful of countries developed nuclear capabilities for military purposes, dozens of countries developed and applied nuclear technology for peaceful applications. Today, nuclear material like uranium, plutonium, and thorium can be found in applications such as energy generation, medical and scientific research, radiation shielding, counterweights, industrial applications, and space equipment. In the energy generation field, as of 2019, there were 450 nuclear power reactors operating in 30 countries with another 53 reactors under construction [1]. These facilities and the associated nuclear fuel cycle facilities use, process, and store nuclear material that could be misused to advance a clandestine NW program.

To help mitigate the proliferation risk posed by increasing use of nuclear material for peaceful applications, the International Atomic Energy Agency (IAEA) applies international safeguards, which refers to technical measures applied by the IAEA on nuclear material and facilities. These measures enable the IAEA to verify that States are in compliance with obligations to use nuclear material for peaceful purposes. These obligations are derived from safeguards agreements between the State and the IAEA. Through the 1960s, when the number of nuclear facilities and NM inventories was still relatively limited, safeguards agreements focused on specific facilities and on selected materials [2]. By the late 1960s, as more countries continued to conduct nuclear tests, strengthen their nuclear capabilities, and increase their NM inventories, the international community recognized the need for a comprehensive approach for ensuring the peaceful use of nuclear technology and successfully negotiated the Treaty on the Nonproliferation of Nuclear Weapons (NPT) [3]. Today, the NPT is the cornerstone of a system designed to prevent the spread of nuclear weapons and weapons technology while promoting peaceful uses of nuclear energy.

This system has grown and evolved during the past fifty years around a set of legal agreements that underpin all safeguards verification activities performed by the IAEA.Footnote 1 In accordance with the terms and conditions of these agreements, the IAEA performs verification activities such as collecting and evaluating safeguards-relevant information, inspecting nuclear installations, verifying States’ declarations of nuclear material, and verifying facility declared designs [5]. The IAEA uses a robust process to explore, evaluate and accept the use of new equipment and technologies to carry out these safeguards functions to ensure conformity with the obligations of the safeguards agreement.

Herein lies a significant challenge facing the IAEA when considering cutting-edge technologies such as DLT. The IAEA has a strong interest in introducing new technologies that could improve the efficiency and effectiveness of its safeguards implementation activities, which are performed in a severely constrained budgetary environment [8].Footnote 2 Yet, the process of integrating new technologies into the international safeguards system involves a level of complexity not found in national regulatory systems or in commercial industries. Unlike national laws and regulations, which can be developed and updated to reflect a changing environment, the obligations and requirements reflected in the model safeguards agreement [4] were carefully negotiated by the IAEA and the international community and explicitly reiterated in hundreds of safeguards agreements with very minor modifications that are tailored to meet the conditions of each State. The IAEA is unlikely to accept a new technology that would alter, undermine, or impact these carefully negotiated agreements. Moreover, the IAEA is unlikely to renegotiate hundreds of safeguards agreements to accommodate a new technology.

Thus, these legal obligations require thoughtful consideration before introducing new technologies, particularly technologies such as DLT that ostensibly disrupt safeguards verification activities. Specifically, the IAEA considers whether the benefits of introducing the technology will outweigh the potential disruption. Commercial experience using DLT to manage various industry supply chains suggest the benefits of introducing the technology for safeguards use might lead to improvements in operational efficiency, data quality, information security, and in the IAEA’s ability to monitor movements of nuclear material within and between States. The challenge facing the IAEA lies in evaluating whether the strict legal framework and political complexities inherent in the safeguards system minimize or preclude any of the benefits that are enjoyed by commercial industries. Such evaluation starts with discussion about the major legal and political questions that arise from technology deployment. Some of these questions are addressed in the following sections.

3 Legal and Political Factors Influencing DLT Acceptance for Safeguards Use

Data confidentiality is one of many legal obligations influencing DLT acceptance. The Comprehensive Safeguards Agreement and Additional Protocol, the primary legal agreements underpinning the safeguards system, clearly place an obligation on the IAEA to “take every precaution” [4] to protect the confidentiality of States’ safeguards information and maintain a “stringent regime” [7] for safeguards confidentiality. States would need to be reassured that the open nature of DLT did not compromise this fundamental obligation.

There are explicit obligations stated in the Model Subsidiary Arrangement governing safeguards implementation in each State that address the type of information that States must report as well as the expected format, deadlines, and entities responsible for reporting information [9]. As will be discussed later in this chapter, a technology that enables real-time posting of safeguards information raises questions about how States might comply with these obligations and which entities (nuclear operators or State Authorities) would be responsible for posting safeguards-relevant information to the ledger.

Additionally, the IAEA is obligated to perform its safeguards verification activities without placing undue burden on States [4]. While the rapid acceptance of commercial blockchain applications has provided insights about the costs of deployment [10], further research is necessary to determine whether incorporation of DLT into the specialized context of nuclear operations and safeguards verification would pose an undue burden.

Finally, for every technology being considered for safeguards use, the IAEA must work with nuclear operators and State Authorities to evaluate whether the technology can be applied in the State without conflicting with or violating its national laws and regulations. A technology whose functionality depends on wireless communications may not be allowed into certain nuclear facilities whose operating license precludes use of wireless communications.

This strict set of legal requirements presents only one challenge for deploying new technology into the safeguards system. Another set of challenges facing technology acceptance arises due to the complex political environment at the IAEA. The IAEA is a large and dynamic international organization that, as of April 2021, consists of 173 Member States that function by consensus. While its work is largely technical—consisting of monitoring, inspection, and information analysis—the ramifications of any negative finding are highly political. Furthermore, the IAEA is charged with verifying the compliance of the very Member States that oversee it and is staffed with people from across the globe. This type of environment breeds potential political challenges that are often entangled with concerns associated with trust and transparency.

Despite the political tensions inherent in the organization, and because of them, the IAEA’s two policy-making bodies, the General Conference and the Board of Governors, ensure the organization acts with the advice and consent of its Member States. While the Board of Governors consists of representatives of States “most advanced in the technology of atomic energy including the production of source materials,” General Conference membership consists of representatives of all Member States [11]. Recognizing their authority and power in the political decision-making process, when considering new safeguards approaches and tools, Member States demand assurance that the new approach or tool will not interfere with the Agency’s ability to remain “non-discriminatory,” “independent,” and “objective” [12,13,14]. Accordingly, the IAEA dedicates significant attention to the tools and approaches it introduces and uses in the field to ensure its verification activities are aligned with the principles of independence and objectivity [13, 14].

Thus, the political and legal structures argue against replacement of the IAEA as an independent verification body. The IAEA cannot be replaced, nor should it, as it plays a critical role in physically verifying information being reported, either via normal mechanisms or on a distributed ledger.  Yet, the first broadly accepted manifestation of DLT, the Bitcoin blockchain, was created to replace the role central authorities such as banks play in managing financial transactions.  If the application were to extend to the safeguards context, one might inquire whether DLT would replace the IAEA as the central authority in the system.  This tension between DLT’s underlying premise and the IAEA’s central role in the safeguards system has prompted skepticism within the safeguards community about DLT’s role in, and potential value to, safeguards. Furthermore, as an emerging, rapidly evolving technology, DLT’s functionality and structure is profoundly confusing and inaccessible to many, further hindering common understanding and appreciation of DLT’s potential contributions to safeguards.

Recognizing the structure and evolution of the international safeguards system, the questions that must be addressed before DLT will be accepted by the safeguards community are: (1) Does the legal system allow use of DLT given the requirements for strict confidentiality of data and the central role of the IAEA codified in the safeguards agreements? (2) Does the benefit of utilizing DLT outweigh the costs of implementation? (3) Will Member States accept its deployment? The rest of this chapter will discuss a variety of issues touching on DLT’s legal, technical, and political feasibility.

4 Technical Factors Influencing DLT Acceptance

Regarding the first question, we have established in this chapter that the existing legal system presents a rigorous set of parameters for introducing new technologies. Without further exploration and negotiation with States about potential DLT deployment, it remains unclear whether these strict parameters will preclude use of DLT for safeguards. However, there is an opportunity within the legal framework to explore the benefits of new technologies that could improve the effectiveness and efficiency of safeguards verification. A provision within the CSA enables the IAEA to “take full account of technological developments” to improve the efficiency and effectiveness of its activities [4]. As this provision gives the IAEA space within the confines of the legal system to explore potentially beneficial technologies, such exploration must start with an evaluation of the technology’s functionality and performance to determine whether States and their operating facilities are likely to accept its use.

Every technology accepted for safeguards use undergoes rigorous testing and evaluation by both the IAEA and Member States’ Support Programs, some of which specifically develop and test new equipment and tools for IAEA use. This testing and evaluation process can last many years. For example, the IAEA took approximately five years to develop, test, and deploy two commonly-used surveillance systems, such as the Digital Cherenkov Viewing Device and the Electro-Optical Sealing System. As part of this process:

the IAEA defines the safeguards needs, coordinates the support programmes, and tests and evaluates the techniques and the resulting equipment developed. All aspects of equipment performance are evaluated, including compliance with specifications, reliability and transportability, and, most importantly, suitability for use by IAEA inspectors in nuclear facilities. The IAEA has an established quality assurance procedure to authorize equipment and software for routine inspection use [15].

Future acceptance of DLT for safeguards use would require a similar evaluation process but may require more extensive consideration since it would not be an incremental improvement like a new seal or verification device. Thus, before making the decision to invest, the IAEA has capitalized on the opportunity to monitor DLT’s performance in safeguards and non-safeguards applications through technical meetings involving Member State participation and more intimate discussions with experts in DLT and international safeguards [16,17,18]. Since any implementation of DLT would likely require investment on the part of Member States it will be necessary to include as many Member States into the discussion as possible. Looking forward, this discussion will likely evolve to focus on questions about the level of acceptance that will be required for successful deployment. For instance, does the use of DLT in safeguards implementation require the participation of all States with safeguards agreements or can it be a subset of all States? Should or can the IAEA impose a specific reporting mechanism on States? As discussed earlier, the answer is likely no, making broad Member State acceptance of DLT acceptance critical.

Thus far, several successful commercial applications of DLT, including, banking, supply chain management, healthcare, real estate, voting, and energy industry, have indicated the technology functions as promised, providing users with greater capabilities in data confidentiality, asset tracking, and auditing [19]. During the last two-to-three years, researchers have begun to develop several prototypes for safeguards use, bolstering the argument that a ledger designed for safeguards purpose also might be technically possible [20, 21]. However, a number of highly visible failures, such as the attack on Coinbase’s Ethereum Classic cryptocurrency and the flaw in the smart contract governing the Decentralized Autonomous Organization that enabled the attacker to steal more than USD $60 million in cryptocurrency, have raised questions among skeptical communities of DLT’s sustainability as a long-term solution [22].

Despite these failures, the IAEA’s increasing challenge of managing, validating, evaluating, and protecting large data streams makes continuing research into information management and data security technologies, including DLT, compelling and necessary. The IAEA was, is, and will continue to be, inundated with data [23, 24]. “Between 2010 and 2017, the amount of nuclear material under IAEA Safeguards increased by over 20%. In 2017, Safeguards staff operated in 182 States, compared with 176 States in 2010, and conducted more than 2000 inspections” [25]. These efforts generate “hundreds of thousands of documents,” satellite images, instrument data, and other digitized data, all of which requires careful evaluation and processing in order to draw safeguards conclusions.

From a practical perspective, the IAEA cannot expect to rely solely on humans to perform these tasks while meeting demands for effectiveness and efficiency. The tasks become even more daunting when those same humans are expected to uphold the organization’s principles of independence, objectivity, and transparency. For these reasons, the IAEA recognizes the need for advanced computing and analytic techniques to support these analytical efforts and is trying to prepare for the influx of data, as exemplified by its investments in its own information infrastructure [24, 25]. One of the outcomes of these investments is the State Declaration Portal, which is a web-based system that supports secure bi-directional information exchange between States or Regional Authorities and the IAEA. Any future deployment of DLT to support information reporting would need to complement and be integrated into this system [26].

5 Addressing Critical Questions About Deploying DLT for Safeguards

Recognizing the variety of legal, political, and technical factors driving DLT acceptance for safeguards use, and raising questions about its feasibility, researchers in NGOs, academia, and national laboratories have conducted a number of independent, and in some cases, collaborative projects to explore some key questions surrounding DLT deployment [18, 20, 21, 27,28,29,30,31,32].

Role of the Central Authority

One prominent question involves the role of a distributed ledger to facilitate interactions in a system with a strong central authority. As mentioned earlier in this chapter, public blockchains, such as the Bitcoin blockchain, are potentially contrary to the legal structure of the CSAs in place with NNWSs. The Bitcoin blockchain was designed for peer-to-peer systems that do not need or desire a centralized authority to manage transactions among them. As the central authority managing and verifying safeguards information, the IAEA cannot, and should not, be replaced. However, there are different types of ledgers, namely permissioned ledgers, that could be used appropriately to address aspects of safeguards verification activities involving peer-to-peer interactions. For example, as demonstrated by the Pacific Northwest National Laboratory (PNNL) in 2019, DLT could be used to facilitate certain aspects of the transit matching process, reducing the number of records that would need to be manually matched by the IAEA and improving the general quality of declarations provided to the IAEA [21, 33]. Transit matching is the process for relating or “matching” reports of domestic and international shipments and receipts of nuclear material between facilities within and between countries.  

As discussed in the 2017, 2018, and 2019 PNNL reports, and further explored by Sandia National Laboratories, DLT could be used to document international transfers of UF6 cylinders between material balance areas in States while the IAEA verifies the inventory change [21, 28, 30]. A distributed ledger deployed in this way, “could improve the timeliness of detection of diversion of nuclear material through real-time match attempts of all transactions posted to the ledger…inform inspection activities…and increase confidence in IAEA safeguards conclusion” that transferred material was not diverted [21]. The report emphasized that the first two outcomes are supported by other existing computer programs as well as distributed ledgers, but the third outcome pertaining to confidence in safeguards conclusion is “enabled only by the immutability and cryptographic surety that the blockchain provides” [21]. As the transit matching use case demonstrates, it is possible to identify safeguards use cases where the benefits of DLT can be derived without undermining the important function of the IAEA.

The Need v. Benefit of Deploying DLT for Safeguards

Another prominent question under consideration is whether DLT solves a specific verification challenge or adds value in other ways. While imperfect, the international safeguards system functions. The IAEA is able to provide credible assurances that States are honoring their legal obligations using its instruments and verification procedures [34]. Based on research to date, DLT does not solve specific safeguards challenges as much as it adds an overall improvement in the level of security, efficiency, transparency, and trust. Due to the IAEA’s budget constraints, there is always an interest in improving the efficiency and effectiveness of safeguards verification activities as well as the timeliness of detection of diverted material or undeclared activities. However, the absence of a clear verification challenge that the technology would resolve raises questions as to whether the costs of exploring, developing, and deploying a complex technology such as DLT for safeguards outweigh the benefits [27].

Impact on Fundamental Safeguards Obligations

A third prominent question focuses on the extent to which fundamental safeguards responsibilities may change as a result of deploying DLT for safeguards purposes. Specifically, the use of computer algorithms and consensus protocols to validate transactions that are posted to the ledger could disrupt the way safeguards information is transmitted and verified today. For example, in States with safeguards agreements in force, nuclear facilities provide safeguards-relevant information to the state authority, which transmits the information to the IAEA via secure email or by hand delivery. This information is provided in standard nuclear material accounting reporting forms in accordance with strict deadlines. The conditions and requirements governing the submission of these reports are clearly established in the State’s CSA and corresponding agreements the State negotiates with the IAEA, such as the Subsidiary Arrangement and facility attachments [9]. If DLT were to be deployed to support nuclear material accounting, many of the requirements pertaining to reporting transmission and deadlines might become moot. For example, transactions would be posted on the ledger, potentially precluding the need to submit an official report to the IAEA, as States are currently required to do at regular intervals [4].

This conflict between DLT deployment and State obligations raises an important issue that impact safeguards inspections. Under the current legal framework, without official nuclear material inventory reports to verify, there is no basis for inspection. Additional study is necessary to fully evaluate the political and legal implications of using a cryptographically secure distributed ledger for reporting safeguards information.

6 Evaluating the Value of DLT Deployment for Safeguards: A Summary of Research to Date

With these questions providing context for discussion, research conducted to date has focused on identifying and evaluating potential use cases for deploying DLT without replacing the IAEA or undermining its core verification functions. Early conceptual studies identified transit matching, UF6 cylinder tracking, and nuclear material accounting as promising areas for future examination [18, 20, 21, 27,28,29,30,31,32]. In addition there has been some work in addressing the possible use of DLT in tracking transfers pursuant to Nuclear Cooperation Agreements [18]. As part of these projects, researchers identified several benefits in using the technology for international safeguards purposes.

The relative transparency of information on a shared distributed ledger is one of the more controversial aspects of DLT as it raises questions around the type of information States can or should share and with whom. Safeguards agreements specify the information the IAEA requires from States to draw safeguards conclusions, and there are few incentives to providing more than what is required to remain compliant with the safeguards agreement. Moreover, States are naturally highly concerned about sharing sensitive nuclear information with anyone other than the IAEA, for both national security and commercial reasons, and expect the IAEA to fulfill its obligation to protect sensitive safeguards information. However, sharing selected information about safeguards transactions, such as the date of the transaction or the countries involved, might help States demonstrate compliance with their safeguards agreements without revealing sensitive information about the nuclear material itself and without adding undue burden to safeguards operations. The fact that ledgers can be designed to share information with stakeholders beyond the IAEA while protecting sensitive information through use of user permissions, encryption, and cryptography creates the potential for monitoring movements of nuclear material in new ways, similar to the use of ‘mailbox’ declarations for bulk processing facilities but across facilities, potentially increasing confidence in the IAEA’s ability to provide assurance that the material remains dedicated to peaceful use.

Another benefit of DLT deployment for safeguards use is that the IAEA might be able to achieve near real-time detection of errors in declarations. The combination of transparency, cryptography and immutability is what makes DLT a unique technology for mitigating distrust while increasing inspector efficiency and effectiveness. While the technology precludes users from manipulating or editing information about past transactions, it might also save inspector time and resources if computer programs running on the ledger could enable automated error detection. It is important to clarify that while many existing computer programs can automate the detection of anomalies, DLT’s unique capability comes from combining such automation with the consensus protocols and cryptographic hash functions found only in distributed systems that strengthen the security of the data being posted to the ledger. These are capabilities that existing databases and software programs cannot offer. Integrated in these capabilities is a third benefit of deployment, namely that States and the IAEA might see improvements in data security due to the resilience inherent in a distributed system.

Based on the findings from the various projects emerging from the NGO, academic, and federal communities, several organizations began development of ledger prototypes to establish user requirements and test assumptions within the context of specific use cases. One prototype was the ledger designed by PNNL to explore potential application of DLT in transit matching processes [21].

A second prototype, SLAFKA, and its predecessor, SLUMBAT, were developed by Dr. Edward Obbard, Guntur Dharma Putra and Edward Yu at the University of New South Wales [20]. SLUMBAT was the first blockchain-based demo for nuclear material accounting, demonstrating how the simplest and most direct implementation of an assumed DLT solution for nuclear material accounting would operate. In collaboration with the Henry L. Stimson Center and the Finnish Radiation and Nuclear Safety Authority (STUK) in 2020, Obbard and his team refined and expanded the tool into SLAFKA, the world’s first DLT prototype developed for a national nuclear regulator. SLAFKA illustrates how a permissioned blockchain handles safeguards reporting in line with confidentiality of nuclear accounting information in a secure and new way to communicate safeguards data. The prototype is based on Finland’s system of accounting and control which uses a centrally stored database called SAFKA. The “SLAFKA” name therefore stands for a “shared ledger SAFKA” [20]. Obbard and his team provide a comparison of the two prototypes in the next chapter.

Lawrence Livermore National Laboratory (LLNL) developed a prototype that explored application of DLT to monitor UF6 cylinders. This researched explored whether DLT might, “provide a digital platform that allows the IAEA and the nuclear industry to improve monitoring the UF6 supply chain, ensure that sensitive material arrives at the final destination through end-user verification, and mitigate pressing proliferation risks by meeting safeguards and export control challenges” [29]. Sandia National Laboratories has also conducted extensive research into different DLT applications, including deployment of DLT for UF6 cylinder tracking in Ethereum, use of DLT for anomaly detection and surety for safeguards data, and deployment DLT as part of an Internet of Things solutions to improve data analytics for safeguards [30,31,32].

Aside from these prototypes, other use cases involving digital safeguards transactions were examined and ultimately dismissed by PNNL during its early conceptual work [28]. These use cases included the one-way provision of safeguards information, governance processes associated with the noncompliance investigations, and the transmission of data from unattended monitoring and state of health instruments. These use cases were deemed unsuitable for distributed ledgers because they lacked peer-to-peer interactions, thus negating the value of distributed networks, or they lacked sufficient digital data that could be posted on a ledger.

In parallel with prototype development, researchers at the Stimson Center, the Stanley Center for Peace and Security (formerly the Stanley Foundation), and PNNL also turned their attention to the issue of Member State acceptance. During a workshop conducted in Vienna, Austria in the summer of 2019, representatives from state authorities, nuclear operators, the IAEA, the nuclear industry, and blockchain developers gathered to explore a variety of deployment challenges.

During the two-day meeting, participants learned about DLT’s evolution and functionality and explored the legal and policy challenges and opportunities for deploying DLT for safeguards use. As documented in the report from that workshop, participants recognized a number of challenges facing DLT acceptance within the safeguards community [27]. For example, there are varying degrees of knowledge, understanding, and access to advanced computing tools among Member States, making broad use of DLT challenging. Participants also discussed Member State concerns about data protection and security, which have led to the establishment of national laws prohibiting electronic transmission of safeguards information. Participants recognized that because many States deliver their safeguards reports in hardcopy, on CDs, or USBs, they would be unlikely to use DLT for safeguards purpose, regardless of IAEA interest in the technology. Participants also discussed the legal framework that governs any future DLT deployment. They concluded that any ledger used for safeguards purposes will need to be integrated into a well-established technical infrastructure.

On a positive note, workshop participants also recognized several opportunities that could support DLT deployment for safeguards use. First, the potential for DLT acceptance improves once Member States are educated about how the technology works. This finding became evident after participants were surveyed before and after the workshop. Survey findings showed a distinct shift in perspective about DLT once participants learned how the technology works. With greater understanding about DLT’s functionality, participants also recognized that DLT offers something above and beyond existing information management systems at the IAEA, namely interoperability among systems and frontloading inspection efforts, without replacing the important regulatory function of performing physical verification of nuclear inventories. From a political perspective, participants noted that DLT platforms would not change what safeguards information is reported or undermine the extent to which it is protected from manipulation or theft, two of the most politically charged issues for the international safeguards community.

7 Summary

Research into DLT’s use for safeguards continues as States grapple with questions about deployment costs, political acceptability, and system integration. Its ultimate success will depend on leaders in the community who are willing to take the first step in developing and demonstrating how the technology can be used to benefit the IAEA, State regulatory authorities, and nuclear operators. These pioneers will help inform future research and define user requirements, making broader access to the technology more likely in the future.