Development of Probabilistic Threat Scenarios for Medical Radioactive source security

Radioactive sources are extremely beneficial to humankind and are routinely used to diagnose and treat disease. In medical facilities, staff receive radiation safety training to help protect patients and workers from these sources. However, these same facilities may not give comparable attention to the security of their radioactive sources. Since medical facilities, including cancer and urgent care centers, are necessarily public places, unauthorized access to vital areas can easily be obtained if controls are lacking. Given the rising threat of radiological and nuclear terrorism, it is imperative to assess if medical facilities have the means to fully understand and evaluate the security of their radioactive sources. In this context, risk assessment is a function of threat, vulnerability and consequences. This study aims to develop and demonstrate a methodology to compute a risk index for a medical facility, based on the probability of occurrence of a Threat Event (TE) and its subsequent magnitude of incurred loss. The risk decomposition is based on the Factor Analysis of Information Risk (FAIR) ontology. Part of the analysis involved development of different probabilistic models delineating various initiating events for theft and sabotage of radioactive sources. Identification of threat scenarios involved classifying adversaries based on their motivations and capabilities. Probability density functions and event trees were then used to simulate the scenarios to estimate the probability of successfully completing a malicious act, such as theft of the source. A specific Category-1 medical radioactive device, the Gamma Knife®, which utilizes Co-60, was the targeted asset under consideration in this study. Based on the proposed attack scenario, a sub-state adversary with superior threat capability and technical knowledge (i.e. device maintenance staff) presented the highest probability of Gamma Knife® source theft (P=0.03) from a medical facility. This numerical value, along with values derived from the losses associated with the threat scenario, will serve as an input towards calculating the risk index for the medical facility.