Home > Electronic Reading Room > Document Collections > Commission Documents > Commission Papers (SECY) > 2007 > SECY-07-0018

POLICY ISSUE
INFORMATION

SECY-07-0018

January 12, 2007

• PURPOSE
• BACKGROUND
• DISCUSSION
• COORDINATION

PURPOSE:

This is to inform the Commission, in accordance with 10 C.F.R. § 2.1011(c)(5), of the status of the Licensing Support Network (LSN) and the activities of the LSN Administrator (LSNA) for the six-month period ending December 31, 2006.

BACKGROUND:

The Commission's Staff Requirements Memorandum (SRM) dated January 31, 1992, directed the submission of a semiannual report on the activities of the LSNA (formerly the Licensing Support System (LSS) Administrator). The scope of this semiannual report includes LSN program activities from July 1, 2006, through December 31, 2006.

DISCUSSION:

1. Activities

1. Licensing Support Network Administrator (LSNA) and Staff

LSN staff member Roy Hardin, LSN Quality Assurance Auditor, has accepted a lateral transfer to the Office of New Reactors, Division of New Reactor Licensing (NRO/DNRL). This transfer, in conjunction with the vacancy created in June 2006 when another LSN employee took a supervisory position in the Office of Information Services (OIS), see SECY-06-165, at 2 (July 27, 2006), has reduced the ASLBP technical team dedicated primarily to the LSN from three individuals to one. As a consequence, there is no federal staff backup for LSN project management and technical operations in Rockville. The recently-announced hiring freeze has resulted in NRO not being able to finalize Mr. Hardin's transfer into that organization, necessitating an extension of his detail to them and delaying ASLBP's commencing, with any reasonable assurance of being allowed to complete a new hire, the process of advertising for a replacement. ASLBP has taken action to prevent a coverage gap in the quality assurance and deputy project manager duties that were encompassed in the two vacant positions. In the interim, Joseph Deucher, the Las Vegas Facility Manager and Deputy Project Manager for the Digital Data Management System (DDMS), has been assigned to act as the LSN Deputy Project Manager. The implications of this staffing situation are discussed in Section II, Issues, later in this report.

2. Federal Advisory Committee Act (FACA)-Related Activities

Dr. Andrew Bates of the Office of the Secretary (SECY) continues to serve as the Licensing Support Network Advisory Review Panel (LSNARP) Chair. On November 29, 2006, the Commission approved a slightly modified LSNARP Charter and on December 6, 2006, the Charter renewal was filed with our congressional oversight committees and the General Services Administration. The renewed charter will run for two years, expiring on December 6, 2008.

3. LSN Advisory Review Panel (LSNARP) Activities

No meetings of the LSNARP occurred during the reporting period. While no meetings are planned for the immediate future, when they are deemed necessary they will be held in conjunction with other NRC and DOE meetings to conserve on resources.

4. LSN Administrator Guidelines

No LSN Administrator Guidelines were revised, and no new Guideline was promulgated, during the reporting period. The technical bases for LSN operations, including participant organization technologies, remain stable.

5. Interactions with Other NRC Offices and Entities

1. The Commission

The previous LSNA semiannual report was submitted to the Commission in July 2006.

2. Office of Information Services

In response to inquiries posed by the LSNA at the end of the previous reporting period, OIS has clarified the requirements for Internet Protocol Version 6 (IPV6) compliance by applications systems such as the LSN that are not installed on the NRC infrastructure. OIS has advised that as of this time, there are no mandates regarding applications using IPV6. With the information available, we have been advised that use of IPV6 by the LSN should not be anticipated prior to the 2010-2011 time frame.

As part of a further attempt to identify the risk associated with IPV6 transition that might be mandated by schedules established by other federal entities over which NRC has no control, LSN staff reviewed 10 C.F.R. Part 2, Subpart J, governing LSN operations and believes that the reference in section 2.1011(b)(2)(vi)(A) to the LSN participants maintaining HTTP/1.1 network access over Transmission Control Protocol over Internet Protocol, which requires mandatory conformance with Internet Engineering Task Force (ITEF) Request for Comment (RFC) 791, alleviates any concern in this regard. Under these protocols, neither the LSN nor the parties to the potential Yucca Mountain high-level waste (HLW) repository licensing proceeding whose documentary material is available on the system will have to adopt approaches such as "dual stacking" or "tunneling" to permit communications between servers using IPV4 (such as the LSN) and a potential party attempting to use IPV6.⁽¹⁾ This also avoids difficulties associated with the fact there currently are no software security products for monitoring IPV6 networks or systems.

LSN staff completed the annual LSN Security Self Assessment used to comply with the Federal Information Security Management Act (FISMA). The Chief Administrative Judge signed off on the LSN Security Self Assessment on July 18, 2006. Additionally, LSN staff submitted required Plan of Action and Milestones (POA&M) quarterly update reports to OIS on August 15, 2006, and November 28, 2006, as accreditation.

ASLBP management was informed of the scores assigned by the Office of Management and Budget (OMB) as a result of its Form 300B review of the LSN. As with all fourteen agency systems identified during this most recent OMB Form 300B review process, the LSN was placed on the OMB Watch List largely because it continues to function under a FISMA-associated Interim Authority to Operate (IATO). ASLBP is working with OIS to expedite the process for obtaining a full Authority to Operate (ATO) for the LSN by May 8, 2007, or sooner if consistent with the agency's response to OMB. Funds for a security certification and accreditation (C&A) support contractor have been identified, a statement of work developed, and a request for procurement action was forwarded to the Office of Administration, Division of Contracts (ADM/DC) in hopes of a January 2007 kickoff for this effort.

3. Office of Nuclear Material Safety and Safeguards

Interactions with the NRC staff on LSN matters dealt primarily with routine document collection maintenance issues. The staff, following procedures established by the Pre-License Application Presiding Officer (PAPO) Board, withdrew the text and images of a small number of privileged documents from the LSN in November. Additionally, in August the LSNA provided information to the Office of Nuclear Material Safety and Safeguards on the history and use of “reasonably contemporaneous” document availability as originally addressed in Subpart J, including the statements of consideration that accompanied the original rule and subsequent rule revisions.

4. Office of the Inspector General

On November 20, 2006, LSNA Dan Graser and LSN Project Manager Matt Schmit met with representatives of the NRC Office of the Inspector General (OIG) to provide background information on any previous LSNARP or LSNA discussions regarding the submission of OIG documents to the LSN. This question arose because the Department of Energy's (DOE) OIG contacted NRC OIG regarding requirements to submit OIG materials to the DOE document collection, perhaps believing that NRC's OIG could provide it with the answer based upon NRC's actions in dealing with the same issue. The LSNA referred OIG counsel Maryann Grodin to the NRC's Office of General Counsel (OGC) as the possible author of a NRC opinion/decision/determination that he recalled indicated Commission-level office materials generally were not to be included in the LSN (in contrast with the required submission of materials from offices reporting to the Executive Director for Operations (EDO)).

5. Office of Administration/Division of Contracts

The LSN operations and maintenance (O&M) contract was awarded on July 14, 2006. The award was made to AT&T Government Solutions, the previous support contractor, and accordingly, there was no disruption in service. The LSN O&M contract consists of a one-year base contract valued at $719,141, with two option-years totaling $1,499,160, for a total three-year award of $2,218,301. If both option- years are invoked, the O&M contract would expire on July 13, 2009 (which, under the current DOE schedule for submitting its HLW repository construction authorization application and the 10 C.F.R. Part 2, Appendix D schedule for the HLW repository licensing proceeding, would be about the time of the initial prehearing conference regarding participant standing and contention admissibility).

6. Office of Administration/Division of Facilities and Security

Subsequent to award of the new O&M contract, the LSN contractor has pursued establishing an enhanced development, test, and evaluation configuration at its offices in Tysons Corner, Virginia. This stand-alone configuration provides the contractors with a matching version of the LSN that can be used to test new software releases, thereby ensuring uninterrupted operation of the production LSN system. One aspect of this activity is that installing this test environment at the contractor facility is subject to FISMA security requirements, which potentially includes having a facility security review performed by the Office of Administration, Division of Facilities and Security (ADM/DFS). On December 20, 2006, LSN project staff met with ADM/DFS personnel to determine what level of facility review was needed. We were advised that no physical security review of LSN contractor space was required because: (1) the LSN is a publically-available system containing information that is not protected data; (2) contractor staff are subject to the Information Technology (IT) Level I or Level II security approval process for access to NRC IT non-sensitive, non-classified systems; and (3) numerous NRC-sponsored organizations have reviewed the facility. Relative to the last point, the National Security Agency (NSA) conducted a review of the AT&T contractor space during LSN-instituted information assurance assessments completed and delivered in August 2002 and August 2005 in conjunction with the system's prior ATO certification.

LSN Project Manager Matt Schmit has been overseeing the process of securing appropriate clearances for the LSN contractor staff since the award of the new O&M contract. Although contractor staff do not visit the NRC facility on a regular basis or have NRC LAN IDs, they do have access to the software code used to maintain and operate the publicly accessible LSN and the non-sensitive, non-classified documentary material it contains. The contractors completed the security application paperwork in November 2006. To date, one of three AT&T staff members have been approved for badging.

Similarly, LSN project staff has been coordinating with the O&M contractor staff to ensure they are obtaining the mandatory annual computer security awareness course to meet the FISMA computer security awareness requirement. Because these courses initially were scheduled at NRC headquarters in Rockville in the October-December timeframe before clearances had been issued to any of the LSN contractors, we were advised we would be able to use an alternative training delivery method, i.e., an OIS-developed DVD of the Dale Carnegie Institute training session.

6. Interactions with DOE's Office of Civilian Radioactive Waste Management on Its Efforts and Readiness to Meet LSN Commitments

On July 19, 2006, the DOE Office of Civilian Radioactive Waste Management (OCRWM) released its schedule for submitting a license application for the proposed Yucca Mountain HLW repository. The schedule includes plans for DOE to certify that its LSN document collection is in compliance with the requirements of Subpart J on December 21, 2007. This event will trigger a period of intense activity for LSN staff and contractors; other participants and potential licensing adjudication participants, whose own LSN certification deadlines are pegged to the DOE certification date; and the PAPO Board, which will be addressing any contested certifications and documentary material disputes. In October 2006, in response to staff reassignments within OCRWM, LSN staff updated the Point of Contact (POC) page entries for DOE. The current POC is Dong Kim, who has been designated as the lead person within the OCRWM program responsible for LSN certification and Subpart J compliance. In subsequent meetings with Mr. Kim, the LSNA was advised that DOE is on schedule for submitting its LSN certification no later than December 21, 2007. DOE's “backlog” document pipeline is empty and it now is processing “current” materials. LSN-associated activities planned by DOE between now and December 2007 include yet another round of internal reviews of the DOE collection to identify and remove Personally Identifiable Information (PII), and preparing privilege claim logs and redacted versions of all sensitive documents that are to be available roughly concurrent with its planned December 2007 document collection certification.

LSN staff continued to work with DOE during regularly-scheduled conference calls to coordinate document loading and other LSN-related administrative activities. At DOE's request, the schedule for these meetings has been changed from biweekly to monthly.

7. Interactions with Other Participants in Conjunction with Their Efforts to be Ready to Meet LSN Commitments

As of this date, the following organizations have submitted LSN certification/compliance statements to the HLW proceeding Electronic Hearing Docket (EHD): NRC, the Nevada counties of Lander, White Pine, Eureka, and Mineral, and Inyo County, California. Additionally, DOE submitted a certification, the validity of which was challenged by the State of Nevada.

The LSNA together with Joseph Deucher, the Las Vegas Hearing Facility Manager, met with technical representatives from Clark County, Nevada, and the Nevada cities of North Las Vegas and Henderson on August 22 in Las Vegas to discuss the LSN system and its operations. Additionally, a representative of the City of Las Vegas who was unable to attend the meeting due to a late-developing schedule conflict subsequently was provided with a complete set of materials used at the briefing. The meeting was very well received and resulted in a November 6, 2006 follow-up meeting.

Subsequent to the August meetings, representatives from the office of the Henderson City Attorney sent general questions regarding potential participation in the HLW repository adjudication, including how to obtain, and the obligations and privileges associated with, the different levels of participation in the proceeding (e.g., party vs. interested governmental entity). This request was forwarded by the LSNA to NRC OGC for a response.

In October 2006, the LSNA provided examples of document collection certifications from the HLW EHD to Inyo County, per its request. Thereafter, on November 15, 2006, Inyo County submitted an initial certification of compliance with Subpart J requirements. At the time of the attempted certification, however, Inyo County had not met LSN certification requirements. The LSNA thereafter provided further clarification to county representatives on the sequence of events needed for successful technical implementation. Working with Inyo County staff, the county's documents were successfully integrated into the LSN, bringing to fifteen the total number of HLW repository licensing proceeding participant or potential participant LSN document collections available via the LSN. Also in November 2006, following PAPO procedures for revising an available certified collection, the NRC staff responsible for administering the NRC document collection removed a small number of documents found to contain sensitive information.

During this reporting period, LSN staff also successfully tested integrating Esmeralda County, Nevada, into the LSN. Esmeralda County, which contracted with the same technical staff that successfully integrated several other Nevada counties into the LSN, expects to post documents in the near future.

On November 21, 2006, Nevada Governor Guinn released a letter requesting that DOE open the “closed” portion of its LSN document collection. In that letter, he also stated that Nevada had opened its own document collection as a gesture of comity. Upon reviewing the letter, the LSNA contacted representatives of the State of Nevada (Nevada) seeking clarification regarding its intentions, as the Nevada collection was emptied, per its direction, following successful connectivity testing more than a year earlier. LSN staff subsequently worked diligently with Nevada to re-index its 3,372 documents and open its collection for searching using the LSN. The Nevada collection was available via the LSN on November 27, 2006, thus effectuating the Governor's request.

8. LSN Project Plan Implementation

1. Ongoing Upgrades and Expansion to the LSN

There are no upgrades or expansions of the LSN production system currently underway

2. Administration of the LSN

Regarding LSN project management performance for the fiscal year concluding September 30, 2006, the LSN project achieved all its planned milestones for user access, participant support, and timeliness of document loading. During the fiscal year, the project team maintained system integrity and document accuracy throughout the year consistent with the LSNA Guidelines, and successfully addressed the potentially severe security event associated with placement of certain sensitive documents into its document collection (as discussed in the July 27, 2006 LSNA semiannual report, see SECY-06-165, at 9). Project performance for the fiscal year was on budget, and all funds were committed well in advance of the end of the fiscal year. A new multi-year O&M contract was competed and put in place without any interruption in system service.

In September 2006, working with ADM/DC, LSN staff completed the annual maintenance contract with GSA for maintaining the LSN.GOV domain registration.

The following table presents cumulative performance metrics for the LSN during the reporting period:

Licensing Support Network System Performance Metrics for the Reporting Period
	July	August	September	October	November	December
Number of Participants	14 (3 hidden)	14 (3 hidden)	14 (3 hidden)	14 (3 hidden)	14 (2 hidden)	15 (2 hidden)
Number of Documents	3,429,448	3,439,862	3,448,571	3,453,872	3,468,298	3,476,201
System Availability (Against Schedule)	100%	100%	100%	100%	100%	100%
Number of Days with Outage More than Four Hours	0	0	0	0	0	0

The following table presents the net document additions/deletions per month, by participant:

Licensing Support Network Documents Added by Participant
	Added July	Added August	Added September	Added October	Added November	Added December	Total 7/06 Through 12/31/06
Churchill Co.	0	0	0	0	0	1	1
City of Las Vegas	0	0	0	0	0	0	0
Clark Co.	0	0	0	0	0	0	0
DOE I	(159)	26	0	0	(32)	(17)	(182)
DOE II*	15,845	10,388	8,709	5,217	11,083	7,804	59,046
Eureka Co.	0	0	0	0	0	0	0
Lander Co.	0	0	0	0	0	0	0
Lincoln Co.	0	0	0	0	0	0	0
Mineral Co.	0	0	0	0	0	0	0
State of Nevada	0	0	0	0	3,372	0	3,372
Nuclear Energy Institute (NEI)	0	0	0	0	0	0	0
NRC	0	0	0	84	3	111	198
Nye Co.*	0	0	0	0	0	0	0
White Pine Co.	0	0	0	0	0	0	0
Inyo Co., CA	0	0	0	0	0	4	4
Total	15,686	10,414	8,709	5,301	14,426	7,903	62,439

*LSN collection not publically available.

3. Security Profile of the LSN

No system downtime was experienced during the reporting period because of hacker attacks directed against the LSN.

The LSN continues to operate under an IATO, which is valid through October 31, 2007. The LSN, however, continues to be an extremely secure IT system, due in large part to its original design architecture, the web hosting infrastructure provided by AT&T, and the robust third-party security services included in the turnkey O&M contract.

On July 17, 2006, Chief Administrative Judge Hawkens, in accordance with Management Directive (MD) 12.5, “NRC Automated Information Security Program,” appointed Joseph Deucher and Andrew Welkie as the primary and alternate LSN Information System Security Officers (ISSOs), respectively. As neither holds database administrator responsibilities on the system, these appointments provide the appropriate separation of duties for the LSN in that separate individuals are assigned key duties such as authorizing, approving, and recording transactions; issuing or receiving assets; making payments; and reviewing or auditing so as to minimize the risk of misappropriation or loss of system assets.

9. LSN Communication Plan Implementation

LSN Communication Plan activities during the period were limited to the participant interactions noted above.

2. Issues

1. Impacts of DOE License Application Schedule Uncertainty on LSN

As noted in the previous LSNA’s Semiannual Report, see SECY-06-165, at 12-13, three budget/staffing resource issues have been identified as a result of DOE HLW repository scheduling announcements, including its December 2007 LSN certification and submission of a Yucca Mountain HLW repository construction authorization application in June 2008:

• The contract providing LSN O&M coverage through July 2009 will expire at the outset of the prehearing phase if a license application for a Yucca Mountain repository is docketed in mid-calendar year (CY) 2008. NRC should anticipate another multi-year LSN O&M contract will need to be put in place by mid-CY 2008. Extending the useful life of the LSN through 2018 will require at least two major technology substitution efforts in addition to routine hardware and software refresh efforts. This issue is within the control of ASLBP management and the LSNA to the extent we can plan for future reprocurement activities and include budget resources during the appropriate budget formulation process, which looks two fiscal years ahead.

• Another near-term impact of such extended LSN operation is an increase in the number of FTEs allocated to LSN to accommodate these new procurement efforts, rather than maintaining (or even reducing) LSN-associated FTEs if the LSN were to remain in a steady-state for only a three-to-four year proceeding. Accordingly, besides planning for and conducting an additional O&M procurement for multiple years of support, LSN budget formulations for FY 2009 and beyond may reflect a significant re-analysis of the impacts of conducting extended operations subsequent to the DOE document collection certification. This issue is within ASLBP and LSNA management control insofar as we can reallocate existing ASLBP IT team members to address some workload spikes, specifically those that are of relatively short duration. As with budget resources, we also can coordinate staff resource increases as part of the budget formulation process.

• A concern relative to the Affected Units of Local Government (AULGs) arises if there are additional delays in the DOE license application submission date beyond June 2008. The Commission should anticipate that some AULGs may seek to “pull the plug” on their LSN document collections until such time as a DOE document collection certification is imminent. As a practical matter, this could mean the LSN project would sustain costs equivalent to what it already has incurred relative to these existing participants by having to incorporate these “former” participants as additional “new” participants as they eventually return and request reconnection to the LSN. The LSN staff believes this issue is manageable if participant organizations maintain some degree of institutional knowledge, which would facilitate participant LSN reconnection based on their earlier successful efforts.

2. LSN Project Staffing and Hiring Freeze Under a Continuing Resolution

ASLBP’s IT support team is currently understaffed by two positions. As noted earlier in this report, as soon as the hiring freeze is lifted, we are prepared to advertise for an IT Specialist (Sysadmin/Sysanalysis) to perform duties currently assigned to the vacant LSN quality assurance and deputy project manager positions. We have been advised by the Office of Human Resources that nothing precludes us from posting the position, reviewing resumes or interviewing individuals, but that we would not be able to extend an offer until the hiring freeze is lifted and risk having to restart the process if the applicant list becomes “stale.” In the interim, Joseph Deucher, the Las Vegas Facility Manager and DDMS Deputy Project Manager will act as the LSN Deputy Project Manager. This interim action is less than optimal due to the physical distance and time-zone differences between Rockville and Las Vegas, as well as the DDMS-related workload currently assigned to Mr. Deucher.

3. Future LSN-Related Activities

Project Manager Matt Schmit will aggressively seek full ATO status for the LSN in accordance with FISMA C&A procedures.

Contractor staff will complete the installation of the development, test, and evaluation facility.

Badged LSN contractor staff will take the mandatory IT security training via OIS-provided DVDs.

COORDINATION:

The Office of the General Counsel has no legal objection.

Distribution:
Commissioners
OGC
ASLBP
CFO
EDO
SECY

1. A number of transition mechanisms are available to enable IPV6-only hosts to reach IPV4 services, such as the LSN, and to allow isolated IPV6 hosts and networks to reach the IPV6 Internet over the existing IPV4 infrastructure. A network stack that supports both IPV4 and IPV6 while sharing most of the code is called a dual stack. Encapsulating IPV6 packets within IPV4, in effect using IPV4 as a link layer for IPV6, is called tunneling.

Privacy Policy | Site Disclaimer
Friday, March 16, 2007