The terrorist attacks of September 11, 2001 demonstrated that a determined adversary, using planning and patience, could catastrophically attack the American homeland and shatter any illusion of a fortress America removed from extremist ideologies and tactics. The aftermath forced the United States to examine its vulnerabilities, identify their causes, and develop mechanisms to prevent, detect, and respond to terrorism. Other implications extend further. Had the attack involved an improvised nuclear device rather than hijacked aircraft, or been targeted at a nuclear facility storing tons of highly radioactive spent nuclear fuel, the consequences could have been more catastrophic. September 11 left enduring security lessons: Low-probability, high-consequence threats must be anticipated and vulnerabilities addressed proactively. Nuclear security became an important expression of that principle, driven by the possibility that a subnational group could acquire the materials necessary to construct a nuclear or radiological weapon or attack vulnerable nuclear materials and facilities. Twenty-five years later, the terrorist nuclear threat remains alive and well, albeit overshadowed by the resurgence of state-level nuclear confrontation. But the nuclear enterprise to which it must now be applied is changing rapidly.
Building the Post-9/11 Nuclear Security Architecture
The 9/11 attacks created a political imperative not just to counter terrorism globally, but also to strengthen nuclear security internationally. Working with its Member States, the International Atomic Energy Agency (IAEA) expanded its nuclear security efforts through published guidance, training, education, research, and advisory services. United Nations Security Council Resolution 1540 (2004) obligated states to take measures to prevent non-state actors from acquiring weapons of mass destruction and related materials. In 2005, states parties to the Convention on the Physical Protection of Nuclear Material (CPPNM) adopted by consensus an Amendment that substantially broadened the Convention’s scope, extending protections for nuclear material beyond international transport to domestic use, storage, and transport, while expanding criminalization provisions to include trafficking in nuclear material and sabotage of nuclear materials and facilities. That same year, the International Convention for the Suppression of Acts of Nuclear Terrorism (ICSANT) opened for signature (and entered into force just two years later in 2007), further strengthening the international legal framework against the misuse of nuclear technology and materials. In 2006, the United States and the Russian Federation created the Global Initiative to Combat Nuclear Terrorism (GICNT), a remarkable initiative precisely because Washington and Moscow recognized that nuclear terrorism transcended their geopolitical competition. Countries that disagreed on much else could still cooperate on a threat that none could afford to ignore. Radiation detection and nuclear forensics also became practical tools for helping states detect and respond to the unauthorized use, movement, storage, or possession of nuclear and radioactive materials. A series of four Nuclear Security Summits convened heads of state between 2010 and 2016, elevating the issue to the highest political level, while in 2013, the IAEA convened the first International Conference on Nuclear Security (ICONS) that has continued at three- to four-year intervals ever since.
Twenty-five years later, there is much to show for these efforts. Nuclear security is widely recognized as a continuing state-level responsibility and has been integrated into nuclear legal frameworks in many countries. Physical protection has improved. Radiation detectors are more widely deployed. States have developed response plans for nuclear material outside regulatory control, and nuclear trafficking cases are investigated and prosecuted. Most importantly, obtaining weapons-usable nuclear material has become substantially harder. The world has so far avoided the terrorist detonation of an improvised nuclear device.
But the system is uneven. Nuclear security ultimately remains a national responsibility, and countries differ considerably in their experience, resources, threat perceptions, and implementation. Nuclear security requirements are still often regarded as an additional regulatory burden and operational expense hindering the development or expansion of civilian nuclear power. The IAEA’s Division of Nuclear Security is still funded largely through extrabudgetary voluntary contributions from member states, which in turn face rising defense and nonproliferation demands on limited resources. An authoritative index of nuclear security across 175 countries and Taiwan has shown regression in recent years.
And the world is distracted and divided.
Growing Nuclear Needs, New Security Threats, Diminishing Cooperation
Great-power competition and armed conflict have pushed counterterrorism down the list of national and international security concerns, as governments increasingly direct attention and resources towards technological arms racing and defense. Russia’s seizure and occupation of Ukraine’s Zaporizhzhia Nuclear Power Plant, the largest nuclear power plant in Europe, demonstrated how state conflict can expose nuclear facilities to risks that differ fundamentally from the terrorist threats that shaped much of the post-9/11 nuclear security architecture. Conflicts in Ukraine and in the Middle East have exposed civilian nuclear facilities to threats, such as drones and autonomous systems, that are well outside their original design basis and were hardly imagined when the post-9/11 nuclear security architecture was being built. Cyber threats can potentially reach systems without ever crossing a physical perimeter. At the same time, state level conflict is eroding arms control and nuclear nonproliferation agreements, and underscores the limitations of the international frameworks and state-level collaborative mechanisms that protected sensitive nuclear infrastructure for decades.
The irony is that this distraction and division come just as the nuclear enterprise is entering what could be one of its strongest periods of expansion in decades. Some 33 countries have now endorsed a goal of at least tripling global nuclear energy capacity by 2050, reflecting growing interest in nuclear power for climate, energy security, and economic objectives. More than 85 gigawatt equivalents of nuclear generating capacity, predominantly conventionally large reactors, are under construction worldwide, and more than 40 countries are taking steps to expand the role of nuclear in their energy production. These numbers do not yet capture the potentially much larger deployment of advanced and small modular reactors now under development.
More nuclear power will mean more nuclear material, more facilities, more transportation, and more private-sector participants. In addition, much of this capacity may be provided by advanced and small modular reactors (SMRs) offering a range of apparent advantages over traditional, large reactors, including factory production, flexible siting and application, modular output scaling, and longer cycles between refueling. Advanced reactors and SMRs can be deployed at sea, such as in floating nuclear power plants, or in isolated, remote terrain, introducing complex physical, cyber, and legal security challenges distinct from those associated with traditional large, land-based reactors. Novel fuel forms, transportability, increased digitization, in combination with more geographically widespread deployment and distributed inventories raise complex security considerations to weigh against their benefits.
Yet the security implications of this expansion have received considerably less attention.
HALEU and the New Fuel Cycle
Some “newcomer” governments and commercial participants will have limited experience implementing nuclear security, while even countries with well-established nuclear energy sectors are racing to understand and address the security implications of these shifts. One of the most salient issues is high-assay low-enriched uranium (HALEU), enriched to greater than 5% but less than 20% uranium-235, which is central to many advanced reactor designs. Its higher enrichment allows smaller reactor cores, longer operating cycles, and other performance advantages. HALEU is notable not only for its higher concentration of uranium-235, but also for the novel fuel forms in which it will be used, distinct from the conventional LEU fuel assemblies that have powered most nuclear reactors for decades. These new fuel forms include metals, salts, and ceramic oxides in pebble or even liquid form. Nor does HALEU represent simply a spectrum of new reactor fuels. It is the foundation of an entirely new fuel cycle. New enrichment facilities, fuel fabrication methods, transportation networks, reactor technologies, and eventually spent-fuel management systems are developing in parallel.
These shifts raise complex questions, including the security implications of long-term storage, disposition, and possible reprocessing of spent HALEU fuel. At the upper end of its enrichment range, HALEU approaches the long-established 20% threshold associated with greater proliferation concern. Material below that threshold may also present security and proliferation risks when available in sufficient quantities. Security calculations based on enrichment levels alone are not enough. The quantity, chemical and physical form, location, transportation routes, and vulnerability to theft or diversion also shape the security risk.
From “Bolt On” Security to Security by Design
In the years after 9/11, nuclear security enhancements were necessarily added to existing operational infrastructure: guards, gates, and guns at facilities; radiation portal monitors at borders; forensic investigations linking nuclear materials to their possible origins or points of diversion; and efforts to correct weaknesses after they were identified. The opportunity today is different. We are designing next-generation reactors, facilities, fuels, and supply chains now. Twenty-five years after 9/11, nuclear security should no longer be bolted on; it should be built in.
HALEU-fueled advanced and small modular reactors, particularly those deployed at remote or distributed sites, will have to contend with cyber, drone, insider, operational, and kinetic threats. Physical protection, material control and accounting, cybersecurity, detection, and response should be considered from fuel fabrication through transportation, reactor operation, and ultimately spent-fuel management. New technologies can help. Advanced analytics and artificial intelligence are already being used in nuclear security to enhance anomaly detection, reassess changing threats, and strengthen the protection of vital areas. But technology does not substitute for thinking through the basic security problems at the design stage by considering security across the entire emerging fuel cycle.
This matters, particularly as governments push to deploy nuclear power more quickly. The United States seeks to greatly expand domestic nuclear generating capacity while streamlining licensing, expanding access to federal deployment sites, and building domestic HALEU production. There is nothing inherently incompatible between speed and security. In fact, designing security into a system from the beginning should be easier and less expensive than retrofitting it later. But despite widespread acknowledgement of this truism and a growing number of awareness-raising documents, guides, and support programs, security-by-design’s champions and thought leaders say only a few of the many advanced reactor and SMR vendors vying for U.S. design approval are integrating security specialists into design teams.
Designing Forensics into the Fuel Cycle
One capability deserves particular attention as the HALEU and advanced reactor fuel cycle is developed over the coming years. Nuclear forensics uses a combination of measurable isotopic, chemical, and physical signatures inherent to nuclear and radioactive materials to help determine their history and origin. It emerged after 9/11 as an important tool for investigating nuclear trafficking and linking interdicted materials to possible sources.
Nuclear and radioactive material signatures can be measured throughout the fuel cycle. Nuclear forensics can improve material characterization and traceability, differentiate manufacturing processes, identify anomalous materials or activities, and support attribution if a nuclear security incident occurs. To aid comparisons, nuclear forensics libraries catalog information on nuclear or radioactive materials that are used, produced, or stored nationally. Nuclear forensics is not only relevant to a nuclear security incident after material has been stolen or intercepted. Its methods can also help determine whether security by design is actually working.
Used properly, forensic capabilities could be incorporated into the new fuel cycle from the beginning, including through unique taggants and other identifying signatures, creating systems that are not only harder to compromise but easier to monitor, investigate, and attribute if something goes wrong. In that sense, nuclear forensics can become an integral part of security by design, strengthening the ability to determine the origin and history of diverted material, incentivizing more effective security practices, deterring potential adversaries, and providing a differentiating advantage for businesses and other entities that participate in signature registration. Such an approach is technically feasible and deserves serious consideration as the HALEU fuel cycle emerges.
The Unfinished Legacy
Twenty-five years after 9/11, the question is whether the nuclear security system built to confront yesterday’s terrorist threat is funded sustainably and evolving fast enough to confront tomorrow’s. The nuclear enterprise is changing, the geopolitical environment is fragmented, conflictual, and beset by competing priorities, and technologies are emerging that create both novel capabilities and new vulnerabilities. HALEU and advanced reactors do not inevitably create unacceptable nuclear security risks. But their vulnerabilities should be identified and addressed as these technologies are developed and deployed.
We have an opportunity now, before the next generation of nuclear infrastructure is fully built, to anticipate and address vulnerabilities, build security into the system, put international nuclear security on a stable budgetary footing, and strengthen our ability to detect and attribute nuclear and other radioactive materials.
September 11 taught us not that catastrophe is inevitable, but that vulnerabilities that appear remote can suddenly prove devastating. The enduring lesson of September 11 is not simply to prepare to respond to the next crisis. It is to act collectively to prevent one.
Twenty-five years after September 11, the nuclear security environment looks very different from the one that shaped the post-9/11 response. The past quarter-century has seen substantial advances in the security of nuclear materials and facilities, including physical protection, radiation detection, nuclear forensics, material control, and international cooperation. Today, however, the nuclear sector features new fuels, facilities, transportation networks, supply chains, and more distributed inventories of nuclear material that will require sustained international focus and security approaches tailored to a changing threat landscape amid renewed geopolitical competition.
Growing interest in and rapid development of advanced reactors and their fuel supply chain create an imperative to apply the lessons of September 11 before vulnerabilities become embedded in a new generation of nuclear infrastructure.
The challenge is to shift from security added after new nuclear systems are developed toward security incorporated from the beginning. Nuclear forensics can support that transition by strengthening material characterization, traceability, detection, and attribution across the fuel cycle.
Nonproliferation
The terrorist attacks of September 11, 2001 demonstrated that a determined adversary, using planning and patience, could catastrophically attack the American homeland and shatter any illusion of a fortress America removed from extremist ideologies and tactics. The aftermath forced the United States to examine its vulnerabilities, identify their causes, and develop mechanisms to prevent, detect, and respond to terrorism. Other implications extend further. Had the attack involved an improvised nuclear device rather than hijacked aircraft, or been targeted at a nuclear facility storing tons of highly radioactive spent nuclear fuel, the consequences could have been more catastrophic. September 11 left enduring security lessons: Low-probability, high-consequence threats must be anticipated and vulnerabilities addressed proactively. Nuclear security became an important expression of that principle, driven by the possibility that a subnational group could acquire the materials necessary to construct a nuclear or radiological weapon or attack vulnerable nuclear materials and facilities. Twenty-five years later, the terrorist nuclear threat remains alive and well, albeit overshadowed by the resurgence of state-level nuclear confrontation. But the nuclear enterprise to which it must now be applied is changing rapidly.
Building the Post-9/11 Nuclear Security Architecture
The 9/11 attacks created a political imperative not just to counter terrorism globally, but also to strengthen nuclear security internationally. Working with its Member States, the International Atomic Energy Agency (IAEA) expanded its nuclear security efforts through published guidance, training, education, research, and advisory services. United Nations Security Council Resolution 1540 (2004) obligated states to take measures to prevent non-state actors from acquiring weapons of mass destruction and related materials. In 2005, states parties to the Convention on the Physical Protection of Nuclear Material (CPPNM) adopted by consensus an Amendment that substantially broadened the Convention’s scope, extending protections for nuclear material beyond international transport to domestic use, storage, and transport, while expanding criminalization provisions to include trafficking in nuclear material and sabotage of nuclear materials and facilities. That same year, the International Convention for the Suppression of Acts of Nuclear Terrorism (ICSANT) opened for signature (and entered into force just two years later in 2007), further strengthening the international legal framework against the misuse of nuclear technology and materials. In 2006, the United States and the Russian Federation created the Global Initiative to Combat Nuclear Terrorism (GICNT), a remarkable initiative precisely because Washington and Moscow recognized that nuclear terrorism transcended their geopolitical competition. Countries that disagreed on much else could still cooperate on a threat that none could afford to ignore. Radiation detection and nuclear forensics also became practical tools for helping states detect and respond to the unauthorized use, movement, storage, or possession of nuclear and radioactive materials. A series of four Nuclear Security Summits convened heads of state between 2010 and 2016, elevating the issue to the highest political level, while in 2013, the IAEA convened the first International Conference on Nuclear Security (ICONS) that has continued at three- to four-year intervals ever since.
Twenty-five years later, there is much to show for these efforts. Nuclear security is widely recognized as a continuing state-level responsibility and has been integrated into nuclear legal frameworks in many countries. Physical protection has improved. Radiation detectors are more widely deployed. States have developed response plans for nuclear material outside regulatory control, and nuclear trafficking cases are investigated and prosecuted. Most importantly, obtaining weapons-usable nuclear material has become substantially harder. The world has so far avoided the terrorist detonation of an improvised nuclear device.
But the system is uneven. Nuclear security ultimately remains a national responsibility, and countries differ considerably in their experience, resources, threat perceptions, and implementation. Nuclear security requirements are still often regarded as an additional regulatory burden and operational expense hindering the development or expansion of civilian nuclear power. The IAEA’s Division of Nuclear Security is still funded largely through extrabudgetary voluntary contributions from member states, which in turn face rising defense and nonproliferation demands on limited resources. An authoritative index of nuclear security across 175 countries and Taiwan has shown regression in recent years.
And the world is distracted and divided.
Growing Nuclear Needs, New Security Threats, Diminishing Cooperation
Great-power competition and armed conflict have pushed counterterrorism down the list of national and international security concerns, as governments increasingly direct attention and resources towards technological arms racing and defense. Russia’s seizure and occupation of Ukraine’s Zaporizhzhia Nuclear Power Plant, the largest nuclear power plant in Europe, demonstrated how state conflict can expose nuclear facilities to risks that differ fundamentally from the terrorist threats that shaped much of the post-9/11 nuclear security architecture. Conflicts in Ukraine and in the Middle East have exposed civilian nuclear facilities to threats, such as drones and autonomous systems, that are well outside their original design basis and were hardly imagined when the post-9/11 nuclear security architecture was being built. Cyber threats can potentially reach systems without ever crossing a physical perimeter. At the same time, state level conflict is eroding arms control and nuclear nonproliferation agreements, and underscores the limitations of the international frameworks and state-level collaborative mechanisms that protected sensitive nuclear infrastructure for decades.
The irony is that this distraction and division come just as the nuclear enterprise is entering what could be one of its strongest periods of expansion in decades. Some 33 countries have now endorsed a goal of at least tripling global nuclear energy capacity by 2050, reflecting growing interest in nuclear power for climate, energy security, and economic objectives. More than 85 gigawatt equivalents of nuclear generating capacity, predominantly conventionally large reactors, are under construction worldwide, and more than 40 countries are taking steps to expand the role of nuclear in their energy production. These numbers do not yet capture the potentially much larger deployment of advanced and small modular reactors now under development.
More nuclear power will mean more nuclear material, more facilities, more transportation, and more private-sector participants. In addition, much of this capacity may be provided by advanced and small modular reactors (SMRs) offering a range of apparent advantages over traditional, large reactors, including factory production, flexible siting and application, modular output scaling, and longer cycles between refueling. Advanced reactors and SMRs can be deployed at sea, such as in floating nuclear power plants, or in isolated, remote terrain, introducing complex physical, cyber, and legal security challenges distinct from those associated with traditional large, land-based reactors. Novel fuel forms, transportability, increased digitization, in combination with more geographically widespread deployment and distributed inventories raise complex security considerations to weigh against their benefits.
Yet the security implications of this expansion have received considerably less attention.
HALEU and the New Fuel Cycle
Some “newcomer” governments and commercial participants will have limited experience implementing nuclear security, while even countries with well-established nuclear energy sectors are racing to understand and address the security implications of these shifts. One of the most salient issues is high-assay low-enriched uranium (HALEU), enriched to greater than 5% but less than 20% uranium-235, which is central to many advanced reactor designs. Its higher enrichment allows smaller reactor cores, longer operating cycles, and other performance advantages. HALEU is notable not only for its higher concentration of uranium-235, but also for the novel fuel forms in which it will be used, distinct from the conventional LEU fuel assemblies that have powered most nuclear reactors for decades. These new fuel forms include metals, salts, and ceramic oxides in pebble or even liquid form. Nor does HALEU represent simply a spectrum of new reactor fuels. It is the foundation of an entirely new fuel cycle. New enrichment facilities, fuel fabrication methods, transportation networks, reactor technologies, and eventually spent-fuel management systems are developing in parallel.
These shifts raise complex questions, including the security implications of long-term storage, disposition, and possible reprocessing of spent HALEU fuel. At the upper end of its enrichment range, HALEU approaches the long-established 20% threshold associated with greater proliferation concern. Material below that threshold may also present security and proliferation risks when available in sufficient quantities. Security calculations based on enrichment levels alone are not enough. The quantity, chemical and physical form, location, transportation routes, and vulnerability to theft or diversion also shape the security risk.
From “Bolt On” Security to Security by Design
In the years after 9/11, nuclear security enhancements were necessarily added to existing operational infrastructure: guards, gates, and guns at facilities; radiation portal monitors at borders; forensic investigations linking nuclear materials to their possible origins or points of diversion; and efforts to correct weaknesses after they were identified. The opportunity today is different. We are designing next-generation reactors, facilities, fuels, and supply chains now. Twenty-five years after 9/11, nuclear security should no longer be bolted on; it should be built in.
HALEU-fueled advanced and small modular reactors, particularly those deployed at remote or distributed sites, will have to contend with cyber, drone, insider, operational, and kinetic threats. Physical protection, material control and accounting, cybersecurity, detection, and response should be considered from fuel fabrication through transportation, reactor operation, and ultimately spent-fuel management. New technologies can help. Advanced analytics and artificial intelligence are already being used in nuclear security to enhance anomaly detection, reassess changing threats, and strengthen the protection of vital areas. But technology does not substitute for thinking through the basic security problems at the design stage by considering security across the entire emerging fuel cycle.
This matters, particularly as governments push to deploy nuclear power more quickly. The United States seeks to greatly expand domestic nuclear generating capacity while streamlining licensing, expanding access to federal deployment sites, and building domestic HALEU production. There is nothing inherently incompatible between speed and security. In fact, designing security into a system from the beginning should be easier and less expensive than retrofitting it later. But despite widespread acknowledgement of this truism and a growing number of awareness-raising documents, guides, and support programs, security-by-design’s champions and thought leaders say only a few of the many advanced reactor and SMR vendors vying for U.S. design approval are integrating security specialists into design teams.
Designing Forensics into the Fuel Cycle
One capability deserves particular attention as the HALEU and advanced reactor fuel cycle is developed over the coming years. Nuclear forensics uses a combination of measurable isotopic, chemical, and physical signatures inherent to nuclear and radioactive materials to help determine their history and origin. It emerged after 9/11 as an important tool for investigating nuclear trafficking and linking interdicted materials to possible sources.
Nuclear and radioactive material signatures can be measured throughout the fuel cycle. Nuclear forensics can improve material characterization and traceability, differentiate manufacturing processes, identify anomalous materials or activities, and support attribution if a nuclear security incident occurs. To aid comparisons, nuclear forensics libraries catalog information on nuclear or radioactive materials that are used, produced, or stored nationally. Nuclear forensics is not only relevant to a nuclear security incident after material has been stolen or intercepted. Its methods can also help determine whether security by design is actually working.
Used properly, forensic capabilities could be incorporated into the new fuel cycle from the beginning, including through unique taggants and other identifying signatures, creating systems that are not only harder to compromise but easier to monitor, investigate, and attribute if something goes wrong. In that sense, nuclear forensics can become an integral part of security by design, strengthening the ability to determine the origin and history of diverted material, incentivizing more effective security practices, deterring potential adversaries, and providing a differentiating advantage for businesses and other entities that participate in signature registration. Such an approach is technically feasible and deserves serious consideration as the HALEU fuel cycle emerges.
The Unfinished Legacy
Twenty-five years after 9/11, the question is whether the nuclear security system built to confront yesterday’s terrorist threat is funded sustainably and evolving fast enough to confront tomorrow’s. The nuclear enterprise is changing, the geopolitical environment is fragmented, conflictual, and beset by competing priorities, and technologies are emerging that create both novel capabilities and new vulnerabilities. HALEU and advanced reactors do not inevitably create unacceptable nuclear security risks. But their vulnerabilities should be identified and addressed as these technologies are developed and deployed.
We have an opportunity now, before the next generation of nuclear infrastructure is fully built, to anticipate and address vulnerabilities, build security into the system, put international nuclear security on a stable budgetary footing, and strengthen our ability to detect and attribute nuclear and other radioactive materials.
September 11 taught us not that catastrophe is inevitable, but that vulnerabilities that appear remote can suddenly prove devastating. The enduring lesson of September 11 is not simply to prepare to respond to the next crisis. It is to act collectively to prevent one.
Recent & Related
What if the US Had Made Peace With Iran After 9/11?
Bombs, Bugs, and Bots: Preventing the Proliferation of Weapons of Mass Destruction 25 Years After 9/11
The Shadow of 9/11 on Future US Foreign Policy
Can the Powers of the Post-9/11 Presidency Be Checked?
The Future of US Basing in the Gulf After the 2026 Iran War
The Continued Nuclear Security Legacy of 9/11
A Cascading Disaster on the China–Nepal Border: What to Know About the August 2026 Rasuwa Flood, 72 Hours Later
As Sea Levels Rise, Where Do Countries End? United Nations Anchors Maritime Boundaries
Can We Rethink Growth Beyond GDP? A Recent UN Report Believes So
ASEAN Needs to Hold Its Line on Myanmar
The Caspianization of Iran’s Security Environment
Beyond Hormuz: Iraq’s Bid to Reach the Mediterranean
Find an Expert
Home to more than 100 scholars and global affiliates, the Stimson Center is proud to be a magnet for the world’s leading experts on the most pressing foreign policy and national security issues of our time. Explore our experts and their work.