Plan alignment and operational interfaces in nuclear security event response: evidence from Türkiye’s all-hazards emergency management system

1 Introduction

Nuclear and radioactive materials are used across a wide range of civilian applications, including power generation, medical diagnostics and treatment, industrial radiography, and scientific research, creating persistent risks of misuse through theft, sabotage, unauthorized possession, and illicit trafficking. The International Atomic Energy Agency (IAEA) defines nuclear security as the prevention of, detection of, and response to such acts involving nuclear or other radioactive material, facilities, and applications (IAEA, 2013). Unlike nuclear safety, which addresses unintentional accidents, nuclear security is concerned with intentional acts, law enforcement coordination, and governance under uncertainty. The two domains are complementary but operationally distinct: safety systems are designed to mitigate accidental failures, while security arrangements must account for deliberate actors whose behavior cannot be fully anticipated in advance. Despite this complementarity, nuclear security continues to face a disparity in institutional prioritization compared to nuclear safety across both established and emerging nuclear states (Islam et al., 2025).

Data from the IAEA Incident and Trafficking Database (ITDB) indicate that nuclear security risks are persistent rather than exceptional. Since 1993, thousands of incidents involving nuclear or radioactive material outside regulatory control have been reported, including cases involving theft, loss, and undetermined intent (IAEA, 2026). A significant proportion occur during authorized transport operations, indicating that nuclear security risks extend beyond fixed facilities into mobile and distributed environments. Radioactive sources used in medical and industrial applications present lower weapons potential than fissile materials, but their wide distribution and variable regulatory oversight make them operationally significant from a security governance perspective (National Academies of Sciences, Engineering, and Medicine, 2021). Nuclear-related risks are therefore more likely to arise from operational failures or malicious acts than from large-scale nuclear conflict (Kapur et al., 2024), and effective response depends on governance arrangements that extend across the full range of material use, transport, and storage contexts.

Responding effectively to nuclear security events requires coordinated action among emergency management authorities, law enforcement agencies, regulatory bodies, health services, and forensic experts operating under different mandates. Once prevention fails, response effectiveness depends on whether planning documents specify how consequence management, threat neutralization, criminal investigation, and public communication are to be coordinated in parallel. This is a problem of institutional design. Organizations with different responsibilities and operating logics must work together as parts of a wider response system during a nuclear security event. Emergency management systems develop around anticipated hazard types, and the organizational routines, legal mandates, and resource allocations that accumulate around those designs may become resistant to reorientation over time (Boin et al., 2016). Emergency management research has long shown that response effectiveness depends not only on formal authority but also on the quality of inter-organizational coordination under time pressure (Kapucu, 2009; Boin and Bynander, 2015). This institutional path dependence is especially relevant to nuclear security event response, where several organizations must coordinate across distinct information requirements and decision authorities. When threat environments evolve, planning arrangements may lag behind, producing a divergence between formal plan alignment and operational specification under intentional threat conditions. This distinction is also relevant to incident-response research, which shows that response procedures are more effective when linked to the operational context and interdependencies of the systems they are intended to protect, rather than treated as isolated process models (Shaked et al., 2023).

The response and operational coordination dimension of nuclear security has received comparatively limited systematic attention in the governance literature, which has focused more extensively on deterrence, proliferation, and regime design (Kapur et al., 2024). This gap is particularly important in all-hazards systems, where operational coordination depends on how emergency management, regulatory, law enforcement, technical and forensic functions are connected before an event occurs and revised through exercises and post-event learning. Studies examining China, India, and Indonesia indicate that coordination and planning-interface questions have appeared in different nuclear governance contexts (Knox, 2012; Singh, 2021; Apriliani et al., 2021), but a systematic examination of nuclear security event response within an all-hazards emergency management perspective remains limited in the published literature. This article addresses that underexamined response dimension through a structured case analysis.

Türkiye provides an analytically relevant case. The country has an established all-hazards emergency management architecture and an evolving nuclear governance framework that has undergone significant reform since 2018, including the establishment of the Nuclear Regulatory Authority (NDK), the adoption of Nuclear Regulation Law No. 7381 (Republic of Türkiye, 2022b), and the development of secondary legislation addressing physical protection, cyber security, and insider threats. These developments have been accompanied by international review processes, including an International Physical Protection Advisory Service (IPPAS) mission in 2021 and preparatory activities for the Integrated Nuclear Security Sustainability Plan (INSSP) update (IAEA, 2021a; IAEA, 2024). As nuclear program expansion continues, the scope of nuclear security governance extends across nuclear facilities, radioactive source use, and associated transport systems, making the interface between nuclear security arrangements and emergency management increasingly relevant.

National emergency response in Türkiye is coordinated by the Disaster and Emergency Management Authority (AFAD) through the Türkiye Disaster Response Plan (TAMP), which applies an all-hazards approach. Nuclear and radiological emergencies are addressed through the National Radiation Emergency Plan (URAP). Both frameworks are primarily structured around accident-driven scenarios. URAP organises nuclear and radiological emergencies into five response categories based on the nature and location of the hazard source: Categories I through III cover facility-based scenarios of increasing severity, including nuclear power plants and research reactors; Category IV addresses events outside fixed facilities, including the transport of radioactive material, material outside regulatory control, and deliberate criminal use of radioactive sources; and Category V covers emergencies originating beyond Türkiye’s borders with potential domestic impact. Response arrangements for nuclear security events involving intentional acts, including command transition to law enforcement, forensic evidence management, and security-sensitive information handling, are less clearly specified within the publicly available planning architecture. This study asks how nuclear security event response is specified within Türkiye’s all-hazards emergency planning architecture and how institutional interfaces are defined for intentional nuclear security events.

To address this question, the study applies the Four C framework to a structured documentary analysis of publicly available planning, regulatory, strategic, and review documents, assessing communication, coordination, collaboration, and cooperation across institutional interfaces (Martin et al., 2016; Farhat et al., 2024). The study frames nuclear security event response as a governance problem embedded in all-hazards planning architecture. The broader analytical issue is how states expanding nuclear programs can incorporate nuclear security response requirements into all-hazards emergency management architectures without confining nuclear and radiological emergency planning to accident-oriented consequence management.

2 Analytical framework

2.1 Nuclear security event response and emergency governance

Contemporary disaster management has shifted toward integrated frameworks addressing prevention, mitigation, preparedness, response, and recovery. The all-hazards approach builds generic capabilities that enhance interoperability and reduce reliance on hazard-specific command structures (Waugh and Streib, 2006; Federal Emergency Management Agency, 2019). Research in this tradition shows that response effectiveness is an emergent property of inter-organizational interaction quality rather than a function of any single institution’s capacity (Starr, 2023; Miller et al., 2025). Coordination failures and competing institutional mandates therefore represent primary sources of systemic vulnerability, particularly in interdependent response systems where institutional boundaries intersect with operational functions (Piraina and Trucco, 2021). Crisis coordination literature similarly shows that coordination is often treated as both the central problem and the prescribed solution in crisis response, yet formal coordination mechanisms may become insufficient when events cross organizational, jurisdictional, and sectoral boundaries under deep uncertainty (Boin and Bynander, 2015).

Nuclear security events differ from accidents in that they involve deliberate actors who may adapt to institutional responses, exploit coordination weaknesses, and pursue objectives that conflict with those of emergency responders. When nuclear or radioactive material is encountered outside regulatory control, emergency management authorities, law enforcement agencies, regulatory bodies, and forensic specialists must operate simultaneously under conditions of uncertainty and competing priorities. Consequence management, threat neutralization, and criminal investigation each impose distinct procedural requirements and must proceed in parallel rather than sequentially. Comparable coordination and planning-interface issues have been discussed in studies of China, India, and Indonesia, although these cases have not been systematically examined through the lens of all-hazards emergency management and nuclear security event response (Knox, 2012; Singh, 2021; Apriliani et al., 2021).

2.2 All-hazards emergency management and nuclear security response

Nuclear security challenges extend beyond technical protection and include insider threats, cyber risks, crisis communication, and physical protection (Kapur et al., 2024). The IAEA Nuclear Security Series promotes risk-informed approaches that calibrate protective measures according to threat scenarios, material characteristics, and potential consequences of malicious acts (IAEA, 2019). Preventive instruments such as national threat assessments and design basis threat documents are essential to physical protection, but they do not by themselves define how the wider emergency management system should respond after an event begins (IAEA, 2021b). IAEA Nuclear Security Series (NSS) No. 37-G identifies core functional components of national nuclear security event response, including consequence management, counteraction, criminal investigation, nuclear forensics, public information management, international notification, and evidence handling (IAEA, 2019). These functions serve as analytical reference points for assessing whether national planning frameworks can activate them under intentional threat conditions. The Four C dimensions are used here to organize these functions analytically: Communication relates to public information management and security-sensitive information handling; Coordination governs counteraction, evidence management, and command transitions; Collaboration reflects joint exercises and training; Cooperation refers to international notification and forensic assistance mechanisms.

The distinction between preventive security planning and disaster management is particularly relevant for events involving material outside regulatory control. Nuclear security planning focuses on anticipating intentional acts before they materialize, while disaster management emphasizes system performance once uncertainty has already materialized. In such events, facility-based protections are no longer applicable and response depends on the quality of cross-institutional coordination. Whether planning arrangements specify the institutional interfaces required for such coordination is the empirical question examined in this study.

2.3 The four C framework for institutional interfaces

Collaborative governance and network-based approaches have contributed to understanding inter-organizational coordination in emergency response (Ansell and Gash, 2008; Kapucu, 2006). Their central insight is that outcomes depend on how institutions interact, not only on the formal mandates assigned to them. However, these frameworks were largely developed in settings involving routine interaction or consensus-building processes and provide less direct guidance for high-stakes intentional events, where coordination failures may have immediate operational consequences. The Four C framework addresses this limitation by focusing on institutional interfaces under conditions of uncertainty and time pressure (Martin et al., 2016; Farhat et al., 2024). Communication concerns real-time information exchange and shared situational awareness; fragmented communication can produce divergent operational pictures at critical stages. Coordination refers to the alignment of simultaneously activated institutions, determining whether operational behavior converges toward a common objective or diverges into competing priorities. Collaboration represents preparedness, including joint exercises, training programs and scenario planning through which institutions develop shared understanding before an event. Cooperation encompasses longer-term external relationships, including international notification systems, mutual assistance arrangements, and access to specialized expertise such as nuclear forensics.

Unlike hierarchical command models, the Four C framework is suited to environments where multiple authority structures operate simultaneously without predefined primacy. This configuration can also be understood through a system-of-systems perspective. The relevant institutions retain operational and managerial independence, yet must combine their capabilities during an event to deliver a response that no single organization could provide alone. In this sense, nuclear security event response may resemble an acknowledged system of systems, in which shared objectives and coordination arrangements exist but constituent organizations retain independent mandates, management structures and resources. Coordination therefore depends substantially on the design of institutional interfaces and on collaboration among participating organizations rather than on fully centralized control (Maier, 1998; Dahmann and Baldwin, 2008). In such contexts, increasing the number of participating institutions without clearly defined coordination mechanisms may reduce rather than improve system effectiveness (Piraina and Trucco, 2021). The framework therefore provides a structured basis for examining not only formal plan alignment but also the functional specification of governance arrangements during nuclear security events involving intentional acts.

3 Research design and methodology

This study uses a qualitative single-case design based on structured documentary analysis. Türkiye is treated as an analytically useful case rather than a representative example (Flyvbjerg, 2006; Yin, 2018). Three features make the case analytically useful: a formally integrated all-hazards emergency management system is in place; recent nuclear governance reforms have introduced or redefined institutional roles; and the relationship between these changes and existing planning documents can be examined through publicly available sources. The aim is not statistical generalization, but to develop case-based insights that may inform future comparative research on nuclear security event response in all-hazards systems.

Document identification and selection proceeded through four phases: identification, screening, eligibility assessment, and final inclusion, summarized in Figure 1. Official institutional websites, government legal repositories, the Official Gazette, IAEA publications, and keyword searches were used to locate potentially relevant documents. Search terms covered nuclear and radiological emergency response, Chemical, Biological, Radiological and Nuclear (CBRN) response, radiation monitoring, nuclear security, emergency governance, institutional coordination, notification, public information, and emergency planning.

The initial search identified 56 records. After removal of 9 duplicate or duplicate-version records, 47 documents underwent preliminary screening based on source, title, and relevance to the study scope. At this stage, 20 records were excluded as clearly unrelated to nuclear or radiological emergency governance, non-official in origin, or superseded by more recent versions. The remaining 27 documents were assessed in full against the eligibility criteria, with forward and backward reference checks conducted to verify coverage. A further 11 full-text documents were excluded at this stage, including media reports, social media posts, non-official commentary, secondary webpages, and technical reactor safety documents outside the scope of emergency response governance. General academic literature and theses on disaster and emergency management were also excluded at this stage, as the corpus was restricted to official public governance documents directly relevant to nuclear and radiological emergency planning or nuclear security event response. The final corpus comprised 14 primary documents coded in the analysis and two supporting contextual sources that were listed but not coded.

Documents were included when they were official and publicly accessible, related to nuclear or radiological emergency planning, CBRN response, radiation monitoring, emergency governance, or inter-organizational coordination, and contained information relevant to response roles, planning procedures, operational interfaces, notification arrangements, public information, or institutional responsibilities. Classified security plans, facility-level physical protection documents, non-public threat assessments, media reports, social media posts, non-official commentary, secondary webpages, and technical reactor safety documents outside the scope of emergency response governance were excluded. The search was concluded when additional searches and reference checks identified no further eligible documents.

The primary corpus consists of 14 publicly available documents obtained from national authorities and international organizations. These include national disaster response plans, nuclear and radiological emergency frameworks, CBRN-related regulations, provincial risk reduction plans, institutional strategic plans, and an independent international assessment. The IAEA Integrated Regulatory Review Service (IRRS) mission report is treated as an external reference point for inter-institutional coordination and safety-security interface governance. Two additional sources, national radiation source statistics and CBRN terminology material, were used only for contextualization and were not coded (Disaster and Emergency Management Authority, 2014; Nuclear Regulatory Authority, 2025a).

Table 1 provides a document-level record of the corpus. It identifies the document type, institutional origin, publication year and version consulted, scope, analytical relevance, and relevant Four C dimensions for each source. Legal and planning instruments were reviewed in the version in force at the date of access; strategic plans, guidance documents, and review reports were reviewed in their most recent publicly available edition. The National Radiation Emergency Plan (URAP) entry records the 2019 version, which remained in force at the time of access. Full references and access dates are provided in the reference list.

TABLE 1. Document corpus, version information, and analytical relevance.

Supporting contextual sources were not coded as part of the primary corpus. n. d. indicates that no publication year was stated in the official version consulted.

The Four C framework provides the deductive coding structure, with Communication, Coordination, Collaboration, and Cooperation as predefined analytical categories. Each document was reviewed systematically by the authors, with relevant passages extracted into analytical notes. Coding was not restricted to a single dimension: where a provision addressed more than one institutional function, it was assigned to all relevant categories. A provision addressing information exchange and task allocation simultaneously, for example, was coded as both Communication and Coordination. This multi-label approach reflects the fact that institutional interfaces in nuclear security event response often combine functions that resist a single classification. Coding decisions were reviewed iteratively for consistency, and Table 1 reports all relevant Four C dimensions rather than a single primary category.

IAEA Nuclear Security Series No. 37-G, IAEA General Safety Requirements No. GSR Part 7, and relevant emergency preparedness guidance served as normative reference points for identifying response functions and assessing whether planning arrangements specified the procedures required to activate, coordinate, and sustain them. These sources were not treated as part of the primary national document corpus.

Procedural specification was assessed through four indicators: responsibility, timing, sequencing, and public visibility. Responsibility, timing, and sequencing were derived from recurring procedural requirements in IAEA guidance. These include the clear allocation of roles and responsibilities, arrangements for notification, activation, and deployment, and the organization of coordinated response actions and information flows across relevant authorities (IAEA, 2012; IAEA, 2015; IAEA, 2019). Public visibility was added as a study-specific evidentiary indicator because the analysis is limited to publicly available documents and does not assess classified plans, informal coordination arrangements, or operational performance.

Responsibility refers to whether a function is assigned to a named institution or actor. Timing refers to whether notification windows, activation thresholds, deadlines, initiation arrangements, or other temporal markers are specified. Sequencing refers to whether the order of interaction between institutions is defined, including escalation, notification, activation, handover, command transition, deployment, or information flow. A provision was assessed as fully specified when all three elements were explicitly defined, as partially specified when only some were present, and as not visible in the public corpus when the relevant function was absent, only implied, or not procedurally described. This last category identifies the limits of what can be assessed from public documents; it does not imply the absence of non-public operational arrangements.

The two provincial risk reduction plans (İRAPs) are official documents prepared by the AFAD Provincial Directorates of Istanbul and Mersin under Türkiye’s national disaster risk reduction framework. They are included as illustrative cases rather than representative samples. Mersin represents a nuclear facility context due to the Akkuyu Nuclear Power Plant, while Istanbul represents a high-density radiological-use environment involving medical, industrial, security, research, and education applications (Disaster and Emergency Management Authority, 2021; Disaster and Emergency Management Authority, 2022).

A methodological boundary applies throughout. The analysis evaluates formal governance architecture as reflected in publicly available plans, legislation, regulations, strategic documents, and institutional reports. It does not assess operational performance, classified capabilities, or informal coordination practices. Findings should therefore be read as identifying limited formal specification in the public corpus, not as evidence of the absence of operational capacity.

4 Türkiye’s emergency planning architecture

4.1 All-hazards emergency governance

Disaster management governance in Türkiye has undergone significant transformation over the past 2 decades, shifting from a reactive model toward a more proactive and risk-based architecture. The 1999 Marmara Earthquake exposed major problems in institutional coordination and response capacity, prompting sustained structural reform (Corbacioglu and Kapucu, 2006). Law No. 5902 established AFAD in 2009 under the Ministry of Interior, consolidating previously fragmented emergency management and civil defense functions under a central coordinating authority (Republic of Türkiye, 2009). The updated disaster and emergency response services regulation further defines the service-group structure and institutional responsibilities underpinning Türkiye’s all-hazards response system (Republic of Türkiye, 2025).

Türkiye’s emergency planning architecture is structured around four main instruments: the Türkiye Disaster Risk Reduction Plan (TARAP) for pre-disaster risk reduction; the Türkiye Disaster Response Plan (TAMP) for emergency response; the Türkiye Post-Disaster Recovery Plan (TASIP) for recovery; and the National Radiation Emergency Plan (URAP) for nuclear and radiological emergencies (Republic of Türkiye, 2022a; Disaster and Emergency Management Authority, 2023; AFAD, 2025a; AFAD, 2019). TAMP’s function-based design enables institutions to operate through shared coordination and service delivery mechanisms across hazard types (Disaster and Emergency Management Authority, 2023). This provides the general all-hazards structure into which nuclear and radiological emergency planning is integrated. At the same time, NDK does not appear within TAMP’s national or provincial command architecture, and the public planning framework does not define a formal structural linkage between regulatory and emergency response functions (Disaster and Emergency Management Authority, 2023; Disaster and Emergency Management Authority, 2019).

Provincial Risk Reduction Plans (IRAPs) show how this architecture is applied at subnational level. The Istanbul IRAP categorizes nuclear and radiological risks under industrial and CBRN accident frameworks, while the Mersin IRAP refers to the Akkuyu Nuclear Power Plant mainly in relation to port and infrastructure planning (Disaster and Emergency Management Authority, 2022; Disaster and Emergency Management Authority, 2021). These examples indicate that provincial plans provide relevant risk-reduction context, but do not themselves define detailed response procedures for intentional nuclear security events. Figure 2 summarizes the relationship among Türkiye’s main disaster planning instruments.

4.2 Nuclear and radiological emergency planning

URAP establishes a multi-layered planning architecture linking national, provincial, and facility-level response structures. Its alignment with TAMP provides a shared legal and organizational basis for radiological emergency response. In this sense, the framework reflects formal integration across the national disaster management system (Christensen and Laegreid, 2007). Whether this formal integration also produces functional integration under intentional nuclear security conditions is the question examined in the findings. The institutional context is complicated by the reallocation of nuclear governance functions after URAP was issued. The 2019 plan refers to the former Turkish Atomic Energy Authority (TAEK). Subsequent restructuring separated regulatory and technical functions across the Nuclear Regulatory Authority (NDK) and the Turkish Energy, Nuclear and Mineral Research Agency (TENMAK). NDK now represents the regulatory authority, while TENMAK holds technical and research-related capacities formerly associated with TAEK (Nuclear Regulatory Authority, 2025a; Nuclear Regulatory Authority, 2026a; Turkish Energy, Nuclear and Mineral Research Agency, 2024). This distinction is relevant because URAP retains legacy TAEK references, whereas the current institutional architecture distributes regulatory and technical responsibilities across separate organizations.

URAP’s operational provisions are primarily organized around radiological emergency categories and consequence management. The plan acknowledges that deliberate acts, including sabotage or radiological dispersal, may trigger emergency conditions (Disaster and Emergency Management Authority, 2019). However, within the publicly available version of the plan, law enforcement coordination, forensic evidence management, and security-sensitive information handling are not presented as separate response functions at an equivalent level of procedural detail. Category I and II accident procedures, for example, specify explicit obligations, named actors, and defined timelines, whereas Category IV provisions addressing deliberate acts are expressed in modal language without equivalent institutional assignments or sequencing requirements (Disaster and Emergency Management Authority, 2019).

Regulatory arrangements add further complexity. Article 30 of the CBRN Regulation requires each institution to develop its own operational directive, which may operate alongside AFAD-coordinated response structures (Republic of Türkiye, 2020). The IAEA IRRS mission also noted the need for continued development in role clarity, inter-agency coordination, and the safety-security interface (IAEA, 2022a).

4.3 The safety-security interface in emergency planning

Nuclear safety and nuclear security share physical infrastructure, personnel, and consequence management responsibilities, but they differ in operational logic. The IAEA defines nuclear safety as the achievement of proper operating conditions, prevention of accidents and mitigation of accident consequences, while nuclear security concerns the prevention, detection of, and response to criminal or intentional unauthorized acts involving nuclear material or other radioactive material (IAEA, 2022b). Although the distinction between the two domains is not absolute, security is generally concerned with intentional actions by people, while safety addresses harmful consequences from radiation exposure whatever the cause. Their interaction is particularly relevant in emergency response planning, where arrangements for both domains must be coordinated (IAEA, 2022b). Security arrangements must account for deliberate actors who may seek to exploit or replicate accident conditions (Williams, 2020). Recent research on the integrated management of nuclear safety and security likewise emphasizes the need for explicit coordination across safety-security interfaces. Assessing safety, physical security, and cybersecurity separately may obscure convergent vulnerabilities that become particularly relevant during emergency response (Ylönen and Björkman, 2023). The safety-security interface becomes visible in recurring operational tensions. Radioactive material transport requires sufficient hazard information for first responders, while security protocols may restrict route and schedule information. Initial response to an unknown radiological anomaly must also balance protective action, scene preservation, forensic requirements, and controlled information release.

The IAEA IRRS mission noted that the safety-security interface requires further development in Türkiye’s regulatory and planning framework (IAEA, 2022a). NDK’s Strategic Plan 2026-2030 formally distinguishes safety and security as separate strategic objectives, reflecting institutional recognition that the two domains require distinct governance arrangements (Nuclear Regulatory Authority, 2026a). Section 5 examines how this strategic distinction is reflected in the public planning architecture for nuclear security event response. Figure 3 maps the institutional interfaces that structure nuclear security event response planning.

5 Findings: operational interfaces in nuclear security event response

The findings are organized around the distinction between formal and functional integration, understood here as the difference between plan-level alignment and operational specification (Christensen and Laegreid, 2007).

5.1 Structural integration and implementation conditions

URAP’s alignment with TAMP provides a legal and organizational basis for activating national and provincial response structures during radiological emergencies. However, the plan does not define nuclear security events as a distinct response category. Incidents involving sabotage, illicit use of radioactive material, or deliberate contamination are addressed through accident-oriented procedures, which leaves the response arrangements for intentional acts less clearly specified than those described in IAEA nuclear security guidance (IAEA, 2019).

This issue is also visible in the revision logic of the plan. URAP links revision to two conditions: the identification of deficiencies through exercises and changes in international guidance or national legislation (Disaster and Emergency Management Authority, 2019). NSS No. 37-G also recommends periodic review and review after major changes in institutional arrangements or threat assessments (IAEA, 2019). URAP does not include equivalent triggers, which may limit the extent to which institutional reforms between exercise cycles are reflected in the plan.

The TAEK, TENMAK and URAP relationship illustrates this point. URAP assigns Category IV technical support functions, including law enforcement briefings on radiological and forensic matters, to TAEK (Disaster and Emergency Management Authority, 2019). However, TENMAK does not appear in URAP, and the plan does not clarify how the legacy TAEK assignment is to be operationalized under the current institutional architecture. As a result, personnel responding to a Category IV event under the current plan would be directed toward an institutional assignment that no longer reflects the current governance architecture. Knox (2012) identifies a comparable condition in China, where legal responsibilities remained assigned to institutions that no longer existed, suggesting that planning lag after institutional reform can occur beyond a single national case.

Provincial planning documents show a similar pattern. Both the Mersin and Istanbul IRAPs address nuclear and radiological risks through accident-oriented hazard typologies without identifying intentional nuclear security events as a distinct planning category. Neither plan includes revision mechanisms linked to major infrastructural change. This suggests that the pattern is not limited to a single document but appears across multiple levels of the public planning architecture.

5.2 Detection and response capacity

URAP acknowledges risks associated with radioactive material outside regulatory control, but does not provide clearly specified scenario-based procedures for incidents involving stolen, lost, or orphan sources. Scene security, criminal investigation integration, public information management, and nuclear forensic evidence handling are not explicitly articulated within the current framework. IAEA guidance recommends national response frameworks tailored to such scenarios, with explicit attention to multi-agency coordination requirements (IAEA, 2011).

Türkiye operates the Radiation Monitoring and Warning System Network (RADISA), a national radiation monitoring network providing continuous gamma dose-rate measurements across 239 fixed stations, including stations in city and district centres, thermal power plants, nuclear facilities, border posts, and the Akkuyu Nuclear Power Plant site. The system is integrated into the European Radiological Data Exchange Platform (EURDEP) and the Radioactivity Environmental Monitoring (REMon) platform (Nuclear Regulatory Authority, 2026b; EURDEP/REMon, 2026). However, RADISA alert data do not appear to be formally integrated into security-specific response activation procedures. The Regulation on National Radiation Monitoring explicitly excludes measurements related to radiological and nuclear threats from its scope, directing such situations to separate emergency frameworks (Nuclear Regulatory Authority, 2022a).

A RADISA alert indicates an abnormal radiological condition, but does not by itself distinguish between an accidental release and a deliberate nuclear security event. Translating such an alert into an appropriate operational response therefore depends on predefined arrangements for assessment, notification, and coordination among technical authorities, emergency management organizations, and law enforcement. For example, an elevated radiation reading during transport could reflect an accident, an orphan source, or the deliberate dispersal of radioactive material. The initial radiological signal may therefore be similar, while the operational response requires different institutional interfaces depending on the underlying cause. These interfaces are only partially specified in the publicly available planning documents for nuclear security event scenarios; whether more detailed procedures exist in non-public or classified frameworks falls outside the scope of this analysis.

TENMAK has developed domestic mobile radiological detection systems with demonstrated field performance (Turkish Energy, Nuclear and Mineral Research Agency, 2025a, Turkish Energy, Nuclear and Mineral Research Agency, 2025b). These assets are not referenced in URAP, and their deployment is not associated with defined activation protocols or authority assignments. TENMAK’s strategic plans identify integration with AFAD and law enforcement as a strategic commitment (Turkish Energy, Nuclear and Mineral Research Agency, 2024), indicating that the constraint lies in planning architecture rather than resource availability or institutional intent.

Compared with URAP, the 2020 CBRN duty regulation provides a more explicit allocation of responsibilities for radiological and nuclear threats and hazards (Republic of Türkiye, 2020). It assigns NDK regulatory, assessment, notification and advisory functions, while assigning TENMAK technical support, measurement deployment, source control, laboratory analysis and responsibilities related to radioactive or nuclear material treated as evidence by law enforcement. These provisions show that security-relevant elements are present in the public regulatory framework. However, these responsibilities are distributed across multiple legal frameworks, planning instruments and governance levels, including TAMP, URAP, provincial plans and agency-specific mandates. Together, these instruments assign relevant responsibilities but do not specify, in publicly available documents, how AFAD, NDK, TENMAK, law enforcement and provincial authorities would coordinate during the early stages of an intentional radiological or nuclear security event. The remaining issue is therefore not the absence of institutional authority, but the limited public specification of inter-institutional coordination procedures. More detailed procedures may exist in non-public or classified frameworks, but these fall outside the scope of this analysis.

A similar planning concern appears in guidance issued by India’s Atomic Energy Regulatory Board (AERB), which calls for emergency arrangements to be integrated into an all-hazards management system and aligned with the response plans of authorities responsible for nuclear security (AERB, 2022).

5.3 Coordination and command transition

AFAD’s coordinating mandate is well established within the disaster management system. Nuclear security events, however, may simultaneously activate regulatory authority, law enforcement powers, health emergency mechanisms, and judicial processes under distinct mandates. In accident scenarios, these functions generally converge around consequence management. In intentional nuclear security events, priorities among public protection, threat neutralization, evidence preservation, and judicial accountability may diverge.

URAP designates AFAD as national coordinator, but does not define the point at which law enforcement assumes operational primacy. International nuclear security response frameworks typically include graduated alarm adjudication protocols, technical reach-back arrangements, and explicit role transitions between law enforcement and technical authorities at key decision points (IAEA, 2011; IAEA, 2019). URAP does not appear to provide an equivalent level of procedural specificity for nuclear security scenarios. This distributed mandate structure also affects command transition. Although the CBRN duty regulation assigns relevant security, notification and technical support functions, URAP does not specify the point at which law enforcement primacy, AFAD coordination, NDK regulatory assessment and TENMAK technical support are operationally sequenced during a Category IV event.

This difference is visible in URAP’s procedural language. Category I and II accident procedures are written in declarative form: on-site personnel must declare a General Emergency within 15 min and notify the Provincial Governor’s Office within 30 min (Disaster and Emergency Management Authority, 2019). Category IV procedures follow a different register: the authorized person “should preserve the scene,” first responders “should establish a cordon,” and response measures “should be initiated” upon detection (Disaster and Emergency Management Authority, 2019). The shift from declarative to modal language suggests that institutional responsibilities and time-bound sequences are less clearly specified for intentional scenarios.

Ontario’s Provincial Nuclear Emergency Response Plan provides a relevant contrast. When a nuclear emergency results from terrorism or civil disorder, Emergency Management Ontario assumes consequence management in support of the Ministry of the Solicitor General’s overall command. This defined allocation reduces ambiguity at the emergency management and law enforcement interface (Ontario, 2025). URAP’s Category IV provisions do not specify a comparable mechanism. In fast-response organizations, coordination depends not only on formal structure but also on the timely integration of distributed expertise, cross-boundary interaction, and shared situational understanding (Faraj and Xiao, 2006). These conditions are typically supported by pre-established procedures that define who acts, in what sequence, and under whose authority. URAP’s modal language for Category IV procedures, where responsibilities are expressed as recommendations rather than obligations, suggests that these procedural conditions are less clearly defined for intentional nuclear security scenarios than for accident-based response.

5.4 Law enforcement and forensic coordination

Nuclear security events require emergency response and criminal investigation to proceed in parallel. This creates a different operational environment from accident scenarios, where the main priority is usually consequence management. In intentional nuclear security events, life-saving measures, scene control, evidence preservation, and source characterization may need to be carried out at the same time. Nuclear forensics is not only a technical analytical function but also part of the evidentiary process through which material history, attribution, and potential prosecution are supported, making chain-of-custody and investigative coordination central to nuclear security response (Fedchenko, 2014).

The Arifiye incident provides a domestic illustration of this interface. AFAD documents the case as a suspected radioactive material incident in Arifiye, Sakarya, in October 2016, following a report to the provincial emergency center. The response involved the AFAD CBRN team, police, TAEK, health authorities, local public health bodies, and company representatives connected to the construction site from which the source had reportedly been obtained (Disaster and Emergency Management Authority, 2025). Measurements were conducted at the scene, a security perimeter and isolation area were established, residents were moved away from the affected area, potentially exposed persons were assessed and transferred to health personnel, and the radioactive source was secured by TAEK. The case is not used here to evaluate operational performance. Rather, it illustrates how several response functions converged in a single setting, including radiological assessment, public protection, scene control, technical authority, health coordination, and potential investigative or evidentiary handling. The case also illustrates a limitation in the public documentary record. AFAD’s case material includes an intervention comment noting that decontamination was later considered unnecessary after TAEK measurements indicated irradiation rather than contamination. However, the reviewed public planning documents do not show whether this operational lesson was formally incorporated into subsequent planning revisions, training design, or inter-agency procedures. The publicly available case description does not indicate how security-specific functions, including evidence preservation, chain of custody, nuclear forensic examination, or subsequent criminal investigation, were coordinated. Whether these activities were undertaken through non-public procedures cannot be assessed from the available documentation.

AFAD case material points to a wider pattern. The cases are presented as CBRN response incidents and repeatedly refer to practical problems such as unclear roles, uneven institutional capacity, delays in inter-agency coordination, the need for joint training, and uncertainty over procedural responsibilities in incidents with investigative or judicial elements. This does not show an absence of CBRN response capacity. It suggests that security-relevant radiological incidents are mainly handled within a broad CBRN emergency response logic, while nuclear security-specific interfaces such as intent classification, law enforcement primacy, evidence preservation, technical authority, and forensic coordination are not developed as separate response functions in the public planning framework (Disaster and Emergency Management Authority, 2025; Republic of Türkiye, 2020).

URAP does not appear to provide clearly specified protocols for the collection and preservation of forensic evidence when emergency response and criminal investigation overlap. This is also relevant for forensic coordination, since the CBRN duty regulation assigns TENMAK functions related to sample collection, laboratory analysis and radioactive or nuclear material treated as evidence by law enforcement. URAP, however, does not define the operational sequence through which evidence preservation, radiation protection, source control and law enforcement authority are reconciled during a Category IV event. Category IV procedures refer to scene preservation and assistance to law enforcement, but they do not define how chain-of-custody requirements are to be maintained during radiation monitoring, decontamination, source recovery, or evidence collection (Disaster and Emergency Management Authority, 2019).

The classification of intent is also important for forensic coordination. If an event is treated initially as a radiological emergency and only later as a criminal act, law enforcement primacy and evidence management procedures may be activated after response actions have already altered the scene. The United States Nuclear/Radiological Incident Annex addresses this issue through a default presumption that a potential terrorist incident is treated as an actual terrorist incident until the Attorney General determines otherwise. This enables early activation of law enforcement structures without waiting for full confirmation of intent (FEMA, 2023).

URAP’s Category IV provisions do not specify a comparable mechanism for resolving classification uncertainty at the early response stage. The central interface question is therefore how law enforcement, technical assessment and radiological protection functions are sequenced during nuclear security events. This interface is central to nuclear security response because it determines whether public protection and forensic integrity can be managed simultaneously. In the absence of clearly specified sequencing procedures, responders must rely on situational judgment to balance radiological protection and scene preservation rather than on a pre-established protocol.

5.5 Communication and sensitive information management

AFAD is designated as the central communication authority within the national disaster management system, with responsibilities for public information and inter-institutional situational awareness. In nuclear security events involving intentional acts, however, the information environment differs from accident scenarios. Early assessments require technical input from NDK on radiation measurements and source characterization, while threat-related information may be held by law enforcement under confidentiality requirements. These conditions can affect how quickly a shared operational picture is formed across institutions. This creates a tension between public communication and investigative confidentiality. URAP sets a 4-h target for initial media briefing through the Public Information Center (Disaster and Emergency Management Authority, 2019). This timeline is suited to accident scenarios where consequence-related information can normally be released without affecting a criminal investigation. In intentional nuclear security events, the same period may coincide with early investigative activity, where disclosure of source location, material characteristics, or suspect-related information may affect forensic processes. URAP does not appear to define procedures for managing this boundary between public information and investigative confidentiality (IAEA, 2019). This is relevant because misinformation and public concern can develop rapidly during radiological events, while premature disclosure may complicate investigation and response (Perko et al., 2014). The reach-back function is also central to communication. It links field detection assets to technical analysis and returns interpreted guidance to responders. TENMAK’s laboratory capabilities provide the analytical endpoint for isotopic identification and source characterization, which can inform consequence management and nuclear forensic analysis. However, the data pathway connecting field teams to TENMAK is not described in the public planning documents reviewed for this study. Whether data formats, classification rules, and information-sharing procedures are specified in non-public or classified frameworks falls outside the scope of this analysis. The integration of technical analysis into coordinated response is therefore not fully visible in the formal public planning architecture.

Taken together, these issues show that communication in nuclear security events is not only a matter of public messaging. It also concerns the controlled movement of technical, operational, and security-sensitive information among institutions. The main issue is therefore not the absence of communication authority, but the formal specification of how information is shared, protected, and translated into response decisions during intentional nuclear security events.

5.6 Collaborative preparedness and exercise practice

Joint planning activities, training programs and exercises under TAMP provide a basis for inter-institutional preparedness. However, collaborative arrangements appear to be more developed for accident-driven radiological scenarios than for nuclear security events involving intentional acts. Exercises involving deliberate misuse of radioactive material or law enforcement-led operations do not appear to be systematically incorporated. AFAD’s 2024-2028 Strategic Plan identifies insufficient joint training and exercises as a continuing issue (Disaster and Emergency Management Authority, 2024), and the IAEA IRRS mission reported similar observations on inter-institutional preparedness (IAEA, 2022a).

URAP defines a 3-year full-scale exercise cycle for nuclear power plant scenarios, with tabletop exercises in intervening years (Disaster and Emergency Management Authority, 2019). An equivalent requirement is not clearly specified for Category IV events involving criminal acts, source theft, or radiological dispersal scenarios. A full-scale radiation emergency exercise conducted in Mersin in December 2025 involved AFAD, NDK, and other institutions, but the scenario addressed a nuclear facility accident rather than an intentional nuclear security event (Disaster and Emergency Management Authority, 2025b). This is consistent with the document analysis, which shows stronger exercise specification for accident-based scenarios than for security-oriented response functions.

A comparable pattern is noted by Singh (2021) in India, where only a small proportion of national disaster management exercises between 2006 and 2015 addressed nuclear or radiological scenarios, with no documented inclusion of intentional security scenarios in later cycles. This comparison is not used to generalize from Türkiye to other systems, but to show that exercise asymmetry may also arise in more established nuclear governance contexts.

URAP does not appear to define performance indicators for nuclear security event response preparedness. Without defined performance indicators, exercises may be less able to function as systematic inputs to plan revision, institutional learning, and operational improvement (IAEA, 2019). More broadly, the public documents reviewed do not clearly identify a formal mechanism through which operational experience from exercises, domestic incidents, or internationally documented events is systematically reviewed and incorporated into planning revisions or inter-agency procedure development. The Arifiye incident, discussed in Section 5.4, illustrates this limitation at the incident level: AFAD case material documents an operational adjustment, but the public record does not show whether this experience was formally incorporated into subsequent planning or training design. Whether such learning processes occur through internal or non-public mechanisms cannot be assessed from the available documentation. In the absence of visible feedback mechanisms, planning arrangements may be less likely to improve systematically from exercise to exercise or from incident to incident.

5.7 International cooperation and assistance

Türkiye maintains formal channels for international notification and assistance through IAEA-coordinated mechanisms, with obligations established under the Convention on Early Notification of a Nuclear Accident and the Convention on Assistance in the Case of a Nuclear Accident or Radiological Emergency (Disaster and Emergency Management Authority, 2019). The IPPAS mission in 2021 evaluated Türkiye’s nuclear security regime against IAEA Nuclear Security Series guidance with participation from multiple national institutions, including AFAD (IAEA, 2021a). In March 2022, NDK and AFAD signed a cooperation protocol establishing a joint self-assessment process in preparation for an IAEA Emergency Preparedness Review Service (EPREV) mission (Nuclear Regulatory Authority, 2022b).

URAP’s international cooperation provisions focus primarily on the IAEA notification chain and inbound assistance mechanisms. They do not clearly specify how law enforcement, judicial authorities, and forensic institutions would be integrated into a shared operational framework, although such integration is required for nuclear security response.

URAP assigns the IAEA notification obligation to NDK across Category IV sub-scenarios with potential cross-border implications (Disaster and Emergency Management Authority, 2019). For Category V events, the plan defines an inbound coordination sequence in which IAEA notifications are transmitted to NDK and then relayed to AFAD’s emergency management center (Disaster and Emergency Management Authority, 2019). The outbound sequence, from domestic response operations to NDK’s IAEA reporting obligation, is less clearly specified. Although NDK holds the notification obligation, it does not appear in AFAD’s command architecture, and the plan does not define a notification timeline or a mechanism through which NDK obtains the situational information required to fulfill this function.

The IAEA’s ConvEx-3 international emergency response exercise demonstrated that notification delays can affect protective measures in neighboring states and identified notification latency as a factor in cross-border response adequacy (IAEA, 2014). Türkiye’s planning architecture does not appear to define a time-based notification standard for intentional nuclear security events. In the absence of scenario-specific procedures and rehearsal, formal treaty commitments may not fully capture the operational time constraints associated with such events (IAEA, 2019). Figure 4 summarizes the public specification of selected nuclear security response functions, showing greater visibility for consequence management and public information than for investigation, evidence management, nuclear forensics and counteraction.

6 Discussion: Lessons learned and implications

The findings show that formal alignment within an all-hazards framework does not by itself ensure operational specification for nuclear security event response. Türkiye’s emergency management architecture provides a coordinated legal and organizational basis for radiological emergencies, but intentional nuclear security events require additional procedural interfaces among emergency management, law enforcement, regulatory authority, technical assessment, forensic evidence management, and public communication. The issue identified is not the absence of institutional capacity, but the limited public specification of procedures that translate existing capacities into coordinated action by defining authority, timing, information flow, and sequencing across institutions. Crisis governance scholarship describes a related dynamic as institutional lock-in: organizational routines, legal mandates, and preparedness practices may consolidate around an initial design logic and become more resistant to adaptation as threat environments change (Pierson, 2000; Boin et al., 2016).

Institutional reform does not automatically update operative planning documents. TENMAK was established in 2020, but URAP continues to assign Category IV technical support functions to TAEK. URAP’s revision mechanism links updates to exercise deficiencies and legislative change, but not to organizational restructuring. This means that the governance architecture visible to response personnel may not reflect the current institutional landscape. Knox (2012) identifies a comparable condition in China, and Apriliani et al. (2021) document a structurally similar pattern in Indonesia. These comparisons suggest that planning lag after institutional reform may also arise in systems where nuclear governance and emergency management institutions evolve at different speeds.

The recurring absence of specified command transitions, forensic evidence procedures, revision triggers, and notification timelines across several document types suggests that the issue is not primarily one of resources or transitional delay. It reflects a planning architecture originally shaped around accident-based response. Nuclear security events do not follow the linear phase structure assumed by conventional emergency plans: consequence management, law enforcement operations, and criminal investigation must proceed simultaneously rather than sequentially. This is consistent with nuclear security scholarship cautioning that additional formal capabilities do not automatically produce more effective security outcomes and may introduce new organizational risks (Sagan, 2004). In the present case, the documentary evidence points more specifically to limited public specification of coordination arrangements across relevant institutions. A similar point appears in the broader emergency management literature on complex disasters, where command-centered response structures may require complementary governance arrangements when multiple authority systems operate simultaneously (Nowell and Steelman, 2019).

A practical implication is that exercises should function not only as compliance activities but as mechanisms for testing command transition, sensitive information handling, forensic coordination, and international notification under time pressure. This is consistent with recent National Academies findings that nuclear incident response builds on all-hazards emergency management capabilities, but requires scenario-specific protocols, specialized expertise, public communication arrangements, and exercises that test how the response system operates as an integrated whole (National Academies of Sciences, Engineering, and Medicine, 2024). These findings can also be read through the Problem-Social-Institutional framework developed by Reich and Subrahmanian (2022). PSI explains complex design and organizational problems through the alignment of problem characteristics, social actors and institutional arrangements. Although this study does not adopt PSI as a second analytical framework, it provides a useful complementary lens for interpreting the gap between formal plan alignment and operational specification. In the Turkish case, the response problem remains framed largely through accident-oriented radiological consequence management, while nuclear security event response requires the simultaneous mobilization of emergency management, regulatory, technical, law enforcement, health and forensic actors. The institutional space, however, remains distributed across multiple plans, regulations and agency mandates. From a PSI perspective, the issue can therefore be understood as a partial misalignment between the problem definition, the social capabilities required for nuclear security event response and the institutional routines through which response is operationalized.

The IAEA NSS No. 37-G identifies functional outcomes and associated response actions including consequence management, counteraction, criminal investigation, public information, evidence handling, and nuclear forensics as relevant components of nuclear security event response (IAEA, 2019). URAP contains detailed consequence management arrangements, but corresponding functions for intentional nuclear security events are less visible in the public planning framework. Strategic documents already recognize related coordination and preparedness issues, including joint training and exercise needs and the distinction between safety and security objectives (Disaster and Emergency Management Authority, 2024; Nuclear Regulatory Authority, 2026a). The remaining question is how this recognition is translated into operational procedures and exercise design. The findings point to a distributed planning architecture rather than an absence of institutional capacity.

Türkiye’s public framework assigns relevant responsibilities across multiple legal, regulatory and planning instruments. However, these mandates are not fully translated into publicly specified coordination procedures that define authority, timing, information flow, and sequencing during nuclear security events. The Four C framework helps identify where this specification is required: communication for sensitive information and public messaging, coordination for command transition and technical support, collaboration for exercises and preparedness, and cooperation for international notification and assistance.

Comparative references are not expanded into a separate comparative analysis. They are used selectively as analytical contrasts to clarify the types of procedural mechanisms through which all-hazards systems can accommodate nuclear security event response. The Memorandum of Understanding between the FEMA and the Nuclear Regulatory Commission (NRC) defines jurisdictional boundaries, establishes joint steering arrangements, and links preparedness assessment to regulatory processes (FEMA and NRC, 2025). The United States Nuclear/Radiological Incident Annex extends a general coordination structure with procedures specifically tailored to intentional nuclear or radiological incidents (FEMA, 2023). These examples suggest a practical direction: all-hazards systems can retain their general coordination architecture while adding a procedurally distinct layer for intentional nuclear security events. In the Turkish case, this points less to wholesale structural redesign than to supplementary procedural specification for the interfaces identified in this study. The practical implication is not to convert all-hazards emergency plans into security plans or to disclose classified response arrangements. It is to ensure that nuclear security response requirements are reflected in public emergency planning through clearly defined functions, interfaces, and coordination responsibilities. For states expanding nuclear programs while relying on established all-hazards systems, nuclear and radiological emergency planning should therefore extend beyond accident-based consequence management and specify how emergency management, regulatory authority, technical assessment, law enforcement, forensic handling, and public communication interact when an emergency is initiated by an intentional act.

The legacy TAEK assignment in URAP, together with the subsequent separation of technical and regulatory functions across TENMAK and NDK, illustrates how institutional reform can outpace planning document revision. This does not indicate an absence of institutional capacity. Rather, it shows how changes in organizational mandates and technical responsibilities may not immediately be translated into publicly specified procedures for emergency response coordination. In this respect, the Turkish case is analytically useful not as a representative example, but as an illustration of how accident-oriented planning arrangements may diverge from the procedural requirements of intentional nuclear security events.

The broader implication is that nuclear security response should be integrated into all-hazards systems not by converting general emergency plans into security plans or by disclosing classified arrangements, but by specifying the public-facing institutional interfaces that become critical once intent, evidence, technical assessment, and public protection must be managed simultaneously. This includes clearer arrangements for command transition, law enforcement coordination, forensic evidence handling, sensitive information management, and notification timing. Future research should examine whether these interfaces are addressed through non-public procedures or inter-agency practices and compare how other all-hazards systems specify command transition, forensic coordination, and notification timing for intentional nuclear security events.

Generative AI statement

The author(s) declared that generative AI was used in the creation of this manuscript. The authors verify and take full responsibility for the content of this manuscript. Generative AI tools were used solely for language editing and minor structural refinement. All content has been reviewed and validated by the authors.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Nadja Zeleznik, Milan Vidmar Electric Power Research Institute, Slovenia

Reviewed by: Stephen Musolino, RadSafe Solutions LLC, United States

Avi Shaked, Tel Aviv University, Israel