Editor’s Note: Non-proliferation has been an imperfect but real policy success in the modern era. However, the emergence of the North Korean program and continued problems with other nuclear weapons states raise the risk of additional proliferation, including to non-state actors. Robert Litwak of the Wilson Center breaks down how we should think about non-proliferation, explaining the different categories of states and policy responses and arguing that an Iran-like deal is a powerful approach that deserves emulation in several other cases.

***

While the United States has been generally resilient to terrorist attack since 9/11, a “potential game changer,” as then-President Barack Obama qualified in a 2010 interview with journalist Bob Woodward, “would be a nuclear weapon in the hands of terrorists, blowing up a major city.” Preventing this nightmare scenario—a nuclear 9/11—hinges on foiling terrorist efforts to acquire the capability that would allow them to act on their intent to commit such a horrific attack.

Each pathway to nuclear acquisition by a non-state terrorist group is contingent on an act of commission or negligence by a state.

That entails blocking the pathways to terrorist acquisition of a nuclear weapon. There are three possibilities for how a terrorist organization might acquire the bomb: transfer—the sale or handoff of a weapon from a nuclear-weapon state; leakage—the theft of a nuclear weapon or weapons-grade fissile material; and indigenous production—the construction of a nuclear device from illicitly obtained weapons-grade fissile material.

Each pathway to nuclear acquisition by a non-state terrorist group is contingent on an act of commission or negligence by a state. The “leakage” of a weapon to a terrorist group would originate from one of the nine nuclear-weapon states or the 22 states (at current count) with weapons-grade fissile material in their civilian stocks. Among this group, the countries of greatest concern regarding the nexus of proliferation and terrorism—North Korea, Pakistan, and Russia—are each continuing their development of nuclear weapons and risking broader proliferation, including to non-state actors.

North Korea is on the verge of a strategic breakout both quantitatively, by ramping up its number of warheads to possibly as many as 100 weapons by 2020, and qualitatively, by mastering warhead miniaturization. And it would have few qualms about selling nuclear materials for the right price. Pyongyang is known, as Secretary of Defense Robert Gates put it, for its willingness to “sell anything they have to anybody who has the cash to buy it.” Pakistan continues to build up its nuclear arsenal (including the development of battlefield tactical nuclear weapons), employs terrorism as an instrument of state policy, and faces the internal security threat of radical Islamists attempting to infiltrate its nuclear establishment. And Russia, which inherited the Soviet Union’s vast nuclear arsenal and stocks of fissile material, terminated its nuclear-security cooperation with the United States under the Cooperative Threat Reduction Program put in place by the Nunn-Lugar Act in 1991.

The country missing from this list is the one that the State Department has called the most active state sponsor of terrorism: Iran. The reason for this striking omission is that the 2015 nuclear agreement reached between Iran and the world’s major powers, if successfully implemented, will block Iran’s pathways to a weapon or weapons-usable material for at least 15 years. In short, the leading state sponsor of terrorism would not be among the leading suspects if the worst form of terrorism occurred.

Effective strategies on the national and international level—ones that lock down weapons and weapons-usable material—are the prerequisite for addressing non-state threats. A repertoire of tailored nonproliferation strategies focused on state actors would not eliminate non-state terrorist threats, but would go far in achieving this goal.

Since 9/11, the Cold War concept of deterrence has been retooled to address the threats of a new era. Classic deterrence theory distinguishes between two variants. Deterrence by punishment seeks to affect the intention of a state to carry out a hostile act through the credible threat of a punitive response, whereas deterrence by denial seeks to affect the capabilities of the target state either by blocking the acquisition of those means or through the adoption of defensive measures to render them ineffective.

The vast majority of work done in the nonproliferation arena to counter nuclear terrorism falls under the rubric of deterrence by denial. This covers a range of activities, such as export controls to limit access to technology and physical security at sensitive sites to lock down fissile material to prevent illicit diversion. The Obama administration pursued “cooperative threat reduction”—a deterrence by denial strategy—to secure nuclear weapons and materials globally through a series of four Nuclear Security Summits, which brought together some 50 heads of state and made significant progress by, to take one example, reducing the number of countries with weapons-usable nuclear materials from 32 in 2010 to 22 by April 2016.

To prevent a state from transferring nuclear weapons or technologies to a terrorist group, the United States has employed deterrence by punishment. Dating back to 2006, when North Korea conducted its first nuclear test, U.S. declaratory policy has held that a state that supports or enables terrorist groups to acquire or use nuclear weapons would be held “fully accountable.” But this policy of calculated ambiguity is inadequate for North Korea—the one state that might sell a weapon or nuclear technology to a terrorist group. In addressing the acute threat posed by the Pyongyang regime, this general declaratory policy should be made explicit: The deliberate transfer of nuclear capabilities by North Korea to a non-state entity would trigger a non-nuclear, regime-changing response from the United States.

The fear of deterrence by punishment could lead countries that are the potential sources of nuclear leakage to implement more effective strategies of deterrence by denial.

A highly contentious issue relating to nuclear leakage is whether potentially negligent states, such as Pakistan, should be held “fully accountable.” Technical advances in the area of nuclear attribution will increasingly permit experts to determine the source of fissile material should an attack occur. The United States has an interest in publicizing its attribution capabilities so that states at risk of contributing to nuclear proliferation, deliberately or not, will know that they need to take the possibility of detection, and the attendant risk of retaliation, into account. The deterrent threat captured in the calculatedly ambiguous phrase “fully accountable” does not commit the United States to a retaliatory response against the country of origin. The fear of deterrence by punishment could lead countries that are the potential sources of nuclear leakage to implement more effective strategies of deterrence by denial.

An inherent tension exists between the twin variants of deterrence—punishment and denial. An over-emphasis on the punitive threat of the former potentially undercuts the target state’s incentive for cooperating in the implementation of the latter. For example, Pakistani cooperation on nuclear security (denial) could provide the United States with sensitive information to identify Pakistan as the source and target it for retaliation (punishment) should one of its nuclear weapons be illicitly obtained by a terrorist group. This policy tension between punishment and denial can be managed but not resolved.

The Iran nuclear accord set an important nonproliferation precedent—deterrence by denial through arms control. That approach should be attempted to constrain the nuclear capabilities of two other hard cases, North Korea and Pakistan. In both, the objective would be to cap and secure those countries’ nuclear weapons and weapons-usable fissile material. Opting for a negotiated freeze of capabilities recognizes that a full rollback of either North Korea’s or Pakistan’s nuclear programs is not a diplomatically attainable objective. Even the more modest goal of capping and securing their nuclear arsenals would face formidable political obstacles in both countries.

Since the early 1990s, when the disintegration of the Soviet Union raised concerns about the security of its vast nuclear arsenal, U.S. measures to deter nuclear terrorism have garnered bipartisan support. The end of U.S.-Russian nuclear security cooperation raises concerns about Russian backsliding—whether, for example, the financially strapped Putin regime will continue to fund security upgrades under the Nunn-Lugar program at Russian nuclear sites. Some experts already see an uptick in the threat as new security upgrades have been canceled at some of Russia’s closed nuclear cities and a project to convert highly-enriched uranium into non-weapons grade fissile material has ceased. For the Trump administration, which has expressed an interest in improved U.S.–Russian relations, the restoration of cooperation on nuclear-security issues with Russia presents both urgency and an opportunity.

An important development with implications for the prevention of nuclear terrorism has been the Trump administration’s decision to continue participation in the Iran nuclear deal, an effective form of deterrence by denial. That agreement remains the focus of congressional criticism because it was transactional, not transformational—that is, it did not address other areas of concern, such as the Iranian regime’s support for Hezbollah and human rights abuses. With North Korea, the most likely state to sell a nuclear weapon to a terrorist group, on the verge of significantly increasing the size of its nuclear arsenal, the pressing question is whether the Trump administration will apply the Iran precedent of transactional arms-control talks to the Pyongyang regime as a stop-gap measure to freeze the North’s capabilities.