This post on Lawfare talks about three ways people and groups other than nation-states could get their hands on nuclear weapons.

That entails blocking the pathways to terrorist acquisition of a nuclear weapon. There are three possibilities for how a terrorist organization might acquire the bomb: transfer—the sale or handoff of a weapon from a nuclear-weapon state; leakage—the theft of a nuclear weapon or weapons-grade fissile material; and indigenous production—the construction of a nuclear device from illicitly obtained weapons-grade fissile material.

Each pathway to nuclear acquisition by a non-state terrorist group is contingent on an act of commission or negligence by a state. The “leakage” of a weapon to a terrorist group would originate from one of the nine nuclear-weapon states or the 22 states (at current count) with weapons-grade fissile material in their civilian stocks. Among this group, the countries of greatest concern regarding the nexus of proliferation and terrorism—North Korea, Pakistan, and Russia—are each continuing their development of nuclear weapons and risking broader proliferation, including to non-state actors.

North Korea is on the verge of a strategic breakout both quantitatively, by ramping up its number of warheads to possibly as many as 100 weapons by 2020, and qualitatively, by mastering warhead miniaturization. And it would have few qualms about selling nuclear materials for the right price. Pyongyang is known, as Secretary of Defense Robert Gates put it, for its willingness to “sell anything they have to anybody who has the cash to buy it.” Pakistan continues to build up its nuclear arsenal (including the development of battlefield tactical nuclear weapons), employs terrorism as an instrument of state policy, and faces the internal security threat of radical Islamists attempting to infiltrate its nuclear establishment. And Russia, which inherited the Soviet Union’s vast nuclear arsenal and stocks of fissile material, terminated its nuclear-security cooperation with the United States under the Cooperative Threat Reduction Program put in place by the Nunn-Lugar Act in 1991.