Insider threat: What you can do about it

Published Sept. 28, 2023
By Daniel Knox, Information Protection Director
88th Air Base Wing

National Insider Threat Awareness Month graphic. (Contributed graphic)

WRIGHT-PATTERSON AIR FORCE BASE, Ohio – I’m sure most of you are aware that potential insider threats include anyone with authorized access to our people, mission assets, infrastructure, and sensitive or classified information who could potentially use that to endanger lives or impact missions vital to national security.

The collective obligation of counter-insider threat measures is to reduce the risk of malicious or nonmalicious insider activity that could impede our ability to successfully execute that mission. The theme for National Insider Threat Awareness Month is to be an “up-stander vs. bystander,” which means if you see something unusual, don’t just observe – do something about it.

Most of you know the Department of Defense has people and processes set up to ensure bad guys don’t gain access, and if they do, to detect those bad guys (or negligent good guys) before they cause harm. As with anything that includes the human dynamic, any countermeasure we develop can be overcome by smart people with the desire and resources to defeat that safeguard. Likewise, it sometimes only takes one smart person like you to prevent the loss of life, assets or sensitive information.

Insider threat measures are like a game of chess; for every move made, there are many countering moves that can be applied toward the initial maneuver. We must decide which move is best for our specific operational need and what we can do to be effective in our circle of influence or control.

Current policy already insists we only trust properly vetted individuals for access to sensitive or classified information, mission assets or critical infrastructure, and sometimes even other people. We conduct polygraph exams and have protocols in place to investigate an applicant’s background for indicators of loyalty to our government, constitutional values, past criminal history or any signs demonstrating potential doubt in a person’s trust. Additionally, we continuously vet employees throughout their federal careers for indicators of distrust or threats to our people or assets.

These processes, however, can’t see all that you see in your daily work environment, which is why you are the most important insider threat detector.

Workplace vigilance may have helped prevent the theft and compromise of classified information by Edward Snowden in 2013, and the Washington Navy Yard active-shooter incident that same year in which a 34-year-old contractor with authorized access killed 12 people. There were observable and reportable indicators in Snowden’s actions that might have precluded his malicious acts of treason. There were also observable and reportable indicators in the shooting event that may have at least revoked the shooter’s Navy Yard access that day.

Even Wright Patterson Air Force Base has seen the intentional theft of classified documents, and the local defense industry has been the target of professional Chinese espionage agents. Most of those incidents demonstrated reportable indicators as well.

Some simple measures you can take include not ignoring a co-worker who demonstrates a desire to harm a specific person or group of people, behavior contradictory to our oath of office or disregard – whether malicious or not – for existing security criteria. The Air Force has dozens of reporting tools and conduits to cover almost every conceivable concern, from safety and security to social issues.

You have many choices of who that someone can be – your supervisor, commander, director, chief, first sergeant, chaplain, inspector general, law enforcement and security professionals, or even a friend. Don’t ignore something that concerns you, your teammates or our mission-essential tasks; if you see or hear something, say something.

You may be wrong, but the consequences of not reporting that something are too important to your team, our mission and the nation.

You are the most important part of the insider threat program. You are trained to understand and recognize indicators of potential threats, training the Air Forces regularly reinforces every year. You also took an oath to protect and defend the Constitution against all enemies, foreign and domestic.

So, when you get that funny feeling about something, don’t ignore your gut – it might save lives and keep the nation more secure from our adversaries.

WPAFB insider threat contact information:

911 to prevent loss of life, property or information
937-257-0911 for WPAFB Emergency Services (Fire Department and security forces)
937-257-6516/7 to contact the 88th Security Forces Squadron’s Base Defense Operations Center
937-257-9603 or www.osi.af.mil/submit-a-tip to reach the Air Force Office of Special Investigations
88ABW.IP.C-InTworkflow@us.af.mil to contact the 88th Air Base Wing’s Insider Threat liaison