1. INSIDER THREAT COURSE THIS IS MY AIRPORT “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

2. 2 IF YOU SEE SOMETHING, SAY SOMETHING TM TSA has developed an Insider Threat Course in collaboration with our industry partners and the Department of Homeland Security’s re-emphasis on “If You See Something, Say Something ™ ” campaign. The course is designed to promote security awareness and vigilance throughout the aviation community. Welcome 2 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

3. 3 IF YOU SEE SOMETHING, SAY SOMETHING TM After this presentation you will be able to: Define and identify an insider threat Explain suspicious behaviors and personal motivators of an insider threat Apply the key components of situational awareness Report observed insider threat or suspicious activity Analyze the consequences of not reporting insider threats Learning Objectives 3 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

4. 4 IF YOU SEE SOMETHING, SAY SOMETHING TM What Is Insider Threat? Insider Threat is defined by the Department of Homeland Security (DHS) as the threat that an employee or a contractor will use his or her authorized access, wittingly or unwittingly, to do harm to the security of the United States. This threat can include damage to the United States through espionage, terrorism, unauthorized disclosure of national security information, or through the loss or degradation of departmental resources capabilities. In a specific aviation context, insider threats are individuals with ACCESS and/or INSIDER KNOWLEDGE that allows them to bypass security of the nation's transportation systems with the intent to cause harm. An insider threat can be anyone who works or has worked at an airport and has done either of the following: Purposefully taken advantage of vulnerabilities in security protocols with the intent of causing harm Accidently exposed vulnerabilities in security protocols that results in harm 4 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

5. 5 IF YOU SEE SOMETHING, SAY SOMETHING TM Evolving Threats Terrorists continuously look for vulnerabilities in aviation security. Your knowledge and access of airport and cargo environments are what they desire most. 5 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

6. 6 IF YOU SEE SOMETHING, SAY SOMETHING TM October 2010 Two packages containing plastic/non-metallic explosives and a detonating mechanism, were found on separate cargo planes traveling from Yemen to the United States. One week later, al-Qaeda took responsibility for the plot. December 2014 At the Atlanta airport, two airline workers, one of them a former employee, were arrested for trafficking over 100 firearms onboard multiple aircraft from Atlanta to New York involving circumventing security measures. February 2016 An explosion blew a hole through the fuselage of (Somali) Daallo Airlines inflight on #3159, from Mogadishu to Djibouti. Somali authorities arrested 20 suspects, including two airport workers, seen on CCTV footage passing a laptop to the suspected suicide bomber. August 2015 At the airport in New York, four contract cargo handlers were arrested for stealing $250,000 in currency (yen) from international mail off of Japan Airlines flights. Criminal/Terrorist Events in Airports October 2015 Metrojet Flight 9268, a Russian charter flight from Egypt crashed killing all 224 people onboard. ISIS claims they circumvented airport security and published a photo online of the alleged improvised explosive device (can of soda). Other theories state the bomb was placed in the cargo hold near the fuel lines. An Egypt Air mechanic with an alleged family tie to ISIS is suspected. The mechanic, two police officers, and a baggage handler were arrested. March 2011 A London based British Airways IT engineer plotted with AQAP's leader Anwar Al-Awlaki to blow up an aircraft. The investigation uncovered hundreds of encoded messages between the British Airways employee and his AQAP handlers. Messages expressed interest in getting a bomb onboard an aircraft, crashing British Airways computer system to cause international disruption, and circumventing security measures. December 2013 At and airport in Wichita, KS, a 58 year-old contract avionics worker was arrested for attempting to explode a vehicle-borne improvised explosive device at the airport. He stated he was inspired by the teachings of Al-Qaeda's Osama bin Laden and Anwar Al-Awlaki. The worker was arrested while circumventing security measures. March 2016 Three suicide bombings ripped through the Zaventem Airport and the Maelbeek Metro station in Brussels, Belgium. The blasts left 31 dead and 270 injured. ISIS has claimed responsibility for the attacks. A known ISIS explosives expert, recorded by an airport surveillance camera, is alleged to have built the bombs used in the attacks and to be one of the suicide bombers that died at the airport. 6 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

7. 7 IF YOU SEE SOMETHING, SAY SOMETHING TM Aviation and cargo employees are the ones most likely to identify suspicious activity at their locations. Employees often follow a similar routine everyday; a suspicious activity will most likely cause you to pause and take notice of an activity that is different from that pattern. Situational Awareness 7 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

8. 8 IF YOU SEE SOMETHING, SAY SOMETHING TM Few Present an Insider Threat Most people with knowledge of internal operations and access to secure or sterile areas pose no security threat. However, a small percentage of people do have ill intent, namely, becoming insider threats and taking advantage of their positions to seek out and recruit other insider support. 8 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

9. 9 IF YOU SEE SOMETHING, SAY SOMETHING TM Who Can Be an Insider Threat? People you may work with or have worked with: Airline employees Airport employees Cargo employees Food vendor employees Construction workers Cleaning crews TSA employees Maintenance crews Security personnel Taxi/limo/shuttle drivers Remember, anyone with access and/or insider knowledge can be an insider threat. 9 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

10. 10 IF YOU SEE SOMETHING, SAY SOMETHING TM How do I identify an Insider Threat? Identifying an insider threat must not be based on race, gender, age, sexual orientation, gender identity, language, or religious beliefs. Only identify an insider threat by actions, by becoming aware of any suspicious activities 10 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

11. 11 IF YOU SEE SOMETHING, SAY SOMETHING TM Radicalization is a process through which an individual changes from a non-violent belief system to a belief system that includes the willingness to actively advocate, facilitate, or use unlawful violence as a method to effect societal or political change. Some insider threat activity has been motivated by greed or financial need. Insider threat activity has been conducted by employees who were disgruntled to the point of wanting to retaliate against the organization. Some insider threats have been individuals who felt a lack of recognition at work, had disagreements with co- workers or managers, and were dissatisfied with the job, or upset by a pending layoff. Insider threat activity has also been conducted by individuals who have pledged allegiance to another person or company, or to a country besides the United States. A person who wants more excitement in life and who is intrigued by covert or sneaky activity is probably motivated by fame. He or she generally has an inflated ego. Blackmail is when a person is easily manipulated due to fear of sensitive information getting out such as gambling, fraud, or illicit relationships. Extortion is when a person is coerced through force or threats. On occasions individual threat activity was related to an individual's problems with substance abuse. In the past, there also have been incidents when a person who was experiencing the stress of family or marital conflicts, or separation from loved ones became involved in insider threat activity. Radicalization Financial gain Anger/revenge Problems at work Divided loyalty Adventure/Thrill Seeker Blackmail/extortion Destructive behavior Family problems Insider Threat Motivators 11 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

12. 12 IF YOU SEE SOMETHING, SAY SOMETHING TM Suspicious Behaviors Be vigilant of anyone displaying the following behaviors: Misusing any security credential Displaying unexplained wealth and high-value purchases Having suspicious foreign contacts or travel Working odd hours or unassigned duties without authorization or logical reason Copying proprietary materials, unnecessarily, especially if marked Sensitive Security Information (SSI) 12 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

13. 13 IF YOU SEE SOMETHING, SAY SOMETHING TM Be vigilant of anyone displaying the following behaviors: Advocating violent or extremist ideology at the workplace or elsewhere Showing unusual interest outside their scope of duty Intentional disregard for airport or cargo security policies Unusual interest in or evasion of random security searches or measures Attempting entry to restricted areas without proper credentials Suspicious Behaviors 13 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

14. 14 IF YOU SEE SOMETHING, SAY SOMETHING TM Do not share detailed or sensitive information about yourself, your family, your associates, or your work with: Anyone without a need to know Anyone expressing heightened interest in you Unknown individuals/groups: Through instant messaging Via e-mail By text By telephone In personal encounters Be Aware of Information You Share 14 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

15. 15 IF YOU SEE SOMETHING, SAY SOMETHING TM Unusual items or situations: A vehicle parked in an odd location Unattended packages and luggage Unsecured SIDA doors Extended loitering in access controlled areas Unusual, repeated, and prolonged observation or picture taking of airport and cargo facilities Be Vigilant 15 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

16. 16 IF YOU SEE SOMETHING, SAY SOMETHING TM Your Responsibility What you observe may save lives. Law Enforcement Officers (LEO) depend on you to report suspicious activities Early reporting is important; the earlier suspicious behavior/activity gets reported, the more likely an investigation will prevent a potential event Once you report the suspicious activity, you should not get involved any further Remember, reporting is your responsibility! 16 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

17. 17 IF YOU SEE SOMETHING, SAY SOMETHING TM What Do I Need to Report? WHO you saw WHAT you saw WHERE you saw it WHEN you saw it WHY you believe the activity or behavior is suspicious 17 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

18. 18 IF YOU SEE SOMETHING, SAY SOMETHING TM Who Do I Contact? Immediate danger: Contact your airports emergency number (303-342-4211) or find a Law Enforcement Officer Suspicious activity: Contact your supervisor Ground Security Coordinator (GSC) Law Enforcement Officer (LEO) Federal Bureau of Investigation (FBI) Report anonymously: TSA Anonymous Tip Line 1-844-MY-ARPRT (1-844-692-7778) 18 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”

19. 19 IF YOU SEE SOMETHING, SAY SOMETHING TM The most important thing to do is be vigilant. Keep your eyes and ears open and report anything you see that is suspicious. Remember… 19 “IF YOU SEE SOMETHING, SAY SOMETHING TM ”