DRAFT Command Brief – Insider Threat Awareness Training

DRAFT Command Brief – Insider Threat Awareness Training
UNCLASSIFIED Customizable DoD Command Brief Insider Threat Awareness DRAFT Command Brief – Insider Threat Awareness Training

DRAFT Command Brief – Insider Threat Awareness Training
UNCLASSIFIED Your Name and Seal Here Insider Threat Awareness Customize with your commands name and logo. Slide 30 provides an opportunity to input customized reporting SOP and POC. Consider supplementing briefing with job aids, case studies, and other awareness materials available under the Awareness and Training and Vigilance Campaign Tabs of the Insider Threat Toolkit at DRAFT Command Brief – Insider Threat Awareness Training

Insider Threat Awareness
Learning Outcome: At the end of this brief, you will be able to: Understand the importance of detecting potential insider threats and reporting behaviors of concern to insider threat personnel or other designated officials Describe methodologies of adversaries to recruit trusted insiders and collect classified information Identify indicators of insider threat behavior and procedures to report such behavior Understand counterintelligence and security reporting requirements

The threat that an insider will use her or his authorized access, wittingly or unwittingly, to do harm to the security of the United States. This can include damage to the United States through espionage, terrorism, unauthorized disclosure of national security information, or through the loss or degradation of departmental resources or capabilities. We often think of counterintelligence in terms of foreign intelligence services and their spies. But what of the insider threat? Insider as Any person with authorized access to any United States Government resource to include personnel, facilities, information, equipment, networks, or systems. The threat that an insider will use his/her authorized access, wittingly or unwittingly, to do harm to the security of the United States. This threat can include damage to the United States through espionage, terrorism, unauthorized disclosure of national security information, or through the loss or degradation of departmental resources or capabilities

Counterintelligence Insider Threat Awareness Class Discussion: Name Examples of the Insider Threat me Ask students to name examples of insider threat – Snowden, Manning, Montes, Ames, Hansen, the usual. Mention Benedict Arnold if students do not and discuss that each of these individuals exhibited behaviors and characteristics that, if reported, could have led to the prevention or detection of their activities much sooner. In fact, in some cases, the behaviors were reported, but no action was taken.

DoD Insider Threat Program
Insider Threat Awareness DoD Insider Threat Program National Insider Threat Program Executive Order 13587 DoD Insider Threat Program DoDD “Leverages counterintelligence (CI), security, cybersecurity, Human Resources (HR), Law Enforcement (LE), and other relevant functions and resources to identify and counter the insider threat”

Internal Threat Threats may include: Espionage Unauthorized Disclosure National Security Crimes Workplace Violence Sabotage Fraud Security Violations Unwitting Actions that increase vulnerabilities Other Counterproductive workplace activity The trusted employee we come in contact with every day – Not necessarily members of the cleared community! No environment is immune from insider threat. insiders can threaten not only classified information but also sensitive information (which includes personally Identifiable Information (PII)) and all types of DoD resources, to include people. Characteristics of insider threats can vary May be volunteers or recruits Often solo actors Naturalized or native U.S. citizens Foreign Connections Computer and Internet savvy Motives: Ideology, disgruntlement, financial gain, ingratiation, coercion, thrills, recognition and ego

Most individuals do not set out to become an insider threat. A combination of factors including personal predisposition and life stressors in the home or on the job place people on the Critical Pathway to Insider Threat. Early identification and reporting of risk indicators can allow your Insider Threat Program to respond appropriately to mitigate risk and help those in need before it’s too late.

Most employees engaging in threat behavior showed one or more Potential Risk Indicators (PRIs). Potential Risk Indicators may include but are not limited to:

Observable and Reportable Potential Risk Indicators (PRIs) may fall into the following categories: PRI Unexplained Foreign Travel Suspicious Behavior Pattern of Security Violations Connection to Anomalies

PRI: Pattern of Security Violations
Insider Threat Awareness PRI: Pattern of Security Violations PRI Pattern of Security Violations Potential risk indicators related to security violations include: Establishing pattern of security violations Seeking to expand access Being reluctant to submit to polygraph Being responsible for unaccounted for classified materials “Fishing” through offices, desk drawers, files, and storage containers in search of classified material

Intentional Mishandling of Classified Information Attempts to Obscure Classification Markings Unauthorized Removal of Classification Markings Classified Materials Kept at Home or Taken on Trips Retention of Classified, Export Controlled or Other Sensitive Materials obtained at Previous Jobs Ben-ami Kadish. 84, was arrested 22 April 2008 on four counts and plead guilty to one: conspiracy to act as an unregistered agent of the government of Israel. Kadish, a mechanical engineer, worked for the US Army’s Armament Research, Development, and Engineering Center at the Picatinny Arsenal in Dover, New Jersey, from 1963 until On numerous occasions from 1980 to 1985, Kadish provided classified documents related to the US military, including some relating to US missile defense systems, to an agent of Israel, Yossi Yagur. Yagur was also Jonathan Pollard’s handler. On 29 May 2009, he eventually was fined $50,000, but not given prison time. Ben-ami Kadish, December 2008: Pled guilty to acting as unregistered agent of foreign power.

Misuse of IT Systems Accessing or Attempting to Access Systems Outside of Normal Work Hours Repeated Deviations from or Circumventions of Standard Security Procedures Use of Unmarked Electronic Media Containing Classified Information Unexplained or Out of the Ordinary Changes in System or User Activity Use of Numerous Passwords and Log Ins Attempting to Obtain the Passwords of Coworkers Browsing Files and/or Records Not Authorized Michael Mitchell, December 2009: Pled guilty to trade secret theft. Michael Mitchell became disgruntled and was fired from his job due to poor performance. He kept numerous computer files with his employer’s trade secrets; he entered into a consulting agreement with a rival Korean company and gave them the stolen trade secrets. In March 2010, he was sentenced to 18 months in prison and ordered to pay his former employer over $187,000. Insider Threat Disgruntled Employees Information Systems folks with all privileges Steganography Open Source Servers Tele-work Removable Media Thumb drives CDs, etc Computer Crime Fraud Identity Theft

PRI: Suspicious Behavior
Insider Threat Awareness PRI: Suspicious Behavior Potential risk indicators related to suspicious behavior include: Working hours inconsistent with job assignment Insisting on working in private without a valid reason Demonstrating exploitable behavior traits Revealing unexplained affluence Showing infatuation with covert activity and interest in clandestine operations PRI Suspicious Behavior

Foreign Preference/Loyalty Strong Ties or Affiliations to Foreign Nations Ownership of Property or other Vested Economic Interest Abroad Attempts to Conceal Service in Foreign Military, Gov’t, or Intel Service Chi Mak admitted that he was sent to the United States in 1978 in order to obtain employment in the defense industry with the goal of stealing US defense secrets, which he did for over 20 years. He passed information on quiet electric propulsion systems for US submarines, details on the Aegis radar system, and information on stealth ships being developed by the US Navy. The Chinese government tasked Mak to acquire information on other technologies. Mak recruited family members to encrypt and covertly courier information back to China. In May 2007, Mak was convicted of conspiracy, failing to register as an agent of a foreign government, and other violations. He was sentenced to over 24 years in prison. Chi Mak, May 2007: Convicted of conspiracy and other violations. Sentenced to 24 years.

Foreign Contacts Contact with Foreign Officials and Representatives Visits to Official Foreign Establishments for Unexplained Reasons Attempts to Conceal Contacts with Foreigners Visits to Foreign Diplomatic Facilities Elliot Doxer, December 2011: Sentenced to 6 months prison, 6 months home confinement & $25,000 fine for economic espionage. Usually combined with Other Indicators – can also include foreign relatives. Notes re: PERSEREC, spies with foreign relatives were more than twice as likely to have been recruited by FIS than those without, they were less likely to have failed in their espionage attempt and the length of time they committed espionage was greater. Elliot Doxer sent an to the Israeli Consulate stating that he was willing to provide information from his employer that might help Israel. An undercover FBI agent posing as an Israeli intelligence officer spoke to Doxer and established a “dead drop” where the two could exchange information. For the next 18 months, Doxer visited the dead drop at least 62 times. Doxer provided customer and employee lists, contract information, and other trade secrets. He pleaded guilty to one count of foreign economic espionage and was sentenced in December 2011 to six months in prison, six months home confinement, and fined $25,000.

Unexplained Affluence Sudden Purchase of High Value Items Unexplained Ready Cash Unexplained Settlement of Large Outstanding Debts Large Deposits to Savings Accounts Opening of Savings or Stock Accounts with Foreign Banks Wen Chyu Liu, January 2012: Sentenced to 60 months prison, $25k fine and forfeiture of $600k. Trade secret theft to China. Wen Chyu Liu, a retired research scientist, was sentenced in January 2012 to 60 months in prison, two years supervised release, a $25,000 fine and was ordered to forfeit $600,000. Liu was convicted in February 2011 of stealing trade secrets from his former employer and selling them to companies in China. Liu conspired with at least four current and former employees, traveled throughout China to market the stolen information, paid current and former employees for material and information, and bribed a then-employee with $50,000 in cash to provide a process manual and other information.

PRI: Unexplained Foreign Travel
Insider Threat Awareness PRI: Unexplained Foreign Travel Potential risk indicators related to unexplained foreign travel include: Reported/unreported foreign travel and contact with foreign nationals Routine vacations to countries of interest Frequent, unexplained short trips PRI Unexplained Foreign Travel

Frequent Unexplained Trips of Short Duration Frequent, Unexplained, Short Not Necessarily Foreign Destinations! Jin Hanjuan August 2012: Sentenced to four years for corporate espionage. Title Says it all, but Edward Howard, CIA: Made 3 trips to Vienna Anne & Jonathan Pollard, Navy: Married in Vienna Ronald Pelton, NSA: Several trips to Vienna Hanjuan Jin took a leave of absence from her US employer in While on leave, Jin worked for a similar company in China. A year later, Jin returned to the United States. Within a week of her return, she bought a one-way ticket back to China, and advised her US employer that she was ready to end her leave. Jin returned to work on February 26, 2007 and for the next two days downloaded hundreds of technical documents. On February 28, 2007, during a routine check at the airport, more than 1,000 electronic and paper documents proprietary to her US employer were found in Jin’s luggage. In 2012, Jin was sentenced to four years in prison and fined$20,000. David Barnett, CIA: FBI spotted while meeting KGB in Vienna

PRI: Connection to Foreign Anomalies
Insider Threat Awareness PRI: Connection to Foreign Anomalies Foreign anomalies include: Appearance of classified or proprietary technology Equipment or technology that incorporate protected U.S. technology Foreknowledge of U.S. diplomatic positions, negotiating strategies, or troop movements Knowledge of sensitive U.S. projects, programs, or technologies by name or designator Publication of classified or sensitive U.S. information Implementation of countermeasures PRI Connection to Anomalies

Killed 3soldiers and wounded 14 others.
Insider Threat Awareness Threats of Physical Violence or Harm Disgruntlement Substandard performance Frequent fights with coworkers and supervisors Failure to follow regulations and guidelines Displays of ill temper and false accusations against others Repeated reprimands, disciplinary sanctions Ivan Lopez April 2, 2014: Killed 3soldiers and wounded 14 others. SP4 Ivan A. Lopez - Lopez  Army Specialist assigned to Ft. Hood, TX  Age at time of incident: 34  Date of incident: April 2, 2014 What Happened  On March 2014, SP4 Lopez was transferred to Ft. Hood. His mother and grandfather had both died in the previous two months. His unit was experiencing a high operational tempo and undergoing turnover of leadership.  SP4 Lopez had recently been counseled regarding a non-promotion status.  Lopez experienced a five day delay in getting leave approved to attend his mother’s funeral and encountered additional delays in leave approval for moving his family into a new apartment.  SP4 Lopez went home, retrieved his pistol, and returned to Ft. Hood. He went into the administration office and began shooting soldiers. When confronted by the military police, he turned his weapon and shot himself. Risk Indicators  Depression, anxiety, sleep disturbances  Recent death of mother and grandfather  $14,000 debt  Recent move to new post & apartment  Frustration in getting his leave approved and processed  Self-reported traumatic brain injury/possible post-traumatic stress disorder Impacts  Death of three soldiers, who left behind wives and children  Fourteen other soldiers wounded  Lopez was a husband and father  Lessons learned from this case and several others has shaped DoD response to Insider Risk

Other Indicators Contact with Foreign Intelligence Service Deception Indicated on CI Polygraph Membership in Subversive Group/Organization Unauthorized Absences Criminal Affiliations Disgruntlement Paranoid behavior Working hours inconsistent with job assignment Insists on working alone/private Loyalty questioned Rummaging through offices/desks Attempts to conceal membership in groups which oppose defense policies – not necessarily membership as an issue, but attempt to conceal. WORK PERFORMANCE, PERSONAL EXPRESSION, & BEHAVIOR Disgruntlement Paranoid behavior Working hours inconsistent with job assignment Insists on working alone/private Loyalty questioned Rummaging through offices/desks

Insider Threat Awareness Counterintelligence and Security
CDSE CI Awareness Video Attempts to conceal membership in groups which oppose defense policies – not necessarily membership as an issue, but attempt to conceal. WORK PERFORMANCE, PERSONAL EXPRESSION, & BEHAVIOR Disgruntlement Paranoid behavior Working hours inconsistent with job assignment Insists on working alone/private Loyalty questioned Rummaging through offices/desks

Foreign Targeting and Recruitment
Insider Threat Awareness Foreign Targeting and Recruitment

Potential Terrorist Indicators Spending abnormal amounts of time with others in the group Long absences from their immediate locality Trouble with employment Trouble keeping employment Criminal activity Unexplained Affluence Changes in character, behavior, appearance Strong ideological beliefs Counterterrorism studies have also identified behaviors that are distinct potential indicators of terrorism related activity

Opportunity and crisis contribute to vulnerability. Access Potential Risk Indicators Perceived Life Crisis

Opportunity, Motive, Ability, Trigger PRIs Accessing information outside need to know Repeatedly borrowing money from coworkers Mishandling Classified Information Anti-social behavior, narcissism, risk taking Recommend showing video of Martin or referring to the case study Awareness in Action: Case Study Who could become an insider threat? Anyone with authorized access to protected information who uses that access—either wittingly or unwittingly—to harm national security. Insider threats can have far reaching consequences and impacts on national security. Bryan Martin Petty Officer 2nd Class Bryan Martin  Arrested in December 2010 for attempting to sell classified documents to someone he believed was a Chinese intelligence officer  Pleaded guilty to four counts of attempted espionage  Age at conviction: 22 Sentenced to 34 years in prison, reduced in rank, forfeited all pay and allowances and a dishonorable discharge from the Navy. Insider Threat Indicators  Financial: Personal finance problems known to peers  Personal Conduct: Excessive gambling and prostitution  Mishandling Classified Documents: Removed classified documents and material from secure facilities. What Happened  Martin claimed that he was “blinded by greed” when he sold classified documents to a man he believed was a Chinese spy, but was actually an undercover FBI Agent.  Martin was overextended due to gambling and prostitution debts. He was recently engaged and in an effort to shore up personal finances and impress his father-in-law to be he attempted espionage.  The undercover agent paid Martin $11,500 in exchange for three packets of documents containing Secret and Top Secret information about current naval operations and intelligence assessments. Impacts  The classified information Martin sold to the undercover agent included photos, satellite images and details about U.S. operations in Afghanistan and Iraq.  Martin revealed his access to military computer systems and named classified network systems he had access to.  Could have resulted in grave damage to U.S. National Security if the undercover agent was in fact a Chinese foreign intelligence agent. Bryan Martin, May 20, 2011: Pled guilty to 11 espionage charges. Sentenced to 48 years. Perceived Life Crisis Massive Gambling Debt

exhibits indicators is an Insider Threat!
Counterintelligence Not everyone that exhibits indicators is an Insider Threat! When you look at indicators, it’s easy to see a spy around every corner – or in every EPSQ, but remember many people will exhibit some of these behaviors over time and for legitimate reasons. Mitigating factors still apply and you are still looking at the whole person concept. The trick for you is parsing out what is a legitimate indicator – a potential espionage indicator, a specific vulnerability manifested in a security or suitability issue, - and then using your crystal ball to determine whether this will be a behavior that will increase the likelihood that the individual will pose an insider threat. And it is very tempting to just deny anyone with anything even remotely resembling an issue, but there are a couple of reasons you wouldn’t want to do that. One being that if we red lined everyone who exhibited the slightest indicator we wouldn’t have any one left = there would be a lot of job openings – but you also have to remember that these are peoples lives and livelihoods you are dealing with. People have families to support and careers that they’ve built, failure to get a clearance can have a devastating affect on an individual and should not be taken lightly. So, no pressure.

Reporting Potential Risks
Insider Threat Awareness Reporting Potential Risks DoD Reporting Requirements: Identify and report indicators of illicit foreign collection activity Identify and report illicit foreign cyber activities Identify and report potential espionage indicators Identify and report factors contributing to insider threat vulnerability

Failure to report: DoD personnel who fail to report information that identifies reportable contacts, activities, indicators and behaviors, may be subject to judicial or administrative action (or both), pursuant to applicable law and regulations. UCMJ: Punitive action under Article 92 Civilian Employees: Appropriate disciplinary action under regulations governing civilian employees.

Organization Specific Reporting: Identify agency SOP Identify POC for Insider Threat Reporting Identify POC for Security Reporting Identify POC for Counterintelligence Reporting Add your own commands specific information on reporting sop and poc

Stewart Nozette – Insider Threat
Insider Threat Awareness Class Discussion: Stewart Nozette – Insider Threat me Optional: Follow the Practical Activity Instructor Discussion Guide and Student Activity Handout. Discuss all of the security issues that should have prevented him from having a clearance, getting access, becoming an insider threat

Case Study The Washington Post, Mar 21, 2012 Maryland scientist Stewart Nozette sentenced for passing secrets to supposed Mossad agent, expresses regret A 54-year-old Maryland scientist said Wednesday that he regretted supplying classified information in exchange for cash to a person he believed was a member of Israeli intelligence but was really an undercover FBI agent. By Del Quentin Wilber Stewart D. Nozette of Chevy Chase, who had previously pleaded guilty to attempted espionage in a deal with prosecutors that set his sentence at 13 years, was officially sentenced Wednesday to that term by U.S. District Judge Paul L. Friedman during a lengthy hearing in the District’s federal court. Friedman also sentenced him to just over three years in prison – a term to run concurrently with his espionage sentence – in an unrelated fraud and tax case. At the end of the proceeding, which included the playing of secretly recorded video of Nozette meeting with an undercover FBI agent posing as a member of the Israeli intelligence agency, the Mossad, Nozette spoke publicly for the first time since his arrest in October 2009. Surveillance video captures an FBI employee's conversation with Stewart D. Nozette on Oct. 19, Nozette pleaded guilty to attempted espionage (U.S. Attorney’s Office) Introduce the case and give the students the Nozette case study (next three slides). Based on the days discussion, ask them to identify behaviors and activities that may be indicative of espionage.

Practical Activity Insider Threat Awareness INSTRUCTOR DISCUSSION GUIDE: DESCRIPTION: This activity requires students to review a news article and, based on information provided in the presentation, identify potential risk indicators – observable and reportable behaviors and activities indicative of the insider threat. Allow 20 minutes for the activity TASKINGS: Read the provided news synopsis: Stuart Nozette Identify any potential risk indicators. Be prepared to discuss your findings with the class – to include whether the identified information, if any, would be reportable. DISCUSSION NOTES: Foreign Contacts – through his consulting firm Unexplained affluence – possibly, via consulting firm Misuse of Info Tech – possibly with thumb drives Foreign Travel – possible with overseas travel Making comments or bragging about spying – comment to colleague Note that many of these say possible. It’s hard to tell until you do investigation if these pose an actual risk but must be reported so that the insider threat program can make appropriate referrals and allow LE/CI to follow up.

Summary Understand the importance of detecting potential insider threats and reporting of suspected activity to insider threat personnel or other designated officials Describe methodologies of adversaries to recruit trusted insiders and collect classified information Identify indicators of insider threat behavior and procedures to report such behavior Understand counterintelligence and security reporting requirements

QUESTIONS?

DRAFT Command Brief – Insider Threat Awareness Training

Similar presentations

Presentation on theme: "DRAFT Command Brief – Insider Threat Awareness Training"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

DRAFT Command Brief – Insider Threat Awareness Training

Similar presentations

Presentation on theme: "DRAFT Command Brief – Insider Threat Awareness Training"— Presentation transcript:

Similar presentations

About project

Feedback