Pentagon Is Building Massive Hub of Insider Threat Data

The Defense Department is building a massive information-sharing system detailing national security personnel and individuals cleared for accessing U.S. secrets, to flag who among them might be potential turncoats or other "insider threats."

The “DOD Component Insider Threat Records System” is part of the U.S. government's response to the 2010 leaks of classified diplomatic cables by former Pfc. Chelsea Manning. A 2011 so-called WikiLeaks executive order called for an "insider threat detection" program. 

A review of the 2013 Washington Navy Yard shootings found the department still lacked "a centralized hub" to obtain a holistic view into potential threats, Defense spokeswoman Linda Rojas told Nextgov in an email.

Now, the Pentagon is establishing a team of “cross-functional experts" trained in cybersecurity, privacy, law enforcement, intelligence and psychology -- aided by the new workflow technology -- to help fill that gap, she said. 

But some civil liberties advocates say this Defensewide insider threat analytics system could create a culture of mutual suspicion that silences whistleblowers.

The Pentagon expects to enter into the tool information that is gleaned, in part, from a new "continuous evaluation" approach to screening clearance-holders that uses automated data checks, according to a May 19 Privacy Act notice. 

The insider-threat system also will share data pulled from public social media posts and "user activity monitoring" of employees’ private digital habits at work, the notice states. The surveillance of military networks may include keystrokes, screen captures, and content transmitted via email, chat, and data import or export.

Earlier this month, Director of National Intelligence James Clapper signed a policy that would authorize investigators to vet public social media posts when conducting background checks of national security personnel.

In the privacy notice, Aaron Siegel, alternate defense Federal Register liaison officer, describes user activity monitoring as the technical capability to "record the actions and activities of all users, at any time, on a computer network controlled by DOD."

The insider threat technology also would disseminate equal employment opportunity complaints, security violations and personal contact records, the notice states. Logs of printer, copier and fax machine use would be shared through the tool. Public information from professional certifications -- like pilot's licenses, firearms and explosive permits -- would be fair game too, the notice states.

Traitor or Truthsayer?

Referring to the equal employment opportunity complaints and security violation data, some civil liberties advocates said the new technology could propagate misleading information about behaviors common in any workplace. 

"Almost all of us at different periods of time, have been upset with the people we work with, and that is part of the human nature, so to identify that behavior as potentially troubling and indicative of being a -- quote -- insider threat is both inappropriate and likely to lead to errors," said Michael German, a 16-year FBI veteran, who now is a fellow with the Brennan Center for Justice’s Liberty and National Security Program. 

“When you read the insider threat material, what they view as a threat is somebody reporting information about government activity to the press, which is, in a democratic society, not only important but necessary,” he said.

According to the privacy notice, the system will be governed under the following definition of "insider threat:”

The threat that an insider will use his or her access, wittingly or unwittingly, to do harm to the security of the United States. This threat includes damage to the United States through espionage, terrorism, unauthorized disclosure of national security information, or the loss or degradation of government, company, contract or program information, resources, or capabilities.

German said personnel who ruffle the feathers of managers while trying to root out government abuses could be tracked by the system.

"They are definitely attempting to get whistleblowers and people who are reporting the truth in the face of government efforts to suppress that truth," he said. "The real threat are the people that they are not seeing," German added, pointing to cases like that of Robert Hanssen, who spied for the Russian government while serving at the FBI -- unnoticed -- between 1979 and 2001. 

And if national security personnel know their criticisms will be widely circulated, they might shy away from reporting problems, German said. 

"If you have an agency whose mission is national security and that entity is being hampered by waste, fraud, misconduct or illegality, you would think reporting that would be something that is positive and promoted, but this program would tend to suppress that type of internal activity and instead cause more problems which then undermine our national security goals," he said.

System Specs

Defense officials said only military-affiliated personnel who fall under certain criteria will be entered into the insider-threat system. 

"Adequate controls, training and oversight are in place to ensure that personally identifiable information is protected and that only information which meets a pre-determined threshold is entered into the system," Rojas said. 

The tool will share records on people eligible to hold sensitive Defense positions and people granted security clearances who have "exhibited actual, probable, or possible indications of insider threat behaviors or activities," Siegel said in the privacy notice.

Only personnel trained in insider threat, privacy and civil liberties, and intelligence oversight, who are approved by the department, will be allowed to use the system, Rojas said. The system will not be activated until after a public comment period that ends June 20.

Insider threat programs require "a holistic approach to information management," as the "data containing anomalous behaviors that may be indicative of an insider threat can come from many sources, such as personnel security, physical security, information assurance, and law enforcement," Rojas said. But right now, this information is not easy to access, plus the size and complexity of the Pentagon makes it hard to share information among military components, she said.

The insider threat tool's "workflow management and analytics" features will facilitate the exchange of information, Rojas said. When one department unit identifies and validates behavior that may signal a threat, it can be shared with other department units for further analysis, once the tool is in place, she said.

The system also will provide access to traditional background check records like biometric data files, and self-reported "SF-86" forms detailing the medical and personal lives of individuals applying for security clearances.

On the Record

A diverse group, including the press and civilian agency employers, will be able to use certain material in the system, according to the privacy notice.

Information in the tool also could be used outside the Pentagon for HR, licensing and counterterrorism purposes.

For example, other federal and state agencies can obtain information relevant to a "decision concerning the hiring or retention" of a worker, the notice states. The "news media or the general public" can view factual information in the public interest and does not constitute an unwarranted invasion of personal privacy, Siegel said. And congressional offices can request records on specific individuals.

In addition to active troops, individuals profiled by the system could include National Guard members, civilian employees cleared to handle classified material, and defense contractors, the notice states.

U.S. Coast Guard members, "mobilized" retired military personnel, and Limited Access Authorization grantees could be documented in the system, too, according to the notice.