Espionage: The Security Professional’s Role in Counter-Intelligence
By Cindy Weigle
June 24, 2015
The term espionage invokes images of slick trench coat-clad spies with thick foreign accents sipping martinis in exotic locales while trying to save the world from sure destruction. It brings up images of James Bond, Mata Hari and Boris and Natasha, the hapless cartoon Soviet-era spies in the “Rocky & Bullwinkle Show.” In real life especially today it’s very different. Espionage is pervasive in our information-technology world taking place on the net with hackers and information thieves leading the charge. People are stealing more secrets than ever, but instead of photo copiers or microfilm their tools are the Internet and thumb drives. Instead of Hollywoodesque spies they are more often information geeks, disgruntled employees or those with strong ties to another country or culture.
U.S. law recognizes two type of espionage. The domestic stealing of trade secrets by a competitor or individuals and the theft of trade secrets or information backed by a foreign government or terrorists. Both are damaging with long-ranging consequences including huge financial and job costs and in some cases the loss of life. So, how do security professionals fit into this picture and what part can they play in this “Spy vs. Spy” scenario?
John F. Wagner, a 26-year veteran of the Naval Criminal Investigative Service recently spoke to a group of security professionals at ASIS International, San Diego Chapter. Wagner now works for defense contractor General Atomics, but his presentation covered information and strategies from his days with NCIS.
There are a number of ways to protect assets and people. Good physical security including guards, cameras and access control to provide the building block of facility security. These are excellent defensive measures, but according to Wagner, to protect our government and trade secrets we need to go beyond that. We need to be proactive in our approach and that’s where counter intelligences comes into the picture. And today’s security professional has an important role to play.
As Wagner reminded his audience, security professionals see things every day in the course of their jobs. Things that don’t add up or just seem off. It can be someone taking photos, loitering on the property or an employee working odd hours.
“As professionals we want to note and document those things, so that we can hand them off to our law enforcement colleagues in government,” said Wagner. “Then they can decide if there needs to be an investigation.”
Some of the counter intelligence activities that Wagner said fall to security professionals are simple. For example, knowing who is coming into a facility. If there are foreign visitors, simple background checks should be conducted. The same for foreign travel. Security professionals want to talk with people before they go overseas, give them an awareness briefing, let them know what to look for and where the red flags might be. That way returning travelers can report any issues and provide valuable information.
The more complicated subset of counter intelligence is insider threat, a prolific and growing problem, according to Wagner. During most of the Cold War the intelligence community looked at protecting sensitive information from outsiders. Chelsea Manning of WikiLeaks fame and National Security Agency contractor Edward Snowden put insider threats front and center.
“These are people who weren’t necessarily being run or handled by foreign intelligence services,” said Wagner. “But, the bottom line is that people on the inside have access to a lot of information.”
Wagner told his audience there are indicators for these threats – behaviors and action that can be identified. And, again, that’s where security personnel fits into the picture.
“If you see these indicators, it doesn’t mean that we have a spy, but it might give you pause to take a little closer look,” he said. “Sometimes it means you may need to have a conversation with human resources or someone’s supervisor.”
Here are some of the indicator Wagner discussed:
Foreign travel– This isn’t necessarily bad, but if someone has a top-secret clearance there are rules and regulations. If they are traveling to a foreign county they need to talk with their security director and be honest about where they are going.
Foreign preference – In some cases people have more allegiance to another county, maybe because they were born or stationed there.
Anti-American associations and activities – This happened with the Manning (WikiLeaks) case. One person came forward and noted the anti-American statements being made.
Falsifying or withholding personal problems – If someone with clearance is going through a bankruptcy or a messy divorce that information has to be divulged.
Personal behavior that increases vulnerability to exploitation – People aren’t recruited by accident. Other governments or individuals do a lot of background research and they are looking for weaknesses before they approach someone. So, if for example, someone is having an affair that could give them a way to blackmail someone into spying or stealing secrets.
Disgruntled employees – Security used to worry about people taking staples and office supplies. Now, there is a whole lot more damage they can do, so termination policies have to take that risk into account.
Working odd hours – Security has access to this information and can look to see what people are accessing at what hours.
Unauthorized devices – It just takes a USB device to download gigabytes of information. After the Manning case the DOD banned the use of USB devices.
No need to know – Many people have clearances, but that doesn’t mean they need to know about
every project or activity. It is out of line for one co-worker to ask another about something classified if he/she doesn’t need to know about it.
Unnecessary or suspicious copying – This doesn’t happen as much anymore, but it should be noted.
Destroying classified documents without proper authority – This includes destroying documents or trying to remove or cover up classified markings.
Changes in behavior – There may be a valid reason for it such as substance abuse issues or a divorce, but this is a common indicator that should be noted
Wagner also emphasized to his audience that these behaviors were not only good indicators for espionage or information theft, but also for workplace violence.
“It’s not just about protecting information, it’s also about noting indicators for potential workplace violence,” he said. “We want to keep our people and property safe.”
(Cindy Weigle is a partner with Daum Weigle Inc. and an editor of the DW Security Update)
