SEPTEMBER 17, 2024 — What does an insider threat look like? From high-profile disclosures and breaches of critical data to mass shootings on military instillations, insider threats pose very real and devastating risks to national security.
The DOD defines an insider threat as “the threat insiders may pose to DOD and U.S. government installations, facilities, personnel, missions, or resources. This threat can include damage to the U.S. through espionage, terrorism, unauthorized disclosure of national security information, or through the loss or degradation of departmental resources or capabilities.”
In October 2011, then-President Barack Obama signed Executive Order 13587 establishing the National Insider Threat Task Force, or NITTF. Developed to establish a governmentwide insider threat program for deterring, detecting, and mitigating insider threats, the NITTF directs federal departments and agencies with access to classified information to establish insider threat detection and prevention programs.
“The goal is to protect Soldiers, their Families and the communities directly outside our gates,” said Phillip Edenfield, Fort Carson’s garrison antiterrorism officer, known as an ATO. “When you look at what happened at Fort Hood, the shooter showed many signs of being an insider threat, but nothing was done. Nothing was reported.”
As the ATO, Edenfield executes the instillation’s antiterrorism program and ensures Fort Carson is in compliance with 36 antiterrorism standards, as outlined in Army Regulation 525-13.
While threats come in all shapes and sizes, there is no one-size-fits-all when it comes to identifying an insider threat. Instead, the Army has developed a list of indicators to help service members, civilians and community members identify a potential insider threat.
In addition to anti-American rhetoric, the list includes indicators such as encouraging disruptive behavior or disobedience to lawful orders, advocating violence to achieve political, religious or ideological goals, and expressing loyalty or support for known terrorist organizations.
Alone, these activities may not be predictors of violence or terrorist activity but may indicate the individual is at risk of becoming an insider threat.
Additionally, all Department of the Army personnel are required to participate in annual Threat Awareness and Reporting Program training, which aims to educate users on deterrence and detection of intelligence and terrorist threats.
Edenfield said a common problem in identifying an insider threat is people choosing a hands-off approach.
“People don’t want to get in trouble, overstep or sometimes even get involved when faced with conflict,” Edenfield said. “But if you see something, say something. At the very least, you might be helping a peer get the resources they need during a difficult time in their life.”
Edenfield noted anyone witnessing an individual exhibiting suspicious behavior should inform their chain of command.
“Leadership is specifically trained on how to handle reports of potential insider threats,” Edenfield said. “Personnel can also utilize iWATCH Army and iSALUTE to report suspicious behavior.”
Established in 2010 and modeled after the Los Angeles Police Department’s iWATCH program, iWATCH Army encourages and empowers the community to identify and report suspicious behavior potentially associated with terrorist activity.
Similarly, iSALUTE enables community members to directly report suspicious activity to U.S. Army Counterintelligence.
“The Army has come a long way in its ability to educate service members and civilians on how to identify and report a potential insider threat,” said Edenfield. “But it’s on everyone to remain vigilant and to help keep our community safe.”
September is National Insider Threat Awareness Month. Submit an iSalute Suspicious Activity Report, visit by visiting the iSalute website.
By Emily Peacock
Fort Carson Garrison Public Affairs Office