The following guides on counterintelligence reporting and security indicators of potential espionage activity were released by the Defense Personnel Security Research Center (PERSEREC) in May 2005 to highlight activities and indicators “primarily behavioral and clearly linked to counterintelligence and security risk.”
| Reporting of Counterintelligence and Security Indicators by Supervisors and Coworkers | May 2005 | 57 pages | Download |
| Counterintelligence Reporting Essentials (CORE): A Practical Guide for Reporting Counterintelligence and Security Indicators | May 2005 | 7 pages | Download |
The Defense Personnel Security Research Center (PERSEREC) conducted research on how employees with clearance access understand the requirements to report suspicious behavior that they observe.
Finding: Supervisors and coworkers are willing to report on behaviors that have a clear connection to security, such as transmitting classified documents to unauthorized personnel, but they are unwilling to report on colleagues’ personal problems, such as alcohol abuse. Because it was difficult to discern which reporting requirements were clearly related to security, there was very little reporting.
Outcome: PERSEREC, in collaboration with counterintelligence professionals, developed a clear, succinct list of “Coworker Reporting Essentials” (CORE) behaviors that could pose a possible threat to national security and thus should be reported if observed. The draft CORE was reviewed and edited by counterintelligence professionals at the Counterintelligence Field Activity (CIFA), and was coordinated by the DoD Investigative Working Group (IWG).
PERSEREC also coordinated with the DoD Counterintelligence Directorate in the Office of the Under Secretary for Defense (Intelligence), who included the PERSEREC CORE list in DoD Instruction 5240.6, Counterintelligence Awareness, Briefing, and Reporting Programs.
…
RECRUITMENT
Foreign intelligence entities are on the lookout for people who can be solicited to commit espionage against the U.S. At the same time, willing would-be spies often approach foreign intelligence operatives on their own initiative, thus volunteering for recruitment. It is a major task of counterintelligence to intercept these relationships. The recruitment cycle requires, first, that contact be established between the foreign intelligence agency and the potential spy, whether by direct recruitment or by volunteering. While the recruitment relationship almost always involves contacts with foreigners, an already-committed U.S. spy may approach you or a colleague on the job for recruitment into espionage.
Reportable Behaviors
• . . you become aware of a colleague having contact with an individual who is known to be, or is suspected of being, associated with a foreign intelligence, security, or terrorist organization.
• . . you discover that a colleague has not reported an offer of financial assistance by a foreign national other than close family.
• . . you find out that a colleague has failed to report a request for classified or unclassified information outside official channels to a foreign national or anyone without authorization or need to know.
• . . you become aware of a colleague engaging in illegal activity or if a colleague asks you to engage in any illegal activity.INFORMATION COLLECTION
Before classified or other kinds of sensitive materials can be passed to a foreign intelligence agency, they must be collected. They can simply be stolen (e.g., paper placed in a briefcase and taken out of the office), photographed, collected via computers, or obtained through eavesdropping or other surveillance devices. The computer age, with its e-mail and database capabilities, has offered new opportunities to potential spies for collecting data. While technical countermeasures can control some situations, it is up to coworkers to watch for and, if possible, identify breaches in the system that allow classified and sensitive information to be collected for espionage purposes.
Reportable Behaviors
• . . a colleague asks you to obtain classified or other protected information in any format to which the person does not have authorized access.
• . . a colleague asks you to witness signatures for destruction of classified information when you did not observe the destruction.
• . . you observe a colleague operating unauthorized cameras, recording devices, computers, or modems in areas where classified data are stored, discussed, or processed.
• . . you become aware of the existence of any listening or surveillance devices in sensitive or secure areas.
• . . you find out that a colleagues has been keeping classified material at home or any other unauthorized place.
• . . you discover a colleague acquiring access to classified or unclassified automated information systems without authorization.
• . . you observe a colleague seeking to obtain access to sensitive information inconsistent with present duty requirements.…
SUSPICIOUS BEHAVIORS
The new DoD Instruction 5240.6, Counterintelligence (CI) Awareness, Briefing, and Reporting Programs (August 7, 2004) lists an additional series of eight items that, while not exactly clear-cut violations, have been traditionally considered behaviors that may well be connected to counterintelligence and security problems. These behaviors do require some degree of judgment before reporting. Often you might not know about them directly but only by hearsay. Often they may easily carry plausible alternative explanations. They are included here with the caveat that they do require a judgment call before reporting. If you are at all uncertain, it is better to report the behavior than to make no report at all.
> Attempts to expand access to classified information by repeatedly volunteering for assignments or duties beyond the normal scope of responsibilities.
> Extensive use of copy, facsimile, or computer equipment to reproduce or transmit classified material that may exceed job requirements.
> Repeated or un-required work outside of normal duty hours, especially unaccompanied.
> Unexplained or undue affluence, including sudden purchases of high value items (e.g., real estate, stocks, vehicles, or vacations) where no logical income source exists. Attempt to explain wealth by reference to inheritance, luck in gambling, or some successful business venture.
> Sudden reversal of financial situation or sudden repayment of large debts or loans.
>Attempts to entice DoD personnel into situations that could place them in a compromising position.
> Attempts to place DoD personnel under obligation through special treatment, favors, gifts, money, or other means.
>Short trips to foreign countries or travel within the United States to cities with foreign diplomatic activities for reasons that appear unusual or inconsistent with a person’s interests or financial means.
Share this:
