back to top

Do You Drink? Work Odd Hours? The FBI Says You Could Be An "Insider Threat"

These training slides say that an "insider threat" could be ... almost anyone. They warn that government employees who drink, brag about what they know, or work odd hours could all be leakers or spies. "YOU are the 1st Line of Defense!"

Posted on

Who was the first person to betray the United States?

If you guessed Benjamin Church, the chief physician of the Medical Service of the Continental Army, then you know your insider threat history.

In 1775, Church, who was deeply in debt, used encoded letters and intermediaries to sell information to the British about the impending Battles of Lexington and Concord.

Church’s betrayal of America appears as a trivia question in a set of controversial FBI training slides that advise bureau employees and other federal personnel how to spot and act against would-be leakers, otherwise known as “insider threats.”

The closely-held 2014 training slides — titled "The Insider Threat: Don’t Be a Victim" — were obtained by BuzzFeed News from the FBI in response to a three-year-old Freedom of Information Act (FOIA) request. The 28 slides, which contain quizzes and comic strips, seem designed to get federal workers to snitch on each other.

According to the training material, potential insider threats include federal employees who brag about what they know, work odd hours, travel overseas without a good reason, or ask their co-workers about classified information without a "need to know." Workers who consume alcohol, use drugs or have “psychological conditions” may also be insider threats, as are those facing disciplinary action or job termination.

The slides encourage government employees to report "high risk behavior."

Another slide says leaks occur because leakers are “disgruntled” and are motivated by “ego,” “financial gain,” and “divided loyalty.” The training slides feature a dozen individuals inducted into the FBI’s “Hall of Shame” who exhibited these characteristics and were later prosecuted. The FBI completely redacted slides that mentioned techniques that insiders use to steal secrets.

Four separate slides center exclusively on when government employees should report their colleagues.

“If you wonder, ‘should I report this?’ – then YES you should!” says one slide.

"YOU are the 1st Line of Defense!" says another.

Government employees who leak to the media are no different than a “traditional spy” who engages in espionage, one slide says. But the FBI has a special category — "stupid" — for leaks to the media and "spills" that involve the accidental disclosure of classified information on social networks.

A slide about social media warns, "NEVER post anything sensitive or classified (or even hints at sensitive/classified information."

The FBI’s training does not make any mention of whistleblowers, insiders who divulge information not to harm the United States but rather to expose wrongdoing or corruption.

That omission sparked a hostile exchange between the FBI and Sen. Chuck Grassley, the chairman of the Senate Judiciary Committee, who felt the bureau should draw a distinction between insider threats and whistleblowers. On April 4, 2014, the bureau briefed Grassley's staffers — but the FBI abruptly ended the briefing because Grassley's staffers "badgered" the FBI "for statements regarding whistleblowing" that the bureau did not consider relevant, according to a summary of the meeting prepared by a top official from the FBI's Insider Threat Task Force.

Jason Foster, who attended the briefing and is the chief investigative counsel for the Senate Judiciary Committee, vehemently disputed that the Senator's staff "badgered" the FBI. They were conducting oversight, he said.

Michael German, a fellow at Brennan Center for Justice at NYU Law School and a former FBI special agent, said the FBI’s insider threat training is designed to root out someone on the order of Aldrich Ames, a CIA agent who was convicted of spying for the KGB, "but who the resources get used against are public employees who complain about waste, fraud, and abuse because they are easy to spot." He added, "It’s very difficult to find traditional spies and very easy to find whistleblowers." German is himself a whistleblower, having disclosed "management failures and violations of law" in an FBI counterterrorism investigation.

According to the slides, there are more than 4 million "insiders" who hold security clearances. Of those, 860,000 have access to top-secret information. The FBI says that insider threats “remain the greatest vulnerability” to the U.S. government, according to a separate heavily redacted PowerPoint presentation for Congress included in the cache of documents.

Over the past year, the FBI has pursued a series of high-profile insider threat cases involving a former National Security Agency contractor, a State Department employee and the leak of CIA hacking tools to Wikileaks.

Grassley asked the FBI to send him its insider threat training material. He received a couple of videos and a brochure. But a spokesperson for Grassley told BuzzFeed News that the senator did not receive the training slides until BuzzFeed News sent a copy.

The training was developed after President Barack Obama issued an executive order in October 2011 that established an Insider Threat Task Force staffed by the FBI and a branch of the Office of the Director of National Intelligence. The Obama administration aggressively prosecuted leaks and indicted more people under the Espionage Act than all other presidents combined.

These training slides are still in use. In recent weeks, according to three federal law enforcement sources, the FBI has again rolled out its insider threat training in response to the numerous leaks to the media about the Trump administration and subsequent calls by President Trump and some Republican lawmakers to track down and prosecute the "criminal leakers." These sources said there at least a half-dozen investigations currently underway involving “insider threats” at “several” government agencies that they declined to name. ●

Jason Leopold is a senior investigative reporter for BuzzFeed News and is based in LA. Recipient: IRE 2016 FOI award; Newseum Institute National Freedom of Information Hall of Fame. PGP fingerprint 46DB 0712 284B 8C6E 40FF 7A1B D3CD 5720 694B 16F0. Contact this reporter at jason.leopold+notactive@buzzfeed.com

Contact Jason Leopold at jason.leopold@buzzfeed.com.

Got a confidential tip? Submit it here.