DHS Insider Threat Program Expanding to Anyone Who Accesses Agency Info

Almost since the department’s inception, Homeland Security has been focused on identifying and preventing agency employees with security clearances from becoming insider threats by leaking information, intentionally or otherwise. Now, the department’s Insider Threat Program is expanding to include anyone—past or present—who has had any kind of access to agency information.

“Subsequent to standing up the DHS ITP, the threats the department faces extend beyond threats of unauthorized disclosure of classified information by DHS-cleared employees,” according to an updated privacy impact assessment released publicly Friday. “Threats faced include those posed by insiders with and without security clearances engaging in activities that have no nexus to unauthorized disclosure of classified information.”

The expanded scope of DHS’s program was first addressed in a December 2016 memo signed by then-outgoing Secretary Jeh Johnson in January 2017.

The letter, penned by Chief Security Officer Richard McComb—who still occupies that role today—recommended “expanding the scope of the DHS Insider Threat Program beyond the protection of classified information to include the threats posed to the department by all individuals with access to the department’s facilities, information, equipment, networks or systems.”

Those recommendations are now going into effect, according to the PIA.

“Originally, the ITP focused on the detection, prevention, and mitigation of unauthorized disclosure of classified information by DHS personnel with active security clearances,” the impact statement reads. “The memorandum expands the scope of the ITP to its current breadth: threats posed to the department by all individuals who have or had access to the department’s facilities, information, equipment, networks, or systems.”

This update officially changes the department’s definition of “insider” to include anyone who has ever had access to DHS resources—physical or digital.

The impact assessment also notes the new definitions require the collection of new information from sources not tapped previously.

“As part of this update, information available to the ITP may now come from any DHS component, office, program, record or source, including records from information security, personnel security and systems security for both internal and external security threats,” the document states.

New information sources also include data “lawfully obtained” through “access from any United States government agency, other domestic or foreign government entity, and from a private sector entity.”

The new data collections will include “current employment and performance information, contract information, personnel files containing information about misconduct and adverse actions, and current and former security clearance status,” the document states.

While the Insider Threat Program is being expanded to include anyone who has interacted with a DHS system, that does not include the Coast Guard’s systems.

“This PIA still does not cover the activities of the United States Coast Guard Insider Threat Program, which operates on different classified and unclassified networks under the purview of the Commandant of the Coast Guard,” the document states, adding that information on Coast Guard personnel might be swept up in larger data collection activities if those employees are access networks and facilities managed by other DHS components.

Per the privacy impact assessment, increasing data collection can lead to additional privacy and data protection concerns. The PIA offers six such concerns, with information on how the department is trying to mitigate those risks.

Overcollection of Employee Information: This risk is “partially mitigated,” according to the PIA. DHS’s Insider Threat Operations Center has developed tools to manage access to ITP data on individuals, with regular reviews to ensure information is not being accessed unnecessarily.

Behavior Indicators Were Created for a Smaller Population: This risk is also “partially mitigated.” The document notes the “initial triggers” included in the policy don’t account for threats “on the unclassified network by uncleared employees.” However, these triggers are merely the start of the process and, while expanded, should not significantly increase privacy risk, according to the PIA.

• Data Aggregated From Other Components Will Get Stale: “There is a risk that ITOC data will become outdated and inaccurate, because the ITOC draws upon data aggregators from DHS, other federal agencies, other domestic or foreign government entities, and from private sector entities,” the document states. DHS officials said this risk was completely mitigated, as the department has established policies on data refresh in the “Procedures for the Insider Threat Program Concerning Bulk Data Transfer.”
• Data Will Be Used For a Different Purpose: ITP officials said the risk of data being used for purposes other than identifying and resolving insider threats is mitigated despite the increase in scope. “Routine audits of system access and use serve to ensure that ITOC analysts employ information consistent with the purposes for which it was collected,” the document states.
• Irrelevant Data Will Be Collected and Reviewed: As with the previous privacy concern, ITP officials were confident this risk has been fully mitigated, as internal policies require “Information identified and accessed through the ITOC for the purpose of identifying insider threats must bear a rational relationship to the scope of the analysis contained in the referral.”
• Non-DHS Employees Won’t Know Their Data Is Being Collected: As the program expands to include non-DHS personnel working with the department, ITP officials acknowledge the current notification procedures might not be enough to keep everyone properly informed. This risk has been largely mitigated for digital access to DHS information, as “All persons accessing DHS information technology are presented with banners informing them that access requires their consent to user activity monitoring,” according to the PIA. However, non-DHS personnel accessing physical systems—such as buildings and/or paper records—“are unlikely to encounter specific notification that information related to their activity at a DHS facility may be provided to the ITP.” The PIA states that component agencies managing those facilities are “responsible for providing notice at the point of collection that the information may be shared with other federal, state, local, and foreign government agencies and authorized organizations.”