September is National Insider Threat Awareness Month, a time to educate staff about the type of threats that may occur at the Lab. Federal agencies, including the Department of Energy, use this month as a reminder to collaborate and emphasize the importance of deterring, detecting, and mitigating threats posed by trusted insiders.
Insider threats can take several forms, whether malicious or stemming from unintentional negligence:
- Data Exfiltrators & Hoarders: Insiders who engage in data hoarding, unauthorized downloading, or transferring protected data to unapproved personal systems or hardware.
- Policy & Access Bypassers: Individuals who inappropriately seek access beyond their assigned duties or attempt to bypass physical and digital security access controls.
- Vulnerable or Compromised Insiders: Individuals experiencing severe professional disgruntlement, unreported foreign influence, or extreme financial distress, which can make them susceptible to bribery or targeted recruitment.
When observing indicators—such as unusual off-hours virtual activity or unexplained affluence—remember that context matters. A single warning sign is rarely definitive on its own; risk becomes significant when indicators form a cumulative pattern.
You can learn more about insider threats. You can also learn more about insider threats at the new Security and Emergency Preparedness training. Take the training.
If you notice suspicious activity, contact the Site Operations Center at soc@lbl.gov or call 1-510-486-6999 to start the review process, rather than confronting individuals directly. Security tracking must strictly follow behavioral signals and never rely on proxy biases such as race, ethnicity, or national origin. Your proactive reporting keeps the Lab safe and resilient.
