PROGRAM FOR APPLIED RESEARCH IN AIRPORT SECURITY PARAS PARAS 0026 March 2021 Insider Threat Mitigation at Airports National Safe Skies Alliance, Inc. Sponsored by the Federal Aviation Administration PARAS 0026 March 2021 Salus Solutions www.Salus.Solutions © 2021 National Safe Skies Alliance, Inc. All rights reserved. COPYRIGHT INFORMATION Authors herein are responsible for the authenticity of their materials and for obtaining written permissions from publishers or persons who own the copyright to any previously published or copyrighted material used herein. National Safe Skies Alliance, Inc. (Safe Skies) grants permission to reproduce material in this publication for classroom and not-for-profit purposes. Permission is given with the understanding that none of the material will be used to imply Safe Skies or Federal Aviation Administration (FAA) endorsement of a particular product, method, or practice. It is expected that those reproducing the material in this document for educational and not-for-profit uses will give appropriate acknowledgment of the source of any reprinted or reproduced material. For other uses of the material, request permission from Safe Skies. NOTICE The project that is the subject of this report was a part of the Program for Applied Research in Airport Security (PARAS), managed by Safe Skies and funded by the FAA. The members of the technical panel selected to monitor this project and to review this report were chosen for their special competencies and with regard for appropriate balance. The report was reviewed by the technical panel and accepted for publication according to procedures established and overseen by Safe Skies. The opinions and conclusions expressed or implied in this report are those of the individuals or organizations who performed the research and are not necessarily those of Safe Skies or the FAA. Safe Skies and the FAA do not endorse products or manufacturers. Insider Threat Mitigation at Airports ii PARAS 0026 March 2021 NATIONAL SAFE SKIES ALLIANCE, INC. National Safe Skies Alliance (Safe Skies) is a non-profit organization that works with airports, government, and industry to maintain a safe and effective aviation security system. Safe Skies’ core services focus on helping airport operators make informed decisions about their perimeter and access control security. Through the ASSIST (Airport Security Systems Integrated Support Testing) Program, Safe Skies conducts independent, impartial evaluations of security equipment, systems, and processes at airports throughout the nation. Individual airports use the results to make informed decisions when deploying security technologies and procedures. Through the POST (Performance and Operational System Testing) Program, Safe Skies conducts long-term evaluations of airport-owned equipment to track and document a device or system’s performance continuously over its life cycle. Through PARAS (Program for Applied Research in Airport Security), Safe Skies provides a forum for addressing security problems identified by the aviation industry. A Board of Directors and an Oversight Committee oversee Safe Skies’ policies and activities. The Board of Directors focuses on organizational structure and corporate development; the Oversight Committee approves PARAS projects and sets ASSIST Program priorities. Funding for our programs is provided by the Federal Aviation Administration. Insider Threat Mitigation at Airports iii PARAS 0026 March 2021 PROGRAM FOR APPLIED RESEARCH IN AIRPORT SECURITY The Program for Applied Research in Airport Security (PARAS) is an industry-driven program that develops near- term practical solutions to security problems faced by airport operators. PARAS is managed by Safe Skies, funded by the Federal Aviation Administration, and modeled after the Airport Cooperative Research Program of the Transportation Research Board. Problem Statements, which are descriptions of security problems or questions for which airports need guidance, form the basis of PARAS projects. Submitted Problem Statements are reviewed once yearly by the Safe Skies Oversight Committee, but can be submitted at any time. A project panel is formed for each funded problem statement. Project panel members are selected by Safe Skies, and generally consist of airport professionals, industry consultants, technology providers, and members of academia—all with knowledge and experience specific to the project topic. The project panel develops a request of proposals based on the Problem Statement, selects a contractor, provides technical guidance and counsel throughout the project, and reviews project deliverables. The results of PARAS projects are available to the industry at no charge. All deliverables are electronic, and most can be accessed directly at www.sskies.org/paras. PARAS PROGRAM OFFICER Jessica Grizzle Safe Skies PARAS Program Manager PARAS 0026 PROJECT PANEL Martina Benedikovicova Charlotte Douglas International Airport Frank Capello Broward County Aviation Department Colleen Chamberlain American Association of Airport Executives Scott Creager Port of Portland Sarah Demory Phoenix Sky Harbor International Airport Michele Freadman Massachusetts Port Authority Tracy Fuller ACTS – Aviation Security, Inc. David Hornsby Dallas Fort Worth International Airport Lisa Rousseau Port of Seattle Timothy Tyler Metropolitan Washington Airports Authority Jon “JT” Taylor Dallas Fort Worth International Airport Serge Potapov Ex-Officio, Transportation Security Administration AUTHOR ACKNOWLEDGMENTS The research team would like to thank the airport administrators, vendors, and concessionaires who took time out of their busy schedules to help make this guidebook robust and useful to airports of all sizes. It is only through the support of airports that Safe Skies is able to continue to provide the aviation industry with valuable research on practical airport related topics. Finally, the research team wants to thank the panel of volunteers who lent their expertise and time to ensure the guidebook would be useful and applicable. Insider Threat Mitigation at Airports iv PARAS 0026 March 2021 CONTENTS HOW TO USE THIS GUIDEBOOK vii PARAS ACRONYMS viii ABBREVIATIONS, ACRONYMS, INITIALISMS, AND SYMBOLS ix SECTION 1: WHAT IS AN INSIDER THREAT? 1 1.1 Risk Indicators, Behavior, and Motivation by Categories 1 SECTION 2: DETECTION AND DETERRENCE 4 2.1 Layers of Security 4 2.2 Interdiction and Disruption 4 2.3 Leveraging Technology 5 2.3.1 CCTV and Video Analytics 6 2.3.2 Biometrics 6 2.3.3 Limiting Remote Access to Computer Networks 7 2.3.4 Systems Integration and Analysis 7 2.4 Employee Vetting 8 2.4.1 Badge Control 9 2.5 Personnel Screening 9 2.6 Detection through Processes 10 2.7 Physical Security 10 2.7.1 Reducing and Controlling Access Points 10 2.7.2 Personal Location Systems 11 SECTION 3: INFORMATION SHARING AND COLLABORATION 12 3.1 Insider Threat Working Group or Hub 12 3.2 Data Sharing and Data-Driven Decision Making 14 3.3 Information Sharing 14 3.3.1 Law Enforcement 15 3.3.2 Air Carriers 15 3.3.3 Other Stakeholders 16 3.3.4 Collaboration and Data Exchange Case Study 16 3.4 Cost Analysis 17 SECTION 4: CREATING A SECURITY-MINDED CULTURE 19 4.1 Training and Awareness Strategies 19 4.1.1 Training Topics 19 4.1.2 Training Frequency and Delivery Methods 20 4.1.3 Assessing the Training Program 20 4.2 Reporting Mechanisms 21 4.2.1 Clarity, Context, and Credibility 21 4.2.2 Developing Reporting Mechanisms 22 Insider Threat Mitigation at Airports v PARAS 0026 March 2021 4.2.3 Privacy and Civil Liberties 23 SECTION 5: WORK ENVIRONMENT AND EMPLOYEE ASSISTANCE 25 5.1 Engagement Programs 25 5.1.1 Reward and Recognition Programs 25 5.2 Mental Health Treatment and Counseling 26 5.3 Reducing Personnel Turnover 27 5.4 Addressing Workplace Harassment 27 SECTION 6: ENFORCING RULES, REGULATIONS, AND SANCTIONS 29 6.1 Badge Holder Responsibilities 29 6.1.1 Sanction Strategies 30 6.2 Escorting Requirements 31 6.3 Challenge Procedures 31 SECTION 7: CONCLUSION 33 REFERENCE MATERIAL 34 CHECKLISTS, FORMS, AND ILLUSTRATIONS A-1 TABLES & FIGURES Table 1. Insider Threat Types, Motivations, and Indicators 1 Figure 1. Layers of Detection and Deterrence 4 Figure 2. Perceived Workplace Injustice 5 Figure 3. Detection During Pre-Attack Cycle 5 Figure 4. Biometric Layers of Detection and Deterrence 7 Figure 5. Airport Security Areas 10 Figure 6. Insider Threat Hub Stakeholders 13 Figure 7. Percentage of Insider Threat Incident Costs 17 Figure 8. Stress Management 27 Figure 9. Escalation of an Insider Threat 28 Figure 10. Notice of Violation Administrative Process 29 Insider Threat Mitigation at Airports vi PARAS 0026 March 2021 HOW TO USE THIS GUIDEBOOK This guidebook is an all-encompassing source for information on insider threat mitigation at airports. To use this document most effectively, begin by reviewing the table of contents to get an overview of the information in the guidebook, and to identify the sections that are especially relevant to your role and responsibilities at the airport. You can also use the information in this guidebook to develop other materials for your airport’s needs, such as presentations for training, and information cards and other handouts with specific information for various roles within your organization. In the appendices of the guidebook are several additional sources, including checklists for planning and reference material for more information. Acknowledging the importance of the work accomplished by the Aviation Security Advisory Committee (ASAC), this guidebook aligns