Insider Threat

The Insider Threat program, as outlined in Program Element (PE) 0305327V, is managed by the Defense Counterintelligence and Security Agency (DCSA). This program is a key component of the Department of Defense's (DoD) efforts to protect personnel, assets, and information from threats originating within the organization. The overarching goal is to ensure a trusted federal, industrial, and affiliated workforce by leveraging advanced technologies, innovation, and integrated counterintelligence capabilities.

Within the Insider Threat program, two primary initiatives are supported: the DoD Insider Threat Management and Analysis Center (DITMAC) and the National Center for Credibility Assessment (NCCA). DITMAC provides an integrated capability to collect, analyze, and respond to information from a variety of sources, including counterintelligence, security, cybersecurity, personnel management, workplace violence prevention, law enforcement, and user activity monitoring on DoD networks. The objective is to identify, mitigate, and counter insider threats through comprehensive data integration and analysis.

DITMAC System of Systems (DSoS) is a central element of the Insider Threat program. Its specific objectives include supporting installation-level reporting for the Prevention, Assistance, and Response (PAR) program, enabling User Access Monitoring (UAM), and enhancing Behavioral Threat Analysis Capability (BTAC). In FY25, the DSoS is required to adapt to automated data ingestion, which will improve the efficiency and accuracy of analytic efforts, particularly in areas identified as higher risk. The DSoS serves as a secure, automated mechanism for transmitting information between DoD components and DITMAC, supporting timely and coordinated threat mitigation.

The National Center for Credibility Assessment (NCCA) is another critical component, focused on research, development, training, and oversight related to credibility assessment technologies. NCCA's mission includes evaluating and advancing methods for detecting deception, with the goal of supporting federal polygraph and credibility assessment partners. NCCA has initiated scientific evaluations of ocular-motor deception detection (ODT) capabilities, including the EyeDetect system, to determine their effectiveness in classifying deceptive versus non-deceptive individuals.

A significant congressional add in FY2024 funded the Ocular-motor Deception Detection (ODT) Capabilities initiative. This project supports scientific evaluation and development of ODT technologies, with efforts conducted by the Applied Research Laboratory for Intelligence and Security (ARLIS) through academic partners such as Texas A&M University and the University of South Carolina. The project also involves the Department of Energy's Oak Ridge National Laboratory (ORNL), which is developing a proprietary decision algorithm for national security applications using machine learning techniques. These efforts aim to provide the federal government with validated, high-performance deception detection tools for use in security and personnel vetting processes.

The Insider Threat program's objectives are justified by the need to address evolving threats from within the DoD and affiliated organizations. By integrating advanced analytic capabilities, automated data processing, and innovative deception detection technologies, the program seeks to enhance the DoD's ability to proactively identify and mitigate insider risks. The program's structure ensures that research and operational development are closely aligned with mission requirements, supporting both immediate and long-term national security objectives.