Threats Inside The Wire – Finding The Truth

Behavioral analysis doesn’t make you a mind reader.  Observing someone who is showing cues from the Uncomfortable Cluster only means that they are uncomfortable.  That observation alone doesn’t mean they are about to commit a Green-on-Blue attack, we can begin putting together a plan, go into Condition Orange, but we still need more information. If you were to look at a TSA checkpoint as an example, an old woman who is nervous about going through security because it is her first time flying in a decade could give off the same exact cues as a smuggler trying to get a suitcase full of heroin onto the plane.  The only way we can narrow this field to the people who truly warrant our attention, stop insider attacks, and find the reason for their behavior is to contact them – to start a conversation.

The “contact” offers two benefits – the first is that it reduces the problem of false positives, the old woman going through the checkpoint.  The second benefit is that it provides the information needed so that you can determine why they were acting the way they were.  They have already gotten your attention, now you can figure out the cause.  This human intelligence (HUMINT) is key to stopping Threats Inside the Wire.

Contacting an anomaly isn’t an intrusive interrogation, but it also isn’t purposeless small talk.  Think of the contact as a conversation with a purpose.  The purpose is to determine whether the individual under suspicion is a threat or not.  The situation, your natural conversational style and your relationship with the person you are talking to are all going to affect how to best get the information you are after, but here are some keys to a good contact:

Make them Comfortable

I’m not saying that you need to be nice to everyone and become friends with each person you talk to; I’m saying that you want to get them into the Comfortable cluster.  Whenever possible, establish rapport with the person so they no longer perceive you as a threat.  You will know when you have succeeded as you see their body language open up, relax and become comfortable in the situation.  The reason you want to do this is so that you can easily observe changes out of the cluster.  We will talk about those changes in a bit, but it is easier to confidently observe a shift from “Comfortable to Uncomfortable” than it is to see someone escalate from “mild discomfort to moderate discomfort.” Having the person relax works in your favor.

Let Body Language Be The Guide

As the conversation transitions from topic to topic you are going to look for any changes in behavior.  If you see them shift to Comfortable to any of the other clusters, it could indicate that there is something about that topic that makes them worried.

Even though changes in the person’s body language will be the indicators that you will observe and will alert you to something being wrong, it is the topic that you will want to take note of.  If you remember Roger Clemens testifying in front of congress, his nonverbal behavior there highlights this.  When he was talking about baseball, his body language was in the Comfortable cluster, he was very relaxed, it was the topic that he could talk about forever.  But when the questions turned to steroids, he shifted into the Uncomfortable cluster, you saw him lick his lips and begin shifting around in his chair.  The cue is the lip licking, you can see that he is no longer comfortable, but it is the topic, in this case steroid use, that you will want to dive into deeper.

Follow Up

When you identify a topic that you want to come back (we refer to them as Repeat Topics), find a creative way to readdress the topic later in the conversation.  You do this to either draw out the facts you are after or to confirm your earlier assessment that it is that specific topic that worries them.  The same concept applies for vague answers, unless you are interviewing a politician, expecting an actual answer to your questions is a normal part of conversation.

The post is labeled “Finding The Truth” because that is the goal – to get the information you need to make an informed decision.  This isn’t about detecting deception. Learning that you are being lied to only helps you know that you don’t have the truth, it lets you eliminate a possibility, but it doesn’t give you the fact that you need.  Don’t stop digging if you think the answer is going to be the difference between success and failure.  Keep in mind that Green-on-Blue attacks are often a result of breakdowns in relationships, which at times can be difficult or awkward to talk about, but it is a key step to ensuring your security.

Get Them Talking

A contact is a situation where you need to gain information and requires voluntary cooperation from the person who has that information.  If you approach the person in the wrong way, they could simply walk away from you, leaving you right back at ground zero.  This can be a challenge sometimes overseas; especially because I could make a solid argument that the one common characteristic across all members of the American military is “blunt.”  We like to get to the point, why use 12 words for a sentence when 10 will do?

While being blunt often works well with junior Marines or soldiers who can’t walk away from someone senior to them, it is rarely conducive to a normal conversation amongst equals. If you are too blunt or accusatory, the person isn’t going to open up; he is just going to walk away.  This doesn’t get you the truth.

Make sure you are asking open-ended questions throughout the conversation that require more than a just a simple “yes or no” response.  The longer the person is talking, the more time you have to observe their behavior and decide if the anomaly is a threat or a false positive.  This is why we say a contact should not be an intrusive set of questions because we need to get them to open up.  This is one way you can set the conditions for your own success.

Contact Everyone

Talk to just about every single person that you can.  When you have the least amount of information available (therefore a high degree of uncertainty), every piece of new information has a huge impact on reducing that uncertainty and help you develop the baseline.  The more conversations you have and the more information you gain is only going to help you expand your understanding and help you get closer to finding the truth.

The other reason to contact as many people as you can is that it is a skill that requires practice.  To become adept at questioning people while also looking for any changes in behavior takes some effort and is not something that will develop overnight. So before you deploy and find yourself in a situation where your ability to effectively contact someone who could also be a potential threat – practice, practice, practice.

This Is The Last 10 Yards

Reading human behavior is going to get you most of the way down the field.  It will let you know who needs to talk to, why they stood out from the crowd, what potential control questions will fit the situation, and help you develop a list of potential reasons why someone is acting that way.  Behavioral analysis might make the person you are talking to think that you are a mind reader, but we know that isn’t the case.  That is the heavy lifting that has to be done from the start, but the only way you can confirm those observations and stop an insider attack before it occurs is to gather the information from a conversation.  There is no substitute for human intelligence and no amount of technology will ever replace it, but it takes work.