William Is a Sanitation Worker at a DoD Facility Who Posts a Photo Exposing Secret Documents — Is He an Insider Threat?

The answer

Yes — William is a potential insider threat. The Department of Defense defines an insider threat as the threat that an insider will use their authorized access, wittingly or unwittingly, to harm the security of the United States. Two phrases in that definition decide William's case: authorized access and unwittingly.

William is a sanitation worker, but he was granted authorized access to the facility to do his job. That access is what makes him an insider rather than an outside attacker. When his photo captured Secret documents in the background and he posted it, those documents were exposed to anyone who saw the image. Classified information was compromised — and that compromise is the harm. Combine the two elements, authorized access plus harm to national security, and the definition is met.

Why intent and clearance don't matter

The most common wrong instinct is "He didn't mean to, so he can't be a threat," or "He's just a janitor with no clearance, so classified rules don't apply to him." Both are false, and the Insider Threat Awareness course is specifically testing whether you understand why.

• Malicious intent is not required. The definition explicitly includes the word unwittingly. Someone who leaks information through carelessness or negligence causes the same damage as a deliberate spy — the documents are exposed either way. Insider-threat programs track negligent and unintentional actors for exactly this reason.
• A security clearance is not required. You do not need to hold a clearance to become an insider threat. You only need access. William's access to the physical space put him near classified material, and that proximity was enough to cause a compromise.

The bigger picture

The scenario is designed to break the stereotype that an insider threat is a hooded hacker or a bitter employee selling secrets. In reality, the largest share of security incidents come from ordinary, well-meaning people who make mistakes: a photo with sensitive material in the background, an email sent to the wrong recipient, a document left on a printer, or a laptop lost in transit.

What should William have done differently? Before photographing anything inside a secure facility, he should have confirmed that photography was permitted, checked that no documents, screens, whiteboards, or badges were visible, and never posted work-area images to social media. When in doubt, he should have reported the concern to his security officer rather than sharing the image. Recognizing that anyone with access can become a threat — accidentally — is the core lesson the course wants you to carry away.