Late Nights, Foreign Contacts, and 62 Printed Pages
A technical sergeant with TS/SCI eligibility works in a test wing and reports 11 foreign national contacts on social media, including three he met in person during a recent conference in Southeast Asia. He did not report the contacts as required. Badge logs show six late-night entries to a classified vault over five weeks, and a printer log shows 62 pages printed from a classified workstation to an unclassified network printer. His supervisor reports mood changes and that he asked whether foreign travel must be reported. A bank record shows $14,500 in cash deposits over three months, and he recently paid off a $9,000 credit card balance. The security manager wants his clearance suspended immediately; the commander wants him interviewed the same day. No one has reviewed the printed pages or the network logs, and the foreign contacts have not been identified.
1. Should this be opened as a counterintelligence investigation, a criminal investigation, or an insider-threat inquiry? What initial steps should the agent take?
Read the worked answer
The indicators cross three lanes: insider threat, counterintelligence, and possible criminal conduct. The agent should open a CI inquiry or preliminary inquiry, not a full criminal investigation by default, because unexplained foreign contacts, unreported travel, cash, and unusual classified printing are classic CI indicators. Coordinate immediately with the AFOSI CI element, the base insider-threat program, security, and the commander, while keeping distribution tight. If a foreign intelligence entity is suspected, the FBI has the lead for espionage-related matters; AFOSI should coordinate rather than act unilaterally. Preserve badge, printer, network, email, financial, and travel records, and secure the 62 printed pages with classified markings and a chain of custody. Identify the foreign contacts through lawful means and review the required reporting forms. Do not confront the sergeant, search his person or home, or suspend access without legal and command coordination unless there is an immediate safety or compromise concern. The first report should distinguish facts from inferences and set a 72-hour investigative plan. The commander's urgency is legitimate, but speed should come from preservation and coordination, not from an early interview.
2. The commander wants an immediate interview and the security manager wants the clearance suspended now. What should the agent advise?
Read the worked answer
The commander can suspend access or clearance administratively if security policy supports it, but AFOSI does not direct that decision and should not frame it as punishment. The agent should advise on investigative risk: an immediate interview may reveal the subject's explanation, but it can also alert a foreign handler, prompt deletion, or end the chance to identify others. A middle path is often best: temporarily restrict access to classified systems and the vault, preserve devices and printed material, and conduct a coordinated interview after the initial records review. If there is an imminent compromise, the security manager and commander may need to act first; the agent should document the reason. The interview should be planned with CI and legal personnel, in a cleared space, with a written warning if custodial or required by policy. The commander should not be present, and the agent should not brief investigative details to the first sergeant or unit. The report should record who made the access decision and why, so the case is not later painted as command pressure. Clearance adjudication and criminal process are separate tracks.
3. What interview strategy and evidence-handling steps should the agent use for the classified printouts and digital records?
Read the worked answer
The interview should test contacts, travel, finances, and access without disclosing classified sources or methods. Prepare a timeline from badge, printer, bank, and travel records; ask open questions first, then narrow to the 62 pages and the $14,500 deposits. Do not ask 'Are you a spy?' or reveal the full scope; ask who he met, why he did not report, who has access to his devices, and how he paid the card. If he invokes counsel, stop. The printed pages must be handled as classified evidence: photograph, label, bag, and store per classification rules; do not make extra copies. Review them only in a cleared facility with need-to-know. Digital media should be imaged by trained personnel and handled under classified procedures if classified data is present. The agent should avoid interviewing foreign contacts without coordination and should not promise confidentiality that cannot be kept. After the interview, reassess whether the matter remains CI, becomes criminal, or supports an administrative security action. Document exculpatory explanations as carefully as incriminating ones.