More live training, new cyber-threat list as Army aims to avoid insider attacks

An Army anti-spying effort born shortly after the Cold War received an update last month, with expanded lists of potentially malicious cyber-activities and new training requirements designed to help ferret out insider threats.

Soldiers and Army civilians aren't strangers to the Threat Awareness and Reporting Program, with mandatory annual training that covers how to spot potential intruders, what methods they may use, and what punishments they — or those who don't report their actions — may face. The substance of that training hasn't changed much since 2010, with updates in the wake of the 2009 shooting at Fort Hood, Texas, but other parts of Army Regulation 381-12 recently received a makeover.

First, new rules require live training, not the online version, for soldiers and civilians "except in exceptional circumstances." These could include those serving in remote locations or alongside counterintelligence units that can't spare the manpower.

The computer-based training has averaged more than 202,000 users since going online in 2012, Army officials said — a number expected to drop significantly.

Second, all Army contractors with access to military information systems will be required to undergo the training. Old regulations applied only to those with security clearances.
Third, a new chart outlines ways potential infiltrators could compromise Army computer systems, including denial-of-service attacks, keystroke logging, and unauthorized data storage, transmission and/or deletion. While the training discusses the punishments potentially faced by infiltrators, up to and including death, it also stresses that failing to report these cyber-behaviors, along with other indicators of espionage and/or extremist behavior, can result in disciplinary action under the Uniform Code of Military Justice.

The program began as SAEDA, or Subversion and Espionage Directed Against the U.S. Army, in 1993. It focused primarily on post-Cold War intelligence threats from former Soviet republics and Warsaw Pact nations, Army officials said.

It has expanded over time to include cyber-threats, domestic terrorism and extremist activity, although neither the regulation nor the training discusses specific religions. Soldiers are asked to report anyone "advocating the use of unlawful force or violence to achieve goals that are political, religious, or ideological in nature."

The updated AR 381-12 also includes details on the the iSalute threat reporting system, which was implemented in 2011 but had not been added to the regulation.