Behavioral analysis doesn’t make you a mind reader. Observing someone who is showing cues from the Uncomfortable Cluster only means that they are uncomfortable. That observation alone doesn’t mean they are about to commit a Green-on-Blue attack, we can begin putting together a plan, go into Condition Orange, but we still need more information. If you were to look at a TSA checkpoint as an example, an old woman who is nervous about going through security because it is her first time flying in a decade could give off the same exact cues as a smuggler trying to get a suitcase full of heroin onto the plane. The only way we can narrow this field to the people who truly warrant our attention, stop insider attacks, and find the reason for their behavior is to contact them – to start a conversation.
The “contact” offers two benefits – the first is that it reduces the problem of false positives, the old woman going through the checkpoint. The second benefit is that it provides the information needed so that you can determine why they were acting the way they were. They have already gotten your attention, now you can figure out the cause. This human intelligence (HUMINT) is key to stopping Threats Inside the Wire.