Reporting Espionage Indicators
Observant supervisors and coworkers are our first line of defense against insider threats, but often fail to recognize or report behaviors of significant security concern. Recent research that explored the underreporting of security-relevant behavior in the workplace shows that individuals are more likely to report when they understand that there is a direct link between the behavior their colleague is engaging in and national security interests. This indicates a need to educate personnel about a clearly defined set of indicators that an individual may be engaging in espionage or other egregious behavior that must be reported.1 Questions asked during personnel security investigative interviews can help with this educational function and remind personnel of their reporting responsibilities.
This file provides brief summaries of cases in which American spies were caught because someone recognized and reported suspicious activity. It also provides brief summaries of cases in which espionage was allowed to continue undetected because coworkers failed to report suspicious activity or a supervisor failed to take the appropriate action when it was reported. All information about these cases is from public records except as otherwise noted.
A separate file in this Counterintelligence module, Potential CI Risk Indicators, includes a comprehensive list of potential indicators of espionage or terrorism.
The following stories are about people who made a difference by helping to catch a spy. When they saw or heard something that raised a suspicion, they chose to act. They made a call that helped to protect our national security.
FBI intelligence analyst Leandro Aragoncillo used his access to FBI databases to search for and copy classified intelligence reports on the Philippines even though he had no need to have this information. When he found reports on the political climate and chances of a coup, he sent these by e-mail to opposition leaders in the Philippines. Aragoncillo is a naturalized U.S. citizen born in the Philippines. He spent 21 years in the U.S. Marine Corps, yet still felt so strongly attached to his native country that he wanted to help overthrow the current Philippine government.
After his arrest in September 2005, it was determined that Aragoncillo started accessing classified intelligence information and sending it to dissident political leaders in the Philippines in 2000, while working as a Marine staff assistant in the Vice President's office in the White House. Aragoncillo traveled back to his native country 15 times between 2000 and 2005, ostensibly at his own expense, despite having financial problems.
Aragoncillo was caught because he abused his authority as an FBI employee by intervening with the Immigration and Customs Enforcement (ICE) agency on behalf of a former senior Philippines police official who was arrested in New York on an expired visa. ICE advised the FBI, which prompted an FBI investigation leading to Aragoncillo's detection. His frequent travel to the Philippines and extensive downloading and copying of classified reports unrelated to his work could have been noted and prompted investigation earlier.
Dr. Ronald Hoffman managed a secret Air Force contract for Science Applications International Corporation (SAIC). From 1986 to 1990, he sold restricted space technology to four Japanese companies -- Mitsubishi, Nissan, Toshiba, and IHI Inc. -- and was paid over $500,000. Hoffman was caught, prosecuted and convicted because an alert secretary saw something that didn't seem right, and reported it. She accidentally saw a fax from Mitsubishi to Hoffman advising of the deposit of $90,000 to his account and requesting his confirmation that the funds were received. The secretary's husband was also suspicious of Hoffman's lifestyle -- two Corvettes, an Audi, a gorgeous sailboat and fine home that didn't seem compatible with his SAIC income.
Here's the secretary's message to others: "No matter what your level in the company, whether you are an engineer or just a clerk or even a person in the mailroom, don't be afraid to stick your neck out and say something. Be accountable."
Jonathan Jay Pollard was a Naval Intelligence analyst arrested for espionage on behalf of Israel. He used his access to classified libraries and computer systems to collect a huge amount of information, especially on Soviet weapons systems and the military capabilities of Arab countries. Over a period of 18 months until he was arrested in November 1986, he passed over 1,000 highly classified documents, many of them quite thick. He was sentenced to life in prison.
The investigation leading to Pollard’s arrest was triggered by a coworker who reported seeing Pollard take a package of Top Secret material out of the building about 4:15 p.m. on a Friday afternoon. Although the package was appropriately wrapped and Pollard had a courier pass to carry such material to a neighboring building, which was not unusual, it did seem suspicious at that time on a Friday, especially since Pollard got into a car with his wife. Investigation rapidly confirmed that Pollard was regularly removing large quantities of highly classified documents.
Steven Lalas, an American of Greek descent, was a State Department communications officer stationed with the U.S. Embassy in Athens, Greece. He was arrested in 1993 and sentenced to 14 years in prison for passing sensitive military information to Greek officials. He began spying for the Greek government in 1977 while with the U.S. Army.
A report by a State Department official triggered the investigation leading to Lalas’ arrest. This official reported the apparent compromise of a State Department communication. In a conversation with an official of the Greek Embassy in Washington, the Greek official revealed knowledge of information that could only have come from a Secret communication between the State Department and the U.S. Embassy in Athens. Investigation pointed to Lalas, and this was confirmed by a videotape of him stealing documents intended for destruction.
A coworker reported in 1986 that Michael H. Allen was spending excessive time at the photocopier in their office. This report led to investigation by the Naval Investigative Service. A hidden camera was installed near the photocopier in Allen’s office. The resulting videotape showed Allen copying documents and hiding them in his pocket.
Allen was a retired Navy Senior Chief Radioman working at the Cubi Point Naval Air Station in the Philippines. He confessed to passing classified information to Philippine Intelligence in an effort to promote his local business interests. He was found guilty of ten counts of espionage.
Many other spies remained undetected for a long period because observed indicators of espionage were not reported or, if reported, were not appropriately followed up. Our country suffered as a result.
Navy spy Jerry Whitworth's work colleagues observed him monitoring and copying a sensitive communications line without authorization, saw classified papers in his personal locker, and knew Whitworth took classified materials home with him, but they believed he was doing it only to keep his work current.
None of these Navy personnel reported these improper activities before Whitworth's arrest in 1985 as part of the infamous John Walker spy ring. Their failure allowed the Walker ring to continue, with massive damage to U.S. national security.
James R. Wilmoth was a U.S. Navy airman assigned to the carrier USS Midway in Japan. He was recruited by a Soviet KGB officer he met in a Japanese bar. As a food service worker he had no access to classified information. In order to be able to earn money as a Soviet spy, he recruited a friend, Russell Paul Brown, who took classified documents from the burn bag in the electronic warfare center of the Midway.
Although Wilmoth bragged about selling secrets to the Soviets, his comments were not taken seriously, so no one reported him. When his Japanese girlfriend sent postcards to Wilmoth's shipmates from vacation in Moscow, no one reported this either.
Army Warrant Officer James W. Hall, III was sentenced to 40 years in prison for spying for both the former East Germany and Soviet Union from 1982 to 1988. He compromised U.S. and NATO plans for the defense of Western Europe. After his arrest, Hall said there were many indicators visible to those around him that he was involved in questionable activity.
Hall sometimes spent up to two hours of his workday reproducing classified documents to provide to the Soviets and East Germans. Concerned that he was not putting in his regular duty time, he consistently worked late to complete his regular assignments. Using his illegal income, Hall paid cash for a brand new Volvo and a new truck. He also made a large down payment on a home and took flying lessons. He is said to have given his military colleagues at least six conflicting stories to explain his lavish life style.
At one point coworkers observed a thick roll of $100 dollar bills fall out of Hall's gym bag. They reported this to their Security Officer. The Security Officer failed to report the incident to counterintelligence. Instead, he called Hall in and asked about the money. Hall told him he had won the lottery, and the Security Officer was satisfied with that explanation. Hall continued to provide large amounts of very damaging information to the Soviet KGB and collected about $100,000 for his services.2
1. Two relevant PERSEREC reports are available. Wood, S. & Marshall-Mies, J. (2003) Improving supervisor and coworker reporting on information of security concern and Wood, S., Crawford, K.S., & Lang E.L. (2005) Reporting of counterintelligence and security indicators by supervisors and coworkers. The latter is a succinct list of behaviors that clearly indicate an individual may be engaging in insider espionage, and which coworkers and supervisors should be required to report. For an electronic copy of either report send an email to perserec@osd.pentagon.mil.
2. The information about the roll of $100 dollar bills and how this was handled is not available in the public record on the Hall case. It is from a personal communication to PERSEREC from Dan Christman, a retired Army counterintelligence specialist who worked on the Hall investigation.