On November 2, 2026, the U.S. Attorney’s Office for the Western District of Texas announced the arrest of Zachry Wade Carroll, 47, of San Antonio, an Air Force contractor charged with losing a classified document, carrying a loaded handgun inside a Sensitive Compartmented Information Facility (SCIF) at Joint Base San Antonio, and lying about it when asked. The case is a reminder that insider risk is not only about espionage or data theft. Carelessness with classified material, a failure to report, and a false statement to security personnel are all warning signs that an insider threat program is built to catch early.
What happened
According to the U.S. Attorney’s Office press release, the indictment alleges:
- A lost classified document. In April 2025, Carroll allegedly lost a classified document relating to the national defense and did not promptly report the loss to his superior officer.
- A loaded handgun inside a SCIF. In November 2025, he allegedly carried a loaded .380 caliber handgun on his person while working in a SCIF at Joint Base San Antonio–Kelly Annex.
- More weapons on base. At the same time, his vehicle on the base allegedly held a loaded AR-15 with 85 rounds and three magazines, and a loaded 9mm handgun with 20 rounds and three magazines.
- A false statement. When asked whether he was armed, he allegedly denied having the .380 on his person.
- Arrest and charges. Carroll was arrested on a Saturday in Comal County and made his initial appearance in federal court in San Antonio on November 2. He is charged with one count of losing national defense information, two counts of possessing a firearm in a federal facility, and one count of making false statements. If convicted on all counts, he faces up to 17 years in prison.
- Investigators. The FBI and the Air Force Office of Special Investigations are investigating the case.
An indictment is merely an allegation. Carroll is presumed innocent unless and until proven guilty beyond a reasonable doubt in a court of law.
Lessons for every insider threat program
- Treat unreported security incidents as a behavior, not just a paperwork gap. The alleged failure to promptly report a lost classified document is itself a concerning indicator. Programs should track missed or late incident reports by individual over time, so a single lapse is handled and a pattern is noticed.
- Connect physical security and personnel security data. Weapons on a base, prohibited items in a SCIF, and access control events often live in separate systems owned by separate offices. An insider threat hub needs a working agreement to receive and correlate those reports with security, HR, and counterintelligence information.
- Take dishonesty with security staff seriously. The indictment alleges a false answer to a direct question about being armed. Candor is a core adjudicative concern. Any false statement to security personnel should trigger a documented referral and a review of the person’s access, not just an on-the-spot correction.
- Close the loop on accountability for classified holdings. Document control, regular inventories, and clear custody records make it possible to spot a missing item quickly and tie it to a person and a date. User activity monitoring (UAM) on classified networks adds a record of who printed, copied, or moved material before it went missing.
- Build a reporting culture that reaches contractors. Contractors work side by side with government personnel in SCIFs. Training and reporting channels must make clear that co-workers, supervisors, and facility security officers on both sides are expected to report concerning behavior, and how to do it.
How TMPC helps
Our team brings more than 30 years of combined insider threat experience and the proprietary processes built from it. For 8 years, TMPC has delivered continuous counter-insider threat and user activity monitoring support to USSOCOM and JSOC, work that drove that program to a #1 ranking among 24 DoW (DoD) components by DCSA and DIA.
- Insider threat hub operations that correlate UAM, security incident, physical access, and personnel data into actionable referrals.
- User activity monitoring analysis on classified and unclassified networks, with trained analysts triaging alerts and documenting findings.
- Program assessments and training that strengthen reporting culture, incident reporting procedures, and contractor integration.
TMPC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) and is cleared to perform classified government work. To talk with our team, contact info@tmpcinc.com or 813.524.6935.
Source: U.S. Attorney’s Office, Western District of Texas, “Joint Base San Antonio Contractor Arrested for Mishandling Classified Documents, Possessing Firearms While on Base,” November 2, 2026.