On October 30, 2026, the Justice Department announced that the FBI had arrested James Thomas Ashbacher, 37, of Spring Lake, North Carolina, a former U.S. government contractor, after an indictment was unsealed charging him with unlawfully transmitting and retaining national defense information and with theft of government property. An indictment is merely an allegation, and Ashbacher is presumed innocent unless and until proven guilty in a court of law.
The case is a reminder that insider risk is not limited to analysts and system administrators. A cleared contractor in a support role, with daily physical access, can create serious exposure with a phone camera and a social media account.
What happened
- Starting in or about 2021, Ashbacher worked for a private company that provided security and emergency management services at the U.S. Army Special Operations Command facility at Fort Bragg, North Carolina. His duties required a Top Secret security clearance with Sensitive Compartmented Information (SCI) access.
- According to the indictment, he photographed and removed, without authorization, videos and photographs depicting classified military operations and sent them to a social media site.
- Other users later reposted the materials on a second social media site.
- In a private message, he allegedly asked a social media user to remove some of the materials, writing that he was “trying to do some damage control.”
- A search of his residence allegedly turned up a classified award write-up containing additional national defense information, along with a night vision goggle system belonging to a specific Army Special Operations Command unit that had been reported missing.
- The FBI Charlotte Field Office is investigating, with substantial assistance from the Department of the Army’s Criminal Investigative Division. (DOJ press release)
Lessons for every insider threat program
- Count cleared support roles in your insider risk population. Security, facilities and emergency management staff often hold broad physical access and high clearances. Include them in user activity monitoring, awareness training and reporting procedures, not just the people who touch classified networks.
- Make device rules real where classified work is visible. The alleged leak began with photos and video. Enforce personal electronic device restrictions at entry points, run unannounced spot checks, and treat a phone found in a controlled area as a reportable event, not a reminder.
- Watch for your information in public. Here, material surfaced on one social media site and spread to another before anyone could contain it. Insider threat hubs should work with OPSEC and counterintelligence partners to monitor open sources for imagery or details tied to their facilities, with a fast path to takedown requests and damage assessment.
- Treat missing sensitive property as a potential insider indicator. The night vision system had already been reported missing. Losses of accountable items such as night vision devices, removable media or classified documents should go to the insider threat hub and be checked against access records, not only handled as a property-accountability problem.
- Make reporting simple and expected. Behaviors like filming in restricted areas or discussing operations online are often visible to coworkers first. Training should say exactly what to report and how, and the reporting channel should lead to visible action.
How TMPC helps
Our team brings more than 30 years of combined insider threat experience and the proprietary processes built from it. For 8 years, TMPC has delivered continuous counter-insider threat and user activity monitoring support to USSOCOM and JSOC, work that drove that program to a #1 ranking among 24 DoW (DoD) components by DCSA and DIA.
- Counter-insider threat program support: hub operations, policy, training and reporting procedures aligned to DoW requirements
- User activity monitoring (UAM): analysis, triage and referral of potential insider threat indicators
- Insider threat program assessments that look across physical access, device controls, property accountability and open-source exposure
TMPC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) cleared to perform classified government work.
To talk with our team, contact info@tmpcinc.com or 813.524.6935.