On October 8, 2026, a 24-year-old Royal Navy sailor appeared at Westminster Magistrates’ Court in London charged with two offences under the UK’s National Security Act 2023. Prosecutors allege that Teddy Young, a warfare intelligence rating who held a high-level security clearance, obtained protected information and prepared to disclose it for the benefit of a foreign power during his first deployment at sea.
The charges are allegations, and Young has not entered a plea. But the conduct described in court follows a pattern that every insider threat program should recognize: a newly cleared member of the workforce, legitimate access to sensitive systems, and data allegedly moved to a private account. For any organization that supports the Department of War (DoD), the case is a useful reminder that insider risk does not respect borders or rank.
What Happened
According to reporting by ITV News, ITV News, and Reuters:
- Young joined the Royal Navy in April 2024 and served as a warfare intelligence rating. The alleged offences occurred on his first deployment, which began in November 2024.
- He faces two charges covering the period between November 2024 and May 2025: engaging in conduct in preparation for disclosing protected information, and obtaining, copying, recording or retaining protected information with intent to benefit a foreign power.
- The prosecution alleges he accessed and retained sensitive UK defence and intelligence material, copied information to a private email account in breach of Navy rules, and used the dark web to try to contact Russian authorities.
- He allegedly drafted a message in Russian that sought to make contact with a potential threat actor.
- Counter-terrorism police arrested him at his home in Bedfordshire on October 6, 2026. He had previously been arrested in Hampshire in 2025.
- At the October 8 hearing he entered no pleas and was remanded in custody, with the case sent to the Old Bailey for an October 16 appearance.
- Commander Helen Flanagan, Head of Counter Terrorism Policing London, said: “These are very serious charges against a serving member of the armed forces.” Police said they worked closely with Ministry of Defence colleagues to manage potential risks.
Lessons for Every Insider Threat Program
1. Monitor the path from classified systems to personal accounts. The most concrete allegation in this case is that sensitive information was copied to a private email account. User activity monitoring (UAM) and data loss prevention (DLP) should flag attempts to forward, paste, or transcribe protected content toward personal accounts, and those alerts need prompt human review rather than a weekly queue.
2. Pay attention to new personnel in sensitive roles. Young had served less than a year when the alleged conduct began, on his very first deployment. A favorable adjudication is a starting point, not a guarantee. Programs should apply continuous vetting and closer early-tenure monitoring to new hires and new assignees in intelligence and other high-access positions.
3. Account for deployed and remote environments. The alleged activity took place while at sea, away from the normal office setting. Insider threat coverage should extend to deployed units, remote sites, and contractor locations, with clear ownership of who reviews activity data when the workforce is dispersed.
4. Treat foreign-contact attempts as reportable indicators. The prosecution alleges an attempt to reach a foreign government through the dark web. Training should make clear that attempts to contact foreign intelligence services, unusual language use in work materials, and interest in anonymizing tools are indicators coworkers and supervisors should report.
5. Keep investigating after the first contact. Court reporting notes Young had been arrested once before, in 2025, and was charged after a second arrest this month. Insider cases often unfold over long periods. Programs need preserved logs, documented case files, and close coordination with security, legal, and law enforcement partners so each stage builds on the last.
How TMPC Helps
Our team brings more than 30 years of combined insider threat experience and the proprietary processes built from it. For 8 years, TMPC has delivered continuous counter-insider threat and user activity monitoring support to USSOCOM and JSOC, work that drove that program to a #1 ranking among 24 DoW (DoD) components by DCSA and DIA.
We help organizations:
- Deploy and tune user activity monitoring and DLP to detect protected data moving toward personal email, cloud, and devices
- Build continuous evaluation and early-tenure monitoring for newly cleared and newly assigned personnel
- Train workforces and supervisors to recognize and report foreign-contact and behavioral indicators
To talk with our team, contact info@tmpcinc.com or 813.524.6935.