Coast Guard says insider threat alert led crew to stop armed member

What happened

A US Coast Guard cutter crew stopped a service member boarding with a firearm and several ammunition magazines in March 2024 after an alert from its insider threat programme, according to the service.

The account, published by the Coast Guard’s MyCG news service, said the Coast Guard Insider Threat Program (CGITP) gathered intelligence and warned the unit so the individual could be apprehended. The crew confiscated the weapon and ammunition.

The service member has since been discharged, MyCG reported. The article does not identify him, name the vessel or give its location. It also does not describe his intentions or report any criminal charges.

The Coast Guard highlighted the intervention in an article marking National Insider Threat Awareness Month in September 2025. Its account does not explain how the intelligence was obtained or establish whether a colleague’s report prompted the warning.

The background

The Coast Guard established CGITP in 2015 to identify and address threats before they cause harm. The programme has 23 staff and is managed by Jared Quance, according to MyCG.

The service defines an insider threat as someone who uses access to its personnel, premises, systems or information in a way that causes harm, whether deliberately or unintentionally. Its examples include disclosure of sensitive information, equipment sabotage, harassment and violence.

That definition extends beyond cybersecurity. It treats the safety of people and physical assets as part of the same remit as protecting information, rather than limiting insider threats to stolen files or misused computer accounts.

The programme trains personnel to recognise concerning behaviour and gives supervisors and colleagues ways to intervene early. MyCG also identifies the Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency and the Secret Service as partners.

The emphasis on training and collaboration is also reflected in private-sector guidance. As previously reported by Insider Threat Roundup, Adaptive Security recommends combining staff training, technical monitoring and shared oversight to address deliberate misuse, mistakes and compromised accounts. The Coast Guard account adds a physical-safety example to that broader discussion.

What people are saying

“We don’t get a lot of ground-level reporting from the field,” Quance told MyCG. He said he wanted personnel to submit more reports.

Quance encouraged staff to notice changes in colleagues’ behaviour, including signs of distress, aggressive language or unusual treatment of sensitive information. He also urged personnel to support colleagues, saying apparent security concerns can sometimes reflect a need for help.

MyCG cited the 2009 Fort Hood shooting, in which 13 people died, as an example of the potential human cost of internal threats. It separately highlighted the toll of military suicides on service members and their families.

The publisher said the 2025 awareness campaign focused on collaboration across the service, sharing information and prioritising staff well-being. Its guidance presented early reporting and support for colleagues as complementary responsibilities.

What happens next

Personnel can raise concerns through their command, a security officer or directly with CGITP, according to the guidance. Reports can be anonymous, providing an option for people who do not want to identify themselves.

MyCG directs staff to the programme’s SharePoint site for further information and to national awareness-month resources and events. The article does not set out a new policy, an expansion of the programme or a timetable for further changes.

No further proceedings involving the discharged service member are described. The published account therefore establishes an intervention and a subsequent discharge, but not a criminal finding or a planned attack.