A case recently surfaced involving a U.S. Army soldier accused of using insider access, allegedly tied to telecom systems, to try to extort AT&T and Verizon. No exotic malware, no zero-day (a previously unknown software flaw hackers exploit before it’s fixed). Just someone with legitimate access deciding to misuse it. That raises an uncomfortable question for every industry this publication covers: if the person causing the damage was never supposed to be stopped by your defenses in the first place, what exactly are those defenses for?
The AT&T/Verizon Insider Threat Case
The Skeptic: This is the story nobody wants to tell because it’s boring and it’s also the real one. We spend billions on firewalls, intrusion detection, zero-trust architectures, and the actual breach came from someone who was handed the keys. That’s not a technology failure. That’s a vetting and monitoring failure.
The Optimist: Sure, but isn’t that also kind of good news? It means the perimeter defenses are working well enough that attackers increasingly need an inside person. That’s a shift we can design around, like behavioral monitoring on privileged accounts, not just border security.
The Skeptic: Okay, so what does “design around it” actually mean in practice? Because behavioral monitoring on insiders has been “coming soon” for a decade. The reason it hasn’t landed is that flagging your own soldier, employee, or contractor for unusual activity means accusing someone with institutional trust, and organizations are allergic to that until it’s too late.
Can Behavioral Monitoring Catch Insider Threats?
The Optimist: Then make it less personal and more statistical. You don’t need to accuse anyone of anything up front. You just need systems that notice when someone with database access starts querying way outside their normal pattern, the way banks already flag unusual card activity, and route it to a human for review automatically.
The Skeptic: That works for a credit card because the bank eats the fraud and the customer barely notices. What’s the equivalent cost model here? If a telecom builds that monitoring layer across every employee and contractor with system access, who approves the false positive rate? Flag too aggressively and you’ve got a workforce that feels surveilled and a compliance nightmare. Flag too loosely and you’ve got exactly this case again.
The Optimist: So the real cost isn’t the technology, it’s the organizational will to actually act on the alerts once you have them. That’s actually a more solvable problem than people think. You don’t need a perfect model, you need a policy that says access gets reviewed on a schedule and revoked by default when a role changes, which is cheap compared to the alternative.
The Skeptic: Here’s where I push back harder. This person was a soldier, meaning the access in question likely touched systems with national security relevance, not just customer billing data. That changes the stakes completely. We’re not talking about a disgruntled employee skimming gift cards, we’re talking about someone with a security clearance and institutional trust allegedly using telecom access as leverage. What does it mean if the military’s own vetting process didn’t catch an insider risk before it reached a private company’s infrastructure?
The Optimist: It means the handoff between institutions is where this actually breaks, not the vetting within either one alone. The Army vets for military trustworthiness, the telecom vets for IT access, and nobody owns the seam between “this person is cleared for this military role” and “this person now has standing access to a private network.” Fix the seam and you fix the blind spot.
The Skeptic: Fixing the seam sounds clean until you ask who has authority to fix it. The Army doesn’t want to be in the business of auditing a telecom’s access logs, and the telecom doesn’t want the Army dictating its internal security policy. So the seam stays unowned because owning it is a liability nobody wants, and that’s exactly why this keeps happening across sectors, not just telecom.
The Optimist: Then maybe the fix isn’t one institution owning it, it’s a shared minimum standard, like financial services has with know-your-customer rules. Critical infrastructure, telecom included, could require continuous re-verification for anyone holding privileged access, funded jointly, audited by a third party. That’s not utopian, that’s just extending a model that already exists in banking to telecom and defense-adjacent roles.
The Skeptic: And who pays when that shared standard produces a false accusation against someone’s service member, or when the audit reveals a problem too late anyway? Standards sound great in a white paper. In practice, extortion attempts like this usually get caught after the fact, through financial trails or tips, not through some elegant access-control system working as designed. So what did this case actually change, concretely, versus what did it just confirm that we already knew?
The Optimist: Fair, it confirms more than it changes. But I’d argue it raises the cost of ignoring the seam problem, because now there’s a named, public case tying military access directly to a private-sector extortion attempt. That’s a different kind of pressure than a hypothetical. Boards and procurement officers respond to specific, embarrassing incidents a lot faster than they respond to theoretical risk models.
The Skeptic: Maybe. I’d just want to see an actual policy change, a specific re-vetting requirement or access review cadence, before calling this a turning point. Otherwise it’s a headline that fades once the court case resolves, and the next insider case starts this exact conversation over again.
What both sides agree on is that this case isn’t really about hacking, it’s about trust that was granted once and never meaningfully revisited. Where they split is whether that’s a fixable systems problem (better monitoring, shared standards, clearer ownership of the seams between institutions) or a structural one that keeps recurring because no one wants to own the cost of catching it early. Left unresolved is the harder question: whether any organization will actually pay the political and financial price of treating insider access as a continuously managed risk, rather than a one-time background check, before the next case forces the conversation again.
This post is a follow-up responding to a discussion question raised in From AI Agents to License Plates: Sanders Wants Flock Out of Federal Hands: “A Soldier’s Insider Access Became a Weapon: What the AT&T/Verizon Extortion Case Teaches Us”