Unauthorized Presence in Security Operations Areas

A subject deliberately enters or remains within a Security Operations Center, incident response room, insider threat investigation area, physical security control room, crisis-management room, or other restricted security operations environment without authorization.

Presence in these areas may expose active alerts, investigative information, subject identities, security architecture, surveillance feeds, response plans, detection capabilities, access credentials, or operational discussions. The subject does not need to interact with a security system or obtain a copy of information; unauthorized proximity to visible or audible security operations is sufficient for the infringement.