Physical Security Patrols

A subject deliberately enters or remains within a physical area as a trespasser, knowing they are not authorized to be present, where that presence alone creates a credible risk of harm to the organization.

This infringement applies where the subject bypasses, ignores, or circumvents defined physical access restrictions, and where mere presence within the environment exposes sensitive assets, information, or operational context. In these cases, harm does not depend on further action; the subject's unauthorized proximity is sufficient.

Qualifying environments include areas where sensitive material is inherently exposed through observation or presence, such as:

• Product development labs containing unreleased intellectual property
• Executive or legal meeting spaces handling confidential matters
• Security operations environments during active incidents
• Locations where credentials, systems, or regulated data are visible without additional access steps

The defining characteristic is that the subject is present as a trespasser, not through error, misassignment, or legitimate overlap of duties. The subject understands the boundary and crosses it regardless.

A subject manually reproduces organizational information onto a physical medium, such as handwritten notes, notebooks, or loose paper, in preparation for an infringement such as IF002.005 – Exfiltration via Physical Documents.

The information may originate from digital systems, physical documents, meetings, or verbal communications. This method allows the subject to create a portable copy of information without generating conventional digital copying, printing, or file-transfer artifacts.

The subject conducts work-related activity outside their established working hours or normal working days. This may include accessing organizational systems, applications, sensitive information, or physical facilities during periods when the subject would not ordinarily be expected to perform their duties.

Activity outside normal working periods may indicate preparation for an infringement, particularly when the subject accesses resources unrelated to their assigned responsibilities or operates during periods of reduced organizational oversight. Such behavior may provide opportunities to conduct reconnaissance, collect or stage information, or test access without attracting attention.

The subject's expected working schedule must be established before assessing this behavior. Working hours may vary according to role, location, shift arrangements, flexible working agreements, on-call responsibilities, and authorized overtime. Investigators should distinguish genuine human activity from automated processes, scheduled tasks, persistent sessions, and other system-generated events that do not demonstrate active participation by the subject.

Activity outside established working periods is not inherently suspicious. Its investigative significance increases when it represents a deviation from the subject's historical behavior and correlates with other indicators of preparation or infringement.

A subject explores or observes an organization's physical environment to identify locations, assets, access routes, security arrangements, or operational routines that could facilitate a subsequent infringement. This may involve reconnaissance of restricted areas, identification of unsecured assets, assessment of entry and exit routes, or observation of security personnel and patrol patterns.

Physical exploration enables the subject to develop an understanding of the organization's physical security posture, identify weaknesses or opportunities, and determine how unauthorized activities could be conducted while reducing the likelihood of detection or intervention. This preparation may support subsequent unauthorized access, theft, sabotage, data loss, or other physical infringements.

The activity may occur within areas the subject is legitimately authorized to access, making the purpose, context, and pattern of observation important considerations when distinguishing preparatory reconnaissance from routine workplace activity.

A subject deliberately bypasses, weakens, disables, or interferes with physical security controls to facilitate a subsequent infringement. This may involve manipulating locks or secured entry barriers, bypassing credential-based access restrictions, circumventing visitor or escort procedures, or interfering with physical security monitoring and alarm systems.

These activities may compromise physical safeguards designed to restrict unauthorized entry, protect organizational assets, or detect movement through secured environments. The subject may exploit existing access, manipulate physical infrastructure, misuse access credentials, or circumvent established security procedures.

Circumventing physical security controls may enable unauthorized access to restricted areas, theft of organizational assets, interference with critical infrastructure, or the unauthorized presence of third parties. The behavior differs from physical reconnaissance or security control testing because the subject actively circumvents or impairs an established protection in preparation for further activity.

A subject has physical access to the internal storage device of a target system, such as a hard disk drive (HDD) or solid-state drive (SSD). This capability may allow the subject to remove, replace, or connect the storage device to another system, enabling direct interaction with its contents independently of the original operating system.

Physical disk access may enable the subject to examine, copy, modify, or destroy stored information, potentially bypassing operating system-level access controls and monitoring. The extent of access depends on the device's configuration, physical security protections, and disk encryption, which may prevent unauthorized access to stored data.

A subject deliberately destroys or materially damages a physical item to prevent or hinder its examination, the recovery of information it contains, or its use in establishing relevant events. The behavior may target electronic devices, storage media, paper records, handwritten notes, or other physical material with evidentiary value. The subject may perform the destruction directly or arrange for another person or service to carry it out, including by misusing an otherwise legitimate disposal process.

The behavior may occur before an investigation begins or after the subject becomes aware of scrutiny. The item does not need to have been formally identified or collected as evidence, and complete destruction or successful prevention of recovery is not required. Classification requires evidence that the destruction was intended to conceal relevant activity or frustrate investigation. Accidental damage, routine authorized disposal, or an unexplained missing item does not independently establish this behavior.

A subject knowingly remains within a restricted physical area after their authorized access period has ended, or enters the area during a time when their role, assignment, escort approval, or access authorization does not permit their presence.

The subject may have legitimate daytime or task-based access to the location, but that authority does not extend to the time at which the presence occurs. Relevant behaviors include remaining after a shift or escorted visit, entering during a closed period, concealing continued presence after other personnel depart, or returning outside an approved access window.

The infringement is distinguished from accidental overstay by evidence that the subject understood the temporal restriction and deliberately remained or entered regardless.

A subject deliberately enters or remains within an area used to store physical records, legal files, personnel documents, investigative material, evidential items, archived media, regulated records, or chain-of-custody material without authorization.

Unauthorized presence may expose confidential information or provide an opportunity to inspect, remove, substitute, contaminate, damage, or interfere with stored material. The infringement applies where the subject knowingly enters the controlled area, even where subsequent access to a specific record or evidential item cannot be established.

A subject deliberately enters or remains within a restricted research facility, laboratory, prototype area, test environment, manufacturing floor, production line, formulation area, engineering workspace, or other location containing sensitive development or operational activity without authorization.

The area may expose unreleased intellectual property, prototypes, formulas, samples, research data, specialized equipment, manufacturing methods, safety-critical processes, or regulated materials. The subject’s presence may create risks to confidentiality, product integrity, safety, regulatory compliance, or operational continuity even where no additional action is observed.

A subject deliberately enters or remains within an executive office, boardroom, senior leadership meeting space, executive support area, or other restricted location used for confidential organizational decision-making without authorization.

The subject’s presence may expose strategic discussions, merger or acquisition information, financial results, legal advice, personnel decisions, security matters, executive schedules, authentication material, or confidential documents. The infringement applies even where the subject does not remove information or interrupt the meeting, because unauthorized observation or proximity may compromise sensitive organizational matters.

A subject deliberately enters or remains within a Security Operations Center, incident response room, insider threat investigation area, physical security control room, crisis-management room, or other restricted security operations environment without authorization.

Presence in these areas may expose active alerts, investigative information, subject identities, security architecture, surveillance feeds, response plans, detection capabilities, access credentials, or operational discussions. The subject does not need to interact with a security system or obtain a copy of information; unauthorized proximity to visible or audible security operations is sufficient for the infringement.

A subject deliberately enters or remains within a data center, server room, network operations area, telecommunications room, cable distribution area, or other restricted environment containing critical information technology or communications infrastructure without authorization to be present.

The subject’s proximity may provide direct access to servers, storage systems, network appliances, cabling, console interfaces, removable media, environmental controls, or out-of-band management equipment. The infringement applies where the subject knowingly crosses an established physical boundary, regardless of whether they subsequently interact with the equipment.

A subject observes, explores, or informally surveys access routes, entrances, barriers, internal layouts, staffing patterns, and operational routines associated with a restricted physical area.

The subject may seek to identify which doors are badge-controlled, when an area is unattended, how visitors are processed, whether personnel challenge unfamiliar individuals, or where movement is not covered by security personnel or closed-circuit television. The activity may appear innocuous in isolation, but repeated or unexplained observation can indicate preparation for unauthorized entry, theft, sabotage, data access, or another physical infringement.

A subject searches for or identifies physical assets that are unattended, insufficiently secured, or accessible outside normal control processes.

These assets may include laptops, removable media, physical identity tokens, keys, printed records, unlocked cabinets, exposed network ports, backup media, prototype equipment, or devices left in shared or low-occupancy areas. The subject may test whether an asset can be handled, removed, connected to, photographed, or accessed without attracting attention.

This behavior is operationally relevant where it indicates that the subject is identifying opportunities that could later support theft, credential misuse, unauthorized system access, data loss, or physical sabotage.

A subject identifies or assesses routes through which they or another person could enter, leave, or move through an organizational facility while reducing the likelihood of challenge or detection.

The subject may observe loading areas, emergency exits, service corridors, shared tenant spaces, stairwells, parking access points, delivery entrances, maintenance routes, or locations with limited physical security coverage. They may also assess whether doors are routinely propped open, whether exit routes permit re-entry, or whether movement between zones can occur without an additional credential check.

The behavior may indicate preparation to bypass normal entry controls, facilitate unauthorized third-party access, remove assets, or move between restricted areas without creating a complete access record.

A subject observes the timing, route, frequency, staffing, or behavior of physical security patrols to identify periods or locations where monitoring is reduced.

The subject may repeatedly remain near patrol routes, note when security personnel enter or leave an area, track shift changes, observe response times, or determine whether patrols follow predictable schedules. They may also identify areas that are checked only intermittently or periods when security personnel are occupied elsewhere.

This behavior can support later unauthorized presence, theft, sabotage, tampering, or access to sensitive areas by allowing the subject to act during a predictable gap in physical oversight.

A subject attempts to access a system, repository, application, physical area, account, record set, or other restricted resource to determine whether the applicable access control prevents entry or generates a response.

The subject may use their own identity to request or attempt access slightly outside their normal responsibilities, test an expired or unauthorized physical identity token, navigate directly to a restricted application resource, or attempt to view information associated with another team, customer, case, or business function.

The action may be deliberately limited so that it can be described as accidental if challenged. Repeated denied attempts, access testing across several resources, or a later successful entry may indicate that the subject is mapping authorization boundaries before conducting unauthorized access or another infringement.

A subject performs a limited physical action to determine whether access controls, security personnel, surveillance, visitor procedures, alarms, or other physical safeguards prevent or identify unauthorized presence.

The subject may test a restricted door, present a credential at an unauthorized area, follow another person through a controlled entrance, remain in an area after their approved access period, or enter a sensitive location without a clear operational reason. They may also observe whether security personnel challenge unfamiliar subjects or whether physical access violations generate follow-up activity.

The behavior is distinct from general physical exploration because the subject actively interacts with or crosses a security boundary to evaluate the result. The test may support later unauthorized entry, physical sabotage, theft, access to infrastructure, or facilitation of another person’s presence.

A subject deliberately interferes with a secured door, gate, or other physical entry barrier to prevent it from locking or closing as intended. This may include propping open access-controlled doors, obstructing latching mechanisms, or manipulating automatic closing systems to facilitate subsequent unauthorized access or movement.

A subject circumvents physical locking mechanisms or secured barriers without using an authorized access method. This may involve picking or manipulating mechanical locks, bypassing secured cabinets or enclosures, or otherwise defeating physical barriers to facilitate unauthorized access to restricted areas or organizational assets.

A subject bypasses physical access controls by following or accompanying an authorized individual through a secured entrance without independently presenting valid access authorization. This may occur without the authorized individual's awareness or with their deliberate cooperation, allowing the subject to circumvent individual access verification and associated entry records.

A subject uses physical access credentials that they are not authorized to possess or use to circumvent organizational access restrictions. This may include using another individual's access badge, an improperly retained access card, or a physical key obtained outside established authorization procedures to facilitate unauthorized entry or movement.

A subject deliberately circumvents established visitor registration, identity verification, escort, or physical access authorization procedures to facilitate unauthorized movement within an organizational facility. This may involve bypassing reception controls, separating from an assigned escort, or avoiding mandatory security checkpoints to access areas without the required authorization or oversight.

A subject deliberately interferes with physical security monitoring or alarm systems to reduce the likelihood of subsequent unauthorized activity being detected. This may include obstructing surveillance cameras, disabling door alarms, interfering with motion sensors, or otherwise impairing physical security detection mechanisms in preparation for an infringement.

A subject may destroy or otherwise impair removable storage media, such as external hard drives or USB sticks, to deny access to the files and artifacts stored on them.

A subject may destroy or otherwise impair physical disk storage, such as hard disk drives or solid-state drives, to deny access to the files and artifacts stored on them.

A subject deliberately destroys or materially damages paper records to prevent or hinder their examination or their use in establishing relevant events. The records may include original organizational documents, printed copies, handwritten notes, notebooks, correspondence, or paper-based transaction records. The subject may perform the destruction directly or arrange for another person or service to carry it out, including by introducing relevant records into an otherwise legitimate disposal process.

The behavior includes destruction of complete records or selected portions containing relevant information. It may occur before an investigation begins or after the subject becomes aware of scrutiny. Complete destruction or successful prevention of recovery is not required. Classification requires evidence that the destruction was intended to conceal relevant activity or frustrate investigation; routine authorized disposal, accidental damage, or an unexplained missing record does not independently establish the behavior.

A subject deliberately destroys or materially damages an electronic device to prevent or hinder its examination or the recovery of information relevant to the subject’s activity. The behavior may target organizational or personally owned laptops, desktop computers, smartphones, tablets, recording devices, or other electronic equipment used in the relevant activity. The subject may perform the destruction directly or arrange for another person or service to carry it out.

This Sub-section concerns destruction directed at the device as a complete item, rather than a separately targeted storage component. The damage may impair access to information without rendering every component unusable, and successful prevention of recovery is not required. Classification requires evidence connecting the damage to an intention to conceal relevant activity or frustrate investigation. Accidental damage, ordinary hardware failure, authorized disposal, or loss of device connectivity does not independently establish the behavior.