Max Zhao
Junior Operations Manager (Austin Corporate Liaison) | PleistoVentures International - Siberian Research Station

Language / Origin: English (native) / USA

Tenure: 18 months

Security Profile Notes: Extremely High Extraversion, Low Conscientiousness. Primary motivation is social signaling and corporate advancement. Habitually ignores clean-desk policies; multiple warnings for unauthorized photography in Restricted Zone 2 (Mammoth Nursery). Was seen "helping" a vendor without checking their ID because they "looked like a tech guy." Viewed as "Austin Baggage" by legacy technical staff.

Kat Byrne's Notes / For SA&T Specialist Use Only 

Zhao is not malicious. I want to be precise about that because it would be easy to read this file and conclude otherwise, and the distinction matters for how you approach him. He is not trying to compromise this facility. He is trying to matter to it, which is a different problem and actually a harder one to address through conventional security channels.

His record here is documented and I will not reproduce all of it. The short version: multiple formal warnings for unauthorized photography in Restricted Zone 2, a vendor tailgating incident attributed to the assessment that the vendor "looked like a tech guy," persistent clean-desk violations, and the Airlock Alpha incident, in which he entered the containment corridor with a 4K camera and claimed verbal clearance to film content for the company Instagram. The automated sensors stopped it. He was surprised. I was the one who filed the denial. The file notes this and so do I, because I think you should know that my read on him is informed by having been on the other side of that conversation.

What the file does not fully capture is why. He is here because Austin needed someone in Siberia and he needed to not be in Austin. The details of the Austin situation are in his personnel record if you have access, and you should read them, because they tell you something important: the behavior that got him sent here was not a departure from his normal operating mode. It was his normal operating mode in a context where the consequences caught up with him. He has not changed the mode. He has changed the setting.

His Instagram documents his time here in what I can only describe as continuous enthusiastic detail. Location. Routine. Equipment. Access level implied by background details he has not thought to consider. He tags the facility. He uses the facility name. He does this because it is how people in his professional cohort demonstrate that they are doing something significant, and he needs to demonstrate that more than most people here because he knows the legacy staff do not respect him and he has not found another way to respond to that. I understand the impulse. I do not have a clean solution to it. Telling him to stop posting has not worked. Explaining why has produced temporary compliance and no lasting behavior change. This is an open problem I am handing to you.

He is also, and I note this because it is security-relevant, genuinely helpful when he believes he is being useful. That helpfulness is not vetted. He will assist anyone who presents a plausible need and a confident manner. He helped a vendor he did not recognize, did not badge-check, and did not log because the vendor seemed like they knew what they were doing. That instinct - the one that says competence signals legitimacy - is the instinct a social engineer counts on. In Zhao it runs particularly hot because being seen as helpful is part of how he is trying to establish himself here.

Approach him as a colleague with something to contribute, because he does have things to contribute and he will work harder for you than almost anyone else on this roster if he believes you see that. The security risk is not that he is hostile to the program. The risk is that he will enthusiastically assist the wrong person with the same energy he would bring to assisting you, and he will not know the difference until it is too late.

He submitted to the newsletter music feature immediately, before most other staff had responded, and included a paragraph about his workout philosophy that nobody asked for. The playlist is below. I will say this for him: the man commits.

Max Zhao's Wellness Center 7am Workout Playlist - Staff newsletter feature, self-submitted. First response received. Included unsolicited commentary.