I have never had an issue with reporting suspected issues to the facility security manager. I've never known one that would kill the messenger. You can still report it to the security manager if you want to keep the third party anonymous or -- if fact of your reporting would lead to the third party -- you can usually leave a note under their door or on the desk. If you're concerned about the note possibly being classified, mark and secure it properly in a security container -- possibly in a sealed envelope -- and then leave the security manager a note telling him/her where to find the report.