An example of this shift presents itself in the case of a former standout Air Force translator and NSA contractor Reality Winner , who was recently prosecuted for leaking classified information and sentenced to more than 5 years in prison. She printed out a report detailing hacking attacks by a Russian intelligence service against local election officials and voter registration databases. Winner then smuggled the top secret report out of the contractor office in her clothing and mailed it anonymously to a news outlet. Winner’s sentence of 63 months is the longest sentence ever imposed for a federal crime involving leaks to the media. This all after Winner’s prior service in the Air Force earned her a medal of commendation for aiding in more than 800 intelligence missions that ‘removed’ a significant number of enemies.
Although the Espionage Act traces back to World War I making it a crime to disclose secrets that could be used to harm the US or aid a foreign adversary, there has been a sharp increase in prosecutions under the law for leaking sensitive information to news media. Additionally, there have been much harsher sentences for those prosecuted under the law. While we search for motives in these cases and try to decide whether patriot or traitor is applicable, their actions are still a breach of trust and contract with the government. Regardless of the intentions of any would be whistle blower the result of these leaks can cause exceptionally grave harm to our national security.
What is ‘Insider Threat’
A company can often detect or control when an outsider (non-employee) tries to access company data either physically or electronically, and can mitigate the threat of an outsider stealing company property. However, the thief who is harder to detect and who could cause the most damage is the insider – the employee with legitimate access. Insiders may steal solely for personal gain or the insider could be acting as a ‘spy’ – someone who is stealing company information or products in order to benefit another organization or country, usually for monetary gain. Here are circumstances and personal indicators of a possible insider threat:
Greed or Financial Need: A belief that money can fix anything. Excessive debt or overwhelming expenses.
Anger/Revenge: Disgruntlement to the point of wanting to retaliate against the organization.
Problems at Work: A lack of recognition, disagreements with coworkers or managers, dissatisfaction with the job, pending layoff.
Ideology/Identification: A desire to help the ‘underdog’ or a particular cause.
Divided Loyalty: Allegiance to another person or company, or to a country besides the United States.
Vulnerability to Blackmail: Extra-marital affairs, gambling, fraud.
Ego/Self-Image: An ‘above the rules’ attitude, or desire to repair wounds to their self-esteem. Vulnerability to flattery or the promise of a better job. Often coupled with Anger/Revenge or Adventure/Thrill.
Ingratiation: A desire to please or win the approval of someone who could benefit from insider information with the expectation of returned favors.
Compulsive and Destructive Behavior: Drug and alcohol abuse, or other addictive behaviors.
Family Problems: Marital conflicts or separation from loved ones.
Some warning signs one should look for when determining if someone poses an insider threat include but are not limited to:
- Working odd hours-before or after everyone else leaves
- Unexplained affluence
- Trying to gain access to classified information without a valid need to know
- Questionable downloads or copying
- Bringing an unauthorized device into a secured or work area
- Loyalty to another country, concealing foreign travel
- Disgruntled employee, threats directed at fellow employees or employer
These behaviors by themselves may not indicate a potential issue, but together may indicate a problem. Be alert and be aware, report suspicious activity to your appropriate compliance or ethics manager for review by your insider threat committee! When in doubt, REPORT!