Q
Q
Q
Q
Insider threats pose unique and complicated challenges to a nuclear facility owing to the privileged knowledge and authority that individuals (or groups of individuals) may hold. Disgruntled employees can pose active risks in of themselves, or be recruited by or otherwise enable external actors who have malicious intent in a passive role. Moreover, personal grievances may give particular motivation for insiders to carry out malicious acts – providing a degree of persistence uncommon to other types of actor.
According to a 2013 report by the UK’s Centre for the Protection of National Infrastructure (CPNI), which studied 120 cases of non-nuclear insider activity between 2007 and 2012, the single most common primary motivation was financial gain (47%). Ideology (20%), a desire for recognition (14%) and loyalty (14%) were also significant factors. An individual’s motivation may affect the form of activity and there is a pattern in the relationship between primary motivation and type of insider incident. Ideology and desire for recognition were closely linked to unauthorised disclosure of sensitive information and financial gain was most closely linked to process corruption or giving access to assets.
The importance of non-financial motivation is also seen in earlier studies on threat to nuclear studies. According to a 1981 study of potential threats to licenced nuclear facilities by the US Nuclear Regulatory Commission, using data from analogous facilities ‘85% of the analogous sabotage cases were committed by a single insider. Although no one motivation dominated the insider saboteur, the combined motivations of psychological problems, disgruntlement and revenge accounted for 54% of the identified motivations.’
Similar results were found by the RAND Corporation in 1990, which noted that ‘one-third of the lone insiders [studied by RAND] were motivated by emotional disturbance, frustration with their employment, and idiosyncratic reasons’. Research by the Computer Emergency Response Team (CERT) centre at Carnegie Mellon University in 2010 suggests that the primary motivation for IT sabotage was revenge.
In most cases, however, it is not the responsibility of staff member or contractors to conduct their own investigation. Rather, it recommended that such incidents are reported to the organisation’s security or human resources team who can record the incident and investigate wider behaviours. Nuclear organisations should consider establishing human resources or security teams where matters can be reported in confidence, and where employees may seek direction for financial or medical assistance.
Further Reading:
