1

UNMASKING THE RADIC AL INSIDER

Matthew Doherty, Senior Vice President, JoAnn Ugolini, Director,

Threat + Violence Risk Management, Hillard Heintze

2

A G E N D A

2

• Connecting the Dots

• Why We Are Here

• Understanding the Radical Insider

• Mitigating the Insider Threat

• A Portfolio of Indicators

• Violent Extremism vs Right of Free Speech

• Apply What You Have Learned Today

3

C O N N E C T I N G T H E D O T S

Punctuated by pivotal research, the field of threat assessment

emerged from a paradigm shift in our understanding and

assessment of persons on the path to violence.

https://www.ncjrs.gov/pdffiles1/Photocopy/167224NCJRS.pdf

3

The Exceptional Case Study Project focused on the thinking and

behavior of attackers

4

C O N N E C T I N G T H E D OT S

Research into insider cyber sabotage showed that the behaviors associated with workplace violence are often identical to those in insider cyber sabotage cases.

https://www.dhs.gov/xlibrary/assets/niac/niac_insider_threat_to_critical_infrastructures_study.pdf

The Insider Threat Study focused on the people behind the sabotage

4

5

W H Y W E A R E H E R E

5

6

W H Y W E A R E H E R E

Violent extremism and radicalization lead to a new threat of workplace violence –

the radical insider

Radicalization is a subset of

workplace violence and insider threat

6

7

W H Y W E A R E H E R E

• A marked rise in executive concerns

• Growing awareness of the risk of radicalization and recruitment of employees

7

8

U N D E R S TA N D I N G T H E R A D I C A L I N S I D E R

8

9

U N D E R S TA N D I N G T H E R A D I C A L I N S I D E R

According to the FBI, the spectrum of terrorist activities include:

9

Direct Action Operational Support Organizational Support Logistical Support

Direct participation in terrorist attacks against human targets

Planning and on-site support for attacks

Spotting, recruitment, fundraising, information dissemination and media strategy

Enabling activities such as providing money, food and lodging

10

U N D E R S TA N D I N G T H E R A D I C A L I N S I D E R

The Violent Extremist

Person who advocates, is engaged in or is preparing to engage in ideologically motivated terrorist activities to further political or social objectives promoted by a foreign terrorist organization (FTO).

10

11

U N D E R S TA N D I N G T H E R A D I C A L I N S I D E R

The Homegrown Violent Extremist (HVE)

A “radicalized” U.S. citizen who intends to commit terrorism inside the U.S. without direct support or direction from a foreign terrorist organization.

11

12

U N D E R S TA N D I N G T H E R A D I C A L I N S I D E R

Zachary Adam Chesser

HomegrownExtremist

12

13

M I T I G AT I N G T H E I N S I D E R T H R E AT

13

14

M I T I G AT I N G T H E I N S I D E R T H R E AT

Addressing the risk of the radical insider calls for a collective effort

14

Security HR Legal ManagersAll

employees

15

M I T I G AT I N G T H E I N S I D E R T H R E AT

A Multidisciplinary Approach

15

WPV Concerning Behaviors Stakeholders Actions

• Hostile Work Environment• Criminal Behavior• Cyber• Sexual Harassment• Substance Abuse• Inappropriate Behavior

• Security• HR• Legal• IT• Law Enforcement• Employees

• Document• Employee Assistance

Program• Confront• Report to Law Enforcement• Counsel• Personnel Action• Compliance Hotline

16

M I T I G AT I N G T H E I N S I D E R T H R E AT

Understanding a potential attacker’s behavior is vital to identifying their intentions.

16

17

M I T I G AT I N G T H E I N S I D E R T H R E AT

Companies must establish guidelines and train employees on recognizing and reporting threat indicators based on behavior-based techniques.

17

18

M I T I G AT I N G T H E I N S I D E R T H R E AT

Social media monitoring can be a powerful tool in supporting and enhancing a culture of awareness

18

19

M I T I G AT I N G T H E I N S I D E R T H R E AT

• Develop a process for reporting any posts of concern.

• Train your in-house team on how to respond.

• Work with your legal team to understand any restrictions on the monitoring.

19

20

M I T I G AT I N G T H E I N S I D E R T H R E AT

Once someone is identified as a subject of concern, attempt to identify their publicly posted personal social media profiles and look for an interest in extremist groups or connections to individuals who have been radicalized.

20

21

M I T I G AT I N G T H E I N S I D E R T H R E AT

• Engaging Technology

• DigitalStakeout

• Sysomos

• BrandProtect

• BabelStreet

• Recorded Future

• LifeRaft

• The key is to monitor, review and know how to interpret the data.

• None of these tools are a one-stop shop.

21

22

A P O R T F O L I O O F I N D I C ATO R S

Mobilization Indicators for Public Safety Personnel, FBI, 2016

22

23

A P O R T F O L I O O F I N D I C ATO R S

23

Group A Group B Group C

Diagnostic on their own

Moderately diagnostic, especially with other indicators

Minimally diagnostic and require the presence of other indicators

24

A P O R T F O L I O O F I N D I C ATO R S

Group A

Diagnostic on their own

• Seeking help from family and friends to enable travel to join terrorist groups overseas

• Planning or attempting to travel to a conflict zone to fight with or support an FTO

• Seeking religious or political justification for violent acts

24

25

Group B

Moderately diagnostic,

especially with other indicators

• Obtaining explosive precursors

• Forming an exclusive cell of like-minded violent extremist actors

• Conducting suspicious financial transactions

• Employing counter-surveillance techniques

25

A P O R T F O L I O O F I N D I C ATO R S

26

Group B

Moderately diagnostic,

especially with other indicators

A P O R T F O L I O O F I N D I C ATO R S

• Having suspicious travel patterns

• Deleting social media, online accounts to avoid tracking by law enforcement

• Observed changes in behavior or linguistic expression that reflect new clarity of purpose relating to violent extremist causes

26

27

Group B

Moderately diagnostic,

especially with other indicators

A P O R T F O L I O O F I N D I C ATO R S

• Having an acknowledged or implied membership in, or association with violent extremist groups

• Expressing acceptance of violence as a necessary means to achieve ideological goals

• Attempting to radicalize/mobilize others, especially family members and close friends

27

28

Group C

Minimally diagnostic and

require the presence of other

indicators

A P O R T F O L I O O F I N D I C ATO R S

• Purchasing military-style equipment

• Suspicious or unexplained weapons acquisition

• Criminal history, including incarceration

• Past history of violence

28

29

Group C

Minimally diagnostic and

require the presence of other

indicators

A P O R T F O L I O O F I N D I C ATO R S

• Blaming external factors for failure in school, career or relationships

• Unemployed/underemployed around time of radicalization, expressing frustration with employment situation

• Displaying an unstable mental state and violent behavior

29

30

Group C

Minimally diagnostic and

require the presence of other

indicators

A P O R T F O L I O O F I N D I C ATO R S

• Switching from one violent extremist ideology to another

• Becoming isolated; breaking contact with family and friends; dropping out of school

• Eschewing entire religious community in favor of one or two violent extremist voices

30

31

Group C

Minimally diagnostic and

require the presence of other

indicators

A P O R T F O L I O O F I N D I C ATO R S

• Promoting a narrative of an existential threat against Islam

• Dehumanizing non-believers

• Exhibiting communication security techniques and tradecraft

• Discussing operational security or way to evade law enforcement

31

32

Group C

Minimally diagnostic and

require the presence of other

indicators

A P O R T F O L I O O F I N D I C ATO R S

• Having an active role or increasing participation in a cluster, or in secret cluster meetings; having views reinforced by other cluster members

• Praising past successful or attempted attacks

• Lying to law enforcement/obstructing investigations

• Consuming and/or sharing violent extremist videos and/or propaganda

32

33

V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H

33

34

V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H

People have a constitutionally protected right to speak their minds on political and social issues

34

• Gun rights

• Right-to-life

• Racism

• Animal rights

• Religious extremism

• Ultra-right-wing activism

• Ultra-left-wing activism

• Environmental activism

35

V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H

Scenario:

Imagine you are walking through a public park and hear three statements at a white supremacist rally held out in the open.

35

Free Speech or Not?

36

“Our race is superior to other races.”

36

V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H

Free Speech or Not?

37

Free Speech

This statement is hateful and offensive, but it is free speech protected by law.

37

V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H

“Our race is superior to

other races.”

38

“We need to take a stand for our race and destroy those who stand in our way.”

38

V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H

Free Speech or Not?

39

Free Speech

The law allows for exaggeration and strong speech. The word “destroy” could suggest violence will be used, but it also could refer to political or social action. Without knowing more about the group’s plans, the speech is protected.

39

V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H

“We need to take a stand for our

race and destroy those who stand

in our way.”

40

"Those opposing our race, like those people over there, are the enemy and must be attacked now!”

40

V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H

Free Speech or Not?

41

Maybe not

The situation is important to understand. Do members of the group appear ready and willing to take violent action right away? If so, the speech may be illegally inciting or encouraging violence or the threat of violence.

41

V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H

"Those opposing our race, like those people over there,

are the enemy and must be

attacked now!”

42

S U M M A R Y

• There is an increasing risk that organizations face when employees radicalize and become a potential terrorist threat.

• Understanding the radical insider is the first step in mitigating this potential threat.

• Recognizing warning behaviors and having the proper tools and procedures to properly address these potential risks is critical.

• It is essential that efforts focus on warning behaviors,not personal characteristics.

• Is the behavior consistent with their statements.

42

43

A P P LY W H AT YO U H AV E L E A R N E D TO D AY

43

44

A P P LY W H AT YO U H AV E L E A R N E D TO D AY

Next step, implement security risk management best practices

• Plan to develop a workplace violence prevention program.

• Conduct a needs assessment.

• Develop clear policies and protocols.

• Create an interdisciplinary threat management team.

• Establish an incident management process.

• Conduct training.

• Address high risk area strategies.

44

45

Q U E S T I O N S A N D D I S C U S S I O N

Matthew DohertySenior Vice PresidentThreat + Violence Risk Managementmatthew.doherty@hillardheintze.com

JoAnn UgoliniDirector, Threat + Violence Risk Managementjoann.ugolini@hillardheintze.com

45