45
UNMASKING THE RADICAL INSIDER Matthew Doherty, Senior Vice President, JoAnn Ugolini, Director, Threat + Violence Risk Management, Hillard Heintze
1
UNMASKING THE RADIC AL INSIDER
Matthew Doherty, Senior Vice President, JoAnn Ugolini, Director,
Threat + Violence Risk Management, Hillard Heintze
2
A G E N D A
2
• Connecting the Dots
• Why We Are Here
• Understanding the Radical Insider
• Mitigating the Insider Threat
• A Portfolio of Indicators
• Violent Extremism vs Right of Free Speech
• Apply What You Have Learned Today
3
C O N N E C T I N G T H E D O T S
Punctuated by pivotal research, the field of threat assessment
emerged from a paradigm shift in our understanding and
assessment of persons on the path to violence.
https://www.ncjrs.gov/pdffiles1/Photocopy/167224NCJRS.pdf
3
The Exceptional Case Study Project focused on the thinking and
behavior of attackers
4
C O N N E C T I N G T H E D OT S
Research into insider cyber sabotage showed that the behaviors associated with workplace violence are often identical to those in insider cyber sabotage cases.
https://www.dhs.gov/xlibrary/assets/niac/niac_insider_threat_to_critical_infrastructures_study.pdf
The Insider Threat Study focused on the people behind the sabotage
4
5
W H Y W E A R E H E R E
5
6
W H Y W E A R E H E R E
Violent extremism and radicalization lead to a new threat of workplace violence –
the radical insider
Radicalization is a subset of
workplace violence and insider threat
6
7
W H Y W E A R E H E R E
• A marked rise in executive concerns
• Growing awareness of the risk of radicalization and recruitment of employees
7
8
U N D E R S TA N D I N G T H E R A D I C A L I N S I D E R
8
9
U N D E R S TA N D I N G T H E R A D I C A L I N S I D E R
According to the FBI, the spectrum of terrorist activities include:
9
Direct Action Operational Support Organizational Support Logistical Support
Direct participation in terrorist attacks against human targets
Planning and on-site support for attacks
Spotting, recruitment, fundraising, information dissemination and media strategy
Enabling activities such as providing money, food and lodging
10
U N D E R S TA N D I N G T H E R A D I C A L I N S I D E R
The Violent Extremist
Person who advocates, is engaged in or is preparing to engage in ideologically motivated terrorist activities to further political or social objectives promoted by a foreign terrorist organization (FTO).
10
11
U N D E R S TA N D I N G T H E R A D I C A L I N S I D E R
The Homegrown Violent Extremist (HVE)
A “radicalized” U.S. citizen who intends to commit terrorism inside the U.S. without direct support or direction from a foreign terrorist organization.
11
12
U N D E R S TA N D I N G T H E R A D I C A L I N S I D E R
Zachary Adam Chesser
HomegrownExtremist
12
13
M I T I G AT I N G T H E I N S I D E R T H R E AT
13
14
M I T I G AT I N G T H E I N S I D E R T H R E AT
Addressing the risk of the radical insider calls for a collective effort
14
Security HR Legal ManagersAll
employees
15
M I T I G AT I N G T H E I N S I D E R T H R E AT
A Multidisciplinary Approach
15
WPV Concerning Behaviors Stakeholders Actions
• Hostile Work Environment• Criminal Behavior• Cyber• Sexual Harassment• Substance Abuse• Inappropriate Behavior
• Security• HR• Legal• IT• Law Enforcement• Employees
• Document• Employee Assistance
Program• Confront• Report to Law Enforcement• Counsel• Personnel Action• Compliance Hotline
16
M I T I G AT I N G T H E I N S I D E R T H R E AT
Understanding a potential attacker’s behavior is vital to identifying their intentions.
16
17
M I T I G AT I N G T H E I N S I D E R T H R E AT
Companies must establish guidelines and train employees on recognizing and reporting threat indicators based on behavior-based techniques.
17
18
M I T I G AT I N G T H E I N S I D E R T H R E AT
Social media monitoring can be a powerful tool in supporting and enhancing a culture of awareness
18
19
M I T I G AT I N G T H E I N S I D E R T H R E AT
• Develop a process for reporting any posts of concern.
• Train your in-house team on how to respond.
• Work with your legal team to understand any restrictions on the monitoring.
19
20
M I T I G AT I N G T H E I N S I D E R T H R E AT
Once someone is identified as a subject of concern, attempt to identify their publicly posted personal social media profiles and look for an interest in extremist groups or connections to individuals who have been radicalized.
20
21
M I T I G AT I N G T H E I N S I D E R T H R E AT
• Engaging Technology
• DigitalStakeout
• Sysomos
• BrandProtect
• BabelStreet
• Recorded Future
• LifeRaft
• The key is to monitor, review and know how to interpret the data.
• None of these tools are a one-stop shop.
21
22
A P O R T F O L I O O F I N D I C ATO R S
Mobilization Indicators for Public Safety Personnel, FBI, 2016
22
23
A P O R T F O L I O O F I N D I C ATO R S
23
Group A Group B Group C
Diagnostic on their own
Moderately diagnostic, especially with other indicators
Minimally diagnostic and require the presence of other indicators
24
A P O R T F O L I O O F I N D I C ATO R S
Group A
Diagnostic on their own
• Seeking help from family and friends to enable travel to join terrorist groups overseas
• Planning or attempting to travel to a conflict zone to fight with or support an FTO
• Seeking religious or political justification for violent acts
24
25
Group B
Moderately diagnostic,
especially with other indicators
• Obtaining explosive precursors
• Forming an exclusive cell of like-minded violent extremist actors
• Conducting suspicious financial transactions
• Employing counter-surveillance techniques
25
A P O R T F O L I O O F I N D I C ATO R S
26
Group B
Moderately diagnostic,
especially with other indicators
A P O R T F O L I O O F I N D I C ATO R S
• Having suspicious travel patterns
• Deleting social media, online accounts to avoid tracking by law enforcement
• Observed changes in behavior or linguistic expression that reflect new clarity of purpose relating to violent extremist causes
26
27
Group B
Moderately diagnostic,
especially with other indicators
A P O R T F O L I O O F I N D I C ATO R S
• Having an acknowledged or implied membership in, or association with violent extremist groups
• Expressing acceptance of violence as a necessary means to achieve ideological goals
• Attempting to radicalize/mobilize others, especially family members and close friends
27
28
Group C
Minimally diagnostic and
require the presence of other
indicators
A P O R T F O L I O O F I N D I C ATO R S
• Purchasing military-style equipment
• Suspicious or unexplained weapons acquisition
• Criminal history, including incarceration
• Past history of violence
28
29
Group C
Minimally diagnostic and
require the presence of other
indicators
A P O R T F O L I O O F I N D I C ATO R S
• Blaming external factors for failure in school, career or relationships
• Unemployed/underemployed around time of radicalization, expressing frustration with employment situation
• Displaying an unstable mental state and violent behavior
29
30
Group C
Minimally diagnostic and
require the presence of other
indicators
A P O R T F O L I O O F I N D I C ATO R S
• Switching from one violent extremist ideology to another
• Becoming isolated; breaking contact with family and friends; dropping out of school
• Eschewing entire religious community in favor of one or two violent extremist voices
30
31
Group C
Minimally diagnostic and
require the presence of other
indicators
A P O R T F O L I O O F I N D I C ATO R S
• Promoting a narrative of an existential threat against Islam
• Dehumanizing non-believers
• Exhibiting communication security techniques and tradecraft
• Discussing operational security or way to evade law enforcement
31
32
Group C
Minimally diagnostic and
require the presence of other
indicators
A P O R T F O L I O O F I N D I C ATO R S
• Having an active role or increasing participation in a cluster, or in secret cluster meetings; having views reinforced by other cluster members
• Praising past successful or attempted attacks
• Lying to law enforcement/obstructing investigations
• Consuming and/or sharing violent extremist videos and/or propaganda
32
33
V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H
33
34
V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H
People have a constitutionally protected right to speak their minds on political and social issues
34
• Gun rights
• Right-to-life
• Racism
• Animal rights
• Religious extremism
• Ultra-right-wing activism
• Ultra-left-wing activism
• Environmental activism
35
V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H
Scenario:
Imagine you are walking through a public park and hear three statements at a white supremacist rally held out in the open.
35
Free Speech or Not?
36
“Our race is superior to other races.”
36
V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H
Free Speech or Not?
37
Free Speech
This statement is hateful and offensive, but it is free speech protected by law.
37
V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H
“Our race is superior to
other races.”
38
“We need to take a stand for our race and destroy those who stand in our way.”
38
V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H
Free Speech or Not?
39
Free Speech
The law allows for exaggeration and strong speech. The word “destroy” could suggest violence will be used, but it also could refer to political or social action. Without knowing more about the group’s plans, the speech is protected.
39
V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H
“We need to take a stand for our
race and destroy those who stand
in our way.”
40
"Those opposing our race, like those people over there, are the enemy and must be attacked now!”
40
V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H
Free Speech or Not?
41
Maybe not
The situation is important to understand. Do members of the group appear ready and willing to take violent action right away? If so, the speech may be illegally inciting or encouraging violence or the threat of violence.
41
V I O L E N T E X T R E M I S M V S R I G H T O F F R E E S P E E C H
"Those opposing our race, like those people over there,
are the enemy and must be
attacked now!”
42
S U M M A R Y
• There is an increasing risk that organizations face when employees radicalize and become a potential terrorist threat.
• Understanding the radical insider is the first step in mitigating this potential threat.
• Recognizing warning behaviors and having the proper tools and procedures to properly address these potential risks is critical.
• It is essential that efforts focus on warning behaviors,not personal characteristics.
• Is the behavior consistent with their statements.
42
43
A P P LY W H AT YO U H AV E L E A R N E D TO D AY
43
44
A P P LY W H AT YO U H AV E L E A R N E D TO D AY
Next step, implement security risk management best practices
• Plan to develop a workplace violence prevention program.
• Conduct a needs assessment.
• Develop clear policies and protocols.
• Create an interdisciplinary threat management team.
• Establish an incident management process.
• Conduct training.
• Address high risk area strategies.
44
45
Q U E S T I O N S A N D D I S C U S S I O N
Matthew DohertySenior Vice PresidentThreat + Violence Risk [email protected]
JoAnn UgoliniDirector, Threat + Violence Risk [email protected]
45
