Insider Threat Assessment

The University of Nebraska, operating under a contract with Mantech International and funding from the Department of Defense Counter Intelligence Field Activity Office, was asked to develop behavioral science guidelines related to the detection of insider threats. This project examined insider threat literature, along with broader based threat assessment literature and combined that base with expert knowledge and experience in order to create a model of insider threat.

Three core principles from the threat assessment approach have been applied to targeted violence to provide a framework for conceptualizing insider threats in this model:

  • Targeted violence is viewed as a process that takes place over time, during which the subject must prepare and plan.
  • Targeted violence results from the interaction of the subject, a stressful event or triggering condition, and a setting that does not prevent the violence from occurring.
  • Successful assessment of targeted violence involves the identification of the subjectís continuum of attack-related behaviors (behaviors of concern).

The evolution of the model through a series of facilitated expert panel sessions to inform the development of the model brought out three main areas of emphasis. Behavioral Assessment of insider threats is multi-dimensional. Threat assessors must consider factors associated with the:

  • Subject
  • Organization (target)
  • Context within which both the subject and organization exist (e.g., broader political or social conditions)

Because of the wide range of threats possible, it is helpful to have a guide for assessing he various factors involved. The framework for assessment of insider threat for this model was deemed to require attention in these areas:

  • Applicable for both anonymous and known subjects
  • Recognizes the interaction of factors
  • Recognizes patterns of behavior
  • Allows for investigation with whatever information is immediately available
  • Recognizes that behaviors or warning activity may shift, decrease, or be emboldened by protective or organizational actions

As warning signs of an insider threat surface, the investigator can use these broad factors to organize incoming investigative information. The analytic process should address many principles including behavior patterns revealing a path to action, the difference between expressed threats and posed threats, mental illness factors and the integration of threat assessment and management.