Communication is key in thwarting insider threats, expert says

The saying "communication is key" may be a cliche, but simply reaching out to a co-worker may help save someone from making a life-altering bad decision, a security expert said.

"Outreach is not about getting in the middle, or causing trouble, or being the bad guy," said Richard Habina, chief of strategic engagement and outreach for the U.S. Navy Insider Threat Hub. "I don't want to turn somebody in; I want to help people and turn them around."

Habina spoke at the McNamara Headquarters Complex Sept. 5 as part of the Defense Logistics Agency's National Insider Threat Awareness Month observances. The theme for this year's NITAM is Partnering for Progress: Protecting the Warfighter.

Habina, who has a long career in government service that includes roles with the Secret Service and the Federal Bureau of Investigation, said the Navy's program aims to help a person before an incident happens.

An insider threat is a person who has or previously had authorized access to information, a facility, a network, people or resources and either wittingly or unwittingly uses that access to do harm against an organization, he said. The person also may perform a destructive act, such as physically harming someone in the workplace.

There are 136 potential risk indicators for an insider threat. Those who have been identified as a threat have displayed one or more risk indicators, according to the Center for Development of Security Excellence.

The Navy chose to have representatives as part of their insider threat program. These representatives became the face of the program, giving employees someone to speak to if they thought a co-worker was acting differently or causing concern.

It's important to have a holistic view of an individual who is acting strangely or showing warning signs, Habina said.

"We cannot just trust one incident," he continued. "There's a history behind that incident. We have to be able to connect those dots. We have to be able to figure out what's going to happen, or the potential of what could happen before it happens."

Determining whether an incident is an insider threat or human-relations issue is a balancing act, Habina said. Knowing the people who work in neighboring desks or cubicles is a good start to seeing the whole picture.

"In my little cube farm, I know almost everything about everybody there. So they're going to be the individuals who pick up on the signs that something has changed in my life, whether or not I've told them," he said. "They're going to pick up on those signs, and it's their job to say, 'Hey, I see that you're not your normal self. Are you OK? What's going on? Do you want to talk?'"

About 94% of all American workers experience stress in the workplace, he said, and 63% have considered quitting because of the stress they're under. If there is also stress at home, it could put someone on a dangerous path.

Habina said simply asking a co-worker some basic questions could change someone's course, even if that means authorities are called in.

"Ultimately, it's about getting that individual help because the last thing we want is for them to take the next step, which is causing harm," Habina said. "We want to make sure we get involved and turn these people around."

After several years of lockdown due to COVID-19, there was a loss of connection and communication with co-workers that needed to be reestablished, he said.

"If you don't have good communication in the office, you do not have good workers in your office," he said.

The time to bring up concerns is when one thinks there may be an issue. For example, one way to support a co-worker going through a divorce is to ask if they want to talk or meet with a social worker or lawyer.

If someone is wondering if they should report a co-worker, Habina said it's better to be safe than sorry.

"If something is reported and it wasn't an issue, nothing happens. But if you see something and you say something, and it does turn into something, now you might have just saved that individual's life, or career, or the people around them," he said.

To report suspicious or concerning activity at DLA, email [email protected]. For more information, employees can visit the agency's ITP SharePoint site and learn about DLA's Insider Threat Program (A DLA common access card is required). Reports are confidential.