1. STRATEGIC INTELLIGENCE MANAGEMENT Chapter by Gregory Saathoff, Troy Nold &Christopher Holstege Chapter 3 - We Have Met the Enemy and They Are Us: Insider Threat and Its Challenge to National Security, Pg. 24

2. Section 1: National Security Strategies and Issues 3. We Have Met the Enemy and They Are Us: Insider Threat and Its Challenge to National Security, Pg. 24 Insider threat is a conundrum: it is so damaging because it is frequently ignored. In some instances, ignorance may be rooted in wholesale denial of the existence of the threat itself. This chapter begins by defining the insider threat, the characteristics and motives of the insider, the types of attacks, and their consequences. It examines the scope of the problem in the context of both technology and insider threat behaviors, with an emphasis on the latter, which is all too often overshadowed by a focus on the former. Because of its impact in shaping our understanding of insider threat, the Amerithrax case is examined in detail for the homicidal, suicidal, and substance- dependence factors that influenced the perpetrator of the attacks.

3. Section 1: National Security Strategies and Issues 3. We Have Met the Enemy and They Are Us: Insider Threat and Its Challenge to National Security, Pg. 24 Disproportionate attention focuses on mitigating external threats. Most organizations worry about people breaching existing external boundaries and firewalls. Therefore security tools are more attuned to threats from the outside and averse to threats from within the organization. The insider threat is unique because being an insider implies a relationship of trust and privilege, an assumption that can be misleading. According to Cole and Ring (2005), insider threat has received limited attention for three reasons: 1. Organizations do not know it is happening. 2. It is easy to be in denial. 3. Organizations fear bad publicity.

4. Section 1: National Security Strategies and Issues 3. We Have Met the Enemy and They Are Us: Insider Threat and Its Challenge to National Security, Pg. 24 Not having enough factual data and the prevalence of risk factors in the general population makes it nearly impossible to detect insider threat using technical screening methods. In contrast, prior concerning behaviors, substance abuse, and employment history are considered to be more reliable indicators of insider risk. The case of Dr. Bruce Ivins, who has been determined by the U.S. Department of Justice as being solely responsible for the mailing of the anthrax letters in 2001, is instructive. In addition to the five people who died as a result of the mailed anthrax, many more were subject to inhalational and cutaneous anthrax infections. The cost to society in terms of expense and social disruption remains incalculable.