Investigating Security Control Violations with a Practical Lens

When investigating a wilful security control violation, it’s difficult not to assume that malice is the suspect’s dominant (if not their only) motivator. After all, if your people know what behaviour your organisation requires, are trained how to properly comply, and are equipped with all the tools needed, then an act of deliberately disobeying said requirement(s) must logically occur because of an intent to cause harm, right? That’s certainly a tempting conclusion; it puts the offender squarely in the “bad guy” camp. The violator obviously exposed the organisation to preventable risk because they wanted to. No need to dig into the details. Punish the heretic and move on. 

Tempting as that is, such an overly simplistic approach is profoundly flawed. By assuming a binary moral outlook (i.e., choosing to comply = good, ergo choosing to not comply can only be evil) the investigator absolves their organisation’s leaders, cultures, processes, and themselves from all responsibility. “We don’t need to change; everything is fine. This completely isolated bad egg did everything they did because of EEEEEEEEEEEVIL.TM” How comforting …

Such an assessment is fine for characters in a comic book. [1] Here in meatspace, real people are complicated, nothing is ever clear cut, and many wilful control violations are reasonable, best-case options based on the totality of disagreeable circumstances. Take, for example, the story of Omar. [2]

My mate Omar works in the imports and exports section of a big manufacturer. He’s the only person working his function at their Dallas plant. In addition to generating all the special paperwork required to send goods outside the USA, Omar is expected to be the subject matter expert on all things related to his field at his site. Unfortunately, Omar was never formally trained; his company doesn’t have any sort of “qualification” programme for ensuring that someone in a high-risk role like Omar is fully proficient. Instead, they hire untrained and expect the existing staff – who aren’t import export experts – to “train” the new hire. It’s madness. 

Still Omar does his best. He strives to be a team player. He’s made contacts with the imports and exports community all throughout his company. He’s drafted written process guides for difficult tasks so his peers can learn from his mistakes. He’s swift to ask questions. That’s how Omar recently discovered – much too late! – that he’d been breaking international law for months.