What the FBI learned from its worst spy disaster
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Aïda Amer/Axios
Until his run ended in 2001, Robert Hanssen spent 20 years as a Russian mole burrowed deep in the FBI. That made him one of history's most successful inside threats — a class of threat that plagues both government agencies and private companies.
The big picture: The FBI agent who went undercover to bring Hanssen down, Eric O'Neill, recounts the operation in "Gray Day," which hits bookstores next week. He spoke to Axios about what Hanssen's tale can teach the rest of us about trusted insiders.
Why it matters: It's not just hackers who steal files or funds; sometimes it's inside threats — employees exploiting legitimate access to a network to rob their employers. "They are people who already have the keys to the kingdom," said O'Neill.
- A 2016 survey found that 27% of cyberattacks were either known or believed to be spearheaded by insiders.
The intrigue: While Hanssen was paid by Russia, according to O'Neill he was also motivated by resentment about being passed over for the fieldwork he sought and instead sent to man counterintelligence databases in an office.
- Disgruntled employees are a key source of insider threats. Just ask Tesla, where an employee passed over for promotion sent trade secrets to competitors last year.
- "Sometimes the people who don't get treated well or don't get promotions or are tired of being seen as the IT geeks, they can really cause the most damage," said O'Neill. "So it really behooves you to take care of those people."
- As in Hanssen's case, the biggest threats are the people with the most access, not necessarily the people with the highest status.
Trust, but verify: The FBI knew that someone in the government was leaking secrets to the Russians. But during their investigations, the agency refused to look internally for the mole.
- "It was a psychological flaw, willful blindness making the FBI so sure it was a CIA person that we didn't see that the guy was someone in the room with knowledge of these cases," said O'Neill.
- That's a block many organizations have when looking for insider threats. It's hard to doubt your own employees, and hard for employees to accept being viewed as a threat.
- With Hanssen, that meant actively ignoring warning signs, including a tip that Hanssen's wife had found a suspect pile of cash in their home.
- "My favorite thing to ask people is 'When do you think was the first time Hanssen, a 25-year vet of the FBI, was polygraphed?'" said O'Neill, noting that the FBI required a lie detector test every 5 years.
- The answer is that he was never given a lie detector until after he was arrested.
What's needed: There are ways to thread the needle and guard against insider betrayal without destroying trust between management and staff.
- "You have to make everyone feel like they are part of the process rather than being watched," said O'Neill.
- That means telling people to be on the lookout for abnormal behavior. "If someone has a problem, it's not just their problem," he said.
- Auditing networks for the removal of files or other strange activity is a non-invasive way of spotting trouble.
- Segmenting networks — keeping data that doesn't need to be connected in separate compartments — and pruning unnecessary network access can limit exposure.
Editor's note: This piece was corrected to show Hanssen's run ended early 2001 (not December 2000).
