Illustration: Aïda Amer/Axios

Until his run ended in 2001, Robert Hanssen spent 20 years as a Russian mole burrowed deep in the FBI. That made him one of history's most successful inside threats — a class of threat that plagues both government agencies and private companies.

The big picture: The FBI agent who went undercover to bring Hanssen down, Eric O'Neill, recounts the operation in "Gray Day," which hits bookstores next week. He spoke to Axios about what Hanssen's tale can teach the rest of us about trusted insiders.

Why it matters: It's not just hackers who steal files or funds; sometimes it's inside threats — employees exploiting legitimate access to a network to rob their employers. "They are people who already have the keys to the kingdom," said O'Neill.

  • A 2016 survey found that 27% of cyberattacks were either known or believed to be spearheaded by insiders.

The intrigue: While Hanssen was paid by Russia, according to O'Neill he was also motivated by resentment about being passed over for the fieldwork he sought and instead sent to man counterintelligence databases in an office.

  • Disgruntled employees are a key source of insider threats. Just ask Tesla, where an employee passed over for promotion sent trade secrets to competitors last year.
  • "Sometimes the people who don't get treated well or don't get promotions or are tired of being seen as the IT geeks, they can really cause the most damage," said O'Neill. "So it really behooves you to take care of those people."
  • As in Hanssen's case, the biggest threats are the people with the most access, not necessarily the people with the highest status.

Trust, but verify: The FBI knew that someone in the government was leaking secrets to the Russians. But during their investigations, the agency refused to look internally for the mole.

  • "It was a psychological flaw, willful blindness making the FBI so sure it was a CIA person that we didn't see that the guy was someone in the room with knowledge of these cases," said O'Neill.
  • That's a block many organizations have when looking for insider threats. It's hard to doubt your own employees, and hard for employees to accept being viewed as a threat.
  • With Hanssen, that meant actively ignoring warning signs, including a tip that Hanssen's wife had found a suspect pile of cash in their home.
  • "My favorite thing to ask people is 'When do you think was the first time Hanssen, a 25-year vet of the FBI, was polygraphed?'" said O'Neill, noting that the FBI required a lie detector test every 5 years.
  • The answer is that he was never given a lie detector until after he was arrested.

What's needed: There are ways to thread the needle and guard against insider betrayal without destroying trust between management and staff.

  • "You have to make everyone feel like they are part of the process rather than being watched," said O'Neill.
  • That means telling people to be on the lookout for abnormal behavior. "If someone has a problem, it's not just their problem," he said.
  • Auditing networks for the removal of files or other strange activity is a non-invasive way of spotting trouble.
  • Segmenting networks — keeping data that doesn't need to be connected in separate compartments — and pruning unnecessary network access can limit exposure.

Editor's note: This piece was corrected to show Hanssen's run ended early 2001 (not December 2000).

Go deeper

Bryan Walsh, author of Future
1 hour ago - Health

Rockefeller Foundation commits $1 billion for COVID-19 recovery

A health worker performs a COVID-19 test in New Delhi. Photo: Raj K Raj/Hindustan Times via Getty Images

The Rockefeller Foundation announced on Monday that it will allocate $1 billion over the next three years to address the pandemic and its aftermath.

Why it matters: The mishandled pandemic and the effects of climate change threaten to reverse global progress and push more than 100 million people into poverty around the world. Governments and big NGOs need to ensure that the COVID-19 recovery reaches everyone who needs it.

Updated 2 hours ago - Politics & Policy

Coronavirus dashboard

Illustration: Sarah Grillo/Axios

  1. Politics: Ex-FDA chief: Pence campaigning after COVID exposure puts others at risk — Mark Meadows: "We are not going to control the pandemic"
  2. Health: 13 states set single-day coronavirus case records last week — U.S. reports over 80,000 new cases for second consecutive day.
  3. World: Italy tightens restrictions Spain declares new state of emergency.
  4. Media: Fox News president and several hosts advised to quarantine after possible COVID-19 exposure

Fox News president and several hosts advised to quarantine in COVID-19 precaution

A political display is posted on the outside of the Fox News headquarters on 6th Avenue in New York City in July. Photo: Timothy A. Clary/AFP via Getty Images

Fox News President Jay Wallace and anchors Bret Baier and Martha MacCallum are among those recommended to get tested and quarantine after possible exposure to COVID-19, the New York Times first reported Sunday night.

The big picture: The Fox News contingent, which also included "The Five" show hosts Juan Williams and Dana Perino, were on a charter flight from Nashville to New York following Thursday's presidential debate with a person who later tested positive for the coronavirus.