Mar 21, 2019

What the FBI learned from its worst spy disaster

Illustration: Aïda Amer/Axios

Until his run ended in 2001, Robert Hanssen spent 20 years as a Russian mole burrowed deep in the FBI. That made him one of history's most successful inside threats — a class of threat that plagues both government agencies and private companies.

The big picture: The FBI agent who went undercover to bring Hanssen down, Eric O'Neill, recounts the operation in "Gray Day," which hits bookstores next week. He spoke to Axios about what Hanssen's tale can teach the rest of us about trusted insiders.

Why it matters: It's not just hackers who steal files or funds; sometimes it's inside threats — employees exploiting legitimate access to a network to rob their employers. "They are people who already have the keys to the kingdom," said O'Neill.

  • A 2016 survey found that 27% of cyberattacks were either known or believed to be spearheaded by insiders.

The intrigue: While Hanssen was paid by Russia, according to O'Neill he was also motivated by resentment about being passed over for the fieldwork he sought and instead sent to man counterintelligence databases in an office.

  • Disgruntled employees are a key source of insider threats. Just ask Tesla, where an employee passed over for promotion sent trade secrets to competitors last year.
  • "Sometimes the people who don't get treated well or don't get promotions or are tired of being seen as the IT geeks, they can really cause the most damage," said O'Neill. "So it really behooves you to take care of those people."
  • As in Hanssen's case, the biggest threats are the people with the most access, not necessarily the people with the highest status.

Trust, but verify: The FBI knew that someone in the government was leaking secrets to the Russians. But during their investigations, the agency refused to look internally for the mole.

  • "It was a psychological flaw, willful blindness making the FBI so sure it was a CIA person that we didn't see that the guy was someone in the room with knowledge of these cases," said O'Neill.
  • That's a block many organizations have when looking for insider threats. It's hard to doubt your own employees, and hard for employees to accept being viewed as a threat.
  • With Hanssen, that meant actively ignoring warning signs, including a tip that Hanssen's wife had found a suspect pile of cash in their home.
  • "My favorite thing to ask people is 'When do you think was the first time Hanssen, a 25-year vet of the FBI, was polygraphed?'" said O'Neill, noting that the FBI required a lie detector test every 5 years.
  • The answer is that he was never given a lie detector until after he was arrested.

What's needed: There are ways to thread the needle and guard against insider betrayal without destroying trust between management and staff.

  • "You have to make everyone feel like they are part of the process rather than being watched," said O'Neill.
  • That means telling people to be on the lookout for abnormal behavior. "If someone has a problem, it's not just their problem," he said.
  • Auditing networks for the removal of files or other strange activity is a non-invasive way of spotting trouble.
  • Segmenting networks — keeping data that doesn't need to be connected in separate compartments — and pruning unnecessary network access can limit exposure.

Editor's note: This piece was corrected to show Hanssen's run ended early 2001 (not December 2000).

Go deeper

Situational awareness

Photo: Drew Angerer/Getty Images

Catch up on today's biggest news:

  1. Scoop: New White House personnel chief tells Cabinet liaisons to target Never Trumpers
  2. Trump misrepresents 2020 Russia briefing as Democratic "misinformation"
  3. Bernie Sanders takes aim at Bloomberg: "Trump will chew him up and spit him out"
  4. Nearly half of Republicans support pardoning Roger Stone
  5. Scoop: Lyft acquires cartop advertising startup Halo Cars

Sanders takes aim at Bloomberg: "Trump will chew him up and spit him out"

Photo: Mario Tama/Getty Images

Bernie Sanders told CBS "60 Minutes" that he was surprised by Mike Bloomberg's lackluster performance at Wednesday's Democratic debate.

What he's saying: "If that's what happened in a Democratic debate, you know, I think it's quite likely that Trump will chew him up and spit him out."

Scoop: Lyft acquires cartop advertising startup Halo Cars

Photo: Drew Angerer/Getty Images

Lyft has acquired Halo Cars, a small startup that lets ride-hailing drivers earn money via ad displays mounted atop their cars. Lyft confirmed the deal but declined to share any details.

Why it matters: Ride-hailing companies are increasingly eyeing additional ways to generate revenue, and Lyft rival Uber has been quietly testing a partnership with New York-based Cargo that gives it a cut of the advertising revenue, as I previously reported.