What is unauthorised data access by an insider?¶
The practical answer¶
Unauthorised data access by an insider occurs when a person uses legitimate or available access to view information they were not permitted or required to access.
The key evidential caution¶
The dangerous assumption is that opening a record proves deliberate misuse.
It may not.
Access may result from:
Key points¶
- mistaken selection
- system preview
- automated workflow
- search results
- case reassignment
- poor interface design
- legitimate support activity
What investigators should establish¶
Investigators should establish:
Key points¶
- which data was accessed
- what type of access occurred
- which account and device were involved
- whether the data was viewed fully
- whether the person had a work-related reason
- whether the action was repeated
- what happened afterwards
One accidental access may differ materially from repeated searches for unrelated people, celebrities, colleagues or personal contacts.
The sequence, search terms and later use can be important.
Evidential limits¶
Do not assume access means copying, disclosure or exploitation.
Those later actions require separate evidence.
Likewise, the absence of a formal permission does not always mean the access lacked a legitimate emergency or supervisory purpose.
Where a search function is used, preserve the search terms, filters and results returned. A person may search broadly but open only one result, or may access a record directly without a search. Those differences can help distinguish accidental exposure from deliberate targeting.
Subsequent behaviour can help interpret the access. Printing, photographing, exporting, repeated return visits or communication about the record may support deliberate interest. Absence of those actions does not prove innocence, but should affect the strength of the conclusion.
Operational takeaway¶
Prove the data accessed, the user’s authorised purpose and the wider pattern, and distinguish accidental, necessary and deliberate access.