Could an insider be coerced or manipulated?¶
The practical answer¶
Yes. An insider may be coerced, deceived, bribed or socially engineered into using legitimate access.
The key evidential caution¶
The dangerous assumption is that the person whose account performed the action necessarily acted freely and knowingly.
They may have been:
Key points¶
- threatened
- blackmailed
- impersonated
- deceived by a fake authority
- persuaded by a colleague
- paid
- pressured through personal circumstances
- tricked into approving access
What investigators should establish¶
Investigators should establish:
Key points¶
- what instruction or pressure occurred
- who communicated
- what the insider believed
- what action they performed
- whether they benefited
- whether they attempted to conceal the activity
- what opportunity existed to refuse or report it
A coerced person may still perform intentional technical actions while lacking the same motive or level of responsibility as the organiser.
Evidential limits¶
Likewise, a claim of coercion should be tested against communications, timing, financial records and behaviour.
Do not reduce the incident to the insider account alone.
The external controller, recruiter or beneficiary may be the more significant offender.
Coercion and manipulation may also occur through compromised personal accounts or impersonation of senior staff. Preserve the original communication route, account identifiers and verification steps. The insider’s belief should be assessed against what they were shown, not only against what investigators later know.
Where payment or benefit is suspected, financial evidence may support recruitment or corruption. But receipt of money alone does not prove which action it related to. Link timing, communication, instruction and technical activity before drawing that conclusion.
Operational takeaway¶
Investigate the instruction, pressure, benefit and external relationship, and separate the insider’s technical action from the responsibility of anyone directing it.