When an organisation suspects an insider incident, such as data theft, misuse of information, unauthorised access or the possibility that a trusted individual has been compromised, it needs the facts established quickly, discreetly and independently. GSA investigates suspected insider incidents, drawing on the experienced investigators and open-source intelligence capability of GSA Investigation Services, within the same group that designs and runs insider risk programmes.
When an Insider Concern Requires Investigation
Typical triggers include:
- suspicious or unexplained access to systems or information;
- suspected theft or exfiltration of data, including by departing employees;
- misuse of confidential or client information;
- suspected fraud involving an employee, contractor or third party;
- undeclared conflicts of interest;
- indications that an individual may have been compromised or is acting under external influence;
- monitoring alerts or whistleblowing reports that cannot be resolved through routine review.
Not every alert indicates wrongdoing. Many reflect innocent or inadvertent behaviour, and some point to individuals who need support rather than sanction. Part of an investigation’s value is establishing, carefully and fairly, which situation the organisation is dealing with.
Scoping an Insider Investigation
Insider investigations are sensitive: they concern people who may be entirely innocent, and mishandling can damage individuals, employment relationships and any later proceedings. GSA scopes each investigation before work begins:
- the allegation or concern, precisely stated;
- what is already known and how reliably;
- the available evidence sources: systems, documents, people;
- the legal, HR and other stakeholders who need to be involved, and when;
- agreed terms of reference, confidentiality arrangements and reporting lines.
Digital, Documentary and Human Evidence
Insider cases typically combine three evidence strands: digital records of access and activity, documents and communications, and accounts from people. GSA coordinates across all three, working with the client’s IT and security teams and, where the technical dimension requires it, with GSA’s Cyber Security and Resilience specialists. Where specialist forensic examination of devices or data is needed, GSA advises on the requirement and how it should be handled so that potential evidence is not put at risk.
OSINT and External Connections
Insider cases often have an external dimension: undisclosed business interests, relationships with competitors, or contact with parties outside the organisation. GSA’s open-source intelligence capability, part of Investigation Services, can examine that dimension lawfully and proportionately as part of the investigation.
Investigating Compromised or Coerced Individuals
Some insider cases involve individuals who may have been targeted, recruited or coerced by an external actor rather than acting on their own initiative. These cases require particular care, for the investigation and for the individual, who may be a victim as much as a subject. GSA brings counterintelligence experience to this category of case through Howard Nichol, formerly the British Army’s Head of Counterintelligence and Security, alongside the investigative team.
Working with HR, Legal and Cyber Teams
An insider investigation sits inside an employment and legal context. GSA works to terms of reference agreed with the client’s legal and HR functions, respects the boundaries between fact-finding and employment decision-making, and keeps the client’s advisers informed at agreed points. GSA establishes facts; decisions about employment, litigation or referral remain with the client and its legal advisers.
Investigation Findings and Reporting
Findings are reported clearly: what was examined, what was found, how reliable the evidence is, and what remains unresolved. GSA’s investigative approach reflects UK police investigative standards, and reporting is prepared with an awareness that findings may be used in HR proceedings, civil litigation or criminal referral. GSA does not guarantee that evidence will be admissible or that any particular legal, regulatory or employment outcome will follow; those are matters for the client’s legal advisers and, ultimately, the relevant tribunal or court.
Where the investigation identifies control weaknesses, GSA can connect the findings back into assessment and programme improvement, which is one reason an incident is so often the trigger for a broader review.
GSA Investigation Experience
Investigations are delivered by GSA’s Investigation Services team, whose backgrounds span policing, intelligence and corporate investigation, with Bill Trent retaining overall leadership of the insider risk relationship. Having investigation capability within the wider GSA group allows an insider concern to move into appropriately scoped investigative work without introducing a completely separate provider.