The recent John Durham filing alleges that a tech executive used his previous company’s access “to nonpublic domain name system (DNS) data” in order to analyze potential links between the Trump organization and a Russian bank. Per the filing, the purpose of this effort was to purposefully gather “derogatory information” about Donald Trump. Ostensibly, the tech executive ultimately used the company’s contract with the Executive Office or the transitional team to exploit this relationship to spy on Trump’s residences when he was a candidate and at the White House when Trump was president.

According to one forensics expert, the data was “highly manipulated” – suggesting that the tech executive selected data to intentionally manufacture connections between Trump and Russia. The tech executive was a willing participant in the process, having previously stated his dislike for Trump (when he stated he’d never take the top cybersecurity job if Trump offered the position).

Insiders are a pervasive threat. A recent 2022 report by a company specializing in insider risk revealed that there was a 72 percent increase in insider incidents (with 42 percent of these activities focusing on the theft of sensitive information). Additionally, an aggregation of this data listed the government sector in the top five industry sectors exploited. The report cited three types of insider threats:

OODA Loop Sponsor

an insider not intending to do harm but may do so because of negligence;
an insider who intends to do harm via data theft or sabotage; and
a “super malicious” insider threat whose technical skills and understanding facilitate malicious activities, demonstrating an ability to conceal his operations from detection.

If Durham’s filing proves correct, the tech executive clearly demonstrates this third category of insider threat – as he was well-positioned to “normalize” his actions in the specific environment without raising immediate red flags.

Interestingly, February 18 marked the anniversary of the arrest of another infamous insider, Robert P. Hanssen. the Federal Bureau of Investigation (FBI) agent had spied for the Russians on and off for approximately 15 years of his 25 years in the FBI. Representing one of the worst types of insider threats, Hanssen’s espionage compromised some of the United States’ most sensitive counterintelligence and military secrets. Hanssen also exemplifies the super malicious insider, one whose access and technical skills enabled his malicious activities. An unclassified copy of Hanssen’s damage assessment by the Department of Justice marked significant shortcomings in the FBI’s internal security practices as one of several reasons Hanssen was able to operate for so long. The biggest one may have been the Bureau’s failure to continuously vet individuals in positions of trust, preferring to look elsewhere instead of internally.

Those that work inside or contract to the government typically don’t bring their personal political leanings to work. While this may be true for the vast majority of this workforce, like any threat, it only has to be successfully executed once to have a tremendous impact. Durham’s filing revealed that the tech executive and his recruited researchers all shared anti-Trumpian biases, which motivated them to act against a sitting president for the purposes of committing deliberate malfeasance. The lead researcher that worked for the tech executive was reported to have said “the only thing that that drives us is that we don’t like [Trump].” It appears that political animosity coupled with insider access helped fan the flames of a major political fiasco with national security ramifications in the balance.

This should be of paramount concern to both political parties, as it has set a precedent that such activities are not just a notional threat to be gamed in security planning scenarios. It also raises an important question when it comes to cybersecurity concerns at the highest levels of the U.S. government. When a new administration assumes the Executive Office, that individual is often focused on getting senior government positions filled in order to execute his agenda. This can be a time-consuming process, especially in a charged and divisive political climate. The types of contract work performed by a tech executive and his company likely would fall well under the radar of a new president.

This mindset and approach to internal security at the Executive Office must change as protecting the confidentiality of communication channels is not reserved solely for hostile outsiders. While this may have seemed impossible or at least implausible before, new ground has been broken in the insider threat space. More information will materialize from Durham’s investigation no doubt, but the damage has been done, and understanding the full consequences of the tech executive’s activities should raise new concerns and new strategies to mitigate the threat of politically-motivated actors from taking advantage of trust. Therefore moving forward, it would behoove any new administration to take the lessons learned here, and like any Cabinet position, consider immediately replacing or at least rigorously vetting any individual or company that performs the kind of functions performed by the one with which the tech executive was affiliated.

Cybersecurity continues to be a challenge for any public or private organization. Threats are numerous, and the potential consequences of successful attacks can be costly and catastrophic. But as history has taught, failing to learn from past incidents and applying the necessary steps to mitigate future threats risks them being repeated in the future. It is always difficult to get the horse back into the barn when the door has already been opened. The horse is out now and if the door is not fixed expeditiously, more can be expected to follow suit.

Related Reading:

Black Swans and Gray Rhinos

Explore OODA Research and Analysis

Decision Intelligence

Disruptive/Exponential Technology

Security and Resiliency

Community