Spyware-For-Business Company Thinks Concerns About 'Medical Bills' Are Indicators Of An 'Insider Threat'

(Mis)Uses of Technology

from the terminated-for-googling-'student-loans' dept

It’s no secret that many companies monitor their employees’ computer use. But things are going much further than simply ensuring the normal “don’ts” — file sharing, porn viewing, etc. — are tracked for disciplinary reasons. Companies are now on the lookout for the next “insider threat.” Some companies are viewing the Snowden saga as the ultimate cautionary tale, albeit one that results in more surveillance rather than less. (via Dealbreaker)

Guarding against such risks is an expanding niche in the security industry, with at least 20 companies marketing software tools for tracking and analyzing employee behavior. “The bad guys helped us,” says Idan Tendler, the founder and chief executive officer of Fortscale Security in San Francisco. “It started with Snowden, and people said, ‘Wow, if that happened in the NSA, it could happen to us.’?”

But the effort to find — and prevent — the next “insider threat” from damaging his or her company seems to be just as misguided as the government’s efforts to do the same. Looking for potential threats often results in viewing almost everything as an indicator of future treachery.

One company cited “changes in email habits” as being indicative of an “insider threat.” Others, like Stroz Friedberg, aren’t as selective. The company, started by former FBI agent Edward Stroz, veers into the same dangerous territory the government does when rooting out “threats.” In its hands, normal activities are viewed with suspicion by its monitoring software.

The software establishes a base line and then scans for variations that may signal that an employee presents a growing risk to the company. Red flags could include a spike in references to financial stresses such as “late rent” and “medical bills.”

And what better way to tackle “late rent” or “medical bills” than suddenly finding yourself unemployed simply because re-purposed FBI analytic software thinks any small sign of (possibly temporary) financial instability indicates your next move will be to steal something. Millions of people in the US deal with these realities frequently — especially the latter. And yet, millions of employees still find other ways to tackle these problems instead of dipping their hands in the tills or running off with sensitive documents.

Stroz’s software also thinks — like the government — that an unhappy employee is a malicious employee.

He offers the scenario of a star trader at a bank who’s disappointed with the size of her annual bonus. Instead of being blindsided when she defects to a rival, a bank using Scout could identify her discontent early and make sure she doesn’t take sensitive data or other team members with her.

Or, the company could try to work with the employee rather than just secretly track her until her eventual exit. Once again, unhappy employees leave companies all the time without taking anything with them. Sure, a few do, but the deployment of software like this will generally produce more false positives (and a further strain work relationships) than insider threats. And there’s nothing like firing people for something they haven’t done (but might!) to endear a company to its remaining employees.

Despite all of this, Edward Stroz believes his company’s predictive employee policing software is just another way for companies to show their employees how much their staff means to them.

He’s still careful when discussing the software, describing it as a way to help employers build a “caring workplace.”

Oh, it’s anything but. While employees will often accept monitoring of their internet/computer usage as being a necessary part of the employee-employer relationship, they’re not going to be happy to find out that searching for information about medical bills might see them lose a source of income. And they’re definitely not going to be thrilled to learn that expressing displeasure about company practices and policies may result in the same thing. If a company wants to foster a “caring workplace,” it should be addressing employee discontent, not monitoring it. But what do you expect from companies — and the entities that provide them with spyware — that view the Snowden leaks as justifying increased surveillance?

Oh, and employees had better believe their file sharing use will be actively monitored (and used against them). Stroz Friedberg may be making enterprise pre-crime software now, but its past as an RIAA lobbying firm (and its slightly-later past as a Six Strikes “independent expert“) has been well-noted.

Filed Under: insider threats, monitoring, spyware
Companies: fortscale security