Threat from Within: Case Studies of Insiders Who Committed Information Technology Sabotage

In this paper, we investigate insider information technology sabotage. After an analysis of over 1200 cases in our insider threat corpus, we identified 97 insider information technology sabotage cases that are found in public records. In all of our cases, the insider has pleaded guilty or was convicted in a courtroom. The majority of the cases are (United States) domestic. We begin by providing an introduction to the problem space. Next, we provide an abridged case summary for a sample of the cases. Based on all of the cases, we perform an analysis to answer the following research questions: 1) Who are the insiders that commit insider information technology sabotage? 2) What is the motivation behind the insider attacking? 3) What technical means were used to launch the attack? 4) How were the insiders caught? 5) What damage did they cause? 6) What sentence did the insider receive? Lastly, we describe our aggregated results and provide best practices to help mitigate the type of insider threat we describe.