Insider Collaborator Recruitment

A subject seeks to recruit another person who currently has, or previously had, authorized access to the affected organization’s resources to knowingly assist an infringement or its concealment. The requested assistance may draw on that person’s access, organizational knowledge, decision-making authority, operational responsibilities, or trusted relationships. This may involve obtaining restricted information, providing credentials or physical entry, approving improper transactions, making unauthorized changes, suppressing scrutiny, or recruiting additional participants.

The person approached may be a colleague, manager, direct report, former member of the organization, or trusted third-party personnel. Investigators should establish the person’s relationship with the organization, the assistance sought, and whether the subject communicated its unauthorized purpose. Recruitment of a former member does not establish that they retain access, and recruitment of a privileged individual does not establish that their privileges were subsequently used. A managerial instruction or request for assistance should not be treated as knowing recruitment solely because it later contributes to an infringement.