Insider risk: what are we actually trusting people with?

Three recent stories encouraged me to focus this week’s blog on the decisions employers make about trust. The Met’s volunteer police chief was dismissed for misconduct. An OpenAI engineer faces recording-device allegations. A flydubai co-pilot is accused of attacking his captain.

The circumstances are different. My concern across them is whether employers have enough relevant information when deciding who to trust, and when to review that decision.

TL;DR

• Screening should reflect the responsibilities and access involved, including relevant external interests and potential conflicts.
• Digital Risk Screening can add human-validated online evidence beyond traditional checks.
• Changes in responsibility or credible concerns may justify proportionate rescreening. Findings need an accountable decision-maker.

The Met: when should an employer look again?

According to the BBC’s report of 10 October, Special Chief Officer James Deller was dismissed following a misconduct hearing after investigators found he had used his police-issued phone to copy intimate images sent to his personal device. The Met said its investigation used lawful business monitoring and Palantir’s Foundry system.

This was a misconduct finding. The investigation used workplace monitoring, a different activity from Digital Risk Screening.

For me, the wider employer lesson concerns the continuing responsibilities of a high-trust role. A promotion, increased access to sensitive information or an identified risk can give an employer a reason to reconsider an earlier screening decision.

The purpose should be unambiguous, the checks proportionate and the process understood by the person concerned. An effective investigation does not remove their right to privacy.

OpenAI: external interests and sensitive access

The BBC reported on 13 October that engineer Abdulrahman Alfozan had been charged with using or attempting to use a device to intercept oral communications after a recording device was discovered in an executive conference room. OpenAI said it had no indication that source code, model weights or customer data had been inappropriately accessed or taken.

CNBC’s subsequent court reporting described prosecutors’ allegations of frequent WhatsApp contact with an unnamed Saudi royal who had sought to recruit Alfozan into a Saudi AI initiative. CNBC also reported his venture-partner role at a Saudi venture capital firm. The filing did not say the royal directed the alleged recording; these remain allegations, not a conviction.

I would want to know how an employer assesses relevant external interests and potential conflicts before granting sensitive access. Someone trusted to enter a meeting room may hear confidential conversations without accessing a secure network.

Verifiable online information about business interests, affiliations or behaviour can inform that assessment. A legitimate overseas connection is not evidence of wrongdoing, and private messages recovered by investigators do not establish what a pre-hire search could have found.

The practical question is whether available evidence warrants clarification before trust is granted.

Flydubai: what did the checks establish?

In its 11 October account of the UAE investigation, Gulf News reported that the co-pilot of flight FZ1073 was accused of attacking the captain during the 30 September flight from Dubai to Tel Aviv. Others intervened and the aircraft landed safely in Saudi Arabia. The alleged attack plan was attributed to prosecutors and had not been established in court.

The report quoted the UAE Attorney-General as saying the suspect had met flydubai’s professional and security requirements at recruitment, but those procedures had not revealed the alleged extremist views or intention to attack.

An RSIS commentary by Kristian Alexander also examined reports that concerns at a previous employer had not reached later decision-makers. Those reports require substantiation; the commentary does not settle who knew what.

I would start by examining what the recruitment checks were designed to establish. Qualifications and professional clearance cannot answer every question about role-relevant behaviour. Digital evidence may contribute where it is discoverable and can be validated; references and lawful information-sharing have a separate role.

Where Digital Risk Screening contributes

At Safehire, we provide an additional due diligence layer alongside criminal-record checks, references and other screening. Relevant evidence may be visible in online activity or digital communities before it appears in a formal record.

Our technology searches defined open-source environments across the surface, deep and dark web. Experienced analysts check identity, source credibility and context before reporting relevant findings and proportionate follow-up options. The employer retains the decision.

That can inform an appointment, a decision to grant sensitive access or a review of an existing position of trust. It cannot predict future conduct, reveal private communications or replace operational safeguards. None of these reports establishes that DRS would have prevented the incident.

A finding also needs fair consideration. The person should have an appropriate opportunity to explain or correct it. Nationality, religion and lawful personal beliefs are no substitute for evidence of relevant behaviour.

One practical review

My view is that employers should use these stories to examine one high-trust role in their own organisation:

• Do the checks address relevant behaviour and potential conflicts, alongside formal eligibility?
• Could validated digital evidence improve the decision?
• Would a promotion, increased access or credible concern trigger consideration of rescreening?
• Who follows up a finding, hears the person’s response and records the decision?

HR may hold the report while another team controls access. The relevant information needs to reach the person accountable for that decision, within lawful limits. Collecting it is only part of the work.

When did you last review whether your screening gives you enough relevant information about the people you trust with your most sensitive responsibilities?