TABLE OF CONTENTS Chapter contributed by Eric Shaw
Prevention
Detection
Insider Case Management
Claude Carpenter, age 20, was hired by a noted defense contractor on March 13, 2000, to serve as a Web host and part-time systems administrator on three IRS servers housed in a secure facility within the Department of Treasury s computer center located in the New Carrollton Federal Building in Lanham, Maryland. This system tracks inventory for all hardware and software within the IRS. Within days of starting work, Carpenter was in trouble. Frequent conflicts with his supervisor and peers, late arrivals to work and inappropriate racial comments alienated him from coworkers. Carpenter also abused his access privileges on the system, attempting to impress IRS computer security staff with his ability to detect and plug security vulnerabilities. However, many of these efforts were counterproductive as Carpenter closed access ports designed to be open to system users. In a meeting with his supervisor on April 18, 2000 regarding his poor work performance, Carpenter reportedly became hostile, and his boss referred the matter to the project manager, who advised Carpenter that any further difficulties with his attitude or performance would result in dismissal. But between April 20 and May 17, 2000 Carpenter reported late for work seven times and had other personal conflicts. As a result, management decided to limit his work and system access. On May 18, 2000, following a dispute between Carpenter and a coworker, his supervisor prepared a draft letter of dismissal...
