Kroll's Security Concepts Podcast

Hear from our Kroll experts Sherine Ebadi and Matthew Dumpert, and moderator Jeff Kernohan, as they discuss heightened threats in today’s environment.

Sherine is an associate managing director in Kroll's Los Angeles office, where she leads the fraud and financial investigations practice. She joined Kroll after a distinguished 10-year career with the FBI, most recently serving as the lead case agent for the special counsel's investigation and prosecution of Paul Manafort.

Matt joined Kroll after a distinguished career as a special agent with the U.S. Department of State where he was often stationed abroad at U.S. embassies working on federal investigations, the protection of overseas missions and threat management.

Passages from the Episode

Increase in Threat Management Cases in 2020 

“Matt, if we look at the time, this time compared to last year, what are you seeing as far as number of actual threat cases, number of cases you're getting brought into? Has there been a major difference in the numbers?” – Jeff Kernohan

“Actually, there's been a significant increase. If we look at this time last year and compare it to now, not only are there more cases we're being brought into, but they're more nuanced. The public is under tremendous pressure right now and it manifests in the workplace in significant ways. So, threat management cases, threats being lodged to executives, to supervisors, to colleagues, it's because we're all under tremendous stress.” – Matthew Dumpert

“And like the typical types of cases, what are you seeing different now compared to how they might've been last year when they were coming in?” – Jeff Kernohan

“Well, they're escalating very quickly. We're seeing a lot of folks with mental health issues, unfortunately, that are going unchecked, whether it's because they're unable or unwilling to be out in public and visit their mental health providers or whether they don't feel comfortable going to the facilities where their providers are. We're also finding a lot of folks that are out of work, whether they've been furloughed, laid off or downsized. Folks are under tremendous financial stress and what it's doing is it's making good people act in ways that they otherwise wouldn't. We're not seeing a marked increase in bad elements acting. We're seeing good people doing things that we didn’t see last year.” – Matthew Dumpert

Trending Elements in Threat Management Cases

“Are there any trending elements that you're seeing with these incidents that you are handling that would be useful for our listeners to hear about?” – Jeff Kernohan

“I think clearly with the unrest that's happening across the United States and in both in urban centers and also in some less urban areas, we're seeing incidents that are racially and politically motivated. We're seeing incidents that are opportunistic in nature. So given that there's maybe a protest going on in a certain area, you'll see incidents that stem from that, whether it be commercial burglaries on a business that's been left unwatched, or is shuttered because of COVID-19 or maybe because of the unrest or just because of the reduction or preoccupation of law enforcement that might otherwise be normally patrolling the area.” – Sherine Ebadi

“I'd like to add something to that. We also see folks implicating their employers in the ongoing social dialogue where employees expect a lot from their employers and their colleagues amidst social unrest. No matter which side of the issue folks fall on, they're expecting some response from their employers, from their colleagues. And when they don't get that, it's leading to instances of workplace violence and increased tension.” – Matthew Dumpert

Challenges with Internal Investigations

“As we deploy and help our clients with these threat management cases, I know a big part of that is the investigations. But, Sherine, I know most of our clients probably don't have FBI trained investigators as part of their internal investigations. What are the issues you often see with internal investigations being handled by personnel who have full-time jobs in other aspects of the business?” – Jeff Kernohan

“I think at its basis form is interviewing. An investigation is not just gathering information and not just asking questions, but these are learned skills on how to interview people to elicit information and then how to connect dots between the information that you're gathering. And although it may be someone from human resources or the general counsel's office or a compliance person, they may be fantastic at the jobs that they were hired to do for their company, but they're not by nature trained investigators.” – Sherine Ebadi

“Often we'll get called in after an ‘internal investigation’ has been unfruitful and we'll notice that the interviews were done with maybe multiple people in the room or the information they were relying upon hadn't been appropriately corroborated or vetted or they'll have interviewed people, but not done much homework upfront so that they can gauge whether the person is providing them with truthful information. Understanding that maybe hiring a FBI-trained investigative team may not always be feasible for a variety of reasons. There are some basic rules of the road that internal components can use to be more successful in their investigations.” – Sherine Ebadi

“Just the basics of doing your homework first and knowing what you know, what you don't know, what you can learn before you talk to anyone, maybe from records, what you can learn from talking to people and who you need to talk to, and then interview one person at a time in-person, if possible, maybe not feasible in our current environment. Don't read from a script of questions. Remember, you're not just asking questions, you're trying to elicit information. Allow the conversation to guide what additional questions you might ask that are logical.” – Sherine Ebadi

“And finally corroborate information. If you're going to be relying upon it for decision making, you want to make sure you've vetted the information as well as possible. It's not really an exhaustive list, but it's a really good starting point.” – Sherine Ebadi

Benefits of Outside Parties Conducting Internal Investigations

“I think that makes a lot of sense to have an outside party come in and do these interviews and that's where we see a lot of success in these threat management cases.” – Jeff Kernohan

“Understanding your environment is critical. If we suspect that…there are issues with mental health, when Kroll puts together a multidisciplinary team of people, it's obviously seasoned investigators like Sherine, but we also have access to world renowned psychologists and psychiatrists affiliated with some of the best institutions in the world. We have forensic accountants; we have all types of specialties that we bring to these investigations.” – Matthew Dumpert

“And the goal there really is to understand what we have. We don't want to start managing a threat situation or engaging with a client where there's threats being lodged without knowing absolutely everything about it because we don't want anything we do to unnecessarily escalate things.” – Matthew Dumpert

“When you do bring in this multidisciplinary team, how does this usually get built and how it actually works in the field when you're doing these investigations and responses to threat?” – Jeff Kernohan

“When we build these teams, it's critically important in the intake phase to understand everything we can about our clients. Some of the clients, we have a very good relationship, a long-standing relationship with. They know our capabilities; we know their problems and we can move forward very quickly and swiftly. When we're talking with new or potential clients, it's really just about being good listeners, understanding the totality of what they've got and also understanding what internal resources they have. The intake process can take some time, but it's critically important.” – Matthew Dumpert

“We have to understand the threat actor, the person that's concerning people. We have to understand what's happened. We have to understand potential friction points, what's happened, what is their grievance, and if they've demonstrated any activity or behavior historically that might inform our process. There's no shortage of resources that we bring to these investigations, but we have to do it smartly and understand exactly the type of problem and the type of threat we're dealing with.” – Matthew Dumpert

“One of the reasons we bring in multidisciplinary teams to these investigations is because all of these different aspects, they don't live in stove pipes. They need to be communicated and built off one another. So what we may learn from scrubbing social media or reviewing of accounts and tracing of money or from interviews needs to be shared with the rest of the team so that information can be built upon as we look into these various nooks and crannies to find additional information. Communication would be my suggestion as to how you would proactively and really effectively work as a multidisciplinary team during a threat investigation.” – Sherine Ebadi

Conducting Investigations Remotely

“How has the working from home environment impacted your ability to be able to do these threat management cases in these investigations? How are you being impacted by everybody working remotely?” – Jeff Kernohan

“My particular skill is interviewing and being able to read people and elicit information from people and kind of get people to tell you things they might not normally want to tell you doing that remotely is extraordinarily difficult. It provides a huge hurdle to building rapport with people that you're interviewing and being able to read the veracity of what they're telling you. It also makes it really difficult because you don't know the environment that they're in when you're talking to them.” – Sherine Ebadi

“So although you may be able to see their face on a screen, you have no idea who else might be in the room or what may be in the background or what other kind of stressor just occurred, and it just is this very large sort of wall or barrier to conducting really good interviews. I think also it's difficult for the client because they're dispersed in different areas, so they may not have the normal institutional controls and insight that they would have in a normal world, whatever normal might be.” – Sherine Ebadi

“I'll add just one thing is that also in any of these threat management cases; people are personally affected. People's livelihoods, their person, their family or their workplace as being threatened by something and managing client anxieties can oftentimes complicate the process, but you have to understand that. And you have to understand that just like the people that are lodging the threats, our clients are under tremendous pressure as well.” – Matthew Dumpert

“Compounding the threats they're dealing with in the workplace is them trying to juggle the home life balance with working from home and not having access to all the information they normally would. And potentially working in an environment with lots of exterior pressures that they normally wouldn't deal with in the workplace. So not only are the threat actors and those lodging threats operating with higher levels of anxiety, but oftentimes our clients are too, and they don't have the protections they're used to in the office. They don't have security personnel, they don't have protocols and procedures to safeguard them and that umbrella of protection. So again, anxiety levels are high, stress is high and that bleeds throughout some of these threat cases.” – Matthew Dumpert

Successfully Manage Your Firms Threat Management Cases   

“I can certainly see how all of these things coming together are making a more difficult response to threat management and really making people even less comfortable in managing threat internally in their corporations. To wrap up the topic here, is there any expert advice that you two might be able to impart to the listeners regarding the management of this emerging threat and all of these new difficulties we have in managing threat today?” – Jeff Kernohan

“I would say the biggest one is having a plan in place before something happens so that you can respond more quickly and effectively. I think most large businesses probably have some form of emergency response plan or some form of continuity of operations plan, but really take a deep look at that because I think one thing COVID-19 has shown us is that this crisis is unlike any other. It's not lasting a day or a couple of days. It's not impacting only one region or one part of the world. It's global, it's pervasive through all industries and it's very much long lasting and there's so many unknowns.” – Sherine Ebadi

“It's very difficult to know if you're standing on firm ground when making decisions. Take a good hard look at whatever your emergency response plan is. Make sure that you're incorporating lessons learned from our current environment. Ensure that you have some sort of redundancy in your key decision-makers because you don't know who's going to be impacted by whatever threat and/or emergency you're going to be reacting to. If there's only one person that's making all these key decisions and they get taken offline for whatever reason, who's going to be the one calling the shots? Make sure you have some redundancy built into your plan.” – Sherine Ebadi

“If I can just add on to the last one in redundancy. That's why a lot of the times with the clients that we work with on a regular basis, we help build a threat management team and a threat management program, which has representatives from a cross section of their organization so they can do exactly that. They have built in redundancy. If a threat comes in and one of the team members is impacted, there's a fairly robust team that's trained on how to deal with these things, so excellent point.” – Matthew Dumpert

“Be aware of the red flag indicators of potential violence. There are things to look out for. There are things that escalate threat cases in our minds, and those are the types of things you want to look out for and not to discount anyone's grievance. When we're talking about a threat management case, it's important to realize that reality from the threat actors' perspective is the most important part to be mindful of. It doesn't matter what an independent third party would think about their grievance. That doesn't control their actions and whether they choose to escalate to violence.” – Matthew Dumpert

“Understanding that even a small grievance or a seemingly small grievance to a supervisor or legal counsel or a human resources representative could be a very big deal for somebody. It's important to understand we can't let those things go. We have to assess those as we find.” – Matthew Dumpert

Talk to a Kroll Expert

Kroll is ready to help, 24/7. Use the links on this page to explore our services further or speak to a Kroll security risk management expert today via our contact page.