How to Detect Insider Threats in Biotech: Three Signals
A biotech can catch an insider threat earlier by watching three things: who has access and what their affiliations are, how people use the company’s systems, and where its research turns up in patent filings. Theresa Campobasso, chief strategy officer of Reinaert and a former U.S. Marine Corps intelligence officer, laid out those three signals on Open Door Salon. Clinton West, Reinaert’s president of supply chain security and logistics operations and a former CIA supply chain risk leader, added the question his former agency asks first.
They were responding to the lawsuit Beam Therapeutics filed in September against YolTech Therapeutics and its U.S. partner Serapha Bio. Beam alleges that a former scientist opened dozens of records outside her normal work, at night and on weekends, then filed patent applications in China about five months after she left. Serapha Bio has denied the claims, and YolTech’s chief executive has said the company built its technology through its own research. The case has not been decided. Our follow-up post explains why trade secret lawsuits are hard to win.
Why is insider risk hard to manage in biotech research?
Because the habits that make science work also leave it open. Campobasso described research security as a balance: the collaborative culture of research makes it hard for an organization to decide what security posture it needs without slowing the science down. Her starting point was the case itself:
What we’re looking at right now is we see maybe three different aspects of insider risk behavior where an intervention could have caught it a little bit early.
What is the first insider threat signal?
Personnel vetting. For everyone with access to the systems or the facilities, Campobasso said, a company should know the network of relationships behind them. That includes any affiliation with an organization that has a history of the same behavior. She was careful about what that finding would mean: not proof, but a question the company can ask once it has the data. Campobasso applies the same network view to investors in our post on what foreign investor due diligence misses.
How can a company spot unusual digital behavior?
By applying to file access the same anomaly detection a security team already applies to physical access. Campobasso borrowed a term from intelligence work:
Just like we have kind of the pattern of life where a person is going through their day to day and they’ve got a routine and we can identify anomalies, the same can be done with their digital pattern of behavior.
In practice that means looking for people who open files outside their work, or outside their hours:
If somebody’s accessing files that they don’t really have a need to know, or they’re accessing files outside of the typical hours, just like we can do with badge records and their physical activities, we can look at that digital pattern of behavior as well.
Why do foreign patent filings matter?
Because the race to file decides who owns the invention. Campobasso estimated that the U.S. patent process can take about two years and is heavy with compliance, while some other countries move faster:
So if you have that access and you’re able to take it through another country’s patent process quicker and get to the finish line quicker, then you technically win that patent race.
That is why she argues emerging technology has to be protected before it is patented. Our earlier post on the routes intellectual property usually takes out of a company covers the patent route alongside two others.
What is the need-to-know test?
It is the first question West’s former agency asks when someone reaches information they should not have:
In my world of almost 30 years in the agency, if somebody gets access to information that they probably shouldn’t have, or there was a misstep, the first question somebody asks is, did that person have the need to know?
If the answer is yes, he said, the next step is to examine the access itself:
What were the irregularities that kind of surrounded that issue?
If the answer is no, the work goes back to vetting where that person came from and who they have been dealing with.
Does any one signal prove theft?
No, and both guests said so. Campobasso described each signal as a chance to intervene, ask the question and act before a loss happens, not as evidence on its own. A weekend login can have an ordinary explanation, such as a manager approving the work. The value is in catching the pattern while there is still time to act. Our earlier post on why smaller biotechs hold the science attackers want covers the same exposure from the cyber side.
What should a biotech do before a case like this?
Put the three signals in place before anything is missing: vet the people with access, watch the digital pattern of behavior, and protect new technology before it reaches a patent office. West, who spent more than two decades at the CIA, would also ask the need-to-know question every time access looks unusual.
The full conversation is on the Open Door Salon episode page, with more about Theresa Campobasso and Clinton West.
Companies that want to reach the leaders who follow this conversation can learn about sponsoring Open Door Salon.
This post is drawn from the recorded, on-the-record conversation between Lori Ellis, Theresa Campobasso and Clinton West on Open Door Salon; quotes are lightly edited for clarity, and the full episode is the record.