top of page

What does Restorative Justice have to say about Insider Risk Management?

Updated: Apr 2

David J.E. Byrne BA MDiv Phd (Candidate)

In 1990, American historian, photographer, and criminal justice worker Howard Zehr published Changing Lenses: A New focus on Crime and Justice (Zehr, 1990). In his book, Zehr provided the first systematic outline of the principles of the emerging restorative justice movement. Theological ethicist Amy Levad defines restorative justice as “every action that is primarily oriented to doing justice by repairing the harm that is caused by crime” (Levad, 2011). First appearing in Canadian court rooms in the early 1970s, by the 1990s restorative justice’s reputation had grown as a unique way to respond to crime, reaching its zenith in popularity in the late 1990s where it became an endorsed response to crime, promoted broadly in both community settings and by justice systems in Canada and the US.

Particularly, as criminologists Bazemore and Maruna note, restorative justice can be characterized by three core principles:

1. The principle of repair - repairing the harm caused by crime;

2. The principle of stakeholder involvement - providing victims, offenders, and communities the opportunity for active involvement in the justice process;

3. The principle of transformation in community and government roles - re-examining the roles of government and community and, in some cases, reversing them to return the responsibility for justice to the community (Bazemore & Maruna, 2009; Elliott & Zajac, 2015).

Grounded in these principles, in its most basic form, restorative justice entails bringing victims, offenders, and community members together to reach agreement about the steps needed to repair harms caused by a crime. As such, restorative justice represents a paradigm shift away from retributive (punishment) and rehabilitative (treatment) approaches to wrongdoing. This move was necessitated, restorative justice advocates argue, because conventional models of justice incentivize perpetrators to avoid taking accountability for their actions while failing to both explore the root causes of crime and meet the needs of victims impact by wrongdoing (Levad, 2011). Some specific examples of restorative justice initiatives include victim-offender mediation, truth and reconciliation commissions, family-group conferencing, accountability boards, and community conferencing (Zehr, 1990) (Levad, 2011). More recently restorative justice methods have also been employed in professional environments other than criminal justice, most notably in education.

Academics and professionals seek to identify “ways to counter insider threat incidents through individual and organizational wellness, protection, and health." – Frank Greitzer, 2022

From the Lens of Threat to the Lens of Harm

But, what does this have to do with Insider Threat Management in a corporate world? The U.S. Cybersecurity & Infrastructure Security Agency (CISA), notes Frank L. Greitzer, defines insider threat as:

“the potential for an insider—any person who has or had authorized access to, or knowledge of, an organization’s assets and resources—to use their authorized access, wittingly or unwittingly, to bring harm to the organization’s mission, resources, personnel, facilities, information, equipment, networks, or systems” (Greitzer, 2022)

To summarize, an insider threat is the risk that someone (individual) poses to harm an organization (an entity within which a person is employed) using access that is provided to them simply because of their professional relationship with that entity. The lens to understand wrongdoing that emerges from this definition, then, is contractual, impersonal, and actuarial, naturally leading to retributive and exclusionary responses.

This is not dissimilar from our current criminal justice systems in Canada and the US, which measure an individual’s risk to commit/recommit a crime using various actuarial instruments while viewing crime itself primarily as the violation of a law. For restorative justice advocates, this kind of a view misses the bulk of the interpersonal impacts that result from wrongdoing. These impacts include harm caused to people, relationships, and the community at large. Many of these harms are immediate but, as we know, the ripples of wrongdoing can be felt for an untold amount of time after the initial event has occurred.

But how do we adopt a restorative mindset? And what insights would the application of this mindset provide for those studying and responding to insider risk and, more specifically, responding to wrongdoers within organizations? Restorative justice advocates have proposed a series of questions to assist people to adopt a restorative mindset. In summary, these questions include:

Questions for the Wrongdoer:

1. What happened?

2. What were you thinking about at the time?

3. What have you thought about since the incident?

4. Who has been affected by these events?

5. What do they need to make things right?

Questions for those Affected by the Wrongdoing:

1. What did you think when you realized what happened?

2. What effect has this incident had on you and others?

3. What has been hardest?

4. What do you think needs to happen to make things right?

Here, wrongdoing is understood as a harm caused by one person/a group of people (community members) to another person/group of people (members of the same community) or to the community itself. Harms to the community can include both reputational and environmental harms. Within this approach the experience of the victim is prioritized, with the task of defining the harm and what needs the harm has produced belonging to the victim. The impact of wrongdoing on the community is also considered, but not until the needs of the direct victim are met.

What is unique here is the relational aspects of this approach. As opposed to a contractual focus, restorative justice views human relationships in covenantal terms. Whereas in a contract, when one side breaks the contract both parties are released, in a covenantal approach both parties are recognized as important members of the community. When a harm occurs it must be identified and repaired, but nobody is excluded from the covenant as a result of their action. This communicates to all members of the community that their presence is meaningful, even if their conduct is of concern, providing opportunities to respond to wrongdoing in ways that meet the needs of victims who are most impacted by the actions of the wrongdoer without devaluing either party.

The consideration of adopting a restorative lens in responding to insider threat and wrongdoing might seem peculiar, but it finds home in the general shift in insider threat research that is being done by social scientists today. In this research, academics and professionals seek to identify “ways to counter insider threat incidents through individual and organizational wellness, protection, and health” (Greitzer, 2022). This is especially so for unintentional insider risk and threat, where considerations of stress, overwork, attention lapses, or negligence all play a major role. Consider, for example, a recent publication on the promotions of positive deterrence as a compliment to a more traditional command-and-control approach in insider threat management (Moore, Gardner, & Rousseau, 2022). According to the authors, a positive deterrence approach “promotes internal behavior drivers that motivate employees to willingly behave in ways reducing insider risk,” impacting an employee’s “perceived organization support (POS).” Strategies within the POS approach include an organization demonstrating the value of an employee’s contributions, well-being, and socio-economic needs while providing them with work/life flexibility, employee assistance, fair compensation, and constructive supervision. In essence, what is described here is similar to a key insight in research on restorative justice: when you feel like you belong meaningfully to your community, you are far less likely to harm again – or, in the base case scenario – cause harm in the first place.

This speaks to the popular concept of organizational culture. Organizational culture, explains Lang, is understood as a “shared set of employees’ perceptions and assumptions that affect their expectations and behaviours” (Lang, 2022). It serves, continues Lang, to affect each individual’s “subject psychological contract” – or, what a worker is willing to do in exchange for what is expected from the organization. It is already shown that negative organizational culture leads to burnout, significantly decreasing the likelihood that employees follow security protocols. While positive workplace cultures build organizations that are “infused with trust,” reducing the circumstances that lead to insider threats (Lang, 2022). Employees who know that errors do not immediately result in expulsion, who know that they are a meaningful part of the organization even when they ere, will be far more likely to seek assistance and provide assistance early when a problem arises.

Bazemore, G., & Maruna, S. (2009). Restorative justice in the reentry context: Building new theory and expanding the evidence base. Victims and Offenders, 4(4), 375-384.

Elliott, I. A., & Zajac, G. (2015). The implementation of Circles of Support and Accountability in the United States. Aggression and Violent Behavior, 25, 113-123.

Greitzer, F. L. (2022). Introduction to CITRAP's Inaugural Issue. Counter-Insider Threat Research and Practice, 1(1).

Lang, E. L. (2022). Seven (Science-Based) Commandments for Understanding and Countering Insider Threats. Counter-Insider Threat Research and Practice, 1(1).

Levad, A. (2011). Restorative Justice: Theories and Practices of Moral Imagination. El Paso: LFB Scholarly

Moore, A. P., Gardner, C., & Rousseau, D. M. (2022). Reducing Insider Risk Through Positive Deterrence. Counter-Insider Threat Research and Practice, 1(1).

Zehr, H. (1990). Changing Lenses: A New Focus on Crime and Justice. Scottsdale, AZ: Herald Press.

bottom of page