Spying, Security and the Psychology of Secrets
A Fortune 100 director willingly passes confidential board room chatter to the press; a CEO slips into using any means available to plug the leak; private eyes are seduced from keyhole peeking into alleged criminal impersonations hoping to impress a big client, and a phone company clerk is flustered or pressured into releasing confidential call records.
What were they thinking?
The actors in the unfortunate events at Hewlett-Packard most likely weren’t thinking at all, and in fact may have been acting under the direction of their hard-wired personality preferences – traits which, in the absence of discipline or policy redirection, and in the presence of a personality-driven and divisive environment, hijacked the director’s recognition of his fiduciary responsibilities and common sense. The devil didn’t make them do it, their psyches did. It could happen to anyone.
It should be noted the authors have no special knowledge of the people and events that have taken place at Hewlett-Packard since May of 2005. We are simply observing, as is the rest of the business community, and expressing those observations as an expert in corporate intelligence gathering with 15 years’ experience, and a psychologist with 30 years of clinical and forensic profiling experience in the criminal justice and intelligence realms. What we do know from our collective experience is that hundreds of companies operate every day under the same forces we see playing out in the H-P case. Where a company employs humans, human behaviors follow. The illustrations and lessons learned become clear by parsing out the events and the personalities involved. This paper introduces the idea that there were more factors at work, in and out of the H-P boardroom, than simple ego, frustration, competitive anxiety or mean spiritedness.
The first question goes to the root of the matter. What compels a corporate director, or any employee entrusted with company secrets, to discuss confidential business topics with outsiders, or at the very least, feel it is permissible to do so? We are going to focus on this point because without that breach of security, the misjudgments, misbehavior and potentially career-ending events that followed might never have occurred.
Understanding the answer requires a brief introduction to psychological profiling of humans in general and executives in particular.
There are recognized behavioral characteristics that everyone has. Knowledge of profiling methods as used in the intelligence and law enforcement realms simply allows analysts to take what would appear to be innocuous traits of a subject and extrapolate behaviors. If we know that a particular executive displays particular traits, that individual’s responses in various scenarios are, to a degree variable with the number of data points, predictable.
The Myers-Briggs Type Indicator (MBTI) is the most familiar instrument for measurement of universal traits involving basic preferences. It has been in use for more than 35 years and is the tool most accessible to non-psychologists. Simple, non-intrusive questions like “Would you rather go to a party early and leave early or arrive late and stay late?” help the analyst understand how a person prefers to organize his life. In a business setting those preferences point directly to the importance of such things as interactions with others or the degree of detail an individual requires to be comfortable in his communications.
When asked by skilled researchers, MBTI questions can be posed directly to the subject in the course of a regular interview or conversation over a meal. Interviews are also often conducted “remotely”; that is, with individuals who have or had close contact with the subject. With enough information from those who know the subject, the results are nearly as accurate as if subjects blackened the boxes of a questionnaire themselves.
Personality preferences in the MBTI are articulated as four universal areas of preferences, captured as four pairs of dyads. Although conceived by Meyers and Briggs as mutually exclusive, these pairs can be understood as polar opposites along a continuum. The more strongly an individual scores in his preference type, the more likely it is that the specific preference will exert a strong influence over his behavior, whether recognized or not. The four sets of dyads are Introvert (I) vs. Extrovert (E) ; Sensing (S) vs. intuitive (N); Thinking (T) vs. Feeling (F) and Judging (J) vs. Perceiving (P). This is the origin of the cocktail party chatter one might hear that sounds like, “I’m an ESFP.”
‘Re-energizing Preference; I or E? The first pair, bounded by Introvert (I) and Extrovert (E), describes how an individual mentally recharges and refreshes himself. Does he “refuel” from the outside world of people, activities and things, or does he recharge in his inner world of ideas, emotions and impressions? Picture going to a bar after a long, exhausting day. The bar is full of other people relaxing and chatting over a glass before heading home. Are you glad to join them (Extrovert) or disappointed there are no quiet tables in a corner? (Introvert)
Receiving Information Preference; S or N? The second pair is bounded by preferences termed Sensing and iNtuitive. (The N is capitalized to differentiate from the capital I for Introvert.) This set describes an individual’s stylistic preference for taking in information. The Sensing types use their five senses to derive what is actual, real and specific. The iNtuitive or N-types use their sixth sense, and prefer to focus on the big picture or what might be, from a global perspective. When you last asked someone for directions did you become impatient when they described in detail the number of streets, the buildings and stores you’d pass, the angle of the intersection and so forth (N); or did you appreciate each bit of detail as reassurance you would find your way? (S)
Decision-Making Preference: T or F? The choice of Thinking vs. Feeling describes the subject’s preference for decision making. Thinking preference types are apt to organize information according to logic and honored, unchanging principles (Think justice.) while Feeling preference types will rank the decision they have to make against their sense of values in terms of the human impact specific to the case at hand. (Think mercy.) Anyone in a tight business climate who has had to decide on which members of his or her immediate team to lay off, knows where they are on this preference pair.
Organizing Daily Life Preference: J or P? Finally, the preference pair termed Judging vs. Perceiving points to how individuals generally prefer to organize their daily lives. The former, the J, seeks order, a schedule and principally closure; the latter, the P preference type, tends toward spontaneity, keeping his options open from day to day or even minute to minute, not needing to drive toward closure with one action or decision before taking up others..
But how do these different personality types generally approach secrecy and the guarding of confidential information?
Extroverts ( E types) , value open and free-ranging interaction. They tend to view communication as intrinsically more valuable than do their opposites, the I-types. This personality feature has several implications, both positive and negative: E-types tend to receive more information, more easily than do I-types, unless the latter are highly focused on the enterprise. Extroverts’ also give out more information in the course of the day. Because of the volume in and out, E’s have to pay stricter attention to sources, recipients and details of information. And if Extroverts deal in sensitive information, they have to expend energy watching the need-to-know aspect of their communications; energy they may not have at a particular point in time when additional caution is most needed. They have to operate quite distinctly and consciously from their instinctive and comfortable habits. Picture squinting to read each word of this paragraph or reading it aloud at, say, one word per second. Tiring, isn’t it?
Introverts, the I-types generally have an easier time holding information, for they tend to be more purposeful about the content of their disclosures, as well as instinctively, simply less productive, communication-wise. In some sense, retaining rather than revealing information is the Introvert’s default position. While they can be expected to be good at keeping secrets, generally, they can also be vulnerable to those very few people in whom they will confide. Introverts handling confidential information must make refined judgments about the reliability of their confidants and their sources, something the Introvert is rarely skilled through experience to do. Without specific training, I-types also often give greater clues via body language when they are withholding, calculating or otherwise strategizing in their communications. They simply do not have the fluency more often enjoyed by E-types.
Extroverts who are also S, Sensing, types tend to feel a need to deal in detailed specifics in both giving and receiving information. Without self-awareness of this trait, they can be more susceptible to disclosure. To some extent, Introverts who are also S-types are similarly vulnerable once they have decided that disclosure is necessary. On the other hand, iNuitive, N types tend to feel a need to provide the big picture to others, just as they, themselves, prefer getting a global, ‘over the horizon’ perspective. This leads to the possibility of disclosing general landscapes of information even while withholding specifics. As noted, in general, those types that instinctively value communication as well as information are going to be less likely to value secrecy, or even caution in disclosing ..
All the personality preference types, however, are entirely capable of deciding to establish and maintain secrecy, ad hoc, and in doing so the question for any individual is how far from his habitual, preferred behavior he has to move, in order to succeed. Self-awareness and discipline, reinforcement and support are the keys to success in this realm. When we encourage companies in our training classes to include a little printed reminder of the need for information containment in employee airline tickets, this is the kind of reinforcement and support that bolsters self -discipline.
We are not suggesting a mass psychological screening of every employee to determine who can and who cannot be trusted with the employer’s confidential information. The fact is that every employee from receptionist to CEO has access to different types of information that would be valued by competitors, or pique the interest of the press, investors or regulators. From the perspective of awareness of one’s own traits, the solution is much simpler. A useful level of operational mastery of the Myers-Briggs Type Indicator is eminently teachable to anyone who manages people inside or outside the company but particularly to sales forces, customer service people, managers, and team leaders, – basically anyone who must negotiate or influence other people in order to succeed themselves. The value of employee training in task-related psychological skills is widely – and increasingly – acknowledged in the corporate sector. What the HP fiasco points to is the need to recognize that directors, though highly accomplished, are subject to the same human characteristics, especially with respect to basic and universal preferences, and need the same self awareness and discipline that training can provide
The above discussion should make it clear that a standardized policy regarding information protection and confidentiality, such as Hewlett-Packard no doubt has in place , is a good first step. But we suggest that its management – indeed, most managements – do not understand that each employees will react differently situationally, as he or she approaches the line toward disclosure of information with which they have been entrusted. At some point the need to protect what they know for many will come in conflict with other, more basic and more powerful influences than “company policy.”
Profiling also draws on the insights provided by other psychological assessment instruments whose perspectives have been adapted to remote gathering of information. For example the FIRO-B test, measuring several dimensions of social needs, would suggest that those who need social connection with others, close affiliations and emotional warmth are rather less likely to see or experience the need for secrecy, as a matter of habit, than those with low needs in those areas. Without training, such individuals are also somewhat less likely to succeed in maintaining secrecy against any social pressure to disclose. They can be expected to experience conflict between competing personality needs. The characteristic ways in which executives approach decisions carry large implications for information-control. Collaborative decision-makers tend to disclose more information, as a practical matter, in the process of decision making and have to consciously focus on tactics aimed at maintaining secrecy if they are so motivated. According to another tool, the Executive Decision Style, (EDS) decision-makers described as “Maximizers” – those who prefer to amass all possible information before making decisions – have to deal with similar issues of strategic and tactical information control.
Finally, Motivational Drivers, as measured by the Weber Motivational Index (WMI) , also play a large role in determining an individual’s stance toward the need to establish and maintain secrecy. An individual who places a high priority on acceptance or risk-avoidance, for instance, will approach the issues surrounding secrecy and disclosure very distinctively from one who highly values recognition as a successful maverick and risk-taker. There are a number of other elements of personality that can be relevant in any specific case. In general, the issues for any individual turn on perception, world-view, history, habit and instinctive preferences, as well as self-awareness, discipline and skills that are brought to bear.
Experienced intelligence officers know how to spot and exploit the personal traits discussed in this paper when recruiting a source to reveal vital information. Practiced in the H-P case, it is highly likely that in the right circumstance and with the right form of inquiry, the leaking director would have exposed himself, obviating the need for a botched, ethically and legally compromised and hugely counterproductive investigation. To be sure such an inquiry may have taken more time, with remote profiling of each director and then establishing the most conducive social or business situation for each to be casually queried. It should be clear, however, that the risk-reward ratios for the latter option, are vastly superior.
Long before an investigation becomes necessary, however, policies and practices should be in place so that that no matter what the rank or personality type of an employee, or director each knows which information he or she must keep confidential, they recognize their vulnerability by personality trails or position, and they understand that the company will do all it can to protect its interests.
Awareness of vulnerability is no more effective by itself than any “Thou Shalt Not…” policy buried in a manual and visited only upon new employees.
Effective processes to implement sound policies must follow. A semi-annual security briefing for all employees should be mandatory, requiring that they acknowledge by signature their awareness of the policy and recognition of their employer’s right to investigate suspected misappropriation of information.
Highly sensitive information should be compartmented. That is, a need-to-know culture should be instilled in order that the smallest number of people has all of the information on confidential situations. This can be instilled in a positive and friendly way: It is not that your company doesn’t trust you. There are people and practices out there, like “pretexting”, that can trip up the most wary employee. If you don’t know, you can’t tell. And that’s a good thing for everyone’s comfort, confidence, morale and stock options.
At this writing the Hewlett-Packard story is still unfolding. There are hundreds if not thousands of business situations, however, where the dominoes have not yet started to fall, causing career-ending embarrassment, turmoil and expense, even if legal penalties are not the ultimate outcome. Combining self awareness, which most companies don’t, with common sense policies, which most do have… helps ensure those dominoes never even teeter.