Can security vetting be extended to include the detection of financial misconduct?

An analysis of the security vetting files of 19 employees within a South African national department who had been found guilty of financial misconduct in the last five years uncovered that the existing security vetting processes did not detect the financial misconduct of which these employees have been found guilty. This research sets out to establish whether security vetting can be extended to include the detection of financial misconduct within the department and, if so, how. Moreover, if security vetting can indeed be so extended, can it possibly enhance the management of fraud risk across all South African public sector departments? Qualitative interviews were conducted with 27 employees who are key to fraud risk management and security vetting within the researched department. During the interviews, the following five themes emerged: (1) the reasons why employees commit financial misconduct; (2) why it is not detected by the security vetting process; (3) the potential alignment of the security vetting process to facilitate the detection of financial misconduct; (4) the following through on security vetting findings; and (5) sharing these findings with the internal audit and risk management functions within state departments. These themes were probed and are reported on, establishing firstly that security vetting can indeed be extended to include the detection of financial misconduct within the researched department, and secondly that it can enhance the management of fraud risk across all South African public sector departments, given the specific mandate of the State Security Agency (SSA) and the national security vetting strategy.     

Nuclear deterrence and cyber warfare: coexistence or competition?

Nuclear deterrence and cyber war seem almost antithetical in their respective intellectual pedigrees. Nuclear weapons are unique in their ability to create mass destruction in a short time. Information or “cyber” weapons, at least for the most part, aim at sowing confusion or mass disruption instead of widespread physical destruction. Nevertheless, there are some intersections between cyber and nuclear matters, and these have the potential to become troublesome for the future of nuclear deterrence. For example, cyber attacks might complicate the management of a nuclear crisis. As well, information attacks on command-control and communications systems might lead to a mistaken nuclear launch based on false warnings, to erroneous interpretations of data or to panic on account of feared information blackout. It is not inconceivable that future nuclear strike planning will include a preliminary wave of cyber strikes or at least a more protracted “preparation of the battlefield” by roaming through enemy networks to plant malware or map vulnerabilities.