November 2026 - Minaz Jivraj My Take: The Threat Within: Confronting Insider Threats in Educational Institutions

Educational institutions are built on relationships of trust. Students and families trust educators, administrators and school employees to provide a safe environment. School boards trust employees, service providers and contractors to protect students, facilities, information and public resources. This trust is essential to education. It also creates vulnerabilities when individuals misuse their positions, access or authority.

Insider threats are often associated with cybersecurity, data theft or deliberate sabotage. In educational settings, the risk is considerably broader. It includes abuse of students, inappropriate relationships, falsification of records, theft, fraud, unauthorized disclosure of personal information, impairment of safety systems, workplace violence and negligent conduct. These risks involve every occupational group, including teachers, administrators, educational assistants, office staff, custodians, maintenance personnel, school bus drivers, IT professionals and contracted service providers.

This article examines the nature of insider threats in education, considers documented Canadian and international evidence, and proposes an integrated approach to prevention, detection, response and institutional accountability. It argues that school safety strategies must address risks originating within the workforce as systematically as they address external threats.

Keywords: insider threat, school safety, personnel security, education, safeguarding, employee misconduct, risk management, cybersecurity, threat assessment, institutional accountability.

1. Introduction

Schools are complex operating environments. They bring together students, educators, administrators, support personnel, contractors, volunteers and visitors. Their daily operations depend on cooperation, professional judgement and access to people, buildings, equipment, records and technology.

This operating model requires trust. Teachers need access to students and classrooms. Custodians require access to buildings and mechanical systems. Maintenance personnel work in restricted areas. School bus drivers assume responsibility for students during transportation. IT personnel manage networks, user accounts and confidential information. Administrative employees handle student records, financial transactions and sensitive correspondence.

Each role carries legitimate authority and access. Each also presents potential vulnerabilities. The insider threat arises when an individual with authorized access, knowledge or a relationship with an institution uses that position in a manner that compromises its people, operations, assets or reputation. The conduct may be deliberate, reckless, negligent or accidental. It may involve criminal behaviour, professional misconduct, violations of policy or failures to follow established safety procedures.

The United States Cybersecurity and Infrastructure Security Agency (CISA), recognizes both intentional and unintentional insider threats. Its guidance emphasizes that an insider may exploit an existing relationship of trust to harm an organization’s mission, personnel, facilities, information, equipment or systems. The Canadian Centre for Cyber Security similarly identifies employees, contractors and partners as potential sources of intentional or unintentional risk.

For educational institutions, the implications extend beyond information technology. An employee who misuses access to a student, disables a security camera, discloses confidential information or disregards a transportation safety requirement presents a personnel security concern. The consequences may affect student welfare, institutional integrity, public confidence and the continuity of educational services.

A comprehensive school safety programme must therefore recognize the insider threat as an institutional risk.

2. Understanding the insider threat in education

An insider is not defined solely by employment status. The term includes anyone who has, or previously had, authorized access to an institution’s facilities, people, information, systems or operational processes.

This includes:

• Teachers, principals, vice-principals and other academic personnel.

• Educational assistants, classroom support workers and special education personnel.

• Administrative, reception, finance, human resources and student services staff.

• Custodians, maintenance workers, tradespeople and facilities personnel.

• School bus drivers, attendants and transportation coordinators.

• IT administrators, cybersecurity personnel and technology support staff.

• Food service workers, security personnel and other contracted service providers.

• Volunteers, placement students and individuals working under service agreements.

The risk does not arise simply because someone belongs to one of these groups. The relevant factors are the individual’s access, responsibilities, conduct, supervision and the controls governing the position.

Insider threats generally fall into three broad categories. Malicious conduct involves deliberate actions intended to cause harm or secure an improper benefit. Examples include theft, fraud, abuse, sabotage, unauthorized disclosure of information, deliberate interference with security systems and misuse of privileged access.

Negligent or reckless conduct involves failures to exercise required care. Examples include leaving sensitive records unsecured, sharing passwords, disregarding safety procedures, failing to report suspected abuse or operating a school vehicle while impaired.

Unintentional conduct involves mistakes or accidental actions. An employee might send confidential student information to the wrong recipient, expose a network to malware or grant access to an unauthorized individual through an administrative error.

The distinction matters. A threat management programme must respond proportionately to the nature, intent and consequences of conduct. It must not treat every mistake as evidence of malicious intent. Equally, an institution must not dismiss repeated negligence or serious policy violations as harmless administrative errors.

3. The occupational dimensions of insider risk

A common weakness in school security planning is the tendency to focus on teachers and administrators while overlooking the wider workforce. Insider risk follows access and opportunity. It is not confined to positions traditionally associated with instruction.

Academic personnel

Teachers and school leaders hold positions of considerable trust. Their responsibilities include supervision, student assessment, mentoring, discipline, safeguarding and communication with families.

Potential risks include inappropriate relationships with students, grooming, abuse, harassment, intimidation, falsification of academic records, unauthorized disclosure of student information and misuse of professional authority.

The Canadian Centre for Child Protection (C3P) has published research documenting sexual misconduct involving school personnel. Its 2018 study examined cases from 1997 to 2017 using disciplinary records, media reports and published case law. The research demonstrated the importance of examining misconduct across multiple information sources rather than relying solely on criminal convictions. tandfonline.com

C3P’s 2022 report identified 252 current or former personnel working in Canadian kindergarten to Grade 12 schools who had committed, or were accused of committing, sexual offences against at least 548 students between 2017 and 2021.

The report also identified 38 additional personnel charged with separate child sexual abuse material-related offences during the same period. These figures reflect the cases identified through the report’s research methodology. They are not a complete census of incidents across Canada, and allegations must remain distinct from proven findings.

These findings raise serious questions about reporting procedures, institutional investigations, professional discipline, transparency and the protection of students who disclose misconduct.

Administrative and support personnel

Administrative employees frequently have access to student records, emergency contact information, attendance data, medical information, financial records and confidential personnel files.

Misuse of this access may involve identity theft, unauthorized disclosure, manipulation of records, financial irregularities or inappropriate sharing of sensitive information. Reception and office staff also influence visitor management and access procedures. Weak verification practices or the deliberate circumvention of entry controls may expose students and staff to risk.

Custodial, maintenance and facilities personnel

Custodians and maintenance employees often work outside regular school hours. Their responsibilities may include keys, access cards, alarm systems, mechanical rooms, roofs, storage areas, cameras and other security infrastructure.

This access is operationally necessary. It also creates opportunities for unauthorized entry, theft, tampering, concealment of damage or interference with protective systems.

Facilities personnel who maintain or administer security equipment must operate within documented procedures. Changes to camera coverage, alarm configurations, door schedules and access permissions should leave an auditable record. Critical systems should not depend on the discretion of a single individual without appropriate oversight.

Transportation personnel

School bus drivers and transportation attendants assume direct responsibility for students beyond the school building. Their duties involve vehicle safety, student supervision, route management, emergency response and adherence to regulatory requirements.

Risks include impaired driving, inappropriate conduct toward students, unauthorized passengers, route deviations, failure to report incidents and misuse of student information.

In April 2026, the Oswego City School District in New York reported the arrest of a bus driver following an investigation into allegations of drug use while transporting students. The district said a community tip prompted its response and cooperation with local police. The driver faced criminal charges. The case illustrates the importance of reporting channels, prompt intervention and cooperation with law enforcement. An arrest or charge, on its own, does not establish guilt.

IT and cybersecurity personnel

Technology employees often hold privileged access to networks, databases, identity management platforms, student information systems, security cameras and communications infrastructure.

An insider with excessive privileges might access confidential records, alter or delete information, disable security controls, compromise user accounts or disrupt essential services. Even without malicious intent, poor password practices, insecure configurations and inappropriate data sharing create substantial exposure.

The Canadian Centre for Cyber Security recommends limiting privileges to the access required for an individual’s duties, reviewing administrative activity, maintaining audit logs, using multi-factor authentication and removing access when an employee changes roles or leaves an organization. These principles apply directly to school boards and educational institutions.

Contractors and service providers

Educational institutions rely on external organizations for transportation, cleaning, construction, security, food services, technology, maintenance and specialized support.

Contractors may receive keys, access cards, network credentials, student contact information or access to restricted spaces. Their employees may work in schools without direct supervision by board personnel.

Institutions must therefore extend personnel security requirements to contracted services. Procurement and contract management should address screening, supervision, access restrictions, incident reporting, confidentiality, subcontracting and the timely return of credentials.

4. Documented evidence and institutional lessons

The insider threat is not theoretical. Government reports, academic research, court decisions and documented incidents demonstrate how failures in personnel controls and institutional oversight expose students and organizations to harm.

The United States Government Accountability Office’s 2010 report, K-12 Education: Selected Cases of Public and Private Schools That Hired or Retained Individuals with Histories of Sexual Misconduct, examined 15 cases across 11 states. The report considered circumstances in which schools hired or retained individuals with histories of sexual misconduct. It identified weaknesses in information sharing, employment screening and institutional decision-making.

The report remains relevant to Canadian school systems. It demonstrates why hiring decisions must consider available information from previous employers, professional regulators and appropriate police record checks. It also reinforces the need for effective procedures when allegations arise during employment.

Canadian jurisprudence provides another perspective. In Fernandes v. Peel Educational & Tutorial Services Limited, 2016 ONCA 468, the Ontario Court of Appeal considered a teacher’s falsification of student grades and repeated dishonesty toward the employer. The Court found the misconduct sufficiently serious to justify dismissal for cause. The case illustrates how an employee’s deliberate manipulation of academic records undermines the integrity of educational assessment and the employment relationship.

These examples involve different forms of misconduct. Their common lesson is the need for reliable controls, credible reporting, documented investigations and appropriate accountability.

An institution should not wait for a criminal conviction before taking reasonable steps to protect students, staff or assets. At the same time, it must respect procedural fairness, privacy rights, employment obligations and the presumption of innocence where criminal allegations remain unresolved.

5. Why educational institutions are vulnerable

Several characteristics of the education sector complicate insider threat management.

First, schools operate on relationships of trust. Employees often develop long-standing relationships with students, families and colleagues. This trust supports learning and student development. It also makes some forms of misconduct difficult to recognize or report.

Second, educational institutions operate across multiple sites. A large school board may oversee dozens or hundreds of schools, administrative offices, warehouses, transportation facilities and specialized learning environments. Central security teams do not have continuous direct oversight of every location.

Third, many employees work independently. Custodians, bus drivers, itinerant staff, maintenance workers and contractors often perform duties outside the immediate supervision of school administrators.

Fourth, institutions must balance accessibility with security. Schools are community facilities. They host parent meetings, sporting events, evening classes, community programmes and public gatherings. Security controls must support legitimate access while protecting students and staff.

Fifth, reporting and investigation responsibilities are often distributed among human resources, school administration, legal services, special education, information technology, health and safety, child protection and security personnel. Without clear coordination, concerns may remain fragmented.

Finally, institutions sometimes hesitate to escalate concerns because of reputational, legal or operational considerations. A serious incident might be described as isolated, misunderstood or unrelated to the broader safety environment. Such language should never replace a documented assessment of the facts and risks.

6. The importance of an integrated insider threat management programme

Insider threat management should form part of an institution’s enterprise risk management and school safety framework. It should not operate as an isolated security project or a purely disciplinary process. An effective programme requires governance, defined responsibilities, consistent procedures and measurable oversight.

Leadership and governance

The school board or governing body should establish a clear policy recognizing insider risk as a matter of student protection, personnel security, operational continuity and information security.

Senior leadership should assign accountability for programme oversight. The policy should define roles for human resources, legal services, school administration, security, IT, privacy, health and safety, transportation and child protection.

A multidisciplinary assessment team

A standing multidisciplinary team should review significant concerns and coordinate institutional responses. Membership should reflect the nature of the risk. It may include senior administration, human resources, legal counsel, security, IT, privacy, student services and other relevant specialists.

The team should assess reported behaviour, access, opportunity, potential impact and immediate protective measures. It should distinguish between employee performance matters, professional misconduct, safeguarding concerns, criminal allegations and credible threats of violence.

Where a concern involves suspected child abuse, the institution must follow applicable statutory reporting duties and must not allow an internal process to delay a required report.

Role-based access management

Every position should have a documented access profile. Access should reflect the employee’s actual duties and should be limited to the minimum necessary.

A role-based access matrix should identify:

• Physical access to buildings, classrooms and restricted areas.

• Access to keys, access cards and alarm systems.

• Access to student, employee and financial records.

• Network, application and administrative privileges.

• Authority to modify security configurations or operational records.

• Access to vehicles, equipment and sensitive materials.

Institutions should review permissions when employees change positions, take extended leave or leave the organization. High-risk actions, such as changing camera coverage or modifying critical access controls, should require authorization and an audit trail.

Screening and ongoing personnel controls

Pre-employment screening remains important, but it is only one component of personnel security. Institutions should verify qualifications, employment history, references and required police record checks in accordance with applicable law.

Ontario’s Regulation 298/25 amended the province’s rules governing the collection of personal information by school boards. It requires police record checks for employees, school-site service providers, volunteers and students on educational placements. The type of check depends on whether the individual occupies a position of trust or authority in relation to pupils. The regulation also establishes recurring collection requirements and annual offence declarations in specified circumstances.

Screening must be lawful, relevant to the role and administered consistently. A police record check does not replace supervision, professional standards, performance management or effective reporting procedures.

Reporting and early intervention

Employees, students, parents and community members need accessible channels to report concerns. These channels should include options for confidential reporting and clear instructions for emergencies.

Reports should receive timely acknowledgement, risk assessment and appropriate referral. Institutions should document decisions and preserve relevant evidence. Staff should understand when to contact school administration, child protection authorities, police, human resources or the designated security office.

A reporting culture depends on confidence. Employees must know that concerns will receive fair consideration and that retaliation for good-faith reporting will not be tolerated.

7. Detection, investigation and response

Insider threat management requires careful observation and reliable information. It does not require intrusive surveillance of every employee. Institutions should identify indicators relevant to the specific risk. Examples include unexplained access to restricted records, repeated attempts to bypass security controls, unauthorized changes to access permissions, missing equipment, unexplained discrepancies in records, repeated breaches of student boundaries or attempts to discourage reporting. No single indicator establishes misconduct. Context, corroboration and a fair assessment of the available evidence are essential.

Digital systems should retain appropriate logs of access to sensitive information and changes to critical configurations. Physical security systems should record authorized changes and identify who approved them. Inventory controls should account for keys, access cards, devices and sensitive equipment.

When an incident occurs, the institution should activate a response proportionate to the risk. Immediate priorities include protecting students and staff, restricting potentially harmful access where justified, preserving evidence, notifying appropriate authorities and maintaining essential services. Investigations should follow established protocols. Investigators should document the allegation, evidence, interviews, decisions and rationale. They should maintain confidentiality while ensuring that information reaches those who have a legitimate need to know.

The institution should also examine whether the incident reveals a wider control failure. If one employee bypassed a procedure, the investigation should ask whether the procedure was poorly designed, inadequately supervised or inconsistently enforced.

8. Training, culture and professional accountability

Policies alone do not create a secure institution. Employees must understand their responsibilities and know how to recognize, report and respond to concerns. Training should reflect the duties and access associated with each position.

Teachers and educational assistants require training on professional boundaries, safeguarding, disclosure, student privacy and reporting obligations.

Administrative employees require training on confidentiality, identity verification, records management and appropriate disclosure.

Custodial and maintenance personnel need clear direction on keys, restricted areas, alarm procedures, security equipment and after-hours access. Transportation personnel require training on student supervision, impairment, incident reporting, route safety and emergency procedures. IT personnel require training on privileged access, audit logging, separation of duties, data protection and incident response. Contractors and service providers should receive site-specific orientation before accessing school property or systems.

Training should include realistic scenarios and practical exercises. Employees should know how to report a concern without attempting to conduct their own investigation or confront a potentially dangerous individual.

Leadership must reinforce a culture in which professional conduct, accountability and student protection apply equally across all occupational groups. Seniority, reputation or length of service should not exempt an employee from established standards.

9. Canadian legal and policy considerations

Canadian educational institutions operate within a framework of provincial and territorial education law, child protection legislation, privacy law, occupational health and safety requirements, employment law and criminal law.

In Ontario, the Child, Youth and Family Services Act, 2017 establishes a duty to report where a person has reasonable grounds to suspect that a child is or may be in need of protection. The duty applies directly to individuals, including professionals who work with children. Internal reporting procedures should support this obligation, not replace it.

Ontario Regulation 298/25 also reinforces the importance of police record checks for individuals working in school environments. Boards must understand the distinction between positions of trust or authority and other roles when determining the required type of check.

Institutions must also respect privacy and human rights obligations. Monitoring, screening, investigations and information sharing should have a lawful purpose and follow applicable requirements. Employee concerns should be assessed on evidence and conduct, not stereotypes, personal characteristics or unsubstantiated assumptions.

A sound programme therefore requires coordination between security professionals, human resources, legal counsel, privacy officers and child protection specialists.

10. Measuring programme effectiveness

An insider threat management programme should be evaluated through measurable performance indicators. Counting the number of incidents alone provides an incomplete picture. An increase in reports, for example, might reflect improved confidence in reporting rather than an increase in misconduct.

Useful measures include:

• Completion rates for required screening and recurring declarations.

• Timeliness of access removal following employee departures.

• Frequency of access reviews and privileged account audits.

• Completion of role-specific training.

• Time taken to acknowledge and assess reported concerns.

• Compliance with investigation and evidence-preservation procedures.

• Number of overdue corrective actions.

• Results of security audits and tabletop exercises.

• Recurring weaknesses identified across schools or departments.

Senior leadership should review these indicators regularly. Findings should inform policy changes, resource allocation, training and operational improvements.

11. Conclusion: Protecting the institution from within

Educational institutions have a responsibility to provide safe environments for students, employees and visitors. Meeting this responsibility requires an honest assessment of every source of risk, including risks originating within the workforce.

The insider threat is complex because it involves people who often hold legitimate authority, established relationships and access essential to the institution’s operations. The majority of employees perform their duties professionally and with integrity. An effective programme recognizes this reality while ensuring that trust does not replace accountability.

Teachers, administrators, educational assistants, office staff, custodians, maintenance personnel, bus drivers, IT professionals and contractors all contribute to the safe operation of a school. Their roles differ, but each carries responsibilities for student welfare, institutional property, confidential information and operational integrity.

School boards should therefore move beyond a narrow view of insider threats as a cybersecurity issue or an occasional employee relations matter. They should adopt an integrated personnel security programme supported by leadership, screening, access controls, supervision, reporting, investigation, training and continuous evaluation.

The objective is not to create a culture of suspicion. It is to establish a culture of professional accountability, where employees understand their responsibilities, concerns receive appropriate attention and students remain the central consideration in institutional decision-making.

School safety does not begin and end at the perimeter fence. It depends on the people entrusted with access, authority and responsibility inside the institution.

References:

1. Canadian Centre for Child Protection. (2022). The Prevalence of Sexual Abuse by K-12 School Personnel in Canada, 2017–2021. ⁠

2. Canadian Centre for Child Protection. (2018). The Prevalence of Sexual Abuse by K-12 School Personnel in Canada, 1997–2017. Journal of Child Sexual Abuse. https://doi.org/10.1080/10538712.2018.1477218

⁠

3. Canadian Centre for Cyber Security. (2024). How to Protect Your Organization from Insider Threats, ITSAP.10.003. Government of Canada.

Minaz Jivraj MSc., C.P.P., C.F.E., C.F.E.I., C.C.F.I.-C., I.C.P.S., C.C.T.P.

Disclaimer:The information provided in this blog/article is for general informational purposes only and reflects the personal opinions of the author. It is not intended as legal advice and should not be relied upon as such. While every effort has been made to ensure the accuracy of the content, the author makes no representations or warranties about its completeness or suitability for any particular purpose. Readers are encouraged to seek professional legal advice specific to their situation.