Guidance material

If your organisation has access to information or items that may be of value to organised crime groups, then you could be targeted.

Organisations most likely to be targeted are those with:

• decision making and regulatory powers, including organisations overseeing the security, construction, planning, and liquor and gambling industries
• access to sensitive information or law enforcement details
• access to large identity databases with personal identification information that could lead to identity theft, witness intimidation and extortion, or could be sold to other criminal groups
• control of property or goods with high resale value.

1. Make security a priority. Conduct risk assessments, perform regular random audits, and apply protections to high-value information.
2. Identify associations with criminal groups. Implement policies for employees to declare associations; make it mandatory during recruitment and employment; and define consequences for non-compliance.
3. Have strong pre-employment checks in place. Vet employees based on access and sensitivity levels; regularly monitor security clearances; and strengthen vetting for positions with increased access.
4. When using third-party recruitment agencies, follow the appropriate procurement processes and conduct due diligence to ensure they follow merit-based selection processes and have ethical practices.

There are several signs that could indicate someone has criminal associations. For example, the person may:

• display unexplained wealth
• request information that is not part of their role
• seek access to systems that are not part of their role
• work overtime or unusual hours
• not take leave.

1. Avoid any risk-taking behaviours that may lead to you being personally compromised by criminal networks including becoming financially implicated or indebted.
2. Exercise caution when using social media platforms because criminals may target you through these channels. Do not use social media to communicate sensitive information about your organisation, do not click on suspicious messages or links from unknown senders, and be wary when accepting friend requests from people you don’t know.
3. Don’t provide any details on your role, processes, systems or information you hold associated with your employment to anyone who doesn’t work at your organisation. Refuse any offers of payment for providing this kind of information to anyone.
4. Consider any pre-existing relationships that could put you in a compromising position through shared interests. Declare any actual, potential or perceived conflicts of interest to your employer.