The Insider Threat
The museum world has a serious problem
The biggest news story in art security over the last year was the theft at The British Museum of 1,800 artifacts stolen from its collection over an extended period of time.
In a civil suit, the museum alleges that its longtime former curator, Peter Higgs, stole or damaged the pieces and sold them online. Higgs is countersuing, but one thing seems to be clear: the thefts were the work of an insider with access to gold jewelry, gems, and other small pieces that were not on public display.
The British Museum was notified early on of the apparent plunder of its collection by an outside gem specialist. Ittai Gradel, who purchased some pieces that he came to believe were taken from the collection illicitly, notified the museum to no initial avail.
While it’s easy to imagine the reluctance of an institution to believe that a trusted employee would steal from its collection, it’s well past time that museums and other cultural institutions pay careful attention.
An FBI estimate dating back to 1998 warned that 83% of all museum theft involves the complicity of staff or persons with privileged access. That’s an astonishingly high rate for insider theft.
For context, consider that a 2023 national retail security survey that included the jewelry industry found insiders complicit in shrinkage just 29% of the time. And the banking industry saw virtually the same rate: 30% of all breaches in finanical institutions were the work of insiders (Verizon Data Breach Investigation Report, 2020).
So why are museums so vulnerable to theft by staff? Three reasons come immediately to mind:
Access to collection pieces is essentially not only for visitors but for staff as well. This is because they must be studied, inventoried, and cared for by employees who often work alone. These same employees usually get into this particular line of work because of a passion for the very things they love and, sometimes, covet. Unfettered access can prove irresistable for the nefarious.
Even smaller insitutions often have very large collections that are nearly impossible to fully audit. The sense that a piece—especially one in storage—will not be missed can lead the unethical to claim it for themselves.
Aside from the directors, cultural institutions pay notoriously low wages. Insider theft is often perpetrated by those who think they are owed something by their employer because of what they view as an unfair salary.
Of course, there are many other reasons why insider theft occurs. But this begs the question, “What can be done?”
First and foremost, cultural institutions of every size must be committed to rigorous credentialling of all new hires. Each person who will have access to the collection, both in the galleries and in storage, must be subjected to a nationwide criminal history check. Some positions also beg for a credit history check. No chances should be taken with any employee, especially in the digital age. Today, vendors can quickly determine whether a new curator, janitor, librarian, etc., has been convicted of offenses that make them a risky hire for a workplace holding so many valuables.
Another step must be a robust access control program. Card readers are no longer an expensive idea. Cameras to work alongside them are getting less costly and more capable every day. There’s no excuse not to be able to tell who was where and when, and to review their actions as needed
Museums should also institute strict policies about accessing collection pieces. For instance, some museums do not allow employees to enter storage areas unaccompanied—and that includes rooms with access card readers and cameras.
Museum security policies should all be safeguarded, with information limited to only those with an operational need to know. Given the high attrition numbers among all security staff, but especially security guards, it’s vital that as few people as possible have a full understanding of all of the layers of security in place in any institution.
Finally, institutions should consider employee bag checks for all employees each time they exit the building, with senior leadership participating and setting the example. It’s vitally important that all levels of employees know that “even the director shows their bags when they leave.” It sets an important zero-tolerance posture.
Museums must work hard to prevent the insider threat. We know it exists, and there’s no reason it shouldn’t be the primary focus of security programs across the world.