Carol Brooks is a cyber psychologist and leadership consultant whose work bridges industry and academia. Currently completing a PhD at the University of Huddersfield on covert cyber investigators and the psychological factors impacting their personal resilience and investigative decision-making, she aims to better understand the people behind covert online investigations. In this interview, Carol shares her research and invites readers to complete a survey on covert cyber investigator well-being.

Carol, can you tell us about your PhD and what led you to study covert cyber investigators?

I’ve wanted to study for a PhD for over a decade, but you really do have to wait until you find a subject area that has the potential to totally consume you and tickles the parts of the brain other topic areas just can’t reach. It was a lightbulb moment for me. I had been working across policing in different ways as a leadership consultant and then worked for a few years with a colleague who specialises in cybercrime investigations. I provided input around the psychology of decision-making, resilience and well-being. I became more and more curious about what the human experience must be like for cyber investigators working online in cyberspace as opposed to the more traditional off-line experience.

I was already a member of the British Psychological Society and again, out of curiosity, I joined their Cyberpsychology Section. All of these things seemed to produce a perfect storm, and I literally woke up one day and knew I wanted to do a PhD that focused on the Covert Cyber Investigator – decision-making, personal resilience and cyberspace. Here we are three years into a part-time PhD by research.

What makes the work of covert cyber investigators different from other roles in digital forensics or cybersecurity?

One of the things that fascinates me is the covert nature part of the role, which I think has been glossed over by some employers in terms of its potential impact on the investigator’s thoughts, cognitions and information processing, feelings, moods and behaviours. In short, we don’t understand enough about what is going on in the moment, when an investigator metaphorically steps into a different world to carry out their investigations, sometimes under a false persona (but not all the time) – that different world being cyberspace. It’s this characteristic of the role I find fascinating, and I would argue this is the uniqueness of the role that is little understood through research.

What I have found since starting down this path, is that for some people working as digital forensic investigators or within cybersecurity, there may well be covert online elements to their role. If we look across all sectors globally, there’s little consistency in job titles or role design. Someone with the title “Researcher” in policing might work covertly with open-source information and intelligence, while a digital forensic investigator outside policing could be investigating live networks undetected and identifying criminals by operating undercover online.

I guess this a way of saying, it’s not about a full-time covert cyber investigator being distinct from other types of digital investigation roles – many roles include some form of covert investigative activity, and there also seems to be a plethora of job titles.

Why did you decide to focus on the psychological factors impacting covert cyber investigators’ decision-making and personal resilience?

I suppose the key thing here is that I am a psychologist by profession and nature. I am both curious and fascinated by the connection between a person’s thoughts, feelings and actions, and I am driven to support people and organisations to fulfil potential in a way that is positive and healthy. My consultancy activities both in the cyber world and leadership world are underpinned by psychological theories and frameworks. So I suppose I was always going to focus on psychological factors, although I interpret this quite broadly, as some factors can be organisational as well as individual.

Decision-making and personal resilience/well-being have always been areas I have supported others with over the last 20 years or so, in many different guises, but the PhD has become an opportunity to dig deeper into the psychology behind these topics and to stay up to date with the latest research. What’s clear, even at this early stage, is that the extensive body of decision-making research applied in traditional or offline investigations doesn’t appear to have been applied or tested in the cyberspace realm of investigation – and certainly not in covert investigations. There is a lot of knowledge and research within the sphere of personal resilience, but again, not actually within the context of the experience of that moment of working in cyberspace.

The other important driver for me is a belief that it’s too late once someone is showing signs of stress and burnout. We need to look more upstream at the protective factors, such as personal resilience, and what the individual, employers and organisations can do to support this. I’m interested in the potential connection between a person’s level of personal resilience and their capacity for effective investigative decision-making. Both of these areas feature in my PhD, but more broadly, I’m also exploring what other factors might influence them – such as working patterns or organisational dynamics.

What challenges have you faced in reaching and connecting with people who work covertly?

I knew it would be challenging to connect with people across all sectors who carry out any type or level of covert cyber investigation. One of the issues seems to be that some people don’t realise they work covertly, or the word “covert” isn’t understood, with people assuming it just means “undercover”. Also, the job titles challenge that I mentioned earlier – this has meant that sometimes other people gatekeep connections on my behalf based on their own knowledge and understanding of what covert cyber investigation means.

The obvious challenge, of course, is the very nature of working covertly online, which understandably leads to extra scrutiny – and, dare I say, a degree of “suspicion” – about why I’m conducting this research, as well as its potential outcomes and consequences. It is frustrating at times, because of course, with my psychology background, all of what I do and why I do it comes from a good place, with good intent.

What can organisations do to better support the well-being and resilience of digital investigators?

My PhD research will ultimately help answer this question – if I can identify the psychological factors I mentioned in your earlier question about my work. So I can’t begin to second guess what will come out of the research, but I can voice an opinion based on my own experience of working with clients across the years. I sometimes describe what is needed as an “organisational scaffold” which is likely to be different in how it is built for each organisation.

At an organisational level, this scaffold might include elements such as access to psychological support for investigators; opportunities for investigators to develop self-awareness of their own well-being and resilience – understanding what helps and what doesn’t; senior leadership commitment to promoting awareness of well-being and resilience; a buddy or mentoring system that includes guidance on supporting well-being and resilience; and a resilience and well-being charter.

These are just some thoughts. I think it is more challenging when investigators work alone, maybe as contractors or freelance investigators. People in this kind of work may find it harder without organisational backing, as they need to create their own version of this scaffold to a greater or lesser extent – whether by connecting with like-minded peers, accessing one-to-one coaching or support, or working to better understand their own resilience and well-being red flags so they can take early action.

In my mind, if we focus effort at the resilience and well-being end, there is a chance, I would hope, of investigators not reaching the stressed, burned-out stage. Logically this is of benefit to organisations and individual businesses, because it means that we have fully functioning investigators who can carry out online investigations to the best of their ability. It’s a win-win scenario.

You’ve spoken previously about bridging the gap between industry and academia. Why is that important?

I think there is a virtuous circle that can develop where there are good links between academia and industry, where there is continuous learning and development of new knowledge flowing between the two. One feeds the other, and I would argue that this benefits the economy and society overall in the end.

That’s the very big picture, but on a day-to-day basis, there is no point, in my eyes, of an academic institution conducting research that cannot be accessed by industry in real time (as opposed to years later). There are, of course, systemic challenges to making this happen — such as cultural differences between academia and industry, the potentially lengthy publication process in academia, and varying levels of openness to new knowledge within industry.

Good practice is evident where strong links exist between academia and industry — for example, through professional doctoral programmes, joint industry–academia conferences, and outreach initiatives from professional bodies and academic institutions into industry. These are just a few examples; I’m sure there are many more.

And finally, what do you enjoy in your spare time?

This question made me smile, because at first my PhD WAS my spare time activity. I really do get a strange sense of enjoyment and a kind of meditation when I am in the zone reading, writing or problem-solving. However, in the spirit of looking after my own personal resilience in a more balanced way, I have re-calibrated over the past year or so. I am a long-standing member of the local Rowing Club and try to get out on the water when I can and train there with others.

I also took up powerlifting and strength training just over a year ago, and I am disciplined about going to these training sessions, because the buzz and enjoyment I get from lifting is immense. In summary, I guess my spare time is about connection with others, fresh air, and challenging myself both physically and mentally.

If you’d like to contribute to Carol’s research by completing the survey, the link is below. It takes no more than 15 minutes, is anonymous, and you can withdraw at any point before submitting.

If you need any further information, Carol’s email address is [email protected].