Source code exfiltration by people who are supposed to have it

The contractor has read access because the job requires read access. A clone is how they start their first day and also how the code leaves. The traffic looks the same either way.

Part of Remote workforce identity

Why content inspection does not help

Every row fails for the same reason: nothing about the action is unauthorised. The problem is not the access, it is the scope of what leaves at once.

The bulk-operation insight

Day-to-day engineering work involves incremental operations: fetching changes, pulling a branch, reading files. Bulk operations are rare.

• A full clone of a repository — typically once per developer per repository
• An archive or bundle export
• A mass download through a web interface
• A wholesale API enumeration of repository contents
• Cloning many repositories in quick succession

The last is the clearest signal. A developer clones the repositories they work on. A departing contractor clones everything they can reach.

Gating rather than detecting

# At the code host, on bulk operations only

def authorise_bulk(user, operation, scope):
    if scope.repository_count == 1 and user.has_prior_clone(scope):
        return allow()          # re-clone of something they work on

    statement = render({
        "operation": operation,             # clone | archive | export
        "repositories": scope.names,        # explicit list
        "total_size": scope.bytes,
        "requester": user.name,
        "employment_type": user.type,       # employee | contractor
        "contract_ends": user.contract_end,
        "prior_clones_30d": user.recent_bulk_count
    })
    return require_manager_signature(statement)

Two fields in that statement do disproportionate work. contract_ends surfaces that a contractor is leaving in a fortnight, and prior_clones_30d surfaces a pattern the manager would otherwise not see.

Why a manager signature rather than an automated rule

An automated rule has to decide in advance what is legitimate, and legitimate bulk access happens constantly: onboarding, migrations, security reviews, incident response.

A manager knows whether this contractor needs all seventeen repositories this week. The signature makes that judgement explicit and attributable, which is both a deterrent and a record.

The offboarding window

Exfiltration concentrates around departure, and the period between a resignation and the last day is when access is broadest and attention is lowest.

1. On notice of departure, flag the account. Bulk operations require signature regardless of prior pattern.
2. Review what the departing person accessed in the preceding period, not only afterwards.
3. Reduce scope progressively rather than all at once on the final day.
4. For contractors, tie access expiry to the contract end date automatically — which is frequently not done.

The fourth is a common finding. Contractor accounts routinely outlive contracts because deprovisioning depends on someone remembering.

What this does not stop

Slow exfiltration. Someone copying files gradually over months, within normal access patterns, is not caught by a bulk-operation gate and is not caught by anything else either.

It also does not stop photographs of a screen, which remains the unaddressable channel and always will be.

What it does is close the fast path. An operation that currently takes four minutes and moves an entire codebase now requires a named person to authorise it — which does not make theft impossible, but makes it slow, visible and attributable.

A worked example: the notice window

A contractor with repository access gives two weeks' notice on a Monday. Access is revoked on their last Friday. Between those two points everything they do is authorised.

The last row is the only one that produces a decision rather than a suspicion, and it is the only one that produces an artefact afterwards showing who authorised what.

Objections and honest limits

“A threshold on clone size will fire on legitimate work.” It will, occasionally. The difference from anomaly detection is what happens next: a person signs, in seconds, and the event becomes evidence rather than a queue entry.

“This does not stop patient, low-volume theft.” Correct, and worth saying plainly. Someone taking a file a day for a year is not caught by this or by anything else currently deployed.

Closing the notice window

1. Define what a bulk operation is per repository. Size, file count, or history depth.
2. Require a countersignature above that threshold. From a manager, not an automated rule.
3. Tighten thresholds during notice periods. The window where risk concentrates.
4. Revoke at notice, not at last day, for sensitive repositories. Access continuation is a choice, not a default.
5. Keep the signed record with the repository. So the question of authorisation has an answer.

Terms used here

Bulk operation

An access pattern whose scale, not content, distinguishes it — a full clone, a mass export, a history download.

Notice window

The period between resignation and revocation, when authorised access and departure intent coincide.

Countersignature

A second signature from a manager, binding a named human to the authorisation.

Frequently asked questions

Why doesn't DLP catch this? The access is authorised, the traffic is encrypted to a legitimate service, and the content is classified for a user who is cleared for it. Nothing about it is anomalous.

What is the clearest signal? Cloning many repositories in quick succession. A developer clones what they work on; a departing contractor clones everything reachable.

Why a manager signature rather than a rule? Legitimate bulk access happens constantly and a rule cannot encode the judgement. A manager knows whether this person needs seventeen repositories this week.

What does it not stop? Slow exfiltration within normal access patterns, and photographs of a screen. It closes the fast path and makes bulk theft slow, visible and attributable.

Why not just detect the anomaly? Because it is not anomalous. Authorised access used as authorised looks like work, and the only difference is scale, which legitimate work also produces.

Why a manager signature rather than an automated rule? A rule can be satisfied by the same credential doing the exfiltration. A second human cannot be, without a second compromise.

What does this not stop? Slow, patient, low-volume theft. Nothing currently deployed stops that either.

Sources and further reading

• Published research on insider data exfiltration patterns and departure timing.
• FTC — business guidance on marketplaces and consumer protection
• CMS — Medicare provider enrollment
• NIST SP 800-53 Rev. 5 — Security and Privacy Controls
• CISA — Insider Threat Mitigation Guide