More often than not, though, rogue spies tend to steal information that will help them start up their own ventures, says Ammon. Such was the case of Sergei Aleynikov, the former Goldman Sachs computer programmer who was convicted of stealing proprietary trading algorithms from his employer. Aleynikov was sentenced to 10 years in prison last December.
Ammon says rogues may also become whistleblowers -- like Private First Class Bradley Manning, the intelligence analyst infamous for leaking more than 200,000 state department cables to WikiLeaks in 2009.
"Whether misguided or not, whistleblowers like this are going to become a bigger risk over time, especially as the next, far more open generation takes over IT," he says.
Anti-rogue defense: Restrict access to proprietary company information on a need-to-know basis, and make employees who have have access to sensitive data sign a confidentiality agreement that binds them even after they've left the company, says Heirmerl. This won't prevent admins from going rogue with your information, but it may make them think twice.
Rogue IT admin No. 5: The avenger
Hell hath no fury like an IT admin terminated for what he or she feels is unjust cause. It's the most common rogue admin story -- and the scariest.
Years ago when he worked for an ad agency, Troy Davis hired a young sys admin because he was reputed to have "mad Linux skillz." But Davis had to let the admin go after six weeks because he had accomplished nothing.
"A few days later a client called me to tell me his website was down," says Davis, who's now CTO at CoupSmart, a company that lets small to medium-sized businesses create coupon campaigns and distribute them via Facebook. "I logged into their server, and sure enough, every file related to the website had been deleted entirely."
A search of server logs turned up the few history files the attacker had neglected to delete, which recorded his IP address, log-in times, and complete shell history. When Troy contacted the service provider that owned the IP addresses, it confirmed the recently discharged admin was the guilty party.
"The local sheriff paid him a visit and let him know how close he was to serving time in prison, had I decided to press charges," says Davis. "We ultimately lost the affected client over the site deletion incident because they simply didn't trust us any more."