Human error

Safety science gives the most useful vocabulary. James Reason's taxonomy in "Human Error" (1990) distinguishes slips (the right intention, wrongly executed, such as picking the wrong autocomplete suggestion), lapses (memory failures, such as forgetting to revoke a leaver's access), and mistakes, where the plan itself is wrong, either rule-based (applying a familiar rule in the wrong situation) or knowledge-based (improvising in an unfamiliar one, such as misreading a firewall rule set). Violations are deliberate deviations from rules, usually well-meant shortcuts under time pressure rather than malice, and they sit on the boundary between error and intentional insider behaviour. The distinction matters because each type has a different remedy: slips and lapses are reduced by design and automation, mistakes by training and better information, and routine violations by removing the pressure or friction that causes them.

In security incidents the dominant error patterns are misdelivery of email, letters and files; misconfiguration, such as publicly readable cloud storage, databases exposed without authentication or overly broad sharing links; publishing personal data by mistake on a website; loss of devices and paper; and failed changes that take systems down. Several of these are latent conditions in Reason's sense, sitting unnoticed for months until someone finds them, which is why misconfiguration is often discovered by outside researchers or attackers scanning the internet.

Error-tolerant design treats the error as expected. Examples are external-recipient warnings and delayed send in mail clients, DLP rules that block or quarantine messages containing CPR numbers, secure defaults and policy-as-code that prevent public storage buckets, two-person review and staged rollout for infrastructure changes, full-disk encryption and remote wipe so a lost laptop does not become a breach, and undo, versioning and soft delete. Blaming individuals tends to suppress reporting, while a just culture that separates honest error from recklessness improves detection.

Regulatorily, intent is irrelevant. A misdirected email containing personal data is a personal data breach under GDPR Art. 4(12), and the controller must assess it and notify Datatilsynet within 72 hours under Art. 33(1) unless it is unlikely to result in a risk to data subjects, and inform them under Art. 34 if the risk is high; every breach must also be documented internally under Art. 33(5). Human error is the unintentional branch of insider threat, as distinct from malicious insiders, and it differs from social engineering, where the error is induced by an attacker who exploits the human factor.