by Christa Miller
Quite a lot has been written over recent weeks about burnout. Not only DFIR-specific posts, first from Richard Bejtlich and then, in follow-up from Eric Huber and Brett Shavers; but also news articles including:
Clearly, as The Guardian relates, the problem is endemic across industries, professions, and organizations. Yet burnout in the digital forensics world is unique. In addition to more typical work and life pressures, digital forensic examiners are faced with traumatic images and audio, long hours, and justice that often seems to be unevenly applied. Few other people understand the job or its stressors, and for those working counterterror investigations, operational security limits the possibility of “talk therapy” even further.
What is burnout, and how do you identify it?
In his blog, Bejtlich reflects:
Starting in late 2014 and progressing in 2015, I became less interested in security. I was aggravated every time I saw the same old topics arise in social or public media. I did not see the point of continuing to debate issues which were never solved. I was demoralized and frustrated.
The Mayo Clinic defines job burnout as “a special type of work-related stress — a state of physical or emotional exhaustion that also involves a sense of reduced accomplishment and loss of personal identity.”
![]()
Burnout isn’t, however, a medical diagnosis, so defining it beyond “work-related stress” can be tricky. In some ways, it’s similar to depression. You might:
- Lack the energy to be productive, to go to the office, or even to get out of bed on workdays.
- Have trouble concentrating, or lose interest in otherwise enjoyable activities.
- Experience changes in sleep habits or the state of your physical health.
- Use food, alcohol, or drugs to numb out — or on the flip side, to try to feel something.
On the other hand, if limited only to work — you feel you come alive on weekends and holidays, for example — it may be burnout, and not depression. The Mayo Clinic’s article lists several other burnout-specific symptoms, including cynicism or irritability in the work environment, disillusionment with your job or workplace, or lack of a sense of satisfaction in your own accomplishments.
Conversely, as described in these pieces from Forbes and Inc, you might feel the need to “prove” yourself, working harder and longer hours. You don’t enjoy it, but because you’re convinced that no one wants to sit in your dark hole with you and you’re determined to find your way out, you stick with it.
Where does burnout come from?
Burnout, like other chronic conditions, is cumulative, and multiple factors often play into it. A 2014 PoliceOne.com article describes a variety of root causes of burnout in police officers. Among others, these causes often include:
- Shift work and overtime that can isolate you from family and friends, especially if you can’t choose shifts or you have to miss holidays and family events.
- Policies or procedures that seem more bureaucratic than beneficial, making it difficult to work efficiently or effectively.
- Unsatisfying assignments, as well as lack of advancement opportunities or professional development.
- Personality conflicts or working with toxic people at any level.
Forensic examiners both in and out of law enforcement can experience these factors. Work demands can seem neverending, especially if your forensic lab is understaffed, the volume of evidence suddenly increases, you have — as Shavers recalls from his own experience — other hats to wear, or your overall environment is fast-paced with a lot of productivity demands. As Huber succinctly put it: “too many hours and too much travel.”
![]()
While many agencies have dedicated budgets and resources to developing professional digital forensics examiners, others still include forensic labs in required rotations. That means that as much as you might love digital forensics work, another investigator might regard it as an “unsatisfying assignment.”
Indeed, sometimes burnout is the result of a misalignment of individual with the company or with the role. Huber notes “the tempo and politics of giant corporations,” while Bejtlich likewise writes:
The prospect of becoming part of a Silicon Valley software company initially seemed exciting, because we would presumably have greater resources to battle intruders. Soon, however, I found myself at odds with FireEye’s culture and managerial habits, and I wondered what I was doing inside such a different company.
That isn’t to say employees of small or medium companies can’t also experience burnout. Startups, for example, demand employees who can, for all intents and purposes, juggle twelve flaming swords while balancing one-footed on a tightrope for twenty hours straight.
In the forensics world, this might mean not only performing digital forensic examinations, but also finding new business, nurturing existing clients, making presentations to local groups, dealing with finances, and other aspects of running a business. Furthermore, as a company grows and its priorities shift, employees must adapt, sometimes more rapidly than they might be comfortable with.
One final factor: the nature of the job itself. Digital forensics examiners are routinely exposed to some of the most traumatic visual and auditory content you never wanted to imagine. Those responsible for analyzing evidence of child exploitation and terrorism content can experience “secondary traumatic stress,” according to a wide range of scholarly research.
Additional stressors, writes Dan Schmidt in a research paper, come from law enforcement colleagues who don’t value digital investigations because they aren’t “hands-on” enough (ironically an argument for mandatory rotation), a lack of appropriate training, and insufficient legal and procedural guidance. Schmidt notes that another source of stress can come from having to interact with suspects online, maintaining a less-than-savory undercover identity.
The impact of employee burnout
Burnout has personal, physical consequences for individuals, according to the Mayo Clinic piece. These include heart disease, high blood pressure, Type 2 diabetes, and a suppressed immune system.
Extrapolate that out to multiple employees, however, and you have to start to consider burnout’s broader implications. Another Forbes article details the business impact of burnout. It increases a company’s healthcare spending, for one, and can contribute to employee attrition.
![]()
That, of course, affects hiring and training budgets, as well as productivity for employees who are left behind. In a tight year, if the empty position is eliminated, other employees are at risk for burnout from the increased workload.
Of course, digital forensics isn’t the kind of profession where burnout can or should be allowed to fester for very long. It’s no exaggeration to say that digital forensics work impacts justice in the most profound way. From victim rescue to determining whether a person could lose their freedom, few stakes could be higher.
That makes a burned-out examiner an even bigger risk in digital forensics than in many other professions. Disorganization, procrastination, corner-cutting, and other work-quality killers could lead to mistakes that might result in the wrong suspect walking free — or the failure to save victims.
Dealing with burnout as an employee
Digital forensics tools have, to some extent, begun to reduce examiners’ exposure to traumatic content by deploying artificial intelligence and other technology. When these tools are available, use them — but don’t rely on technology exclusively to prevent burnout.
Shavers writes:
“I have never been approached with advice or support or suggestions or offers to take some of the burden, so I quickly learned that it is up to me to recognize where my pain threshold is and to take proactive measures to not cross that burnout line. My suggestion is that you should never expect anyone to tell you that you need a vacation. You have to check yourself constantly. Consider yourself lucky if someone else tells you that you need a break. And take the advice because they may see something you don’t.”
As for how to actually deal with a case of burnout? That’s largely up to you. The PoliceOne.com article lists six ways to prevent and manage burnout. For example, play harder than you work, making time for “laughter, fun, and excitement” with outside hobbies and interests. Huber took up shooting; Bejtlich, krav maga; while Shavers noted the importance of family.
You should also surround yourself with positive people who can model good coping and problem-solving skills and make you feel good when they’re around. Work on resiliency and self-care, including diet, exercise, and sleep, and do good by volunteering with an organization outside of law enforcement and your identity.
Non-work activities are also mentioned in the New York Times piece:
Mr. Crawford changed his lifestyle after he realized it made him miserable. Now, as an entrepreneur-in-residence at 500 Start-ups, an investment firm, he tells fellow founders to seek out nonwork-related activities like reading fiction, watching movies or playing games. Somehow this comes off as radical advice. “It’s oddly eye-opening to them because they didn’t realize they saw themselves as a resource to be expended,” Mr. Crawford said.
If you’re a highly sensitive person, like marriage and family therapist Brooke Nielsen, you might need to find different strategies like the ones Nielsen outlines. These could include a regular meditation or journaling practice, a reordering of your schedule, changes to your work responsibilities, or another job — or career — entirely. Huber writes:
If you do find yourself burned out, there isn’t anything wrong with making a change and finding different pastures, but it’s best to make those changes when it’s not a response to getting the point of being burned out in the first place. One of the best hedges against this is having activities outside of professional life that help manage stress and give you an opportunity to do something meaningful outside of career life.
Bejtlich recommends talking about it, acknowledging that it’s a difficult subject to discuss. It can be nerve-wracking to approach a boss or colleagues who may not understand, especially if you’re concerned that their lack of understanding will lead you out the door altogether.
![]()
However, while it may be true that “the only way out is through,” you should be able to go “through” together with leaders, mentors, colleagues, friends, and family you trust. If you don’t feel you can trust these people, you need new people (including changing jobs if required).
Finally, consider professional therapy. In particular, Eye Movement Desensitization and Reprocessing (EMDR) therapy may help first responders experiencing secondary traumatic stress.
Dealing with burnout as a manager
At a time when #DFIR Twitter is awash with discussions about the talent shortage, addressing burnout takes more than an individual’s capacity to source the company Employee Assistance Program or read through all the Google Search results on the topic. It’s not a sign of a weak employee, so much as the result of normal employees who have been pushed to their breaking points.
The tricky part is that everyone’s breaking point is different. Shavers writes about:
“… regularly bringing myself to the burnout line, because that is the way I am. I enjoy working hard, solving problems, and moving on to the next challenge….
“I believe that most everyone in InfoSec (DF/IR) has the same type of personality. We see broken things and want to fix them. When we don’t see broken things, we break things and try to rebuild improved versions of what we just broke. That’s the nature of problem solvers.”
Rather than viewing burnout as being strictly a personal problem, individuals — both employees and managers — should pay close attention to the environment they’re working in, and the one they’re creating either actively or passively. It may be that one burned-out employee is a signal of a problem that could end up affecting more than just that person.
You can hire and train for resiliency, as this PoliceOne.com article pointed out; traits like high self-esteem might be ingrained (and develop over time with a consistently positive work environment); while other traits, like flexibility, optimism, and the ability to move on, might be teachable.
You can also make sure you’re supporting examiners in your lab by purchasing the right tools, and sending them to the right training — including, if possible and relevant, courses offered by organizations such as the Innocent Justice Foundation’s SHIFT Wellness. Even tool-specific training, though, can help examiners when they know how to use features that limit their exposure to traumatic content.
For both individuals and cultures, just because something is, doesn’t mean it has to be that way. Company and department culture is a choice, and it’s up to everyone to participate — even if it means shifting priorities or assumptions.
![]()
That’s where articles like the Forbes piece on bucking the “cult of busy” habit can help. It outlines not just day-to-day changes for individuals to make, but also lists some of the ways companies (or to some extent, departments) can change their culture.
In the DFIR and infosec worlds, companies that prioritize, for example, time for employees to take vacations and pursue personal goals in between engagements might have a leg up on those that don’t. If you’re interviewing, ask how the company empowers and aids responders to avoid burnout; if you’re employed, become an advocate if you think things could be improved.
Managers and colleagues themselves can be a line of defense, as well, as Shavers points out:
“I look for burnout in others. And dude, if I see it, I am on it like no one’s business. If it comes down to me just giving a hug, a pat on the back, or having a serious sit-down, I do it on the spot. Consider that if you see burnout in someone, that is a problem. You are a problem solver. Go solve that problem. You might end up doing more than just saving someone’s job.”
Most importantly, burnout shouldn’t be treated as a breakdown. Rather, it’s an opportunity for everyone to learn and grow: for individuals to process their own limits, and for organizations to rethink how they do business.
” to “Play games while you ride your horse” and changed the string “I used to drive 4 hours a day to get to SF” to “I used to drive 4 hours a day to get to San Diego” in the message body.
