# To Catch a Thief: Examining Socio-technical Variables and Developing a Pathway Framework for IP Theft Insider Attacks

Monica T. Whitty, Christopher Ruddy, David A. Keatley

► To cite this version:

Monica T. Whitty, Christopher Ruddy, David A. Keatley. To Catch a Thief: Examining Socio-technical Variables and Developing a Pathway Framework for IP Theft Insider Attacks. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.377-390, 10.1007/978-3-031-38530-8_30. hal-05462115

HAL Id: hal-05462115

https://inria.hal.science/hal-05462115v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# To Catch a Thief: Examining Socio-technical
Variables and Developing a Pathway
Framework for IP Theft Insider Attacks

Monica T. Whitty¹(✉) ID, Christopher Ruddy¹ ID, and David A. Keatley² ID

¹ Monash University, Melbourne, VIC, Australia
monica.whitty@monash.edu

² Murdoch University, Perth, WA, Australia

**Abstract.** IP theft insiders continue to pose threats to organizations, which can lead to large financial losses and reputational harm. This paper examines IP insider threat in a novel way by combining the methods of Grounded Theory and Behavior Sequence Analysis. Novel socio-technical variables identified in our study included IP theft via photographs rather than simply downloading data, travelling overseas, approaching other organizations, and delivering presentations. Contrary to previous assumptions about IP theft, the BSA revealed multiple, complex pathways that were not linear. The analysis showed the work behind seeking out potential organizations to sell the stolen IP. This occurred in some cases on multiple occasions (until the insider was successful at selling or continued, gaining multiple transactions). Uniquely, the paper proposes a new way forward in considering insider threats. We argue that insider threat takes place via non-linear and multiple pathways. Understanding insider threat by applying this framework opens up new, improved methods to prevent and detect Drawing from Situational Crime Prevention Theory, we provide guidelines for policymakers to make it harder for insiders to commit these acts (e.g., policies around personal devices and travel).

**Keywords:** Insider threat · IP theft · Pathway framework · Behavior Sequence Analysis · Socio-technical variables · Situational Crime Prevention · Human factors · Cybersecurity

## 1 Introduction

Intellectual property (IP) theft by insiders continues to pose a significant threat to organizations. IP insiders gain access to organizations' data, systems, and business secrets to steal intellectual property for financial gain or revenge [3, 17, 20]. Harms include financial, reputational, and intellectual property losses [19]. The economic cost of IP theft has been estimated to be 1 to 3% of the gross domestic product of developed countries or approximately USD 180 to 540 billion for the United States [4].

Whilst systems exist to detect insider IP theft, and policies have been developed to prevent it, much work is still needed in this space. Many insiders leave an organization
before detection [3], which is too late for IP theft. Anomaly detection is often employed
in organizations to detect deviations from normal behavior (e.g., downloading volumes
of data). This method, however, can have a high false-positive rate [12]. Rule-based
solutions for known attacks and anomaly detection can help improve detection tech-
nologies [13]. However, these systems, ignore situational awareness [1, 2] and do not
record physical behaviors [24], which have also been found to signify the risk of insider
IP theft [23], nor do they differentiate between attack types (fraud, sabotage, IP theft),
which may involve different risk indicators [3, 24].

Researchers have developed critical pathway models to help predict the likelihood that an employee will become a malicious insider [20, 21, 24]. This approach considers predisposing factors, such as personality traits, stressors, concerning behaviors, networks, contextual risk setting, and maladaptive organizational responses. Importantly, this approach considers events beyond detecting an anomaly or a series of technical events. A pathway model may help detect and prevent insider attacks (e.g., developing policy to improve organizational responses to problematic behaviors).

This paper explores a pathway framework for IP theft malicious insider attacks to assist in detection and prevention. Our model examines socio-technical indicators (i.e., the social and technical factors that interact in a system). Unlike other more qualitative models, we examine the interdependences and statistical connections between behaviors. In this way, we can more precisely predict the likelihood that certain behaviors will lead to an IP theft insider attack.

## 1.1 Related Work

The scholarly research on insider threat is rather slim, even more so for IP theft insider
cases. According to the available research, insiders are more likely to be men between 20–
45 years [22], with slightly more insiders holding a university qualification [5]. Willison
and Siponen provide a list of 25 techniques that could be used in the situational prevention
of insider attacks but have not researched the effectiveness of these methods or broken
them down by type of insider attack. For example, they suggest that access to facilities,
denying benefits and setting security policies may be of use [25]. Disgruntlement is
the more common motivation cited for conducting an attack, although Whitty [24] has
suggested a host of other motivations (e.g., addiction, greed).

Only a few studies have directly focused on the characteristics of IP theft insiders and
the pathways that lead to these attacks. IP theft insiders are typically male employees with
an average age of 37 years [21]. Approximately 65% of employees who commit insider
IP theft have already accepted a new job, and those who commit this crime typically
steal using the authorization privileges they had been given access to in their jobs. They
tend to be employed as scientists, engineers, programmers, and salespeople [3]. The
current understanding of the pathway to an IP theft attack is basic. The malicious insider
seeks to identify business secrets to steal or has been involved in creating the IP for the
organization; they then move to copy that information (downloading digital devices) and
finally leave that organization selling the IP or taking it to another organization [21].
This current understanding of IP theft makes it difficult to detect or prevent, as the theft
appears to occur quickly with little warning.
IP theft insiders have been categorized as entitled disgruntled employees or Machiavellian leaders [21]. Entitled, disgruntled employees often act alone and steal data either to take to a new role or for use in a side business [3]. However, they have also been found to work in groups (e.g., groups of software developers) [24]. The second category, also termed the ambitious leader recruits others to steal data [3].

## 1.2 The Current Study and Theoretical Framework

This paper has two main objectives, which are to a) assist in the detection of IP insider attacks and b) by gaining insights into IP insider attacks, develop suggestions for policy to prevent these attacks from occurring. We intend to achieve our objectives by investigating socio-technical variables evident in previous IP theft cases and statistically examine the chronological order of these events. This approach will help with detection tools, monitoring techniques (technical and human observation) and in developing policy to know what actions must be taken when certain behaviors or violations are observed.

Situational Crime Prevention Theory provides a useful lens to examine insider threats and guides the approach taken in this paper [5]. According to the theory, crime may be prevented by removing opportunities for offending, increasing the perceived effort and the risk of being apprehended, reducing anticipated rewards and provocations, and removing excuses [5]. If we can learn the typical behaviors that led up to an insider attack, as this theory suggests, we may discover methods to interject or develop policy to make it more difficult for potential IP theft insiders to continue down the predicted pathway to commit these attacks.

In line with our objectives, the following research questions were posed.

* RQ1: What socio-technical variables are involved in an insider IP theft attack?

* RQ2: What are the sequences of behaviors that lead to an insider IP theft attack?

* RQ3: How might our findings be used in policy to prevent IP insider theft?

# 2 Methodology

Prior to conducting the research, the university ethics committee approved the study. To explore the socio-technical variables involved in an insider IP theft attack, we conducted a ground theory analysis [22] of 86 confirmed cases of IP theft. To examine the statistical relationships between these variables, we conducted a Behavior Sequence Analysis (BSA) [8].

## 2.1 Data

The 86 IP theft cases were identified from online searches of court documents on legal websites. Cases were identified by using the terms 'IP theft', 'trade secret', or 'trade secret theft' in google searches of news reports and by searching within the United States Department of Justice website, using the terms 'inurl:justice.gov' alongside the terms 'IP theft', 'trade secret', or 'trade secret theft'. Then, court documents were obtained by searching for the insider's name and using the terms 'filetype:pdf' or the terms 'inurl:courts'. Most documents were drawn from the US Department of Justice website
(https://www.justice.gov). However, documents were also sourced from the US Govinfo (https://www.govinfo.gov), Casetext (https://www.casetext.com), Justia (https://www.justia.com), Dokumen (https://dokumen.tips), Cite Case Law (https://cite.case.law) and other legal websites. To ensure anonymity, we de-identified the insiders by referring to each case as a number.

Almost all cases were heard in the United States and at the District Court level. However, some cases were heard in the US Court of Appeals. Insiders were sentenced to varying terms of imprisonment in 45 of these cases. These cases occurred between 1985 and 2020; most cases (74 cases, or 86%) were committed between 2004 and 2018. We make note of these time periods, given that the methods used in attacks may evolve as technology changes. The types of organizations affected included finance, manufacturing, communications, health, education, information technology, retail, transportation, government, technology, and agriculture.

The cases were about ten pages in length. Below are examples of summarized cases.

A 31-year-old male employee of a wealth management division of a bank's Manhattan stole client information for personal advantage. The financial advisor obtained confidential client information from his employer by accessing computer systems without authorization. Computer systems were created to manage clients' confidential account information. The perpetrator's role as a financial advisor required him to provide financial and investment services to private wealth management clients; however, he accessed clients' account information outside his group. He performed approximately 6000 unauthorized searches of the computer systems and accessed details including names, addresses, telephone numbers, account numbers, fixed-income investment information and account values of approximately 730 000 clients. Over three years, he uploaded the information to a personal server as his home. During this time, he engaged in discussions concerning potential employment with two other financial institutions that were competitors of the victim organization. He was sentenced to three years probation and ordered to pay $600,000 in restitution.

A 63-year-old male US Department of State officer based in Virginia gained possession of classified documents and digital memory devices without authorization, transferred these to his home residence and later provided misleading statements to conceal his relationship with a foreign intelligence service. The man falsely denied engaging in conduct with her that might make him vulnerable to coercion, exploitation, or pressure from a foreign government. He was sentenced to 12 months imprisonment.

A 73-year-old male engineer from California provided space technology to a foreign government. After retiring from the victim organization, an airline company, the man commenced employment as a contractor. He worked on projects involving sensitive information and removed and concealed sensitive information relating to military technology, which he acquired for the benefit of a foreign government. Evidentiary materials presented in court revealed that the perpetrator pursued and maintained roles to steal IP and provide this to the foreign government. Letters
delivered to the perpetrator directed him to collect specific technological information, including the sensitive information about military technology he stole. In one of his responses, the perpetrator stated that he wanted to assist the foreign government in achieving its objectives. Whilst employed by the victim organization, the perpetrator made various trips to the foreign country, where he delivered lectures, met with representatives of the foreign country and discussed the ongoing IP theft and methods of delivering information. When federal agents searched his house, more than 250 000 pages of the victim company's documents were found inside a concealed space. He was convicted.

## 2.2 Selecting a Methodology

We selected a methodology that would address our objectives and research questions. Akin to previous research, we could have opted to analyze the data via a thematic analysis [e.g., 18, 22] employed in general systematic reviews of insider threat. This, however, would give us no more than a description of observed behaviors. Alternatively, we could have employed Crime Script Analysis, a method often employed by criminologists to examine crime patterns [11]. Researchers using this method are also interested in the events that occur before, during, and after an event. Crime Script Analysis allows the researcher to develop a more detailed account of the patterns of crimes rather than treating the crime as a “snapshot” of an event [11]. However, the limitation of this approach is that it lacks detail and cannot statistically account for the likelihood of events being linked. Moreover, this method does not allow researchers to examine temporal crime patterns. Given that our research questions focused on uncovering socio-technical variables (based on previous theory and being open to new theories) and learning the sequences of behaviors that lead to an insider IP theft attack, and we wanted to use these findings to develop policy to prevent IP theft (RQ3), it was deemed most appropriate to employ a Grounded Theory Analysis combined with a Behavior Sequence Analysis.

## 2.3 Grounded Theory

In line with previous research investigating insider threat [24], the first phase of our analysis employed Strauss and Corbin's grounded theory [22]. This approach allows for the development of new theories (inductive analysis) whilst also allowing the researcher to acknowledge previous theories and hypotheses [22]. Given that much work is needed to uncover the cyber and socio-technical variables involved in IP insider threat, we began our analysis acknowledging previous uncovered indicators [15, 24] but were open to elucidating new ones.

## 2.4 Behavior Sequence Analysis (BSA)

We applied Behavior Sequence Analysis (BSA) to investigate pathways to insider IP theft [9]. BSA enables the identification of statistically significant transitions between one behavior or event and the next and the mapping of these into chronological sequences. Due to its investigation of the chronological order in which behaviors occur, BSA enables the identification of behaviors that emerge early in the offending process and is therefore
conducive to supporting the prevention of insider IP theft. The method's focus on the sequence of behaviors or events also offers a means to guide insider IP theft detection in that identifying early indicators of insider behaviors could inform subsequent data collection and analysis. Although not previously applied to analyze the behavior of insiders - or insider IP theft, more specifically - BSA has been used to examine crimes such as murder [9] and stalking [10]. It is arguably, therefore, an appropriate method to investigate pathways to an insider attack.

# 3 Results

This section outlines the findings of our analysis of the IP theft cases. This includes a Grounded Theory Analysis followed by a BSA.

## 3.1 Grounded Theory Analysis Findings

Initially, categories were identified and arranged into lists. These were then separated into variables. Actions performed by the insiders were identified as behaviors, and external circumstances (e.g., being arrested) were categorized as events (see Table 1). As can be seen, many more variables leading up to an insider attack were identified than previously known. Known events include unauthorized access and misuse of the organization's systems, downloading data, and physical behaviors, such as recruiting co-offenders. [3, 7, 15, 21, 24]. Some noteworthy unknown variables include data to storage - photograph, communications relating to offending, approached by a rival organization, recruited co-offender, travel overseas, data to another government, delivered presentations, prepared to abscond, and the insider publicized the activity.

## 3.2 Behavior Sequence Analysis Findings

The BSA provides findings in state transition diagrams, which typically highlight stronger (i.e., those with higher frequency and Standardized Residual [SR])) pairings in the data. End-users and novice readers can easily interpret these flow-type diagrams. One caveat of the diagrams is to recall that they are underpinned by lag-one analyses – which are pairings of behaviors. While the diagram may appear to show longer sequences of codes (e.g., A → B → C), this would not be the correct way to interpret the diagram. Instead, the diagram should be read as A → B, B → C.

A BSA was applied to the events and behaviors (socio-technical variables) identified in the Grounded Theory Analysis. A state transition diagram was then drawn to illustrate graphically the sequence of behaviors and events in order of occurrence (Fig. 1). On the diagram, arrows connecting cells are presented with varying breadth to represent Standardized Residual (SR) scores. These measure the strength of the difference between observed and expected values and reflect the relative likelihood of one behavior or event preceding another. Broader arrows represent greater SR scores, meaning these connections are more likely to occur [9, 10]. Given that a complete diagram would include too many nodes and transitions to be interpretable, cut-off criteria were applied
<table><caption>**Table 1.** Behaviors and events identified through the grounded theory analysis.</caption><thead><tr><td>Behavior/Event</td><td>Definition</td></tr></thead><tbody><tr><td>Approached by rival organization</td><td>Approaches to the insider by another company</td></tr><tr><td>Approached competitor</td><td>Contact with potential, sponsors or other employers</td></tr><tr><td>Arrested</td><td>Being detained in relation to the IP theft</td></tr><tr><td>Collection</td><td>Attempts to gather data of interest to the insider's goal</td></tr><tr><td>Concealed conflict of interests</td><td>Dishonesty concerning affiliations with another organization</td></tr><tr><td>Communication of intent</td><td>Statements referring to future involvement in insider activity</td></tr><tr><td>Communications relating to offending</td><td>In-person or electronic discussions that refer to the theft</td></tr><tr><td>Damaged data/infrastructure</td><td>Damage, including manipulating and destroying data</td></tr><tr><td>Data to another government</td><td>The provision of stolen data to a foreign government</td></tr><tr><td>Data to another organization</td><td>Providing the victim organization's data to another company</td></tr><tr><td>Data to storage - online/removable storage</td><td>Moving to online storage or to detachable devices, such as a USB, CD or floppy disk</td></tr><tr><td>Data to storage - personal</td><td>Movement of data to the insider's own device</td></tr><tr><td>Data to storage - photograph</td><td>Copying data using photography</td></tr><tr><td>Data to storage - physical</td><td>Conversion of data to a printed format</td></tr><tr><td>Downloading - organization</td><td>Downloading the victim organization's data using its network</td></tr><tr><td>Deleted files from server</td><td>Concealment of insider activity through the removal of files</td></tr><tr><td>Delivered presentations</td><td>Delivering talks or speeches, especially to potential sponsors</td></tr><tr><td> DESTROYED physical document</td><td>Elimination of data in a printed format</td></tr><tr><td>Detection - before resignation</td><td>Discovery prior to the insider departure</td></tr><tr><td>Detection - during attack</td><td>Discovery during the commission of the offense</td></tr><tr><td>Detection - external notification</td><td>Discovery following advice provided by an outsider</td></tr><tr><td>Detected - following resignation</td><td>Discovery of the IP theft after the insider had given notice</td></tr></tbody></table>

(continued)
<table><caption>**Table 1.** (continued)</caption><thead><tr><td>Behavior/Event</td><td>Definition</td></tr></thead><tbody><tr><td>Detected - internal notification</td><td>Discovery based on information from another employee</td></tr><tr><td>Employment terminated</td><td>Discontinuation of the insider's employment</td></tr><tr><td>Found guilty</td><td>Being found guilty of wrongdoing in court</td></tr><tr><td>Insider publicized activity</td><td>Discovery after the insider made details of the theft public</td></tr><tr><td>Left organization - not abruptly</td><td>Departing the victim organization in a typical manner</td></tr><tr><td>Lied to investigators/court</td><td>Dishonesty during legal or investigative processes</td></tr><tr><td>Misused systems</td><td>Unauthorized use of the organization's systems</td></tr><tr><td>Overseas travel</td><td>Moving outside the country of victim organization</td></tr><tr><td>Prepared to abscond</td><td>Taking steps to flee, including by purchasing flights</td></tr><tr><td>Recruited co-offender</td><td>Involving, or attempting to involve others in the theft</td></tr><tr><td>Reluctantly continued employment</td><td>Expressions of a desire to depart the victim company, but continuing to work for the victim company</td></tr><tr><td>Resigned and separated</td><td>Giving notice, then departing the victim organization</td></tr><tr><td>Sold data/assets</td><td>Profiting from the organization's data or assets</td></tr><tr><td>Sought other work</td><td>Attempts to obtain alternative employment</td></tr><tr><td>Started new organization</td><td>Establishing another organization, especially a competitor</td></tr><tr><td>Stole equipment/assets</td><td>Theft of an organization's physical assets</td></tr><tr><td>Summoned to court</td><td>Being directed to attend court</td></tr><tr><td>Unauthorized access</td><td>Viewing or using data or systems without permission</td></tr><tr><td>Worked for rival organization</td><td>Commencing work with another organization</td></tr></tbody></table>

and only transitions with SR scores above three were included in the diagram - consistent with the BSA procedure [9].

The state transition diagram (Fig. 1) shows the complexity of IP theft. Contrary to previous understandings of IP theft, there are multiple pathways to consider, which are not all linear. For example, approaches to a competitor were an antecedent to overseas travel (n = 4, SR = 3.57), concealment of a conflict of interests (n = 3, SR = 4.78), and
<figure><img src="image_4.png" /><figcaption>Fig. 1. State transition diagram of behaviors and events leading to IP theft</figcaption></figure>
unauthorized access (n = 6, SR = 3.30), and a sequitur to other behaviors. These include overseas travel (n = 5, SR = 4.99), seeking other employment (n = 4, SR = 7.20), and unauthorized access (n = 4, SR = 2.25). Approaches by a rival organization were also both antecedents - to overseas travel (n = 3, SR = 4.64) and to communications relating to offending (n = 4, SR = 1.92) and a sequitur to behaviors. Notably, the recurrent nature of many behaviors that comprise the pathways also exists.

As indicated by the broadness of the arrows when compared to those representing other relationships in the diagram, the first three transitions in the IP theft sequence were amongst the strongest in the entire sequence. Importantly for early prevention, this suggests that behavior sequences in IP theft that demonstrate the most robust statistical significance - and therefore greater predictability - emerge initially rather than later in the offense pathway.

# 4 Discussion

This paper examined the socio-technical behaviors evident in 86 IP theft insider attacks. In addition, we investigated the temporal order of the occurrence of these behaviors, the interdependencies between indicators, and the statistical likelihood of one preceding succeeding another. The work presented here provides a comprehensive and insightful examination of the pathways that lead to IP theft attacks.

The Grounded Theory Analysis addressed RQ1. This analysis identified socio-technical variables consistent with earlier research [3, 15, 21, 24], such as unauthorized access and misuse of the organization's systems, downloading data, and physical behaviors, such as recruiting co-offenders. The downloading of large volumes of data is a socio-technical variable frequently noted in the literature on IP theft. However, new variables were also revealed. One of the most interesting new variables was the use of photography to record IP. This demonstrates the evolving technical nature of insider threats. Given that SOCs can identify large downloads of data, alerting an organization to a potential threat [11], the use of photography to record IP makes it much harder to detect in this way. Instead, organizations may choose to implement other surveillance methods, such as camera surveillance combined with AI [16], should they deem IP theft to be a concerning threat and should they decide that such surveillance techniques are ethical and appropriate for the workplace (a decision that should not be taken lightly) [24]. Alternatively, policies around limits of digital devices in particular zones and increased levels of security access might be a desirable method forward for some organizations. Understanding these new attack methods will help organisations re-work policy as new methods are noted and technology evolves.

Other new socio-technical variables identified in our study included communications referring to details of the IP theft, travelling overseas, approaches to other organizations and the delivery of presentations. Communications that accidentally and intentionally leak IP theft have been identified in previous studies [1, 2, 8]. However, to our knowledge, no studies have identified the delivery of presentations in the pathway to an IP insider attack. This may be because the few available IP insider studies have focused on what occurs in the place of work and how IP might travel via digital devices. Moreover, the assumption is that malicious insiders find new employment and bring the IP of other
organizations, unknowing to that organization [3, 6], or that nation-states actively coerce others to steal IP [6]. Our study uniquely reveals that insiders work hard and sometimes travel overseas to sell the organization's IP. These actions are unlikely to be detected via digital surveillance. Contrary to previous literature, the work here also demonstrates the complexity of insider threats.

The BSA addressed RQ2. This analysis highlighted that multiple and complex pathways are involved in insider IP theft and that not all pathways are linear. Akin to previous research [3, 14, 21], we found that the pathway of data stored to physical (i.e., printed out) led to misused systems, which led to unauthorized access (probably to acquire IP the insider did not have access to). This path then returns to the storing of data on digital devices. This finding highlights the importance of detecting unauthorized access, which many organizations already undertake [13], but also demonstrates that once this is identified, there are additional indicators to seek out if IP theft is a concern for that organization, such as employees approaching competitors and travelling overseas. Notably, in many of these cases, the employee remained in the organization after the initial IP was stolen, and then they continued to steal IP. This contradicts previous research, which suggests that once IP is stolen the employee abruptly leaves that organization [3, 17, 21, 24]. The BSA also revealed that some IP insiders join an organization intending to steal IP, indicated by the stand-alone socio-technical variables – sold data/assets, which lead to stolen equipment/assets. This is consistent with previous research [3, 17, 21, 24].

The BSA highlighted some unique and recurrent pathways not identified in previous research. For example, we found that communications related to offending led down various pathways to eventually communicate with rival organizations (that the insider sought, or organizations sought them), travel overseas, and conduct presentations. Whilst some of these behaviors may be difficult to detect, if earlier suspicious digital behaviors are observed combined with travel, an organization might be concerned that they have an IP theft insider.

Taking the Grounded Theory and the BSA findings together, our work confirmed the importance of some indicators already used in detection, such as unauthorized access and downloading data. We also revealed new indicators (e.g., communications with externals to sell the IP). These variables are essential in any anomaly detection. However, our findings also provide strong evidence for using rule-based solutions for known attacks. We have identified pathways systems could incorporate into the algorithms to detect potential problematic behaviors.

Our final RQ asked how our findings might be used in policy guidance to prevent IP insider attacks. In addressing this question, it is helpful to consider Situational Crime Prevention Theory, described earlier in this paper [5]. As a reminder, this theory suggests that crime may be prevented by removing opportunities for offending, increasing the perceived effort and the risk of being apprehended, reducing anticipated rewards and provocations, and removing excuses [5].

Notably, our paper highlighted technical and physical behaviors of concern that could help reduce the risk of an IP theft attack. Some of the technical behaviors occurred on digital devices owned by the insider (e.g., communications, downloads, taking photographs of the IP), most likely conducted to avoid detection. If organizations are very concerned about IP theft, they may decide to create policies around personal devices
in the workplace. Some physical actions could be considered in policy to help prevent IP theft. For example, we learnt that insiders travelled overseas to meet potential rival organizations and conduct presentations. There may be policies developed around travel (e.g., travelling with others if for work, restricting countries employees might travel around for work). This might make it more difficult for insiders to meet potential buyers of the IP they have stolen.

Further, our research revealed a cluster of insiders who joined an organization to steal IP deliberately. Organizations concerned about IP theft may employ more stringent vetting procedures to help prevent malicious insiders into their workplaces.

Notably, the contribution of this paper to the field is more than a set of findings. This paper offers a new framework to understand and study insider threat. No longer may scholars and organizations approach these threats as a simple linear pathway. Moreover, the attacks can be multiple. As the analysis showed, numerous attempts were made in arguably non-subtle ways to steal and sell IP. Contrary to what is generally accepted, many IP insiders sometimes sell portions of IP over time and/or to multiple buyers.

# 5 Conclusions

The study of IP theft insiders and how they systematically undertake an IP theft attack is an under-researched area. However, gaining a rich understanding of the behaviors and events involved in these attacks and the pathways of these events is critical if organizations are to develop more effective techniques to detect and prevent IP theft insider attacks. This research employed novel techniques, combing Grounded Theory and a relatively new type of analysis called BSA (not previously used to examine IP theft but supported across a range of social and criminal behaviors). This analysis provides insights into novel socio-technical variables (given that we considered technical and physical behaviors and events) and the statistical likelihood that one variable leads to another. Novel variables, especially of note, included photographing IP, seeking out organizations to buy IP, travelling overseas and conducting presentations. Contrary to what was previously assumed, we uncovered multiple pathways, many of which were non-linear. We have demonstrated the complex nature of insider attacks and the need to broaden the focus beyond technical indicators.

There are a few significant limitations to note. First, this is one sample of IP theft cases, all of which were discovered by the organizations that went to court. Many IP theft cases are potentially undiscovered, and of those that do, not all go to court (especially for organizations who believe it is a risk for the public to learn about their stolen IP). In addition, our study did not consider the psychological profiles, psychological concerns (e.g., stressors), and organizational stressors examined in previous studies [19, 21, 24].

Despite the significant limitations, the methods used here might be applied in future studies. Moreover, the novel findings (variables and pathways) might be considered by scholars and employed in organizations to improve the detection and prevention of IP insider threats. The work presents a new way of considering pathway models to insider threat. It proposes a new theoretical understanding – that insider threat may be (at least for IP theft) non-linear and complex. Such new ways of understanding may help to develop more effective tools and policies to prevent and detect IP theft.
**Acknowledgements.** This research is supported by a grant funded by the Department of Defence
Next Generation Technologies Fund (NGTF) initiative.

References

1. Ahmad, A., Maynard, S.B., Desouza, K.C., Kotsias, J., Whitty, M.T., Baskerville, R.L.: Cybersecurity incident response in organizations: an exploratory case study and process model of situation awareness. Comput. Secur. **101**, 102122 (2021)

2. Ahmad, A., Desouza, K., Maynard, S.B., Whitty, M., Kotsias, J., Baskerville, R.: Situational-awareness in incident response: an in-depth case study and process model. In: ICIS 2020 Proceedings, vol. 1 (2020)

3. Cappelli, D.M., Moore, A.P., Trzeciak, R.F.: The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes (Theft, Sabotage, Fraud). Addison-Wesley, Upper Saddle River (2012)

4. Ciuriak, D., Ptashkina, M.: Quantifying trade secret theft: policy implications. CIGI Paper, 253 (2021)

5. Clarke, R.V.: Situational crime prevention: theory and practice. Br. J. Criminol. **20**, 136–147 (1980)

6. Collins, M.L., Spooner, D., Cappelli, D.M., Moore, A.P., Treciak, R.F.: Spotlight on: Insider theft on intellectual property inside the United States involving foreign governments or organisations. Software Engineering Institute. CERT Division, Carnegie Mellon University, Massachusetts (2013)

7. CPNI: insider data collection study - Report of main findings (2013). http://www.cpni.gov.uk/Documents/Publications/2013/2013003-insider_data_collection_study.pdf. Accessed 2 Apr 2023

8. Frishammar, J., Ericsson, K., Patel, P.C.: The dark side of knowledge transfer: exploring knowledge leakage in joint R&D projects. Technovation **41**(42), 75–88 (2015)

9. Keatley, D.: Pathways in Crime: An Introduction to Behaviour Sequence Analysis. Springer, Tunbridge Wells (2018)

10. Keatley, D.A., Golightly, H., Shephard, R., Yaksic, E., Reid, S.: Using behavior sequence analysis to map serial killers’ life histories. J. Interpers. Violence **36**(5–6), 2906–2928 (2021)

11. Keatley, D.A., Mcgurk, S., Allely, C.S.: Understanding school shootings with crime script analysis. Deviant Behav. **41**(9), 1084–1096 (2019)

12. Knerler, K., Parker, I., Zimmerman, C.: 11 Strategies of a World-Class Cybersecurity Operations Centre MITRE, Massachusetts (2022)

13. Liu, M., Li, M., Sun, D., Shi, Z., Lv, B., Liu, P.: Terminator: a data-level hybrid framework for intellectual property theft detection and prevention. In: CF 2020: Proceedings of the 17th ACM International Conference on Computing Frontiers, pp. 142–149. Association for Computing Machinery, New York (2020)

14. Maloof, M.A., Stephens, G.D.: Elicit: a system for detecting insiders who violate need-to-know. In: Kruegel, C., Lippmann, R., Clark, A. (eds.) RAID 2007. LNCS, vol. 4637, pp. 146–166. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-74320-0_8

15. MITRE: ATT&CK Matrix for Enterprise. https://attack.mitre.org/matrices/enterprise/. Accessed 2 Apr 2023

16. Nguyen, M.T., Truong, L.H., Tran, T.T., Chien, C.-F.: Artificial intelligence based data processing algorithm for video surveillance to empower industry 3.5. Comput. Ind. Eng. **148**, 106671 (2020)
17. Nurse, J.R.C., et al.: A critical reflection on the threat from human insiders – its nature, industry perceptions, and detection approaches. In: Tryfonas, T., Askoxylakis, I. (eds.) HAS 2014. LNCS, vol. 8533, pp. 270–281. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-07620-1_24

18. Prabhu, S., Thompson, N.: A unified classification model of insider threats to information security. In: ACIS 2020 Proceedings, vol. 40 (2020)

19. Sarkar, K.R.: Assessing insider threats to information security using technical, behavioural and organization measures. Inf. Secur. Tech. Rep. **15**(3), 112–133 (2010)

20. Shaw, E.D., Sellers, L.: Application of the critical-path method to evaluate insider risk. Stud. Intell. **59**, 1–8 (2015)

21. Shaw, E.D., Stock, H.V.: Behavioral risk indicators of malicious insider theft of intellectual property: misreading the writing on the wall. White Paper, Symantec, Mountain View, CA (2011)

22. Strauss, A., Corbin, J.: Basics of Qualitative Research: Grounded Theory Procedures and Technique. Sage, London (1988)

23. Walker-Roberts, S., Hammoudeh, M., Dehghantanha, A.: A systematic review of the avail-
ability and efficacy of countermeasures to internal threats in healthcare critical infrastructure.
IEEE Access **6**, 25167–25177 (2018)

24. Whitty, M.T.: Developing a conceptual model for insider threat. J. Manag. Organ. **27**(5), 911–929 (2021)

25. Willison, R., Siponen, M.: Overcoming the insider: reducing employee crime through situational crime prevention. Commun. ACM **52**(9), 133–137 (2009)