Detecting Disgruntled Insiders

# Overview This talk discusses a method developed over 15 years to identify disgruntled, at-risk insiders by analyzing organizational communications using psycholinguistic indicators. By evaluating specific linguistic patterns against established baselines, the approach systematically filters massive message volumes down to a manageable fraction requiring review or investigation.

# Key Topics - Psycholinguistic Filtering: Reducing large corpuses of messages (such as millions of corporate emails) into small, high-risk subsets using baseline metrics. - Behavioral Indicators: Operationalizing linguistic markers for anger, blame, and victimization. - Statistical Baseline Modeling: Measuring the mean and standard deviation of specific language variables across relevant peer groups to identify statistical outliers. - Case Illustration: A real-world example of a system administrator at a New York bank who pushed back against management interventions before taking down critical accounting servers.

# Technical Details - Baseline & Filtering Funnel: In a client dataset of roughly 63 million messages from 117,000 senders, the filtering process started by querying messages containing more than five instances of the pronoun 'me' based on subgroup mean and standard deviation, immediately dropping the pool to 34,000 messages. Further psycholinguistic filtering cut this to less than 1% of messages from less than 1% of senders. - Investigation Outcomes: From the final filtered subset, one-third of the flagged communications were referred for a full investigation under the organization's low-threshold criteria, one-third presented issues that warranted ongoing monitoring without triggering immediate investigation, and one-third were false positives. - Psycholinguistic Variables: The system utilizes around 60 variables, covering dimensions such as anger, financial stress, sexuality, and violence. Key core variables include: - Negatives (Anger): Negations such as 'no', 'not', 'never', and contractions with "n't" (e.g., 'won't', 'can't'), signaling negative judgments and frustration. - Second-Person Pronouns (Blame): Direct references using 'you' and related personal pronouns, which surge when individuals feel cornered and direct blame externally (e.g., 'until you fire me', 'take orders from you'). - First-Person Object Pronouns (Victimization): Use of 'me', where the sender portrays themselves as the passive object of actions taken by others (e.g., 'relieve me', 'order me'). While low usage indicates passivity, high usage serves as a strong marker of victimization. - Domain Filtering: The method actively filters out non-relevant context, such as interpersonal relationship content (by demanding minimum references to employment) and religious phrases (such as references to 'the blood of Christ').

# Takeaways - Psycholinguistic analysis can detect 95% of at-risk communications across 100% of examined authors in experimental baselines. - Identifying outliers relative to the mean and standard deviation of peer communications offers an effective, systematic mechanism to drastically reduce noise and uncover severe insider threats before or during destructive actions.