The use of communicated negative sentiment and victimization for locating authors at-risk for, or having committed, insider actions

This article examines the challenge of locating persons at-risk for insider actions through communications by identifying psychological states and attributions associated with past insider violations. We specifically seek to expand and replicate two earlier studies (Shaw et al., 2013a, 2013b) which examined the relationship between negative sentiment and insider risk and the utility of psycholinguistic software targeting negative sentiment and feelings of victimization for locating communications of at-risk criterion groups within an organization's communication cache. The first study attempted to replicate Shaw et al. 2013a, in which two new rating tools for negative sentiment and insider risk were applied to 1000 randomly selected Enron archive communications to determine the frequency and overlap of messages containing negative sentiment and insider risk. In the present work the data set was expanded from 1000 to 10,000 messages. The second study attempted to replicate Shaw et al. 2013b by inserting 100 communications from authors at-risk for, or having committed, insider acts into the expanded Enron sample. The software used to operationalize the search for indicators of negative sentiment and victimization located 95% of the criterion group emails and all of the targeted authors inserted into the Enron sample. In Study 3, the repetition of this search using only indicators of negative sentiment caused a significant decrement in search results, reducing the percent of located emails from 95% to 58%. This result supported earlier findings (Shaw et al. 2013a, 2013b) emphasizing the dangers of using negative sentiment alone to locate indicators of insider risk. Finally, we described the true and false positive rates obtained when an enterprise version of the psycholinguistic software was deployed to locate similar at-risk communications in an actual mail cache containing over 50 million messages from over 63,000 Senders. The implications of all three studies and this field deployment for the relationship between negative sentiment and insider risk and the ability of investigators and analyst to locate potential insiders within organizational communication caches are discussed.