Sorting Insiders From Co-Workers: Remote Synchronous Computer-Mediated Triage for Investigating Insider Attacks.

OBJECTIVE: Develop and investigate the potential of a remote, computer-mediated and synchronous text-based triage, which we refer to as InSort, for quickly highlighting persons of interest after an insider attack. BACKGROUND: Insiders maliciously exploit legitimate access to impair the confidentiality and integrity of organizations. The globalisation of organisations and advancement of information technology means employees are often dispersed across national and international sites, working around the clock, often remotely. Hence, investigating insider attacks is challenging. However, the cognitive demands associated with masking insider activity offer opportunities. Drawing on cognitive approaches to deception and understanding of deception-conveying features in textual responses, we developed InSort, a remote computer-mediated triage. METHOD: During a 6-hour immersive simulation, participants worked in teams, examining password protected, security sensitive databases and exchanging information during an organized crime investigation. Twenty-five percent were covertly incentivized to act as an 'insider' by providing information to a provocateur. RESULTS: Responses to InSort questioning revealed insiders took longer to answer investigation relevant questions, provided impoverished responses, and their answers were less consistent with known evidence about their behaviours than co-workers. CONCLUSION: Findings demonstrate InSort has potential to expedite information gathering and investigative processes following an insider attack. APPLICATION: InSort is appropriate for application by non-specialist investigators and can be quickly altered as a function of both environment and event. InSort offers a clearly defined, well specified, approach for use across insider incidents, and highlights the potential of technology for supporting complex time critical investigations.

A liar and a copycat: nonverbal coordination increases with lie difficulty.

Studies of the nonverbal correlates of deception tend to examine liars' behaviours as independent from the behaviour of the interviewer, ignoring joint action. To address this gap, experiment 1 examined the effect of telling a truth and easy, difficult and very difficult lies on nonverbal coordination. Nonverbal coordination was measured automatically by applying a dynamic time warping algorithm to motion-capture data. In experiment 2, interviewees also received instructions that influenced the attention they paid to either the nonverbal or verbal behaviour of the interviewer. Results from both experiments found that interviewer-interviewee nonverbal coordination increased with lie difficulty. This increase was not influenced by the degree to which interviewees paid attention to their nonverbal behaviour, nor by the degree of interviewer's suspicion. Our findings are consistent with the broader proposition that people rely on automated processes such as mimicry when under cognitive load.

Correction of 'Culture moderates changes in linguistic selfpresentation and detail provision when deceiving others'.

[This corrects the article DOI: 10.1098/rsos.170128.].

Culture moderates changes in linguistic self-presentation and detail provision when deceiving others.

Change in our language when deceiving is attributable to differences in the affective and cognitive experience of lying compared to truth telling, yet these experiences are also subject to substantial individual differences. On the basis of previous evidence of cultural differences in self-construal and remembering, we predicted and found evidence for cultural differences in the extent to which truths and lies contained self (versus other) references and perceptual (versus social) details. Participants (N = 320) of Black African, South Asian, White European and White British ethnicity completed a catch-the-liar task in which they provided genuine and fabricated statements about either their past experiences or an opinion and counter-opinion. Across the four groups we observed a trend for using more/fewer first-person pronouns and fewer/more third-person pronouns when lying, and a trend for including more/fewer perceptual details and fewer/more social details when lying. Contrary to predicted cultural differences in emotion expression, all participants showed more positive affect and less negative affect when lying. Our findings show that liars deceive in ways that are congruent with their cultural values and norms, and that this may result in opposing changes in behaviour.

Demographics of dogs, cats, and rabbits attending veterinary practices in Great Britain as recorded in their electronic health records.

BACKGROUND: Understanding the distribution and determinants of disease in animal populations must be underpinned by knowledge of animal demographics. For companion animals, these data have been difficult to collect because of the distributed nature of the companion animal veterinary industry. Here we describe key demographic features of a large veterinary-visiting pet population in Great Britain as recorded in electronic health records, and explore the association between a range of animal's characteristics and socioeconomic factors. RESULTS: Electronic health records were captured by the Small Animal Veterinary Surveillance Network (SAVSNET), from 143 practices (329 sites) in Great Britain. Mixed logistic regression models were used to assess the association between socioeconomic factors and species and breed ownership, and preventative health care interventions. Dogs made up 64.8% of the veterinary-visiting population, with cats, rabbits and other species making up 30.3, 2.0 and 1.6% respectively. Compared to cats, dogs and rabbits were more likely to be purebred and younger. Neutering was more common in cats (77.0%) compared to dogs (57.1%) and rabbits (45.8%). The insurance and microchipping relative frequency was highest in dogs (27.9 and 53.1%, respectively). Dogs in the veterinary-visiting population belonging to owners living in least-deprived areas of Great Britain were more likely to be purebred, neutered, insured and microchipped. The same association was found for cats in England and for certain parameters in Wales and Scotland. CONCLUSIONS: The differences we observed within these populations are likely to impact on the clinical diseases observed within individual veterinary practices that care for them. Based on this descriptive study, there is an indication that the population structures of companion animals co-vary with human and environmental factors such as the predicted socioeconomic level linked to the owner's address. This 'co-demographic' information suggests that further studies of the relationship between human demographics and pet ownership are warranted.

Small animal disease surveillance: respiratory disease.

Presentation for respiratory disease comprised 1.7 per cent, 2.3 per cent and 2.5 per cent of canine, feline and rabbit consultations, respectively, between January 2014 and December 2015. Coughing was the most frequent respiratory sign reported in dogs (71.1 per cent of consultations); in cats it was sneezing (42.6 per cent). Mean percentage of samples testing positive for feline calicivirus (FCV) was 30.1 per cent in 2014 and 27.9 per cent in 2015. January was the month with the highest percentage of FCV-positive samples in both 2014 and 2015.

Small animal disease surveillance.

This is the first UK small animal disease surveillance report from SAVSNET. Future reports will expand to other syndromes and diseases. As data are collected for longer, the estimates of changes in disease burden will become more refined, allowing more targeted local and perhaps national interventions. Anonymised data can be accessed for research purposes by contacting the authors. SAVSNET welcomes feedback on this report.

Detecting insider threats through language change.

The act of conducting an insider attack carries with it cognitive and social challenges that may affect an offender's day-to-day work behavior. We test this hypothesis by examining the language used in e-mails that were sent as part of a 6-hr workplace simulation. The simulation involved participants (N = 54) examining databases and exchanging information as part of a four-stage organized crime investigation. After the first stage, 25% of the participants were covertly incentivized to act as an "insider" by providing information to a provocateur. Analysis of the language used in participants' e-mails found that insiders became more self-focused, showed greater negative affect, and showed more cognitive processing compared to their coworkers. At the interpersonal level, insiders showed significantly more deterioration in the degree to which their language mimicked other team members over time. Our findings demonstrate how language may provide an indirect way of identifying employees who are undertaking an insider attack.