Software Engineering Institute

This paper appeared in the Proceedings of the International Conference of the System Dynamics Society, July 2015.

In this paper, we describe a preliminary system dynamics model of insider espionage social networks. Social capital, which is measurable in terms of standard social network metrics, can serve to both indicate low or dwindling insider engagement with their jobs as well as a means to bolster an insider's connections in a way that disincentivizes insider threat and improves employee productivity. The model focuses on two forms of social capital: (1) obligations and expectations and (2) social norms. We present our analysis of two widely known espionage incidents using the model to demonstrate the dynamics we are researching. We also describe four working hypotheses, based on our analysis and past experience, that form the basis of our research going forward. Finally, we describe possible uses of the model, including tracking early indicators of insider threat and evaluating the ways that organizations can disincentivize the threat by improving employee engagement and their overall job satisfaction. Clearly, no firm conclusions can yet be drawn and much work remains to analyze additional incidents and comparison data of the average employee. Nevertheless, the model that we describe here provides a useful "stake-in-the-ground" and vision for our future efforts.