Sorting Insiders From Co-Workers: Remote Synchronous Computer-Mediated Triage for Investigating Insider Attacks

OBJECTIVE

Develop and investigate the potential of a remote, computer-mediated and synchronous text-based triage, which we refer to as InSort, for quickly highlighting persons of interest after an insider attack.

BACKGROUND

Insiders maliciously exploit legitimate access to impair the confidentiality and integrity of organizations. The globalisation of organisations and advancement of information technology means employees are often dispersed across national and international sites, working around the clock, often remotely. Hence, investigating insider attacks is challenging. However, the cognitive demands associated with masking insider activity offer opportunities. Drawing on cognitive approaches to deception and understanding of deception-conveying features in textual responses, we developed InSort, a remote computer-mediated triage.

METHOD

During a 6-hour immersive simulation, participants worked in teams, examining password protected, security sensitive databases and exchanging information during an organized crime investigation. Twenty-five percent were covertly incentivized to act as an 'insider' by providing information to a provocateur.

RESULTS

Responses to InSort questioning revealed insiders took longer to answer investigation relevant questions, provided impoverished responses, and their answers were less consistent with known evidence about their behaviours than co-workers.

CONCLUSION

Findings demonstrate InSort has potential to expedite information gathering and investigative processes following an insider attack.

APPLICATION

InSort is appropriate for application by non-specialist investigators and can be quickly altered as a function of both environment and event. InSort offers a clearly defined, well specified, approach for use across insider incidents, and highlights the potential of technology for supporting complex time critical investigations.

Real-world implications of aphantasia: episodic recall of eyewitnesses with aphantasia is less complete but no less accurate than typical imagers

Individuals with aphantasia report an inability to voluntarily visually image and reduced episodic memory, yet episodic accounts provided by witnesses and victims are fundamental for criminal justice. Using the mock-witness paradigm, we investigated eyewitness memory of individuals with aphantasia versus typical imagers. Participants viewed a mock crime and 48 hours later were interviewed about the event, randomly allocated to one of three conditions. Two interview conditions included techniques designed to support episodic retrieval mode, namely (i) Mental Reinstatement of Context (MRC) and (ii) Sketch Reinstatement of Context (Sketch-RC). A third Control condition did not include retrieval support. Aphantasic mock-eyewitnesses recalled 30% less correct information and accounts were less complete, but they made no more errors and were as accurate as typical imagers. Interaction effects revealed reduced correct recall and less complete accounts for aphantasic participants in MRC interviews versus Sketch-RC and Control. Aphantaisic participants in the Control outperformed those in both the Sketch-RC and MRC, although Sketch-RC improved completeness by 15% versus MRC. Our pattern of results indicates reduced mental imagery ability might be compensated for by alternative self-initiated cognitive strategies. Findings offer novel insights into episodic recall performance in information gathering interviews when ability to voluntarily visualize is impoverished.

Cross cultural verbal cues to deception: truth and lies in first and second language forensic interview contexts

Introduction

The verbal deception literature is largely based upon North American and Western European monolingual English speaker interactions. This paper extends this literature by comparing the verbal behaviors of 88 south Asian bilinguals, conversing in either first (Hindi) or second (English) languages, and 48 British monolinguals conversing in English.

Methods

All participated in a live event following which they were interviewed having been incentivized to be either deceptive or truthful. Event details, complications, verifiable sources, and plausibility ratings were analyzed as a function of veracity, language and culture.

Results

Main effects revealed cross cultural similarities in both first and second language interviews whereby all liar's verbal responses were impoverished and rated as less plausible than truthtellers. However, a series of cross-cultural interactions emerged whereby bi-lingual South Asian truthtellers and liars interviewed in first and second languages exhibited varying patterns of verbal behaviors, differences that have the potential to trigger erroneous assessments in practice.

Discussion

Despite limitations, including concerns centered on the reductionary nature of deception research, our results highlight that while cultural context is important, impoverished, simple verbal accounts should trigger a 'red flag' for further attention irrespective of culture or interview language, since the cognitive load typically associated with formulating a deceptive account apparently emerges in a broadly similar manner.

Parental experiences of the impact of grooming and criminal exploitation of children for county lines drug trafficking

Background

County lines is used to describe the illicit drug supply model whereby drugs are transported from one area of the country to another, often by children believed to have been physically and psychologically coerced to do so. County lines is a serious threat to public health, with significant negative impacts on the physical and psychological health and wellbeing of children and families.

Methods

We conducted in-depth interviews with parents of children involved in county lines to understand their experiences and the impact of grooming and recruitment. Interviews were conducted between December 2019 and January 2021. Thematic analysis identified four primary themes: (i) out of nowhere behaviour change, (ii) escalation and entrenchment, (iii) impact of intervention failures and (iv) destructive lifestyle choices.

Results

Parents from across England all reported similar experiences, and so these data offer novel insight into potential grooming and recruitment indicators. All were frustrated by the prevailing vulnerable narrative, which they argued hindered understanding. A lack of consultation, and reports of numerous intervention failures was common.

Conclusion

The importance of giving parents a voice and involving them as a potential first line of defence, and how the current vulnerability narrative appears to be closing impactful education opportunities are discussed.

Rapport building and witness memory: Actions may 'speak' louder than words

Building rapport during police interviews is argued as important for improving on the completeness and accuracy of information provided by witnesses and victims. However, little experimental research has clearly operationalised rapport and investigated the impact of rapport behaviours on episodic memory. Eighty adults watched a video of a mock crime event and 24-hours later were randomly allocated to an interview condition where verbal and/or behavioural (non-verbal) rapport techniques were manipulated. Memorial performance measures revealed significantly more correct information, without a concomitant increase in errors, was elicited when behavioural rapport was present, a superiority effect found in both the free and probed recall phase of interviews. The presence of verbal rapport was found to reduce recall accuracy in the free recall phase of interviews. Post-interview feedback revealed significant multivariate effects for the presence of behavioural (only) rapport and combined (behavioural + verbal) rapport. Participants rated their interview experience far more positively when these types of rapport were present compared to when verbal (only) rapport or no rapport was present. These findings add weight to the importance of rapport in supporting eyewitness cognition, highlighting the potential consequences of impoverished social behaviours for building rapport during dyadic interactions, suggesting 'doing' rather than simply 'saying' may be more beneficial.

Supporting older eyewitnesses' episodic memory: the self-administered interview and sketch reinstatement of context

Environmental support at retrieval improves episodic performance, yet there exists very few empirically evaluated techniques for supporting older witnesses/victims' remembering (>65 years). We investigated two techniques for use in a criminal justice context - the Self-Administered Interview and Sketch Reinstatement of Context. Older adults (N = 134) witnessed an unexpected live event, following which half immediately completed a Self-Administered Interview and half did not (Time 1). All were interviewed 48 h later (Time 2) using one of three face-to-face interview techniques: Sketch Reinstatement of Context, Mental Reinstatement of Context, or no support Control. Those who completed a Self-Administered Interview at Time 1 recalled more correct information at Time 2 irrespective of interview condition and confabulated less. Likewise, participants interviewed using the Sketch Reinstatement of Context technique recalled more correct information and confabulated less, whether they had completed a Self-Administered Interview, or not. However, the Self-Administered Interview + Sketch Reinstatement of Context was the most effective combination, indicating an interaction between stabilising a memory trace quickly and how sketching appears to scaffold memory retrieval during face-to-face interviews.

Noncoercive human intelligence gathering

Despite widespread recognition that coercive methods for intelligence gathering are unethical and counterproductive, there is an absence of empirical evidence for effective alternatives. We compared 2 noncoercive methods-the Modified Cognitive Interview (MCI) and Controlled Cognitive Engagement (CCE)-adapted for intelligence gathering by adding a moral frame to encourage interviewees to consciously consider sharing intelligence. Participants from the general population experienced an unexpected live event where equipment was damaged, and an argument ensued. Prior to interview, participants were incentivized to withhold information about a target individual implicated in the event. CCE yielded more target information more frequently than MCI (67% vs. 36%). Similarly, framing yielded target information more often (65% vs. 39%). The effects of interview and framing appear to be additive rather than interactive. Our results indicate combining noncoercive interview methods with moral framing can enhance intelligence gain. (PsycInfo Database Record (c) 2020 APA, all rights reserved).

Health inequalities and health equity challenges for victims of modern slavery

Background

Modern slavery is a serious organized crime, with severe consequences for the physical and mental health of victims, and so has public health implications. Anecdotally many victims of sex slavery experience difficulties accessing healthcare. Public Health England recently articulated the importance of health engagement to address modern slavery but little is known about the experiences of the survivors.

Methods

We conducted in depth interviews with Albanian female survivors of sex slavery who all displayed significant and complex health needs. Interviews were conducted between July 2017 and January 2018. Thematic analysis identified four primary themes: (i) barriers to access, (ii) negotiating access, (iii) health needs and care received and (iv) overall experience of primary care.

Results

Survivors experienced repeated challenges accessing healthcare, for themselves and their children, and initially could not access GP services. When accompanied by an advocate they reported qualitatively and quantitatively improved experiences resulting in improved permeability. Confusion surrounding eligibility criteria and a lack of understanding of modern slavery emerged as the primary barriers, fueling biased adjudications.

Conclusions

The importance of advocates, enabling rights-based approaches, improving understanding about access to health services for vulnerable groups, and a need for education across health service settings are discussed.

Eyewitness Memory in Face-to-Face and Immersive Avatar-to-Avatar Contexts

Technological advances offer possibilities for innovation in the way eyewitness testimony is elicited. Typically, this occurs face-to-face. We investigated whether a virtual environment, where interviewer and eyewitness communicate as avatars, might confer advantages by attenuating the social and situational demands of a face-to-face interview, releasing more cognitive resources for invoking episodic retrieval mode. In conditions of intentional encoding, eyewitnesses were interviewed 48 h later, either face-to-face or in a virtual environment (N = 38). Participants in the virtual environment significantly outperformed those interviewed face-to-face on all episodic performance measures - improved correct reporting reduced errors, and increased accuracy. Participants reported finding it easier to admit not remembering event information to the avatar, and finding the avatar easier to talk to. These novel findings, and our pattern of retrieval results indicates the potential of avatar-to-avatar communication in virtual environments, and provide impetus for further research investigating eyewitness cognition in contemporary retrieval contexts.

No Evidence Against Sketch Reinstatement of Context, Verbal Labels or the Use of Registered Intermediaries for Children with Autism Spectrum Disorder: Response to Henry et al. (2017)

Recently, Henry et al. (J Autism Dev Disord 8:2348-2362, 2017) found no evidence for the use of Verbal Labels, Sketch Reinstatement of Context and Registered Intermediaries by forensic practitioners when interviewing children with a diagnosis of autism spectrum disorder. We consider their claims, noting the limited ecological validity of the experimental paradigm, the impacts of repeated interviewing where retrieval support is not provided at first retrieval, question the interviewer/intermediary training and their population relevant experience, and comment on the suppression of population variances. We submit that rejecting these techniques on the basis of this study is completely unwarranted and potentially damaging, particularly if used in legal proceedings to undermine the value of testimony from children with ASD, who continually struggle to gain access to justice.

Analyzing Decision Logs to Understand Decision Making in Serious Crime Investigations

Objective To study decision making by detectives when investigating serious crime through the examination of decision logs to explore hypothesis generation and evidence selection. Background Decision logs are used to record and justify decisions made during serious crime investigations. The complexity of investigative decision making is well documented, as are the errors associated with miscarriages of justice and inquests. The use of decision logs has not been the subject of an empirical investigation, yet they offer an important window into the nature of investigative decision making in dynamic, time-critical environments. Method A sample of decision logs from British police forces was analyzed qualitatively and quantitatively to explore hypothesis generation and evidence selection by police detectives. Results Analyses revealed diversity in documentation of decisions that did not correlate with case type and identified significant limitations of the decision log approach to supporting investigative decision making. Differences emerged between experienced and less experienced officers' decision log records in exploration of alternative hypotheses, generation of hypotheses, and sources of evidential inquiry opened over phase of investigation. Conclusion The practical use of decision logs is highly constrained by their format and context of use. Despite this, decision log records suggest that experienced detectives display strategic decision making to avoid confirmation and satisficing, which affect less experienced detectives. Application Potential applications of this research include both training in case documentation and the development of new decision log media that encourage detectives, irrespective of experience, to generate multiple hypotheses and optimize the timely selection of evidence to test them.

Drawing the answers: Sketching to support free and probed recall by child witnesses and victims with autism spectrum disorder

The success of witness interviews in the criminal justice system depends on the accuracy of information obtained, which is a function of both amount and quality of information. Attempts to enhance witness retrieval such as mental reinstatement of context have been designed with typically developed adults in mind. In this article, the relative benefits of mental and sketch reinstatement mnemonics are explored with both typically developing children and children with autism. Children watched a crime event video, and their retrieval of event information was examined in free and probed recall phases of a cognitive interview. As expected, typically developing children recalled more correct information of all types than children with autism during free and probed recall phases. Sketching during free recall was more beneficial for both groups in both phases in reducing the amount of incorrect items, but the relative effect of sketching on enhancing retrieval accuracy was greater for children with autism. The results indicate the benefits of choosing retrieval mnemonics that are sensitive to the specific impairments of autistic individuals and suggest that retrieval accuracy during interviews can be enhanced, in some cases to the same level as that of typically developing individuals.

Finding a needle in a haystack: toward a psychologically informed method for aviation security screening

Current aviation security systems identify behavioral indicators of deception to assess risks to flights, but they lack a strong psychological basis or empirical validation. We present a new method that tests the veracity of passenger accounts. In an in vivo double-blind randomized-control trial conducted in international airports, security agents detected 66% of deceptive passengers using the veracity test method compared with less than 5% using behavioral indicator recognition. As well as revealing advantages of veracity testing over behavioral indicator identification, the study provides the highest levels to date of deception detection in a realistic setting where the known base rate of deceptive individuals is low.

Detecting insider threats through language change

The act of conducting an insider attack carries with it cognitive and social challenges that may affect an offender's day-to-day work behavior. We test this hypothesis by examining the language used in e-mails that were sent as part of a 6-hr workplace simulation. The simulation involved participants (N = 54) examining databases and exchanging information as part of a four-stage organized crime investigation. After the first stage, 25% of the participants were covertly incentivized to act as an "insider" by providing information to a provocateur. Analysis of the language used in participants' e-mails found that insiders became more self-focused, showed greater negative affect, and showed more cognitive processing compared to their coworkers. At the interpersonal level, insiders showed significantly more deterioration in the degree to which their language mimicked other team members over time. Our findings demonstrate how language may provide an indirect way of identifying employees who are undertaking an insider attack.

Drawing to remember: external support of older adults' eyewitness performance

Although healthy aging is accompanied by a general decline in memory functioning, environmental support at retrieval can improve older adults' (+65 years) episodic remembering. Despite those over the age of 65 years representing a growing proportion of the population, few environmental retrieval support methods have been empirically evaluated for use with older witnesses and victims of crime. Here, the efficacy of a novel retrieval technique, the Sketch Mental Reinstatement of Context, is compared with a standard Mental Reinstatement of Context and a no support control (Control). Fifty-one participants witnessed an unexpected live event, and 48 hours later were interviewed using one of three aforementioned techniques. In line with predictions emanating from cognitive theories of aging and the environmental support hypothesis, participants in the Sketch Mental Reinstatement of Context condition recalled significantly more correct information and fewer inaccurate items. The Sketch Mental Reinstatement of Context technique appears to scaffold memory retrieval in an age-appropriate manner during a post-event interview, possibly by encouraging more effortful retrieval and reducing dual-task load. As such, this procedure offers an effective alternative to current approaches, adding to the toolbox of techniques available to forensic and other interviewers.

Psychology and interviewing: what direction now in our quest for reliable information?

Purpose

The purpose of this paper is to discuss two distinct but interrelated areas, namely witness/victim and suspect interviewing, and to argue that both must continue to evolve, suggest how they might do so, and that this process must be driven by emergent theory and contemporary empirical research.

Design/methodology/approach

The paper outlines the impact of psychological theory and empirical research to investigative interviewing in recent decades.

Findings

It is argued that in order to stay ahead of the game, the field of investigative interviewing (suspect and witness) must continue to evolve in such a manner that not only protects and fosters the important practitioner/academic relationship, but also ensures that future directions are driven by empirical research, with recourse to emergent theory.

Originality/value

The paper outlines the impact of psychological theory and empirical research on investigative interviewing and the consequent enhancement of the interviewing of both suspected offenders and witnesses. The paper demonstrates that working closely together academic research can make a difference, and influence law, policy decisions and training guidelines in order to improve practice.