Table 1. Behaviours and events...

Table 1.

Behaviours and events identified through the grounded theory analysis

Behaviour/event	Definition
Approached by rival organisation	Approaches to the insider by another company
Approached competitor	Contact with potential, sponsors or other employers
Arrested	Being detained in relation to the IP theft
Collection	Attempts to gather data of interest to the insider's goal
Concealed conflict of interests	Dishonesty concerning affiliations with another organisation
Communication of intent	Statements referring to future involvement in insider activity
Communications relating to offending	In-person or electronic discussions that refer to the theft
Damaged data/infrastructure	Damage, including manipulating and destroying data
Data to another government	The provision of stolen data to a foreign government
Data to another organisation	Providing the victim organisation's data to another company
Data to storage – online/ removable storage	Moving to online storage or to detachable devices, such as a USB, CD or floppy disk
Data to storage – personal	Movement of data to the insider’s own device
Data to storage – photograph	Copying data using photography
Data to storage – physical	Conversion of data to a printed format
Downloading – organisation	Downloading the victim organisation's data using its network
Deleted files from server	Concealment of insider activity through the removal of files
Delivered presentations	Delivering talks or speeches, especially to potential sponsors
Destroyed physical document	Elimination of data in a printed format
Detection – before resignation	Discovery before the insider departure
Detection – during attack	Discovery during the commission of the offense
Detection – external notification	Discovery following advice provided by an outsider
Detected – following resignation	Discovery of the IP theft after the insider had given notice
Detected – internal notification	Discovery based on information from another employee
Employment terminated	Discontinuation of the insider’s employment
Found guilty	Being found guilty of wrongdoing in court
Insider publicised activity	Discovery after the insider made details of the theft public
Left organisation – not abruptly	Departing the victim organisation in a typical manner
Lied to investigators/court	Dishonesty during legal or investigative processes
Misused systems	Unauthorised use of the organisation's systems
Overseas travel	Moving outside the country of victim organisation
Prepared to abscond	Taking steps to flee, including by purchasing flights
Recruited co-offender	Involving, or attempting to involve others in the theft
Reluctantly continued employment	Expressions of a desire to depart the victim company, but continuing to work for the victim company
Resigned and separated	Giving notice, then departing the victim organisation
Sold data/assets	Profiting from the organisation's data or assets
Sought other work	Attempts to obtain alternative employment
Started new organisation	Establishing another organisation, especially a competitor
Stole equipment/assets	Theft of an organisation's physical assets
Summoned to court	Being directed to attend court
Unauthorised access	Viewing or using data or systems without permission
Worked for rival organisation	Commencing work with another organisation

Behaviour/event	Definition
Approached by rival organisation	Approaches to the insider by another company
Approached competitor	Contact with potential, sponsors or other employers
Arrested	Being detained in relation to the IP theft
Collection	Attempts to gather data of interest to the insider's goal
Concealed conflict of interests	Dishonesty concerning affiliations with another organisation
Communication of intent	Statements referring to future involvement in insider activity
Communications relating to offending	In-person or electronic discussions that refer to the theft
Damaged data/infrastructure	Damage, including manipulating and destroying data
Data to another government	The provision of stolen data to a foreign government
Data to another organisation	Providing the victim organisation's data to another company
Data to storage – online/ removable storage	Moving to online storage or to detachable devices, such as a USB, CD or floppy disk
Data to storage – personal	Movement of data to the insider’s own device
Data to storage – photograph	Copying data using photography
Data to storage – physical	Conversion of data to a printed format
Downloading – organisation	Downloading the victim organisation's data using its network
Deleted files from server	Concealment of insider activity through the removal of files
Delivered presentations	Delivering talks or speeches, especially to potential sponsors
Destroyed physical document	Elimination of data in a printed format
Detection – before resignation	Discovery before the insider departure
Detection – during attack	Discovery during the commission of the offense
Detection – external notification	Discovery following advice provided by an outsider
Detected – following resignation	Discovery of the IP theft after the insider had given notice
Detected – internal notification	Discovery based on information from another employee
Employment terminated	Discontinuation of the insider’s employment
Found guilty	Being found guilty of wrongdoing in court
Insider publicised activity	Discovery after the insider made details of the theft public
Left organisation – not abruptly	Departing the victim organisation in a typical manner
Lied to investigators/court	Dishonesty during legal or investigative processes
Misused systems	Unauthorised use of the organisation's systems
Overseas travel	Moving outside the country of victim organisation
Prepared to abscond	Taking steps to flee, including by purchasing flights
Recruited co-offender	Involving, or attempting to involve others in the theft
Reluctantly continued employment	Expressions of a desire to depart the victim company, but continuing to work for the victim company
Resigned and separated	Giving notice, then departing the victim organisation
Sold data/assets	Profiting from the organisation's data or assets
Sought other work	Attempts to obtain alternative employment
Started new organisation	Establishing another organisation, especially a competitor
Stole equipment/assets	Theft of an organisation's physical assets
Summoned to court	Being directed to attend court
Unauthorised access	Viewing or using data or systems without permission
Worked for rival organisation	Commencing work with another organisation

Source: Created by authors

[ViewLarge]

Sharing Unavailable