How AI-powered employee surveillance is neutralising insider threats

If peo­ple are their busi­ness­es’ great­est asset, they’re also their great­est lia­bil­i­ty. The cost of poor data man­age­ment is colos­sal: human error in this respect knocks $3.1tn (£2.3tn) each year off the US econ­o­my alone, IBM has esti­mat­ed. 

Fat fin­gers aside, mali­cious acts by work­ers also cost busi­ness­es hun­dreds of bil­lions of pounds a year. Exploit­ing the increas­ing depen­dence of firms on online oper­a­tions since the pan­dem­ic start­ed, cyber­crim­i­nals have been “devel­op­ing and boost­ing their attacks at an alarm­ing pace”, accord­ing to Inter­pol. In a sig­nif­i­cant pro­por­tion of cas­es, rogue employ­ees at the organ­i­sa­tions being tar­get­ed are com­mit­ting or abet­ting acts such as fraud, intel­lec­tu­al prop­er­ty theft and cor­po­rate espi­onage.

The smart thing for a com­pa­ny to do when faced with such a poten­tial­ly cost­ly risk is to inter­pret the data. But when that data is, in essence, peo­ple and the deci­sions they make, the issue becomes even thornier. Sales of AI-based sur­veil­lance sys­tems have boomed dur­ing the pan­dem­ic, but employ­ee mon­i­tor­ing still car­ries a stig­ma that gath­er­ing infor­ma­tion about cus­tomers, say, does not.

“Many tech­nolo­gies are immense­ly use­ful for col­lect­ing employ­ee data, aggre­gat­ing it and pro­vid­ing a handy overview of team per­for­mance,” says Ashish Gup­ta, senior lec­tur­er in HR man­age­ment at the Uni­ver­si­ty of Law Busi­ness School. “But their appli­ca­tion by organ­i­sa­tions is more like­ly to cre­ate anx­i­ety and con­flict.”

Snoopers charter

Cor­po­rate inter­est in sur­veil­lance tech was strong even before the Covid cri­sis. For instance, when Accen­ture polled 1,400 busi­ness lead­ers in 13 indus­tries in 2018, 62% of respon­dents said that their firms were using new tech­nolo­gies to col­lect data on staff and their activ­i­ties. But the pan­dem­ic has weak­ened com­pa­nies’ efforts to com­bat employ­ee malfea­sance, accord­ing to Fahreen Kur­ji, chief cus­tomer intel­li­gence offi­cer at risk and com­pli­ance spe­cial­ist Behavox. 

“Busi­ness­es that were quick to adopt remote work­ing with­out ful­ly com­pre­hend­ing the risks have sleep­walked into trou­ble,” she reports. “We have seen a huge rise in the num­ber of bad actors sim­ply because HQs have become dig­i­tal and there is less over­sight.”

Teams in thou­sands of UK com­pa­nies have become dis­persed as a result of the government’s work-at-home guid­ance, often with­out a risk assess­ment of which con­trols still apply to them. Old-fash­ioned super­vi­so­ry meth­ods such as in-per­son obser­va­tions and impromp­tu chats are becom­ing things of the past in this new era of video meet­ings. The mon­i­tor­ing of employ­ees’ data foot­prints instead appears prefer­able. 

Banks, which by law must record the com­mu­ni­ca­tions of cer­tain employ­ees, have been among the ear­li­est adopters of AI-based sur­veil­lance, giv­en its use­ful­ness as a com­pli­ance tool. The bench­mark-rig­ging scan­dals of the late noughties revealed the lim­i­ta­tions of the pre­vi­ous mon­i­tor­ing tech, which sim­ply scanned emails for tell­tale words and phras­es. It’s being replaced by intu­itive ana­lyt­ics plat­forms that cov­er a far broad­er area. 

Machine learn­ing algo­rithms can be trained on GPS data, swipe-card usage and var­i­ous chat and video for­mats, for instance, to build a detailed pic­ture of any employee’s behav­iour. Some­one who’s work­ing exces­sive hours, say, or send­ing emails with attach­ments or even pass­words out­side the busi­ness may be show­ing signs of going off the rails.

“Insid­er dan­gers, such as intel­lec­tu­al prop­er­ty theft and cor­po­rate espi­onage, are the kinds of prob­lems where it pays to be ahead of the curve rather than run­ning an inves­ti­ga­tion after the fact, as we’ve seen his­tor­i­cal­ly with var­i­ous insid­er-trad­ing scan­dals,” Kur­ji says.

Late last year, New York hedge fund the Jor­dan Com­pa­ny installed AI-pow­ered soft­ware that can mon­i­tor indi­vid­u­als’ emails, video­con­fer­ences and oth­er data. It will build a far more nuanced pic­ture of how each per­son oper­ates than was pos­si­ble when using old­er sur­veil­lance meth­ods. 

The company’s gen­er­al coun­sel, Ugo Ude, reports that the new sys­tem is con­tin­u­al­ly learn­ing and “gets bet­ter and more accu­rate every time I log in”. Pre­vi­ous­ly, Ude would sim­ply pick ran­dom emails or phone calls to mon­i­tor before judg­ing whether any wrong­do­ing might have occurred. Now that this task has been auto­mat­ed, he can devote his time to more val­ue-adding work.

Regulatory pressures

The use of AI-based employ­ee sur­veil­lance sys­tems will only increase as firms face greater reg­u­la­to­ry pres­sures and the poten­tial­ly ruinous threat of rep­u­ta­tion­al dam­age. So says Paul Hodge, co-founder of risk and con­trol spe­cial­ist 1LoD and a for­mer head of first-line super­vi­sion for Bar­clays in EMEA.

These sys­tems take an “employ­ee-focused approach to iden­ti­fy­ing poten­tial mar­ket abuse, poor cul­tur­al indi­ca­tors and exam­ples of con­duct risk, link­ing an individual’s com­mu­ni­ca­tions across mul­ti­ple chan­nels with their sales or trad­ing activ­i­ties”, he says. They can also mon­i­tor “per­son­al employ­ee data such as cred­it scores and time in and out of the office. In some cas­es, they will even analyse com­mu­ni­ca­tion meta­da­ta, which can bring to light hid­den rela­tion­ships in a depart­ment.” 

AI can also root out neg­a­tive sub­cul­tures in ways that human review­ers can­not, Hodge notes. “This behav­iour­al lens is one of the many ways in which the larg­er, more sophis­ti­cat­ed com­pli­ance func­tions are attempt­ing to improve the effi­cien­cy of their sur­veil­lance func­tions while at the same time improv­ing their abil­i­ty to detect risk.”

Employ­ee-gen­er­at­ed data rep­re­sents a com­plex issue for some multi­na­tion­al com­pa­nies, he adds, par­tic­u­lar­ly where some juris­dic­tions have laws against record­ing and analysing staff con­ver­sa­tions. Despite this, ever more inge­nious ways of obtain­ing employ­ee data are emerg­ing – and the uptake of pow­er­ful AI-based sur­veil­lance tools seems unlike­ly to lev­el off any time soon.

For busi­ness­es that do want more work­force insights but expect resis­tance to broad­er mon­i­tor­ing, the best pol­i­cy is to be hon­est about their inten­tions, says Rachel Toz­er, employ­ment part­ner at Key­stone Law.

“Employ­ers should com­mu­ni­cate clear­ly to their staff how they are being mon­i­tored, why it’s jus­ti­fied and how the infor­ma­tion that’s gath­ered will be stored and used,” she advis­es. “Employ­ees should then be mind­ful that any data gath­ered from law­ful mon­i­tor­ing may be used in dis­ci­pli­nary or capa­bil­i­ty pro­ce­dures.”