Abstract. Malicious insiders do great harm and avoid detection by using their legitimate privileges to steal information that is often outside the scope of their duties. Based on information from public cases, consultation with domain experts, and analysis of a massive collection of information-use events and contextual information, we developed an approach for detecting insiders who operate outside the scope of their duties and thus violate need-to-know. Based on the approach, we built and evaluated elicit, a system designed to help analysts investigate insider threats. Empirical results suggest that, for a specified decision threshold of .5, elicit achieves a detection rate of .84 and a false-positive rate of .015, flagging per day only 23 users of 1, 548 for further scrutiny. It achieved an area under an roc curve of .92
