Assessing the Feasibility of Applying Criminological Theory to
the IS Security Context Robert Willison
This format serves as the rubric by which your effort will be graded.>>
Essay
If you choose an essay, you should evaluate it according to the following format:
1.Summarize the article. (40 points)
2.What are its major conclusions? (12 points)
3.What are the articles strengths? (12 points)
4.What are its weaknesses? (12 points)
5.Were the conclusions properly drawn and supported? How? (12 points)
6.Which ones, if any, were not? Show why not. (12 points)
Understanding the Offender/Environment Dynamic for Computer
Crimes: Assessing the Feasibility of Applying Criminological Theory to
the IS Security Context
Robert Willison
Department of Informatics, Copenhagen Business School
[email protected]
Abstract
There is currently a paucity of literature
focusing on the relationship between the actual
actions of staff members, who perpetrate some
form of computer abuse, and the organisational
environment in which such actions take place. A
greater understanding of such a relationship may
complement existing security practices by possibly
highlighting new areas for safeguard
implementation. In addition, if insights are
afforded into the actions of dishonest staff, prior to
the actual perpetration of a crime, then
organisations may be able to expand their
preventive scope, rather than relying solely on
technical safeguards to stop the actual commission
of some form of computer abuse. To help facilitate
a greater understanding of the
offender/environment dynamic, this paper assesses
the feasibility of applying criminological theory to
the IS security context. More specifically, three
theories are advanced, which focus on the
offender’s behaviour in a criminal setting. After
opening with a description of the theories, the
paper provides an account of the Barings Bank
collapse. Events highlighted in the case study are
used to assess whether concepts central to the
theories are supported by the data. The paper
concludes by summarising the major findings and
discussing future research possibilities.
1. Introduction
There is currently little written about the
relationship between the actual criminal actions of
staff members, who perpetrate some form of
computer abuse, and the organisational
environment in which such actions take place [1].
Insights into such a relationship may complement
existing IS security practices by possibly
highlighting additional areas in which safeguards
could be introduced. More specifically, if insights
are afforded into the actions of dishonest staff,
prior to the actual perpetration of a crime, then
organisations may be able to expand their
preventive scope. Rather than relying solely on
technical safeguards such as intrusion detection
tools and password system to help stop the
commission of a computer crime, other safeguards
designed to prevent criminal behaviour, prior to
perpetration, would prove to be a useful addition
in the preventive armoury of IS security
practitioners. In an attempt to facilitate a clear
understanding of the offender/environment
dynamic, this paper assesses the feasibility of
applying criminological theory to the IS security
context. Three theories are advanced which
specifically address the offender’s behaviour in the
criminal setting. The paper opens with a
description of the criminological approaches,
which include routine activity theory,
environmental criminology and the rational choice
perspective. This is followed by an account of the
collapse of Barings Bank. Events highlighted in
the account are then drawn on in the discussion
and analysis section, to assess whether concepts
central to the theories are supported by the data.
The paper concludes summarising the findings and
discussing further research possibilities offered by
the three criminological schools of thought
Proceedings of the 37th Hawaii International Conference on System Sciences – 2004
0-7695-2056-1/04 $17.00 (C) 2004 IEEE 1
2. IS Security and Criminological
Theory
In an attempt to provide new insights into the
relationship between the criminal actions of
dishonest employees and their workplace
environment, criminology would appear to be a
potentially fruitful body of knowledge from which
to draw upon. Clarke [2] notes how:
“Most criminological theories have been
concerned with explaining why certain
individuals or groups, exposed to particular
psychological or social influences, or with
particular inherited traits, are more likely to
become involved in delinquency or crime”.
However, in the last four decades, a number of
like-minded theories have emerged which, rather
than focusing on how people become criminals,
address the actual criminal act [2]. Included in
this group are routine activity theory,
environmental criminology and the rational choice
perspective. These theories focus on the
relationship between the offender and the actual
environment in which the crime takes place and it
is for this reason that they are advanced as
potentially useful schools of thought for IS
security research. As a first step in assessing the
feasibility of applying the theories to the IS
security context, this section of the paper describes
the three approaches.
2.1. Routine Activity
Routine Activity Theory is a relative newcomer
to the field of criminology. Cohen and Felson [3]
discuss how changes in what they describe as
‘routine activities’ of society’s members have
impacted on the levels of direct-contact predatory
crimes, i.e. crimes where one or more persons
directly take or damage the person or property of
another. These activities include the provision of
food, shelter, leisure, work, child-rearing, and
sexual outlets. It is argued that these forms of
behaviour influence direct-contact predatory (i.e.
where one or more persons directly take or
damage the person or property of another) crime
rates by impacting on the convergence in time and
space, of the three elements required for a crime to
occur. These elements consist of a likely offender,
a suitable target, and the absence of a capable
guardian, who, if present, would be in a position to
stop a criminal act. As the name suggests, the
offender is the individual who may, or may not,
decide to perpetrate a crime. A target may be a
person or object that is attacked or taken by the
offender. This might include, for instance, a man
the offender wants to rob or a car he wishes to
steal. What also determines a target is whether or
not the entity, which forms the basis for a target,
either lacks or has present, a capable guardian.
Thus for example, a house where the owner is
present is afforded a capable guardian. If,
however, the owner is at work, the property lacks a
capable guardian and consequently represents
much more of a target to the potential offender.
Cohen and Felson [3] assert that it takes merely
the absence of one of these three elements for a
crime not to occur. So for example, drawing on
U.S.A. census data and victimisation surveys, they
reveal how between 1960-1970, daytime
residential burglary increased by 15%. They
partly explain this rise by noting how the decade
also witnessed an increase of females in the
workforce and a rise in the number of individuals
living along. As a consequence, there was a
related rise in the number of properties left vacant
and lacking a capable guardian during the working
day.
Routine activity theory is still in a period of
transition, as witnessed by the efforts of Felson [4]
to extend its scope. In an attempt to accommodate
Hirschi’s [5] social control theory, Felson [4]
proposes the incorporation of another element, that
of the ‘intimate handler’, to illustrate how people
can act as a ‘brake’ on the activities of offenders.
In his book Causes of Delinquency, Hirschi [5]
argues that there are four factors that constitute a
social bond between an individual and society.
These include commitments, attachments,
involvements and beliefs. Felson uses the word
‘handle’ to summarise the four elements. By
doing so he argues that the social bond (and hence
handle) is a key element in informal social control.
The ‘intimate handler’ represents the individual
who is able to exert this form of social control.
The handler is normally someone who is
recognised by, and has sufficient knowledge, of
the potential offender. Hence the mere presence of
a person known to the potential offender may act
as a form of ‘handling’, and consequently a
deterrent, by reminding the offender of their social
bonds. By incorporating the concept of the
handled offender and the intimate handler into
routine activity theory, Felson argues that just as a
target must be lacking a capable guardian for the
commission of a crime, so too must the offender
be lacking an intimate handler.
Furthermore, as a means of enhancing its
contribution to crime prevention, Clarke [6]
Proceedings of the 37th Hawaii International Conference on System Sciences – 2004
0-7695-2056-1/04 $17.00 (C) 2004 IEEE 2
advocates that routine activity theory could
incorporate the category of ‘crime facilitators’.
These relate to items such as cars, guns, and credit
cards, which act as tools for specific crimes – as
well as dis-inhibitors such as alcohol, which
facilitate the precipitation of crimes. Clarke [6]
argues that if we appreciate how these facilitators
are used, it may be possible to identify points were
safeguards can be introduced.
2.2. Environmental Criminology
Environmental criminology has provided
considerable insight into the ‘search’ patterns of
offenders and illustrated how the majority of
crimes are committed within areas visited by
offenders during their routine work and leisure
pursuits [7]. Offenders develop an ‘action space’
in which these everyday pursuits take place and
through such activities acquire a detailed
knowledge of this environment, leading to what
these authors describe as an ‘awareness space’.
Like the rational choice perspective, Brantingham
and Brantingham [7] argue that the motivated
individual engages in a ‘multi-staged decision
process’ prior to the commission – or not as the
case may be – of a crime. Such a process is
informed through knowledge gathered from the
offender’s awareness space. Furthermore, they
argue that a specific environment emits cues
relating to its spatial, cultural, legal and
psychological characteristics. With experience, an
offender is able to discern certain sequences and
configurations of these cues associated with a
‘good’ target.
2.3. Rational Choice Perspective
The rational choice perspective focuses on the
decision-making processes of offenders [8, 9, 10].
The approach assumes that crimes are chosen by
the offender, as a suitable course of action, with
the intention of deriving some type of benefit.
Obvious examples are cash or material goods, but
a broader reading of the term ‘benefits’ allows for
the inclusion of other forms, such as prestige, fun,
excitement, sexual gratification, and domination.
Joyriding is an example of how the benefits may
take the intangible forms of fun and excitement.
Of further importance to the rational choice
perspective is the division of criminal choices into
two groups, viz., ‘involvement’ and ‘event’
decisions. The former refers to decisions an
offender makes regarding their criminal careers.
The latter refers to those decisions made during
the actual commission of a crime. These decisions
are based on the offender’s perceptions of the
situation. Hence, the decision to carry out a
particular criminal act emerges from a reasoning
that the associated risks and efforts are outweighed
by the perceived rewards. In other words, the
decision to carry out a particular criminal act
represents an assessment by the offender that the
particular situation offers an opportunity. Given
this, an opportunity can be seen as a subjective
relationship between an offender and their
environment.
The approach further assumes that choices are
characterised by what is termed ‘bounded’ or
‘limited’ rationality. In other words, criminal
decision making is at times less than perfect, as a
consequence of the conditions under which
decisions are made. With the associated risks and
uncertainty in offending, criminals may make
decisions without the knowledge of all the
potential costs and benefits (i.e. the risks, efforts
and rewards). Devoid of all the necessary
information, offenders may resort to ‘rules of
thumb’ when perpetrating offences, or rely on a
tried and tested general approach that may be
called into action when unexpected situations
arise.
3. Case Study: The Collapse of Barings
Bank
On the 26th February 1995, administrators were
appointed by the High Court in London (UK) to
manage the affairs of Baring Plc. following the
identification of substantial losses incurred by a
related overseas subsidiary known as Baring
Futures Singapore. This section of the paper
provides an account of the major factors that were
instrumental in the collapse of Barings. The
purpose of the account is two fold. First the reader
is afforded an understanding of the collapse.
Secondly, data drawn from this case study is then
used in the ‘Discussion and Analysis’ section to
assess whether events highlighted in the account
support concepts, which are central to the three
criminological theories. Two points should be
noted here. First, given the limitations on space,
the account is simplified, highlighting areas most
obviously covered by the theories. Secondly, the
account is based on the Bank of England: Report
of the Board of Banking Supervision Inquiry into
the Circumstances of the Collapse of Barings [11]
and Stephen Fay’s The Collapse of Barings [12].
Proceedings of the 37th Hawaii International Conference on System Sciences – 2004
0-7695-2056-1/04 $17.00 (C) 2004 IEEE 3
3.1. Brief History and Background of
Barings Bank
Prior to its collapse, Baring Brothers & Co. had
been the oldest merchant bank in the City’s square
mile. Founded initially as a partnership in 1762,
the bank had managed to remain independent and
privately controlled. After a near fatal business
venture in Argentina, Baring Brothers & Co. was
established in 1890 to succeed the partnership. In
1985 the share capital of Baring Brothers & Co.
was acquired by Barings plc, which became the
parent company of the Barings Group. Apart from
Baring Brothers & Co., the other two principal
operating companies of Barings plc were Baring
Securities Limited and Baring Asset Management,
which played no part in the collapse (and hence
will not be referred to again in this account).
Baring Securities Limited had commenced
business in 1984, specialising in Far East
Securities. The company expanded rapidly. In the
first five years of trading, Baring Securities
Limited opened nineteen subsidiary offices. Aside
from the traditional business activities carried out
by Baring Brothers & Co., Baring Securities
Limited represented Barings first involvement in
the securities business.
3.2. Creation and Management of Baring
Futures Singapore
Baring Futures Singapore was one of the new
offices that opened during the expansion of Baring
Securities Limited, and was formed to specialise in
exchange-traded futures and options (i.e. these
were Baring Futures Singapore’s bank products).
More precisely, Baring Futures Singapore would
execute client business on the Singaporean Stock
Exchange (SIMEX) on behalf of Baring Securities
Limited and Baring Securities Japan. This client
business, also referred to as ‘agency’ business, was
managed by Mike Killian (Head of Global Equity
Futures and Options Sales) in Tokyo. Baring
Futures Singapore would accumulate profits
through commission charged to clients.
Nick Leeson, a pivotal figure in the collapse of
Barings, was asked by Killian to apply for the post
of settlements manager. Leeson had acquired the
necessary experience through working in the
settlement’s section of a Baring Securities Limited
department, which specialised in Japanese futures
and options. He accepted the offer, and his name,
once submitted to the Management Committee,
was approved.
Previously in 1987, Baring Securities had
opened their first Singaporean office in the form of
Baring Securities Singapore. The managing
director of Baring Securities Singapore was James
Bax. He oversaw a business which traded equities
(but not derivatives) on
SIMEX. Bax’s second-incommand
was Simon Jones, who acted as the
Chief Operating Officer of Baring Securities
Singapore. This position included responsibility
for the back office, which settled Baring Securities
Singapore’s equity trading.
Leeson moved to Singapore in early March
1992. Initial problems in the management of
Baring Futures Singapore were created shortly
afterwards, by the actions of Ian Martin (Baring
Securities Limited’s Finance Director). Despite
the fact that Mike Killian had asked Leeson to run
the back office (i.e., the settlements section) of
Baring Futures Singapore, Martin instructed Jones
and Killian that Leeson would be in charge of the
front and back offices. By so doing, Martin was
breaching one of the golden rules of management,
which states that there should be a strict
segregation of duties between trading and
settlement.
The supervisory failings with regard to Barings
Futures Singapore were compounded by the
actions of Jones and Bax, who took little interest
in the new subsidiary, despite the fact that both
were, on paper at least, responsible for Leeson at a
regional level.
Mike Killian further rejected the idea that there
was a reporting line between himself and Leeson.
Yet this runs contrary to what Leeson argues, who
cites Killian as one of the people who managed
him in 1992. Hence from the very start of
Leeson’s employment at Baring Futures
Singapore, there was considerable confusion over
two key areas: first, what his job responsibilities
were, and secondly, who managed him.
In early 1993 Leeson started trading on SIMEX
in conjunction with Baring Securities Japan’s
Tokyo traders who (since the collapse of the
Japanese stock market in 1990) made their money
through a type of trading called ‘arbitrage’,
otherwise known as ‘switching’. This section of
Baring’s business was known as equity
derivatives. Unlike Killian’s business, the trading
undertaken by the Baring Securities Japan traders
and Leeson was conducted solely to make profits
for Barings and not clients, and can therefore be
classified as proprietary trading. The manager in
charge of the switching business was Fernado
Gueller, based in Japan.
Proceedings of the 37th Hawaii International Conference on System Sciences – 2004
0-7695-2056-1/04 $17.00 (C) 2004 IEEE 4
When Peter Norris became CEO of Baring
Securities Limited in March 1993, one of his first
decisions was to make the Financial Products
Group of Baring Brothers & Co. responsible for
the equity derivatives business (i.e., switching).
The actual hand-over of this business did not take
place until late 1993. The manager in charge of
the Financial Products Group was Ron Baker.
3.3. Unauthorised Trading Activities
Conducted by Baring Futures
Singapore
Leeson was engaged in substantial
unauthorised trading on SIMEX through the taking
of proprietary positions in futures and options.
This section addresses the trading through a brief
examination of the history of the account (88888)
used to book and record the deals.
3.3.1. Account 88888. Unauthorised trading of
futures commenced very shortly after the opening
of 88888 and carried on until the collapse in late
February of 1995. This trading went largely
unnoticed for almost two years and eight months.
The only capacity in which Baring Futures
Singapore was authorised to transact options was
with regard to agency trading. However, in
October 1992 Leeson started to sell options, and
continued to do so until 23rd February, 1995.
At the year-end 1992, losses incurred through
the unauthorised trading were relatively minor,
standing at £2 million. One year later, they had
grown to £23 million, and by 31st December 1994,
the figure amounted to £208 million. In the space
of the following three months, however, this figure
had almost quadrupled to a staggering £827
million.
3.4. Failure of Internal Controls
The ability of Leeson to establish substantial
unauthorised trading positions on SIMEX was
afforded by failures in the management, financial,
and operating controls in Barings. These failures
were evident in Singapore, Tokyo, and London,
and encompassed all levels of control ranging
from the management committees, the business
functions and associated organisational units, and
the actual day-to-day operating controls. The
following list highlights the areas of failure:
• Failures in the managerial supervision of
Leeson.
• Lack of segregation between the front
and back offices of Baring Futures
Singapore.
• Insufficient action taken by Barings
management in response to warning
signals.
• No risk management or compliance
function in Singapore.
• Weak financial and operational control
over the activities and funding of Baring
Futures Singapore at Group level.
4. Discussion and Analysis
In attempting to assess the feasibility of
applying the three criminological theories to the IS
security context, this section of the paper examines
whether events highlighted in the case study
support those concepts which are central to the
theories.
4.1. Routine Activity Theory: Intimate
Handler/Unhandled Offender
Initial management problems were created at
the inception of Baring Futures Singapore. The
BoBS report cites how despite the fact that James
Bax (Head of Baring Securities Singapore) and his
second in command, Simon Jones (Chief
Operating Officer of Baring Securities Singapore)
had, on paper at least, regional responsibility for
Leeson, neither spent much time overseeing his
activities. Although the BoBS report
acknowledges there was some contact between the
two ‘managers’ and Leeson, it further contends
that both Bax and Jones preferred to focus their
energies on Baring Securities Singapore.
Additionally, Mike Killian, who managed the
agency business sent from London and Tokyo, and
executed by Baring Futures Singapore, rejected the
idea of a reporting line between himself and
Leeson. Hence, from the start of Leeson’s
employment at Baring Futures Singapore, there
was confusion over who actually managed him.
This confusion manifested itself in a paucity of
oversight from senior management. There is some
overlap here with the theoretical concepts of the
intimate handler and the handled offender. The
fact that, on the whole, there was an absence of an
intimate handler in the form of senior
management, provided Leeson with the freedom to
undertake his unauthorised trading.
However, there is a divergence between theory
and data with regard to how supervision is actually
enacted. With regard to the intimate handler, their
Proceedings of the 37th Hawaii International Conference on System Sciences – 2004
0-7695-2056-1/04 $17.00 (C) 2004 IEEE 5
presence is enough to act as a deterrent. But it was
not just the mere physical absence of a manager,
which aided Leeson in perpetrating his criminal
activities. When Leeson was afforded some
supervision, the evidence suggests that the
management problem was compounded by the fact
that Bax, Jones and Ron Baker (who was later
responsible for managing Leeson at a product
level) had very little understanding of the products
(futures and options) he dealt in and the trading
processes which underpinned this business. In this
sense, supervision could not be executed properly
owing to the ignorance of managers regarding the
nature of business undertaken by Leeson and not,
in the case of intimate handlers, owing to their
absence.
4.2. Routine Activity Theory: Targets
The Barings case, highlights a possible
variation on the targets concept inscribed in the
model. Although there is no hard evidence to
suggest it, the obvious assumption would be that
Leeson carried out the unauthorised trading for
personal financial gain. Hence the ‘target’ in this
sense would have been the ability to undertake the
unauthorised trading, while the benefits
represented monies derived from the unsanctioned
business. However, in his book The Collapse of
Barings, Fay [12] argues that behind Leeson’s
illegal activities was the desire to become one of
the elite traders on the floor of SIMEX. Leeson
got to know some of these traders owing to the
fact that the companies they worked for (First
Continental Trading and Spear, Leeds and
Kellogg) used Baring Futures Singapore for
clearing their trades with SIMEX. Admiring the
status and prestige associated with the elite
brokers, Fay argues that Leeson was keen to
emulate their activities and establish himself as a
name on the trading floor. To do this, however,
rather than taking the conventional route, Leeson
carried out the unauthorised trading, creating
fantastic ‘profits’ through dumping losses in
account 88888.
In this sense, the benefit derived from trading
was not the obvious one of money, but rather the
benefits of prestige and status that were afforded
the top traders. What the two benefits have in
common is the nature of the target, which was the
ability to undertake unauthorised trading.
Although ‘ability’ has a comparatively intangible
nature, it can still be viewed as consistent with
routine activity theory, which views a target as one
of the elements necessary for the commission of a
crime. The data not only supports this proposition
but, if we subscribe to Fay’s [12] argument, it can
be seen to support the rational choice perspective,
by illustrating how the ‘benefits’ of crime can
come in many guises. In Leeson’s case, as noted,
his benefits were prestige and status.
4.3. Routine Activity Theory:
Guardianship Factors
Compared with traditional applications, the
issue of guardianship is far more complex when
discussing the collapse of Barings. Indeed, a
number of safeguard factors can provide
guardianship in the banking environment, such as
internal/external audit, compliance monitoring,
risk management and the like. To some extent,
these guardianship factors can be perceived as still
in keeping with routine activity theory, given that
their presence or absence would play a part in
determining whether an entity represents a viable
target.
However, it should be noted that the elements
that are considered guardianship factors in the
Barings case are of a far more complex nature than
those traditionally recognised by routine activity
theory. More specifically, a priori conditions need
to be met before they can exist. Take for instance
Baring Securities Limited’s internal audit group.
A management committee would have decided on
its establishment, the size of the group, and the
positions that would need to be created. The
employment vacancies would be advertised,
people interviewed and selected. Obviously, only
after its inception could arrangements have been
made for the group to carry out audits in Baring
Securities Limited’s various subsidiaries.
Of course, even if guardianship factors like the
internal audit group are introduced into the
banking context, there is no guarantee that their
mere existence will provide effective guardianship
over the target they purport to safeguard. Rather
they have to exist and be working effectively.
This last assertion can be seen as a slight departure
from routine activity theory, which asserts that the
existence of a capable guardian would deter a
crime. Obviously of importance here is what
exactly constitutes a capable guardian, but routine
activity does emphasise how the mere physical
presence/existence (as also noted with the handled
offender) is often sufficient to provide the
necessary guardianship. Hence the presence of an
individual in their home is a good illustration. Yet
in the case of Barings, the existence of a
Proceedings of the 37th Hawaii International Conference on System Sciences – 2004
0-7695-2056-1/04 $17.00 (C) 2004 IEEE 6
guardianship factor is not sufficient. They must
exist and be effective.
4.4. Routine Activity Theory: Facilitators
Clarke [13] depicts facilitators as coming from
the physical environment. However, the internal
threat posed by staff, and the organisational
environment in which they work, places a different
spin on the concept. As Willison [14] asserts:
“More interesting perhaps is the idea that
potential offenders acquire facilitators in the
course of their work. Unlike their physical
counterparts, these facilitators are cognitive in
nature, and … are assimilated by staff the day
they begin working for a particular company.”
Essentially these cognitive facilitators include
those skills and knowledge that a person acquires
to perform their jobs. A key point here is that,
although on the whole these skills are used by
employees for perfectly legal activities, they can
also be used to help facilitate activities of an
illegal nature. Perhaps not surprisingly, the BoBS
report highlights numerous instances of Leeson
using his skills in this manner. Indeed, all his
criminal activities were underpinned by
knowledge initially acquired to support legitimate
work. This is clearly revealed by the very fact that
the report makes the distinction between
authorised and unauthorised trading.
For Leeson, the knowledge required to
undertake the unauthorised trading was gleaned
not just from his experience in Singapore, but also
in London where he had previously worked in the
late 1980s and early 1990s. Barings Securities
Limited had commenced trading futures and
options in 1989. In the same year Leeson joined
the department which dealt with the settlements
side of this business, and began to develop an indepth
knowledge of these products. It was his
expertise in this area that landed him the position
in Singapore. Furthermore, while Leeson was
acquiring the necessary skills and knowledge to
undertake his duties, he was also acquiring an indepth
understanding of the work processes of
which his duties were an inherent part.
4.5. Environmental Criminology: Search
Patterns of Offenders
Data from the case study appears to support this
depiction of a potential offender as an individual
who collates information from their awareness
space and uses it for criminal purposes. Leeson’s
‘awareness space’ encompassed the offices he
routinely worked in. These included not only
Baring Futures Singapore and SIMEX, but also
Baring Securities Limited (London) where he had
worked prior to moving to the Far East. While
performing his day-to-day duties, Leeson was able
to note any weak links in the control environment.
Prior to the commencement of the unauthorised
trading, Leeson opened account 88888 to help
conceal his aberrant activities. He knew from his
time in London, that as with other accounts, the
trading details of account 88888 would be sent by
Baring Futures Singapore to London in the form of
four reports, which included a trade file, which
gave details of the day’s trading activity; a price
file, which reported on closing settlements price; a
margin file, listing the initial – and maintenance –
margin details of each account; and the London
gross file, which provided details of BFS’s trading
position. In order to stop details of account 88888
reaching London, Leeson instructed Dr. Edmund
Wong, a computer consultant, to omit details of
the account from three of the four daily trading
reports. The exception was the margin file.
Leeson was aware that the margin file represented
a security vulnerability for Baring Securities
Limited, simply because it was routinely ignored
by staff in London. Conversely, for Leeson, the
margin file represented no risk with regard to
helping to uncover his unauthorised trading, given
the oversight by staff in London. As a
consequence, he was able to ignore it.
Of key importance here is the fact that Leeson
worked for Barings. This represents a slight
departure from the offender’s circumstance
traditionally found in the studies of environmental
criminology. For example, Brantingham and
Brantingham [7] cite the work of Dufala [15]
whose study addresses convenience store robberies
in Tallahassee, Florida. Dufala reports how, for
marketing purposes, the stores were situated near
major roads. As a consequence, these stores also
formed part of the awareness space of offenders
who, like many other urban residents, lived
nearby. Leeson’s position, however, would be
more comparable to that of a clerk in one of the
shops. Hence, learning his trade and developing
knowledge of his target took place in the same
context.
A related point concerns the quality of
information that the offender is able to garner.
Although an offender’s rationality is addressed in
the next section of this