The ultimate goal for journaling to detect an insider threat early in the process is to avoid the many complications associated within Massive Information Management (MIM) and data archiving challenges involved with this process, based on the myriad of legal,regulatory and other organizational requirements to ensure the integrity of that data. The second benefit of performing the journaling in the context of insider computer fraud is the importance of having this information to establish a profile of the nominal data values, i.e., values that occur in the absence of attacks.