Using various UNIX programs, it is possible to capture data on users that is stored in an IT system. This includes data that can provide information on a user’s activity profile. It can also contain information on other logged-in users, as well as technical information on the installation and configuration of the operating system.

For example, with a simple program that analyses information provided by the “who” command at certain intervals, any user can generate a precise utilisation profile for an account. It can then be determined, for instance, when the system administrator or administrators have been absent in order to exploit these patterns for unauthorised acts. The program also makes it possible to determine which terminals are approved for privileged access. Other programs with similar potential for data misuse are “finger” and “ruser”.