Response Time Concealed Information Test Using Fillers in Cybercrime and Concealed Identity Scenarios

This study tested the Response Time Concealed Information Test (RT-CIT) using filler items in cybercrime and concealed identity scenarios with over 1,400 participants across three experiments. Results showed moderate accuracy for crime details (AUC ~.70) but excellent performance for autobiographical information (AUC ~.95), with similar effectiveness across different filler item types.

Three online experiments with between-subjects design compared guilty participants who completed mock cybercrime scenarios against innocent controls, testing recognition using RT-CIT with various filler item configurations.

This research addressed critical gaps in RT-CIT validation by testing the method in realistic cybercrime scenarios rather than artificial laboratory tasks. Across three large-scale online experiments, participants either completed mock hacking simulations or served as innocent controls, then underwent RT-CIT testing with different filler item designs. The study found that filler item type (specific, generic, or nonverbal) had minimal impact on accuracy, but revealed a substantial performance gap between crime-related details and autobiographical information. Results suggest RT-CIT's effectiveness depends more on the nature of concealed information than on specific test design elements.

Findings suggest RT-CIT may have limited practical utility for cybercrime investigation due to moderate accuracy with crime details, while highlighting the importance of memory type in deception detection applications and supporting simplified filler protocols for field use.

Background & Context

The Response Time Concealed Information Test (RT-CIT) represents a cost-effective alternative to traditional physiological polygraph methods, detecting concealed knowledge by measuring millisecond differences in reaction times when examinees encounter crime-relevant information. The test can reveal that a person recognizes a relevant item among other control items, based on slower responses to the former compared to the latter ones. Prior research demonstrated that adding "filler" items to the test significantly improved its accuracy, but these validations predominantly used unrealistic scenarios like testing participants' recognition of their own names.

The RT-CIT has been predominantly examined only in the context of scenarios that are very unlikely in real life, while sporadic assessment has shown that it suffers from low diagnostic accuracy in more realistic scenarios. This 2023 study by Gáspár Lukács addresses a critical gap by testing the RT-CIT in a highly relevant contemporary context: cybercrime investigation. With cybercrime incidents escalating globally, developing validated deception detection tools for digital offenses represents an urgent practical need.

The research also tackles fundamental questions about filler item design—whether these enhancement elements must be specifically tailored to each scenario or whether generic filler items could work universally across different deception contexts. This has significant implications for standardizing and simplifying RT-CIT protocols for field applications.

Research Design & Methodology

The research comprised three online experimental studies with large sample sizes. Study 1 included 614 participants and Study 2 included 553 participants, both testing a mock cybercrime scenario. Study 3 included 250 participants in a concealed identity scenario. All studies employed a between-subjects design comparing "guilty" participants who possessed crime knowledge against "innocent" controls.

In the cybercrime scenarios, participants in the guilty condition completed an online hacking simulation where they accessed a fictional company's database, extracted specific files, and transferred money to designated accounts. They were then tested on their recognition of crime details like the company name, specific file names, and account numbers. Innocent participants received no crime exposure and were tested on the same items.

The RT-CIT protocol presented items requiring two-choice categorization responses. Key design elements included:

• Probe items: Crime-relevant details (e.g., the actual company hacked)
• Irrelevant items: Similar but crime-unrelated alternatives (e.g., other company names)
• Target item: A designated non-crime item requiring opposite response
• Filler items: Familiarity-referring words ("Familiar," "Recognized") and unfamiliarity-referring words ("Unfamiliar," "Unknown")

Study 2 manipulated filler characteristics (regular vs. varied proportions), while Study 3 compared specific self-related fillers, generic relevance-related fillers, and nonverbal symbolic fillers (numbers and arrows). The primary outcome measure was the Area Under the Curve (AUC) of receiver operating characteristic analysis, with AUC values where .5 means chance level classification and 1 means flawless classification.

Results & Key Findings

The study found significant though moderate effects in the cybercrime scenarios, and similar diagnostic accuracies when using specific, generic, and even nonverbal filler items. The headline finding revealed a substantial performance gap based on memory type rather than filler design.

The most striking result: AUC estimates were around .70 for crime details, but around .95 for autobiographical items, despite otherwise near-identical RT-CIT designs. This represents a dramatic difference in detection accuracy, with autobiographical information producing classification rates approaching those needed for real-world applications, while cybercrime details showed only moderate diagnostic value.

Additional key findings included:

• Filler type generalizability: Specific, generic, and nonverbal fillers all produced similar enhancement effects, suggesting flexibility in filler selection
• Probe-control RT differences: Mean differences of approximately 14.5 ms were observed, with corresponding AUC of .62 and correct detection rate of .64
• Filler arrangement: Small variations in filler proportions showed minimal impact on overall diagnostic accuracy
• Item salience effect: The relatively low accuracy for incidentally-acquired cybercrime details versus personally-meaningful autobiographical information highlighted salience as a critical moderating factor

The relatively low diagnostic accuracy in case of the cybercrime scenario reemphasizes the importance of assessments in realistic scenarios as well as the need for further improving the RT-CIT. The research demonstrated that while the enhanced RT-CIT works, its effectiveness depends heavily on the nature of the concealed information being tested.

Discussion & Significance

This research makes several important contributions to concealed information testing. First, it provides the first systematic validation of the RT-CIT in a cybercrime context, demonstrating that the technique can detect digital crime knowledge above chance levels, even if not yet at field-ready accuracy. The cybercrime scenario represents a more ecologically valid testing ground than typical laboratory paradigms, as digital evidence increasingly features in real investigations.

The finding that filler items need not be scenario-specific is practically significant. While it is important that fillers in some way refer to the probe item, the strict probe-relatedness of the filler plays no major role, suggesting one can either choose filler words fairly liberally or simply always use a set of generic relevance-referring filler words. This greatly simplifies test construction and standardization efforts, potentially enabling automated RT-CIT deployment.

However, the substantial accuracy gap between cybercrime and autobiographical scenarios raises important theoretical and practical concerns. The results suggest that crime details acquired incidentally during brief online activities produce weaker memory traces than deeply-encoded personal information. This challenges the applicability of RT-CIT to realistic investigative scenarios where suspects may have limited exposure to crime details. The finding aligns with prior research showing that item salience significantly influences CIT effectiveness, but quantifies this effect more precisely than previous work.

Limitations & Considerations

The mock crime paradigm, while more realistic than name recognition tasks, still differs from actual criminal behavior in crucial ways. Participants completed the "cybercrime" knowing it was simulated research, eliminating the motivational, emotional, and consequential factors present in real offenses. The online format, while enabling large sample collection, precluded behavioral observation and environmental control typical of laboratory studies.

The cybercrime scenario involved relatively brief exposure to crime details (typically under 10 minutes), which may not reflect prolonged criminal planning or repeated criminal acts. Memory consolidation for quickly-acquired information differs from knowledge gained through extended criminal activity. Additionally, the one-week delay used in Study 1 may not represent typical investigation timelines, though Study 2 tested participants immediately after the mock crime.

The moderate accuracy rates (AUC around .70) for cybercrime detection fall below thresholds typically required for high-stakes forensic applications, where false positive rates must be minimized. While statistically significant, these effect sizes suggest the current RT-CIT protocol requires further refinement before deployment in actual cybercrime investigations. The sample consisted entirely of online volunteers, potentially differing from criminal suspect populations in cognitive abilities, motivation to deceive, and familiarity with deception detection procedures.

Practical Applications

For polygraph practitioners and investigators, this research offers both promise and caution regarding RT-CIT application to cybercrimes. The technique's simplicity, low cost, and potential for remote administration make it attractive for screening large numbers of suspects or employees in data breach investigations. The finding that generic fillers work across scenarios means examiners could use standardized protocols without extensive customization.

However, the moderate accuracy rates for crime details suggest the RT-CIT should be viewed as an investigative tool rather than conclusive evidence in cybercrime cases. It may be most valuable for narrowing suspect pools, prioritizing investigative leads, or corroborating other evidence rather than serving as a standalone determination of guilt. Examiners should recognize that detection accuracy will likely be higher when testing recognition of personally significant information (like an examinee's own username or frequently-accessed sites) versus incidentally encountered crime details. For consumers of polygraph services, understanding these accuracy limitations is essential when evaluating RT-CIT results in cybersecurity or employee screening contexts.