The stakes of the problem are considerable. Competition among software firms has fueled theft of intellectual property and a steady stream of patent infringement lawsuits, and one of the most consequential threats is the unauthorized use of code, ideas, or program components by competitors. When former employees or outsourcing partners carry an employer’s intellectual capital to a rival organization, the victim firm’s software product development can be compromised. Unlike a stolen physical asset, misappropriated knowledge leaves no obvious trace: a routine, an algorithm, or an architectural insight can travel in a person’s memory and reappear in a competitor’s product months later, making detection and legal proof difficult. Every such transfer of knowledge by someone bound by an NDA constitutes a violation of that agreement, yet information systems research has offered limited explanation of why developers engage in it. The new study is presented explicitly as a first step in closing that gap.

The theoretical pivot of the paper is a deliberate departure from the mainstream of information security research. Most studies of information policy violations are grounded in deterrence theory, which asks how organizations can scare employees into compliance through the threat of formal sanctions. That framework has produced useful findings for behaviors such as password sharing or unauthorized system access, where violations are visible in audit logs and can be traced to identifiable individuals. The authors argue that this lens is insufficient for NDA violations because of their inconspicuous nature: unlike, say, sharing a password or plugging an unauthorized device into a corporate network, reusing code or applying ideas learned at a previous employer is difficult to observe, hard to attribute, and unlikely to be detected. When the probability of getting caught is low, deterrence loses much of its leverage, because the expected cost of the behavior — the sanction multiplied by the likelihood of detection — shrinks toward zero even if the sanction itself is severe. Social learning theory, by contrast, shifts the analytical focus from deterrence to motivation — asking where developers acquire the attitudes, rationalizations, and expectations that make violation seem acceptable or even advantageous.

Social learning theory, rooted in the criminological work of Edwin Sutherland and later formalized by Ronald Akers and colleagues, holds that deviant behavior is learned through interaction with one’s social environment. People observe what others do, hear whether significant figures in their lives approve or disapprove, and weigh the rewards and punishments that follow. The theory has been applied for decades to behaviors ranging from adolescent substance use to white-collar crime, and its central claim is that no deviant act is purely an individual calculation; it is embedded in a web of examples, approvals, and anticipated consequences. The study translated these classic constructs into the NDA context, measuring differential associations (how many family members, friends, co-workers, and supervisors the respondent knows to have violated an NDA), imitation of others, significant others’ influence (whether those same people would approve of a violation), praise for abstaining, encouragement for violating, expectations of whistleblowing, formal sanctions, perceived benefits of violating, and perceived costs. All constructs were measured with seven-point Likert scales, and the models treated them as first-order reflective constructs.

To elicit violation intentions, the researchers used scenario-based vignettes, a common technique for studying sensitive or illegal behaviors that cannot be observed directly. Direct observation of NDA violations is practically impossible for researchers — firms do not publicize them, and violators do not self-report — so vignettes allow respondents to project themselves into realistic situations while preserving anonymity. Two scenarios anchored the survey. In the first, a chief software developer named M. Nykänen, recently hired away from a market-leading competitor, considers reusing solutions developed at the previous firm to improve the new employer’s product, knowing the move would raise his salary and bonus but also knowing the former employer could sue. In the second, a developer at a gaming company, S. Jarvi, is asked by a client to design a set of avatar fighting components; rather than building new code at great expense, Jarvi considers reusing similar components previously created for another client under an NDA. The two vignettes were designed to capture distinct violation contexts — an employee switching employers and a contractor serving multiple clients — reflecting the two most common channels through which confidential knowledge crosses organizational boundaries. Respondents were asked how likely they would be to do what the scenario character did.

The empirical findings deliver a clear hierarchy of influence. Deterrence mechanisms — formal sanctions such as the possibility of reprimand, probation, or firing, and the expectation that others might blow the whistle to management — did significantly reduce violation intentions, but only modestly. By contrast, the social-learning mechanisms showed stronger effects, with significant others’ influence and perceived benefits standing out as the most powerful predictors. In other words, what mattered most was not the fear of punishment but whether the people around a developer would approve of the violation, and whether the developer believed violating would bring good outcomes such as a promotion or other career advantages.

This pattern has a coherent logic given the nature of the behavior. Because NDA violations are inconspicuous, the expected cost of getting caught is low, which blunts the deterrent power of formal sanctions. Meanwhile, the perceived benefits remain fully salient to the individual: reusing existing code saves time and money, impresses a new employer, and can accelerate a career. If peers and supervisors signal approval — or if a developer has watched colleagues violate NDAs without consequence — the social environment effectively licenses the behavior. The measurement results reinforce the reliability of these conclusions: constructs such as perceived costs, imitation, and formal sanctions showed high internal consistency, with composite reliabilities ranging up to 0.96, while the whistleblowing measure was comparatively weaker, itself a hint that reporting NDA violations is a less well-formed expectation among developers than fear of direct punishment. That weakness is telling in its own right: unlike a colleague who misuses a corporate account, a developer who quietly reuses old code is unlikely to be reported by anyone, because coworkers may not recognize the behavior as a violation at all — or may have committed similar acts themselves.

The implications for practice cut against a purely punitive compliance strategy. If organizations want developers to honor NDAs, the study suggests they must engage with software developer culture and the social influences that shape developers’ motivations, rather than relying solely on sanctions and monitoring. That could mean cultivating norms in which respected colleagues and supervisors visibly disapprove of violations, recognizing and praising compliance, and addressing the perceived benefits that make violation attractive — for instance, by ensuring developers are not placed in situations where reusing a former employer’s ideas is the easiest path to a bonus. Organizations can also shape the social cues developers encounter: onboarding that emphasizes clean-room practices, team leads who model careful handling of prior-employer knowledge, and hiring processes that avoid implicitly rewarding candidates who bring confidential material with them. The findings also echo a broader movement in the information security literature, where scholars have increasingly argued that deterrence alone cannot explain insider computer abuse and that motives, moral beliefs, and social context matter alongside controls.

The study sits within a rich research conversation. Prior work has examined deterrence in information security policy compliance, neutralization techniques that employees use to rationalize violations, fear appeals, peer monitoring, and the role of social influence in compliance. The authors’ contribution is to extend this tradition into the specific and underexplored domain of NDAs, drawing on instruments adapted from classic criminological studies by Akers and colleagues and by Paternoster and Simpson. Related recent work on keeping inventions confidential and on why software professionals knowingly omit quality practices underscores a growing recognition that legal and procedural controls in software development are shaped as much by human and social dynamics as by formal rules. In that sense, the paper connects information systems research to a long line of organizational studies showing that written policies are only as strong as the informal norms that surround them.

As with any scenario-based survey, the study measures intentions rather than observed violations, and intentions do not always translate into behavior; the authors note that the dataset is available from the corresponding author on reasonable request, subject to institutional restrictions. The survey was anonymous, with no identifying information gathered, and the authors report no conflicts of interest or external funding. Because the scenarios depict specific situations — a developer moving to a competitor, and a contractor reusing code covered by a client NDA — generalization to other NDA contexts, industries, and cultures warrants caution. Still, as a first empirical mapping of the motivational terrain of NDA violations, the study makes a clear claim: to understand why software developers break their promises of confidentiality, look less at the punishment they might face and more at the people they work with, the approval they seek, and the rewards they believe are waiting on the other side of the violation.