The present invention relates to a system for detecting misuse of authorized access to a digital data gathering system by a user. User behavior is monitored as to the search queries, the search results, or both. When a valid record of normal user behavior is obtained, each new query and result for the user can be compared to the record to determine if anomalous activity has occurred.