An experimental method for the elicitation of implicit attitudes to privacy risk

We test an experimental method for the elicitation of implicit attitudes to privacy risk. We ask individuals to decide whether to incur the risk of revealing private information to other participants. This type of risk that involves a social component corresponds to privacy threats that individuals may face in the field. We derive a measure of individual attitudes to privacy risk with our method. We empirically test the validity of this measure by running a laboratory experiment with 148 participants. Our results confirm that the willingness to incur a privacy risk is driven by a complex array of factors including risk attitudes, self-reported value for private information, and general attitudes to privacy (derived from survey methods in our study). We also observe that attitudes to privacy risk depend on the order in which measures of risk attitude are elicited, but do not depend on whether there is a preexisting threat to privacy, over which participants have no control. We explain how our method can be simplified and extended for use in eliciting attitudes to a wide range of privacy risks and various types of private information

An experimental method for the elicitation of implicit attitudes to privacy risk

We test an experimental method for the elicitation of implicit attitudes to privacy risk. We ask individuals to decide whether to incur the risk of revealing private information to other participants. This type of risk that involves a social component corresponds to privacy threats that individuals may face in the field. We derive a measure of individual attitudes to privacy risk with our method. We empirically test the validity of this measure by running a laboratory experiment with 148 participants. Our results confirm that the willingness to incur a privacy risk is driven by a complex array of factors including risk attitudes, self-reported value for private information, and general attitudes to privacy (derived from survey methods in our study). We also observe that attitudes to privacy risk depend on the order in which measures of risk attitude are elicited, but do not depend on whether there is a preexisting threat to privacy, over which participants have no control. We explain how our method can be simplified and extended for use in eliciting attitudes to a wide range of privacy risks and various types of private information

Economics of Privacy: Users' Attitudes and Economic Impact of Information Privacy Protection

This doctoral thesis consists of three essays within the field of economics of information privacy examined through the lens of behavioral and experimental economics. Rapid development and expansion of Internet, mobile and network technologies in the last decades has provided multitudinous opportunities and benefits to both business and society proposing the customized services and personalized offers at a relatively low price and high speed. However, such innovations and progress have also created complex and hazardous issues. One of the main problems is related to the management of extensive flows of information, containing terabytes of personal data. Collection, storage, analysis, and sharing of this information imply risks and trigger usersâ concerns that range from nearly harmless to significantly pernicious, including tracking of online behavior and location, intrusive or unsolicited marketing, price discrimination, surveillance, hacking attacks, fraud, and identity theft. Some users ignore these issues or at least do not take an action to protect their online privacy. Others try to limit their activity in Internet, which in turn may inhibit the online shopping acceptance. Yet another group of users gathers personal information protection, for example, by deploying the privacy-enhancing technologies, e.g., ad-blockers, e-mail encryption, etc. The ad-blockers sometimes reduce the revenue of online publishers, which provide the content to their users for free and do not receive the income from advertisers in case the user has blocked ads. The economics of privacy studies the trade-offs related to the positive and negative economic consequences of personal information use by data subjects and its protection by data holders and aims at balancing the interests of both parties optimising the expected utilities of various stakeholders. As technology is penetrating every aspect of human life raising numerous privacy issues and affecting a large number of interested parties, including business, policy-makers, and legislative regulators, the outcome of this research is expected to have a great impact on individual economic markets, consumers, and society as a whole. The first essay provides an extensive literature review and combines the theoretical and empirical evidence on the impact of advertising in both traditional and digital media in order to gain the insights about the effects of ad-blocking privacy-enhancing technologies on consumersâ welfare. It first studies the views of the main schools of advertising, informative and persuasive. The informative school of advertising emphasizes the positive effects of advertising on sales, competition, product quality, and consumersâ utility and satisfaction by matching buyers to sellers, informing the potential customers about available goods and enhancing their informed purchasing decisions. In contrast, the advocates of persuasive school view advertising as a generator of irrational brand loyalty that distorts consumersâ preferences, inflates product prices, and creates entry barriers. I pay special attention to the targeted advertising, which is typically assumed to have a positive impact on consumersâ welfare if it does not cause the decrease of product quality and does not involve the extraction of consumersâ surplus through the exploitation of reservation price for discriminating activities. Moreover, the utility of personalized advertising appears to be a function of its accuracy: the more relevant is a targeted offer, the more valuable it is for the customer. I then review the effects of online advertising on the main stakeholders and users and show that the low cost of online advertising leads to excessive advertising volumes causing information overload, psychological discomfort and reactance, privacy concerns, decreased exploration activities and opinion diversity, and market inefficiency. Finally, as ad-blocking technologies filter advertising content and limit advertising exposure, I analyze the consequences of ad-blocking deployment through the lens of the models on advertising restrictions. The control of advertising volume and its partial restriction would benefit both consumers and businesses more than a complete ban of advertising. For example, advertising exposure caps, which limit the number of times that the same ad is to be shown to a particular user, general reduction of the advertising slots, control of the advertising quality standards, and limitation of tracking would result in a better market equilibrium than can offer an arms race of ad-blockers and anti-ad-blockers. Finally, I review the solutions alternative to the blocking of advertising content, which include self regulation, non-intrusive ads programs, paywall, intention economy approach that promotes business models, in which user initiates the trade and not the marketer, and active social movements aimed at increasing social awareness and consumer education. The second essay describes a model of factors affecting Internet usersâ perceptions of websitesâ trustworthiness with respect to their privacy and the intentions to purchase from such websites. Using focus group method I calibrate a list of websitesâ attributes that represent those factors. Then I run an online survey with 117 adult participants to validate the research model. I find that privacy (including awareness, information collection and control practices), security, and reputation (including background and feedback) have strong effect on trust and willingness to buy, while website quality plays a marginal role. Although generally trustworthiness perceptions and purchase intentions are positively correlated, in some cases participants are likely to purchase from the websites that they have judged as untrustworthy. I discuss how behavioral biases and decision-making heuristics may explain this discrepancy between perceptions and behavioral intentions. Finally, I analyze and suggest what factors, particular websitesâ attributes, and individual characteristics have the strongest effect on hindering or advancing customersâ trust and willingness to buy. In the third essay I investigate the decision of experimental subjects to incur the risk of revealing personal information to other participants. I do so by using a novel method to generate personal information that reliably induces privacy concerns in the laboratory. I show that individual decisions to incur privacy risk are correlated with decisions to incur monetary risk. I find that partially depriving subjects of control over the revelation of their personal information does not lead them to lose interest in protecting it. I also find that making subjects think of privacy decisions after financial decisions reduces their aversion to privacy risk. Finally, surveyed attitude to privacy and explicit willingness to pay or to accept payments for personal information correlate with willingness to incur privacy risk. Having shown that privacy loss can be assimilated to a monetary loss, I compare decisions to incur risk in privacy lotteries with risk attitude in monetary lotteries to derive estimates of the implicit monetary value of privacy. The average implicit monetary value of privacy is about equal to the average willingness to pay to protect private information, but the two measures do not correlate at the individual level. I conclude by underlining the need to know individual attitudes to risk to properly evaluate individual attitudes to privacy as such

Factors Influencing the Perception of Website Privacy Trustworthiness and Users’ Purchasing Intentions: The Behavioral Economics Perspective

In this study, we identified the factors that influence consumer purchasing intentions and their perceptions of the trustworthiness of the privacy-related practices of e-commerce websites. We produced a list of website attributes that represent these factors in a series of focus groups. Then we constructed and validated a research model from an online survey of 117 adult participants. We found that security, privacy (including awareness, information collection, and control), and reputation (including company background and consumer reviews) have a strong effect on trust and willingness to purchase, while website quality plays only a marginal role. Although the perception of trustworthiness and purchasing intention were positively correlated, in some cases participants were more willing to buy from a website that they judged as untrustworthy with regard to privacy. We investigated how behavioral biases and decision-making heuristics may explain the discrepancy between perception and behavioral intention. Finally, we determined which website attributes and individual characteristics impact customer’s trust and willingness to buy

A Narrative Review of Factors Affecting the Implementation of Privacy and Security Practices in Software Development

Funding Information: This work received funding in part from the EU Horizon 2020 research and innovation programme under the Marie Skłodowska-Curie grant agreement 754489, in part from Science Foundation Ireland grant 13/RC/2094 and co-funded under the European Regional Development Fund through the Southern & Eastern Regional Operational Progamme to Lero—the Irish Software Research Centre (www.lero.ie), and in part by a grant from the Center for Long-Term Cybersecurity (CLTC) at U.C. Berkeley, by National Science Foundation grants v and CNS-1528070, and by the National Security Agency’s Science of Security program. Opinions, findings, and conclusions are those of the authors and do not necessarily reflect the views of the funders. Publisher Copyright: Copyright © 2023 held by the owner/author(s).Privacy and security are complex topics, raising a variety of considerations and requirements that can be challenging to implement in software development. Determining the security and privacy related factors that have an influence on software systems development and deployment project outcomes has been the focus of extensive and ongoing research over the past two decades. To understand and categorize the factors that have an impact on developers' adoption and implementation of privacy and security considerations and practices in software development, we carried out a narrative review of the literature. The resulting mapping of factors provides a foundation for future interventions targeting organizational and individual behavior change, to increase the adoption of privacy and security practices in software development.Peer reviewe

Investigating Users\u27 Preferences and Expectations for Always-Listening Voice Assistants

Many consumers now rely on different forms of voice assistants, both stand-alone devices and those built into smartphones. Currently, these systems react to specific wake-words, such as "Alexa," "Siri," or "Ok Google." However, with advancements in natural language processing, the next generation of voice assistants could instead always listen to the acoustic environment and proactively provide services and recommendations based on conversations without being explicitly invoked. We refer to such devices as "always listening voice assistants" and explore expectations around their potential use. In this paper, we report on a 178-participant survey investigating the potential services people anticipate from such a device and how they feel about sharing their data for these purposes. Our findings reveal that participants can anticipate a wide range of services pertaining to a conversation; however, most of the services are very similar to those that existing voice assistants currently provide with explicit commands. Participants are more likely to consent to share a conversation when they do not find it sensitive, they are comfortable with the service and find it beneficial, and when they already own a stand-alone voice assistant. Based on our findings we discuss the privacy challenges in designing an always-listening voice assistant

Deployment of Source Address Validation by Network Operators: A Randomized Control Trial

IP spoofing, sending IP packets with a false source IP address, continues to be a primary attack vector for large-scale Denial of Service attacks. To combat spoofing, various interventions have been tried to increase the adoption of source address validation (SAV) among network operators. How can SAV deployment be increased? In this work, we conduct the first randomized control trial to measure the effectiveness of various notification mechanisms on SAV deployment. We include new treatments using nudges and channels, previously untested in notification experiments. Our design reveals a painful reality that contrasts with earlier observational studies: none of the notification treatments significantly improved SAV deployment compared to the control group. We explore the reasons for these findings and report on a survey among operators to identify ways forward. A portion of the operators indicate that they do plan to deploy SAV and ask for better notification mechanisms, training, and support materials for SAV implementation.Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.Organisation & Governanc