Predicting privacy and security attitudes

Abstract

While individual differences in decision-making have been examined within the social sciences for several decades, this research has only recently begun to be applied by computer scientists to examine privacy and security attitudes (and ultimately behaviors). Specifically, several researchers have shown how different online privacy decisions are correlated with the "Big Five" personality traits. However, in our own research, we show that the five factor model is actually a weak predictor of privacy preferences and behaviors, and that other well-studied individual differences in the psychology literature are much stronger predictors. We describe the results of several experiments that showed how decision-making style and risk-taking attitudes are strong predictors of privacy attitudes, as well as a new scale that we developed to measure security behavior intentions. Finally, we show that privacy and security attitudes are correlated, but orthogonal.

References

1. A. Acquisti and R. Gross. Imagined communities: Awareness, information sharing, and privacy on the Facebook. In Privacy Enhancing Technologies Workshop (PET '06), 2006.
2. K. C. Appelt, K. F. Milch, M. Handgraaf, and E. U. Weber. The decision making individual differences inventory and guidelines for the study of individual differences in judgment and decision-making research. Judgment and Decision Making, 6(3): 252--262, April 2011.
3. A.-R. Blais and E. U. Weber. A domain-specific risk-taking (dospert) scale for adult populations. Judgment and Decision Making, 1(1): 33--47, 2006.
4. J. Blythe, J. Camp, and V. Garg. Targeted risk communication for computer security. In Proceedings of the 16th International Conference on Intelligent User Interfaces, IUI '11, pages 295--298, New York, NY, USA, 2011. ACM.
5. T. Buchanan, C. Paine, A. N. Joinson, and U.-D. Reips. Development of measures of online privacy concern and protection for use on the internet. Journal of the American Society for Information Science and Technology, 58(2): 157--165, 2007.
6. J. T. Cacioppo, R. E. Petty, and C. Feng Kao. The efficient assessment of need for cognition. Journal of personality assessment, 48(3): 306--307, 1984.
7. P. T. Costa and R. R. McCrae. The revised neo personality inventory (neo-pi-r). The SAGE handbook of personality theory and assessment, 2: 179--198, 2008.
8. S. Egelman and E. Peer. Scaling the Security Wall: Developing a Security Behavior Intentions Scale (SeBIS). In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, CHI '15, New York, NY, USA, 2015. ACM. To appear.
9. S. D. Gosling, P. J. Rentfrow, and W. B. Swann Jr. A very brief measure of the big-five personality domains. Journal of Research in personality, 37(6): 504--528, 2003.
10. L. Gou, M. X. Zhou, and H. Yang. Knowme and shareme: Understanding automatically discovered personality traits from social media and user sharing preferences. In Proceedings of the 32Nd Annual ACM Conference on Human Factors in Computing Systems, CHI '14, pages 955--964, New York, NY, USA, 2014. ACM.
11. L. K. John, A. Acquisti, and G. Loewenstein. Strangers on a plane: context-dependent willingness to divulge sensitive information. Journal of Consumer Research, 37(5): 858--873, 2011.
12. J. Joireman, M. J. Shaffer, D. Balliet, and A. Strathman. Promotion orientation explains why future-oriented people exercise and eat healthy evidence from the two-factor consideration of future consequences-14 scale. Personality and Social Psychology Bulletin, 38(10): 1272--1287, 2012.
13. I. A. Junglas, N. A. Johnson, and C. Spitzmuller. Personality traits and concern for privacy: an empirical study in the context of location-based services. European Journal of Information Systems, 17(4): 387--402, print 2008.
14. M. L. Korzaan and K. T. Boswell. The influence of personality traits and information privacy concerns on behavioral intentions. Journal of Computer Information Systems, 48(4): 15--24, 2008.
15. P. Kumaraguru and L. F. Cranor. Privacy Indexes: A Survey of Westin's Studies. Technical Report CMU-ISRI-5-138, Carnegie Mellon University, December, 2005. http://reports-archive.adm.cs.cmu.edu/anon/isri2005/abstracts/05-138.html.
16. N. K. Malhotra, S. S. Kim, and J. Agarwal. Internet users' information privacy concerns (iuipc): The construct, the scale, and a causal model. Information Systems Research, 15(4): 336--355, December 2004.
17. M. Matsunaga. How to factor-analyze your data right: Do's, don'ts, and how-to's. International Journal of Psychological Research, 3(1): 97--110, 2010.
18. J. H. Patton, M. S. Stanford, et al. Factor structure of the barratt impulsiveness scale. Journal of clinical psychology, 51(6): 768--774, 1995.
19. D. M. Pedersen. Personality correlates of privacy. The Journal of Psychology, 112(1): 11--14, 1982.
20. V. F. Reyna, W. L. Nelson, P. K. Han, and N. F. Dieckmann. How numeracy influences risk comprehension and medical decision making. Psychological bulletin, 135(6): 943, 2009.
21. S. G. Scott and R. A. Bruce. Decision-making style: The development and assessment of a new measure. Educational and psychological measurement, 55(5): 818--831, 1995.
22. R. Strahan and K. C. Gerbasi. Short, homogeneous versions of the marlowe-crowne social desirability scale. Journal of clinical psychology, 1972.
23. A. Woodruff, V. Pihur, S. Consolvo, L. Brandimarte, and A. Acquisti. Would a privacy fundamentalist sell their dna for $1000...if nothing bad happened as a result? the westin categories, behavioral intentions, and consequences. In Proceedings of the 2014 Symposium on Usable Privacy and Security, pages 1--18. USENIX Association, 2014.

Index Terms

• Human-centered computing

  • Human computer interaction (HCI)

• Security and privacy

• Social and professional topics

  • Computing / technology policy

    • Computer crime