• No results found

Background and Literature Review

2.2 User Behaviour and Cyber Security

2.3.3 Defaults and Least Resistance

"Treading the path of least resistance" refers to people’s natural desire to adopt the easiest method of task completion (a process often involving some attribution of "laziness, fear and distraction") [229]. It implies that if given a task (where a default option is available - an option that is automatically selected if the user does not respond), we can expect the majority of a population to end up with this choice irrespective of whether or not it is best for them.

The impact of such a default is magnified in its’ effectiveness if there is some form of explicit or implicit suggestion that it reflects normative behaviour or the recommended choice.

A default is therefore an extremely powerful component of the choice architecture owing to its unavoidable, ubiquitous nature. In presenting a choice, there must always be a rule that governs the system’s behaviour if the user does not choose an option. The importance of

2.3 Nudge 33

defaults is further stressed through the common belief that "if I do nothing, nothing changes"

[229]. This is highly problematic and completely open to manipulation from a corrupt choice architect.

In Computing, the role of defaults can have profound impacts on IS. During software installation, many install wizards often contain additional pieces of software that are defaultly selected for installation (that are typically not from the same vendor) in order for them to profit from additional software sales or advertisement revenue. This software is from an unknown source which may or may not be trustworthy. Once installed, the software may then execute whichever commands it has been programmed to do so.

Defaults are also controversial in nature. Most common to cause complaints are those defaults that relate to financial transactions or cause some form of loss to the user, recurring subscriptions for example. Other examples include the necessity to manually opt-out of default charges (environmental CO2off-set, or default travel insurance).

To those who oppose the idea of defaults, Thaler [229] suggests the idea of "required choice, or mandated choice", a concept that is clearly illustrated through the example of organ donation [129], a decision that often sparks considerable debate especially given the pretence that many people are willing to accept an organ but far fewer are registered donors. This has similarities with Information Security decisions where users often view their personal sensitive data with higher regard than corporate data, and thus are more likely to take proactive measures to protect it. Within Thaler’s study, it is noted that some countries have an opt-out policy with respect to organ donation, a term coined "presumed consent".

This approach inevitably increases the number of people who implicitly agree to organ donation. The initiative has had strong negative feedback, however, as people feel that the government has no right to presume anything with respect to their organs and body after death. To remedy this, a mandated choice could be adopted. Thaler [229] discusses such an approach with respect to driving licence renewal in the state of Illinois, where upon renewal drivers are asked whether or not they wish to become organ donors. Such a policy has had a considerable effect on the number of donors resulting in a rise to 60% adoption from the national average of 38%.

2.3.4 Feedback

An essential component of any effective choice architecture is the ability to provide feedback to the user [229]. Examples include digital cameras that allow the user to instantly review a photograph they have taken (allowing the user to identify any errors) rather than having to send the film to be developed and finding out that the photograph is imperfect when it is too late.

Other useful feedback mechanisms can be visualised in the home energy market with the recent addition of smart meters. These smart meters aim to give a visual representation (through the use of colour coding) as to the amount of energy you are currently using in your home. similar visual stimuli can be observed in the automotive industry with the inclusion of miles per gallon displays which aim to push drivers into adopting a more economical, environmentally friendly driving style. (Defaults will be further discussed in 2.3.4).

MINDSPACE

MINDSPACE is a framework for understanding "nine effects on behavior operating largely on the “automatic” system: messenger, incentives, norms, defaults, salience, priming, affect, commitment, and ego" [84], [83], [82]. Dolan et al [84] use the following diagram to highlight the links between the respective nodes.

Fig. 2.5 Mindspace Diagram [84]

MINDSPACE is important in understanding how nudges are effective as it describes specific behaviours and how they can be modified. It is a tool for changing behaviour. To effectively change behaviour one must combine MINDSPACE with the 6 E’s of learning [84]. This process consists of understanding how users react to MINDSPACE and delivering

2.3 Nudge 35

our nudges in methods that conform to the 6 E’s, both of which have been extensively documented within literature. Delivery must be holistic to working practices in order to improve the effectiveness of our nudges.

Fig. 2.6 Mindspace Diagram with 6 E’s [84]

Defining the specific elements of behavioural change and how they may be altered is a powerful tool as it allows focused attempts to modify specific behaviours. Such a process enables the creation of highly effective nudges that can have a significant impact on the way in which people behave in a given environment.

Nudges are designed to exploit a given behaviour. Understanding the intricacies of MINDSPACE allows for the specific targeting and deployment of such nudges. Sunstein [218] provides a detailed overview of the ten most important factors with respect to nudges:

1. Defaults: see 2.3.3.

2. Simplification: complexity is a serious issue in both rich and poor nations. Programmes should be easily navigable and simplification in all forms should be a high priority.

Overly complex procedures deters participants from important processes.

3. Use of social norms: social norms aim to highlight normative behaviour, essentially they reinforce the user that their behaviour is in line with most other users within the system. The use of social norms can be effective in reducing crime and promoting a healthier lifestyle (smoking and alcohol campaigns are highly prevalent).

4. Increases in ease and convenience: people often tend to choose the easiest option and thus a good strategy to adopt is "make it easy". If the desire is to promote a certain behaviour then it is a good idea to remove barriers that prevent adoption. Resistance to change is often a result of perceived difficulty or complexity rather than disagreement or scepticism.

5. Disclosure: openness of data repositories promotes trust through partnerships (open-governmentpartnership.org for example). Simplicity is of the utmost importance in any strategy. Sunstein [218] states that "disclosure can operate as a check on private or public inattention, negligence, incompetence, wrongdoing, and corruption".

6. Warnings, graphic or otherwise: If a risk is serious, the best nudge might be to issue a public warning. "Large fonts, bold letters, and bright colors can be effective in triggering people’s attention" [218]. The central belief to this theory is that "attention is a scarce resource" and warnings are attentive to that fact. Warnings aim to counteract the natural human tendency to towards unrealistic optimism and "simultaneously increase the likelihood that people will pay attention to the long-term". Warnings can be discounted by users in the belief that it will not happen to them, but can be combated by informing users (via descriptions) as to the relevant strategies to mitigate risk (if I do x I can combat y).

7. Pre-commitment strategies: denote a person’s actions with respect to their predeter-mined goals. In essence, people with goals (i.e., quitting smoking) are more likely to behave in a manner that will help them to accomplish this goal rather than actions that will prolong its fulfilment. Such behaviour typically reduces procrastination.

8. Reminders: Reminders serve to combat non-fulfilment of a time dependant task.

Whether it is through reluctance, procrastination, competing obligations or any other reason, reminders can have a profound impact on completion. Timing is of great importance with reminders as there needs to be sufficient time to complete the task at hand.

9. Eliciting implementation intentions: "people are more likely to engage in activity if someone elicits their implementation intentions" [218]. As a result, a simple question,

2.3 Nudge 37

"do you plan to vaccinate your child?", can have significant impact on the user’s choice and likelihood to act.

10. Informing people of the nature and consequences of their own past choices: Public and private organisations often have detailed information on their customer’s past financial transactions (bank statements, energy bills), often having a more detailed account than the customers themselves. Being aware of one’s past choices has a profound impact on future choices and can be a useful tool for behavioural change.