Markus Lennartsson

Joakim Kävrestad

Marcus Nohlberg

Exploring the meaning of "usable security"

Keywords: Information Security, Usable, Usability

While there are many examples of incidents that make the need for more work around the human aspects of security apparent, the literature makes it obvious that usable security can mean many different things and usable security is a complex matter. This paper reports on a structured literature review that analyzed what the research community considers to be included in the term "usable security". Publications from the past five years were analyzed and different perceptions of usable security were gathered. The result is a listing of the different aspects that are discussed under the term "usable security" and can be used as a reference for future research of practitioners who are developing security functions with usability in mind.

Introduction

A lot of attention is currently given to the human, or user, side of information security and it is widely acknowledged that user behavior is a crucial factor in information security [START_REF] Furnell | Enhancing security behaviour by supporting the user[END_REF]. An important topic in this area is usable security, the notion that security tools and measures have to live up to usability demands in order to function as intended [START_REF] Das | Why johnny doesn't use two factor a two-phase usability study of the fido u2f security key[END_REF]. Tools that are lacking in usability are likely to not be used at all or be used incorrectly. If a given tool is not used, the security value that it is supposed to add will be lost. A tool that is used incorrectly can give a false sense of security, or even have a negative impact on security [START_REF] Whitten | Why johnny can't encrypt: A usability evaluation of pgp 5[END_REF].

While there are many papers that provide usability evaluations on various tools and techniques, there is an ambiguity in the research community as to what the concept of usable security actually encompasses. There are several examples of papers that discuss or validate usability and two examples are [START_REF] Marchal | Off-thehook: An efficient and usable client-side phishing prevention application[END_REF] that evaluates certain usability criteria of a phishing defense mechanism and another is [START_REF] He | Rethinking access control and authentication for the home internet of things (iot)[END_REF] where usability in access control in IoT is discussed. While valuable pieces of research, none of them discuss usability in a broader sense. Further, [START_REF] Khan | Usability and security perceptions of implicit authentication: Convenient, secure, sometimes annoying[END_REF] evaluates usability around the keywords "convenience, annoyance, time-consuming and tiring" and builds on the System Usability Scale (SUS) presented by [START_REF] Brooke | Sus-a quick and dirty usability scale[END_REF]. While the SUS scale measures important aspects of usability, it does not factor in ideas that [START_REF] Whitten | Why johnny can't encrypt: A usability evaluation of pgp 5[END_REF] consider essential in usable security, for instance, that users should not make dangerous errors.

The existing research demonstrates that usable security is a complex area with many dimensions. However, to the best of our knowledge, there is no common definition or understanding of what the term actually includes. The aim of this paper is to address this gap by reviewing how the term is applied in recent research. The result will describe what researchers mean with usable security and can be used as a reference for future studies. Future research will build on this paper with the goal of establishing evaluation criteria for usability is security tools and measures designed to be used by end-users.

Methodology

The research was carried out using a structured literature review targeting research published in the past five years. The review followed the process described by [START_REF] Kitchenham | Procedures for performing systematic reviews[END_REF]. The outcomes of a literature review are heavily dependent on the databases used, search terms are chosen, and the criteria applied to select relevant literature [START_REF] Meline | Selecting studies for systematic review: Inclusion and exclusion criteria[END_REF][START_REF] Jesson | Doing your literature review: Traditional and systematic techniques[END_REF]. The databases and search terms used in this study are shown in The initial searches resulted in 378 articles, papers that were duplicates or failed to meet inclusion criteria were removed resulting in 49 papers that were selected for further analysis. Backward snowballing, as described by [START_REF] Wohlin | Guidelines for snowballing in systematic literature studies and a replication in software engineering[END_REF], was employed and resulted in another 21 papers, resulting in 70 papers that were included for the study. Table 2 presents the inclusion and exclusion criteria used in this study and Table 3 shows the result of the initial selection process. Table 4 shows the results of the backward snowballing.

Inclusion criteria

Exclusion criteria IC1: Published between 2015 and 2020 EC1: Publication occurs multiple times IC2: Published in peer-reviewed journal or conference EC2: Fails to meet inclusion criteria IC3: Publication is relevant to the topic EC3: Payment required for access IC4: Written in English, Swedish EC4: Dubious description of method or German or results The selected papers were analysed, using the software MAXQDA, using thematic coding as described by [71].

Results

Following the selection process, the included papers were analyzed using thematic coding. First, high-level aspects of usable security were identified. They were then refined into subcategories. The results are summarized in Figure 1, below, where the high-level aspects and their subcategories are displayed. The number in parenthesis shows the number of papers connected to a given subcategory.

The remainder of this chapter will describe the discovered aspects of usable security. The papers classified in each aspect will be referenced continuously and are listed in the reference list, preceded by an asterisk (*).

Cost of Use: This aspect addresses factors that users tend to perceive as inconvenient in terms of cost-effectiveness. Financial costs are mentioned repeatedly [START_REF] Abu-Salma | Obstacles to the adoption of secure communication tools[END_REF]34,25] and one publication [START_REF] Abu-Salma | Obstacles to the adoption of secure communication tools[END_REF] states that resource consumption (e. g. battery) might be of significance.

Consistency: Security solutions are perceived as usable when they are operating predictably. This applies to matters of behavior [34, 31], meaning that similar tasks work identically, and implementation[6, 55, 57] factors including standardized setups, consistent phrasing, and design that allows to easily recognize requirements and conditions.

Perception: Willingness to adopt security solutions depends partially on how they are perceived by individuals. One aspect relates to trust and reputation [61,12,10,67,11,45,25,4,36,60]. Multiple studies report that users prefer solutions they feel confident with. Such beliefs arise when a solution is from reputable sources, verified by experts, or recommended. Additionally, the coolness factor [61] of authentication schemes might be another contributing aspect.

GUI (Graphical User Interface): This aspect is concerned with the way the GUI is constructed. First, it should be understandable and simple [59,69,34,51,5,40,48,49,54,55,57,66]. This includes visualization of navigation options and clear menu arrangements in accordance to what users might anticipate. Also, the GUI should not require unnecessary user attention and merely display information necessary for decision making. A GUI that is adjustable [6, 31, 55] to the user's preferences increases usability since it improves learnability.

Scalability: Another factor is the extent to which security solutions can deal with multiple user accounts and security keys. Usable account handling[22, 24, 57] does not restrict the number of allowed user accounts and allows to operate multiple accounts with mutual keys. Concerning key handling [12], a scalable solution should be able to install and control multiple keys without complicating usage.

Compatibility: Security solutions should be compatible with commonly used systems and services[20, 1, 22, 24, 57] to be perceived as usable. The trend of developing new security solutions with separate and fragmented user bases is a hinder to usability. Compatibility with other security solutions [START_REF] Abu-Salma | Obstacles to the adoption of secure communication tools[END_REF] is crucial since users will presumably reject overly incompatible products such as communication tools that only allow conversations with other instances of themselves.

Adaptability: How well a security solution can be adapted to the specific needs of individuals represents an important factor according to 19 publications. The first subcategory deal with the amount of allowed user control [20,69,22,28,31,40,49,55]. Enabling users to customize configurations to their preferences increases convenience. Facilitating memorability by allowing users to choose their own passwords is also advantageous. Regarding user capacity [34,51,5,12,18,27,28,38,49,55,70], security solutions should be adaptable to various expertise levels and be able to, preferably intelligently, adapt to individual abilities and disabilities.

Interference: Usability is reduced when users' primary tasks are disturbed. The first subcategory addresses workflow [20, 63, 26, 27, 30, 49, 53] interference. Necessary security actions should be arranged in ways that minimize interruptions. Even re-authentication [START_REF] Al Abdulwahid | Security, privacy and usability-a survey of users' perceptions and attitudes[END_REF]6,14,24,27,39] requests are described as disruptive and inconvenient . They can be perceived as wasted time and cause increased complexity. Also, compelling users to remember passwords repeatedly interrupts other tasks since enforced context switches may cause confusion. Finally, there is a physical [61, 15, 56, 57] category to this aspect. Users are anxious to lack immediate access to a token when needed, fear of loss or theft are common.

Error rate [20, 34, 63, 37, 3, 4, 17, 21, 26, 33, 35, 36, 38-40, 53, 57, 58, 66, 68, 70] To which extent a security solution enables users to conduct their primary task without having to deal with annoying completion failures is a prominent usability precondition. Increasing error rates cause substantial inconvenience since users are forced to repeat actions. Solutions become ineffective since they are unable to complete tasks as intended. In this context, it is secondary if errors are caused directly by the system or indirectly via users. When security solutions are errorprone, users may choose to circumvent them to preserve usability.

Error

Conclusions

This paper aimed to summarize the meaning of usable security by analyzing recently published research to identify the dimensions that encompass the term usable security. Using a structured literature review, this research identified 70 papers from the past five years that discussed the topic of usable security. Using thematic coding, 14 aspects were created from analyzing the included papers, the aspects were then refined into 31 subcategories that describe usability factors for security measures. The most discussed subcategories dictate that the time needed to complete security tasks, the cognitive load added by security tasks and the ease of completing security tasks. While this research does not attempt to weight the different identified aspects, this aligns well with the common understanding of a need for time-efficient and easy-to-use security functions.

The results of this paper is a summary of current research that can help researchers as well as practitioners to better understand the topic of usable security, a necessity in implementing user-centred security measures and applications. It also provides a better understanding of the users roles and challenges in security and can be used as a reference model when developing security functions, applications and procedures. While this research employs measures such as backwards snowballing to be as complete as possible, a given limitation is that it relies on previous research. A possible impact on that is that no previously unknown usability factors has been discovered.

An apparent direction for future work would be to research the identified usability factors from a user-centred standpoint. Such a project could aim to include users in an attempt to weight the different factors according to the users perception. Another direction for future work would be to continue the research by developing concrete guidelines for implementation of user-centered security. Such a project would include practitioners as well as researchers and users.

Fig. 1 .

 1 Fig. 1. Identified aspects of Usable Security. The number in parenthesis display the number of publications relation to each sub-category.

  4. * Al-Sarayreh, K.T., Hasan, L.A., Almakadmeh, K.: A trade-off model of software requirements for balancing between security and usability issues. International Review on Computers and Software 10(12), 1157-1168 (2015) 5. * Alarifi, A., Alsaleh, M., Alomar, N.: A model for evaluating the security and usability of e-banking platforms. Computing 99(5), 519-535 (2017) 6. * Almutairi, E., Al-Megren, S.: Usability and security analysis of the keepkey wallet. In: 2019 IEEE ICBC. pp. 149-153 7. * Alshamsi, A., Williams, N., Andras, P.: The trade-off between usability and security in the context of egovernment: a mapping study. In: Proceedings of BCS-HCI 30. pp. 1-13 (2016) 8. * Alshanketi, F., Traore, I., Ahmed, A.A.: Improving performance and usability in mobile keystroke dynamic biometric authentication. In: 2016 IEEE SPW. pp. 66-73. IEEE (2016) 9. * Andriotis, P., Oikonomou, G.C., Mylonas, A., Tryfonas, T.: A study on usability and security features of the android pattern lock screen. Inf. Comput. Security 24(1), 53-72 (2016) 10. * Atwater, E., Bocovich, C., Hengartner, U., Lank, E., Goldberg, I.: Leading johnny to water: Designing for usability and trust. In: SOUPS 2015 (2015) 11. * Bai, W., Kim, D., Namara, M., Qian, Y., Kelley, P.G., Mazurek, M.L.: Balancing security and usability in encrypted email. IEEE Internet Computing 21(3), 30-38 (2017) 12. * Bai, W., Namara, M., Qian, Y., Kelley, P.G., Mazurek, M.L., Kim, D.: An inconvenient trust: User attitudes toward security and usability tradeoffs for keydirectory encryption systems. In: SOUPS 2016). pp. 113-130 (2016) 13. * Belk, M., Pamboris, A., Fidas, C., Katsini, C., Avouris, N., Samaras, G.: Sweetspotting security and usability for intelligent graphical authentication mechanisms. In: WIMS 17. pp. 252-259 (2017) 14. * Benenson, Z., Lenzini, G., Oliveira, D., Parkin, S., Uebelacker, S.: Maybe poor johnny really cannot encrypt: The case for a complexity theory for usable security. In: NSPW 15p. pp. 85-99 (2015) 15. * Bhagavatula, R., Ur, B., Iacovino, K., Kywe, S.M., Cranor, L.F., Savvides, M.: Biometric authentication on iphone and android: Usability, perceptions, and influences on adoption. In: USEC. Citeseer (2015) 16. * Bindu, C.S.: Secure usable authentication using strong pass text passwords. IJC-NIS (2015) 17. * Bošnjak, L., Brumen, B.: Examining security and usability aspects of knowledgebased authentication methods. In: 2019 MIPRO. pp. 1181-1186 (2019) 18. * Caputo, D.D., Pfleeger, S.L., Sasse, M.A., Ammann, P., Offutt, J., Deng, L.: Barriers to usable security? three organizational case studies. IEEE Security Privacy 14(5), 22-32 (2016) 19. * Carbone, R., Ranise, S., Sciarretta, G.: Design and security assessment of usable multi-factor authentication and single sign-on solutions for mobile applications. In: IFIP International Summer School on Privacy and Identity Management. pp. 51-66. Springer (2018) 20. * Colnago, J., Devlin, S., Oates, M., Swoopes, C., Bauer, L., Cranor, L.F., Christin, N.: "it's not actually that horrible": Exploring adoption of two-factor authentication at a university. In: CHI '18 21. * Das, S., Dingman, A., Camp, L.J.: Why johnny doesn't use two factor a twophase usability study of the fido u2f security key. In: FC 2018. pp. 160-179. Springer (2018) 22. * Das, S., Russo, G., Dingman, A.C., Dev, J., Kenny, O., Camp, L.J.: A qualitative study on usability and acceptability of yubico security key. In: STAST 17. pp. 28-39. ACM (2018) 23. * Das, S., Wang, B., Tingle, Z., Camp, L.J.: Evaluating user perception of multifactor authentication: A systematic review. arXiv preprint arXiv:1908.05901 (2019) 24. * Ebert, A., Marouane, C., Rott, B., Werner, M.: Keypocket-improving security and usability for provider independent login architectures with mobile devices. In: SecureComm 2015. pp. 41-57. Springer (2015) 25. * Fagan, M., Khan, M.M.H.: Why do they do what they do?: A study of what motivates users to (not) follow computer security advice. In: SOUPS 2016. pp. 59-75 (2016) 26. * Feth, D.: User-centric security: optimization of the security-usability trade-off. In: ESEC/FSE 2015. pp. 1034-1037 (2015) 27. * Feth, D., Maier, A., Polst, S.: A user-centered model for usable security and privacy. In: Tryfonas, T. (ed.) HAS 2017. pp. 74-89. Springer (2017) 28. * Feth, D., Polst, S.: Heuristics and models for evaluating the usability of security measures. In: MUC 2019, pp. 275-285 (2019) 29. * Fukumitsu, M., Hasegawa, S., Iwazaki, J., Sakai, M., Takahashi, D.: A proposal of a password manager satisfying security and usability by using the secret sharing and a personal server. In: AINA 2016. pp. 661-668 (2016) 30. * Glass, B., Jenkinson, G., Liu, Y., Sasse, M.A., Stajano, F.: The usability canary in the security coal mine: A cognitive framework for evaluation and design of usable authentication solutions. arXiv preprint arXiv:1607.03417 (2016) 31. * Gordieiev, O., Kharchenko, V.S., Vereshchak, K.: Usable security versus secure usability: an assessment of attributes interaction. In: ICTERI (2017) 32. * Goudalo, W., Kolski, C.: Towards advanced enterprise information systems engineering. In: ICEIS 2016. pp. 400-411 (2016) 33. * Green, M., Smith, M.: Developers are not the enemy!: The need for usable security apis. IEEE Security Privacy 14(5), 40-46 (2016) 34. * Hasan, L.A., Al-Sarayreh, K.T.: An integrated measurement model for evaluating usability attributes. In: IPAC 2015. ACM (2015) 35. * Hausawi, Y.M., Allen, W.H.: Usable-security evaluation. In: HAS 2015 (2015) 36. * İşler, D., Küpçü, A., Coskun, A.: User perceptions of security and usability of mobile-based single password authentication and two-factor authentication. In: Data Privacy Management, Cryptocurrencies and Blockchain Technology, pp. 99-117. Springer (2019) 37. * Karapanos, N., Marforio, C., Soriente, C., Capkun, S.: Sound-proof: Usable twofactor authentication based on ambient sound. In: USENIX 2015 (2015) 38. * Katsini, C., Belk, M., Fidas, C., Avouris, N., Samaras, G.: Security and usability in knowledge-based user authentication: A review. In: PCI 16. pp.

Table

Table 1 .

 1 1, below. List of used databases and search terms

	Databases	Search Terms
	ACM Digital library
	IEEExplore	"usable security"
	Springer Link
	dblp (Digital Bibliography & Library Project)
	ArXiv SCOPUS	usability AND security
	CSCAN HAISA

Table 2 .

 2 Inclusion and exclusion criteria

	Resource	Search date Hits	Eliminated due to: Accepted EC1 EC2 EC3 EC4
	ACM Dig. Lib. 20200102 12
	IEEExplore	20200102 68
	Springer Link 20200102 14
	dblp	20200102 142	145 159 15 10	49
	ArXiv	20200102 20
	SCOPUS	20200111 102
	CSCAN HAISA 20200103 20
		Table 3. Initial search process
	Resource	Search date Hits	Eliminated due to: IC1 IC2 IC3 IC4 EC1 EC3 EC4	Accepted
	References in
	publications from stage I 20200116 1641 1250 161 147 57 1	3	1	21

Table 4 .

 4 Snowballing process

  management: Effective means of prevention[59, 20, 69, 34, 67, 4, 6, 28, 31, 33, 48, 49, 54, 55, 57] are required to reduce error rates. Users should be provided with clear and simple instructions that help to prevent frequent errors. Incorrect operations can be prevented by automatic means such as input validity checks. Before errors occur, easy-to-understand warning messages should be communicated clearly and point out problem causes. Making users aware of their actions' negative consequences beforehand is beneficial. If such hints go unheeded, execution should be rejected. If errors cannot be prevented, proper means of error recovery[20, 34, 22, 4, 8, 12, 14, 29, 40, 49, 40, 54, 55, 57] should exist to maintain usability. One way to recover is to allow users to cancel or revert their actions. Laborious recovery procedures are harmful to usability. Giving simple hints about causes and recommended actions are preferable. Users should be empowered to address most errors without external help, but help should still be available if needed.Simplicity: A great quantity of studies report that users become overwhelmed by overly complex systems. Lots of papers stress that the cognitive load [44, 42, 34, 15, 10, 67, 11, 63, 45, 22, 51, 3, 2, 5-7, 9, 12-14, 19, 21, 24, 26, 28, 30, 30, 33, 36, 39-41, 49, 52-55, 57, 60, 62, 64, 66] put on users needs to be minimized to preserve usability. Reducing the amount of required knowledge , things a user has to recall , or the number of available choices and necessary decisions are important in this context. This also applies for frequent task switching demands. Also, default configurations should be appropriate and safe to use. Twentyone publications find that high amounts of interaction demands [61, 20, 1, 42, 10, 67, 37, 16, 25, 22, 3, 4, 6, 12, 24, 30, 46, 58, 60, 62, 64] affect usability negatively since users generally favor solutions that don't require significant effort. Necessary interaction should be simple. Integrating security solutions into existing well-known systems reduces required efforts. So does centralized authentication.Info & Support: This aspect is addressed by the second largest amount of studies. It covers how information should be presented to users. Firstly, it should be highly comprehensible[59, 20, 1, 69, 34, 15, 67, 22, 51, 2, 4-6, 9, 12, 27, 28, 31, 33, 40, 41, 49, 55, 57, 58, 66, 70] in both formulation and amount. Low abstraction levels facilitate understanding by non-experts. Reasonable amounts prevent overexertion of users. Furthermore, information needs to be findable[59, 20, 1, 15, 67, 22, 21, 28, 41, 49, 55], meaning that users should not have to conduct taxing searches, especially external ones. Information should also be complete [59, 34, 4-6, 9, 12, 14, 27, 31, 43, 55, 57] enough to sufficiently address potential problems regarding all functionalities. Explaining risks & benefits[59, 11, 22, 51, 9, 12, 21, 23, 26, 28, 55, 60, 70] of security solutions and particular user decisions reduces usability issues and increases trust. Making users aware of threats and consequences helps increasing acceptance of security requirements and enables better system understanding and utilization. Context related [65, 59, 22, 6, 21, 28, 55, 62] information corresponds directly to executed tasks and allows to exhibit specifically required actions without the need to interrupt said tasks. This reduces perceived complexity and strain.Transparency: Systems should be transparent regarding status and completion[61, 42, 67, 11, 22, 27, 36, 46, 48-50, 54, 55, 57, 58, 62]. Feedback should be provided about underlying mechanisms, the progress of security actions, the system's status, and task completion. This approach facilitates trust and reduces error rates. Providing knowledge about available choices[65, 11, 28, 33] when users need to make important decisions helps them to react properly and reduces error rates.Time: Secondary only to cognitive load, invested time until successful task completion[61, 59, 65, 20, 44, 42, 34, 11, 47, 37, 16, 51, 4, 7, 14, 17-19, 24, 28, 30, 31, 33, 35, 32, 38-40, 46, 49, 53, 54, 56, 58, 64, 66, 68, 70] is one of the most prominent us-ability aspects. Inefficient time utilization due to delays can impair users' primary objectives and thereby reduce usability significantly. Periods of delay and idle waiting should be minimized. Additionally, putting users under time pressure [56, 68] by time-out settings increases error rates and stress levels and reduces perceived usability.

  Reynolds, J., Smith, T., Reese, K., Dickinson, L., Ruoti, S., Seamons, K.: A tale of two studies: The best and worst of yubikey usability. In: 2018 IEEE Symposium on Security and Privacy. pp. 872-888 58. * Ruoti, S., Andersen, J., Heidbrink, S., O'Neill, M., Vaziripour, E., Wu, J., Zappala, D., Seamons, K.E.: "we're on the same page": A usability study of secure email using pairs of novice users. In: CHI 16 (2016) 59. * Ruoti, S., Andersen, J., Hendershot, T., Zappala, D., Seamons, K.E.: Private webmail 2.0: Simple and easy-to-use secure email. In: UIST '16 (2016) 60. * Ruoti, S., Andersen, J., Monson, T., Zappala, D., Seamons, K.: A comparative usability study of key management in secure email. In: SOUPS 2018). pp. 375-394 (2018) 61. * Ruoti, S., Roberts, B., Seamons, K.E.: Authentication melee: A usability analysis of seven web authentication systems. In: WWW '15 (2015) 62. * Ruoti, S., Seamons, K.E.: Johnny's journey toward usable secure email. IEEE Security Privacy 17(6), 72-76 (2019) 63. * Sasse, A.: Scaring and bullying people into security won't work. IEEE Security Privacy 13(3), 80-83 (2015) 64. * Schwab, D., ALharbi, L., Nichols, O., Yang, L.: Picture passdoodle: Usability study. In: IEEE Big Data Service 2018. pp. 293-298 (2018) 65. * Shay, R., Bauer, L., Christin, N., Cranor, L.F., Forget, A., Komanduri, S., Mazurek, M.L., Melicher, W., Segreti, S.M., Ur, B.: A spoonful of sugar?: The impact of guidance and feedback on password-creation behavior. In: CHI 15. pp. 2903-2912. ACM (2015) 66. * Shirvanian, M., Saxena, N.: On the security and usability of crypto phones. In: ACSAC 2015. pp. 21-30 (2015) 67. * Vaziripour, E., Wu, J., O'Neill, M., Whitehead, J., Heidbrink, S., Seamons, K.E., Zappala, D.: Is that you, alice? a usability study of the authentication ceremony of secure messaging applications. In: SOUPS 2017 (2017) 68. * Wang, T., Ge, H., Chowdhury, O., Maji, H.K., Li, N.: On the security and usability of segment-based visual cryptographic authentication protocols. In: CCS 16. pp. 603-615 (2016) 69. * Weber, S., Harbach, M., Smith, M.: Participatory design for security-related user interfaces. USEC 2015 15 (2015) 70. * Wolf, F., Kuber, R., Aviv, A.J.: " pretty close to a must-have" balancing usability desire and security concern in biometric adoption. In: CHI 19. pp. 1-12 (2019) 71. Braun, V., Clarke, V.: Using thematic analysis in psychology. Qualitative research in psychology 3(2), 77-101 (2006)

	42. * Lerner, A., Zeng, E., Roesner, F.: Confidante: Usable encrypted email: A case
	study with lawyers and journalists. EuroSP 2017 pp. 385-400 (2017)
	43. * Ling, Z., Borgeest, M., Sano, C., Lin, S., Fadl, M., Yu, W., Fu, X., Zhao, W.: A
	case study of usable security: Usability testing of android privacy enhancing key-
	board. In: Ma, L., Khreishah, A., Zhang, Y., Yan, M. (eds.) Wireless Algorithms,
	Systems, and Applications. pp. 716-728. Springer (2017)
	44. * Mayron, L.M.: Biometric authentication on mobile devices. IEEE Security Pri-
	vacy 13, 70-73 (2015)
	45. * McGregor, S.E., Charters, P., Holliday, T., Roesner, F.: Investigating the com-
	puter security practices and needs of journalists. In: USENIX 2015). pp. 399-414
	(2015)
	46. * Melicher, W., Kurilova, D., Segreti, S.M., Kalvani, P., Shay, R., Ur, B., Bauer, L.,
	Christin, N., Cranor, L.F., Mazurek, M.L.: Usability and security of text passwords
	on mobile devices. In: CHI 2016. pp. 527-539 (2016)
	47. * Meng, W., Liu, Z.: Tmgmap: Designing touch movement-based geographical
	password authentication on smartphones. In: ISPEC 2018. pp. 373-390. Springer
	(2018)
	48. * N, M., P. Onay, D.: A systematic mapping study of usability vs security. In:
	CEIT 2018. pp. 1-6
	49. * Napoli, D.: Developing accessible and usable security (accus) heuristics. In: Ex-
	tended Abstracts of the CHI 2018. pp. 1-6 (2018)
	50. * Naqvi, B., Seffah, A.: Interdependencies, conflicts and trade-offs between security
	and usability: Why and how should we engineer them? In: HCII 2019. pp. 314-324.
	Springer (2019)
	51. * Nwokedi, U.O., Onyimbo, B.A., Rad, B.B.: Usability and security in user interface
	design: a systematic literature review. vol. 8, pp. 72-80 (2016)
	52. * Oluwafemi, A.J., Feng, J.H.: Usability and security: A case study of emergency
	communication system authentication. In: Stephanidis, C. (ed.) HCI International
	2019. pp. 205-210. Springer International Publishing
	53. * Patil, A.D., De Meer, H.: Usability of it-security in smart grids. In: e-Energy
	2018. pp. 393-395. ACM (2018)
	54. * Qin, L., Lapets, A., Jansen, F., Flockhart, P., Albab, K.D., Globus-Harris, I.,
	Roberts, S., Varia, M.: From usability to secure computing and back again. In:
	SOUPS 2019) (2019)
	55. * Realpe, P.C., Collazos, C.A., Hurtado, J., Granollers, A.: A set of heuristics for
	usable security and user authentication. In: Interacción '16. pp. 1-8. ACM (2016)
	56. * Reese, K., Smith, T., Dutson, J., Armknecht, J., Cameron, J., Seamons, K.: A
	usability study of five two-factor authentication methods. In: SOUPS 2019) (2019)
	57. *
	1-6 (2016)
	39. * Khan, H., Hengartner, U., Vogel, D.: Usability and security perceptions of implicit
	authentication: Convenient, secure, sometimes annoying. In: SOUPS 2015. pp. 225-
	239 (2015)
	40. * Khodadadi, T., Islam, A.K.M.M., Baharun, S., Komaki, S.: Evaluation of
	recognition-based graphical password schemes in terms of usability and security
	attributes. International Journal of Electrical and Computer Engineering 6(6),
	2939-2948 (2016)
	41. * Krombholz, K., Mayer, W., Schmiedecker, M., Weippl, E.: " i have no idea what
	i'm doing"-on the usability of deploying {HTTPS}. In: USENIX 2017. pp. 1339-
	1356 (2017)


Joakim Kävrestad

Marcus Nohlberg

ContextBased MicroTraining: A Framework for Information Security Training

Keywords: Security training, awareness, ContextBasedMicroTraining, information security

This paper address the emergent need for training measures designed to improve user behavior in regards to security. We do this by proposing a framework for information security training that has been developed for several years and over several projects. The result is the framework ContextBased MicroTraining (CBMT) which provides goals and guidelines for how to better implement information security training that supports the user in the situation where the user needs support. CBMT has been developed and tested for use in higher education as well as for the support of users during passwords creation. This paper presents version 1.0 of the framework with the latest refinements.

Introduction

It is well established that insecure user behavior is a major problem in information security [START_REF] Safa | An information security knowledge sharing model in organizations[END_REF]. Users are commonly referred to as the weak link in security and while there are many technical security measures that address technical security issues, there is still a need for ways to improve user behavior with regards to security [START_REF] Bulgurcu | Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness[END_REF]. Threat actors recognize this notion and are often exploiting users, making the need for measures towards secure behavior emergent [START_REF] Joinson | Human aspects of cyber security: Behaviour or culture change? Cyber Security: A Peer[END_REF]. Desmand [START_REF] Desman | The ten commandments of information security awareness training[END_REF] described a need for making users understand the consequences of insecure behavior and learn them to behave in a secure way [START_REF] Desman | The ten commandments of information security awareness training[END_REF].

The common suggestion for how to improve user behavior is through the use of training [START_REF] Puhakainen | Improving employees' compliance through information systems security training: an action research study[END_REF]. Further, there are many different suggestions on how to carry out security training, from the practitioner as well as the research community. Different training measures range from lectures to micro training and nudges or special purpose tools such as password strength meters. While there are research examples of individual studies where researchers provide good evidence that specific methods work, there are reports that suggests that organizations training programs are not grounded in empirical evidence of their validity [START_REF] Al-Daeef | Security awareness training: A review[END_REF][START_REF] Alshaikh | An exploratory study of current information security training and awareness practices in organizations[END_REF]. As such, the need for further research into this area is apparent.

This paper reports on research in this area that has been ongoing since 2014 intending to address the following objectives:

-O1: Develop a framework of guidelines for user training that supports user awareness and security-related decision making.

-O2: Evaluate how the framework developed in O1 can assist in making users act more securely -O3: Evaluate if the framework from O1 can be applied in higher education As such, the paper will present and discuss the framework developed in the projects and focus on the later parts of the development where the framework is refined. Following the presentation of the research process, previously published work will be accounted for and briefly described. The paper will then discuss the final part of the research process and present the final framework developed in the research. The paper will be concluded with a discussion on the topics and directions for future work.

Research process

The research has been carried out in multiple steps and the complete process is outlined in figure 1, below. The emphasis in this paper is on the final parts of the research process (made bold in Figure 1) The research as a whole employs a Fig. 1. Research process mixed-method approach using qualitative as well as quantitative methods. The reasoning behind this approach is twofold:

-Some research steps are intended to provide input to the development of the framework, making a qualitative approach feasible, while other steps intended to measure the effects of implementations of the guidelines making a quantitative approach feasible. -Using different methods in research around the same objective, triangulation, can increase the validity of the outcomes [21].

While a discussion on all methodological approaches used in the research is well beyond the scope of this paper (and previously published [START_REF] Kävrestad | Defining, categorizing and defending against online fraud[END_REF][START_REF] Kävrestad | Online fraud defence by context based micro training[END_REF][START_REF] Kävrestad | Users perception of using cbmt for informationsecurity training[END_REF][START_REF] Kävrestad | Using context based micro training to develop oer for the benefit of all[END_REF][START_REF] Kävrestad | Using contextbased microtraining to enforce secure behavior among computer users[END_REF]) the remainder of this section will introduce the methodology used in the final research steps, "Framework refinement". During the evaluation step, quantitative data was used to evaluate implementations of the framework and qualitative data about the frameworks as well as the implementation of the framework was gathered. The data was gathered using free-text survey questions. Further, the suggested framework was presented at the 19th Seminar within the Framework of a Swedish IT Security Network for PhD students (SWITS) [START_REF] Kävrestad | Using contextbased microtraining to enforce secure behavior among computer users[END_REF] and the following discussions were summarized and considered in the framework refinement. The gathered data was analyzed using the principles of thematic coding [START_REF] Braun | Using thematic analysis in psychology[END_REF]. The following codes were established prior to the analysis:

-Strengths -Weaknesses -Clarification needed
The first code was used to identify the strengths of the framework. The second and third codes were used to identify areas in the framework that needed reconsideration or improvement. The coding was performed together by the authors and the results were used to refine the framework and establish the final framework as presented in this paper.

Previous research steps

This chapter briefly presents previous research in this project beginning with the developed framework, ContextBased MicroTraining(CBMT). Then, the implementation and evaluation of CBMT based training will be presented.

CBMT and the development thereof

The development began with a literature search that intended to find what goals the framework should seek to fulfill. Fundamental problems in the domain of information security training were identified to be that users are not actively participating in information security training measures [START_REF] Kim | Recommendations for information security awareness training for college students[END_REF] and that users, while worried about cyber threats, lack awareness about the possible damage they can cause [START_REF] Marinos | [END_REF]. It was also evident that several sources reported that security measures must, in themselves, be easy to use, appear useful and interrupt the user's normal computer usage as little as possible [START_REF] Whitten | Why johnny can't encrypt: A usability evaluation of pgp 5.0[END_REF][START_REF] Payne | A brief introduction to usable security[END_REF][START_REF] Beckles | Mechanisms for increasing the usability of grid security[END_REF]. Following the literature search, four requirements for what was called a "Situated Learning based defense mechanism" were established:

-Provide training that users want to make use of, instead of forcing users to participate in the training -Include an awareness increasing mechanism -Provide training to the user when the user is in a situation where the training is relevant -Require no prior knowledge from the user

The first two bullets were achieved by the third bullet and the idea was that information security training should be delivered to the user when the user entered a situation where the training was of direct relevance. For instance, a training module designed to teach the user about online fraud would be presented to the user when she was in a situation where she risked being defrauded [START_REF] Kävrestad | Defining, categorizing and defending against online fraud[END_REF]. A fundamental notion in the requirements is that people need motivation in order to learn and that adults will be more likely to learn if the presented information seems meaningful, a notion based on the concept of andragogy [START_REF] Knowles | Andragogy in action: applying modern principles of adult learning[END_REF][START_REF] Hedin | Lärande på hög nivå[END_REF].

A demonstrator of a defense mechanism based on the requirements was implemented, the context was online fraud. A survey containing the demonstrator and questions about how the respondents perceived it was presented. 98 respondents answered the survey and it revealed that the respondents were, overall, positive towards the defense mechanism. The survey data did, however, stress that it was important for a defense mechanism to not be enforcing and that it should be possible to read the information presented quickly [START_REF] Kävrestad | Defining, categorizing and defending against online fraud[END_REF]. This falls well in line with what Nanolearning tries to facilitate [START_REF] Wang | Mobile learning design: The ltcs model[END_REF]. Previous research into microlearning also shows positive results in terms of learner participation [START_REF] Bruck | Mobile learning with micro-content: A framework and evaluation[END_REF]. Supporting a high degree of user participation is one of the fundamental problems this research aims to address. The requirements were updated, and expressed as a small framework of goals and guidelines were the goals reflect the overall goal of the framework and the guidelines are more practical implementation guidelines. The goals were the following:

-Provide training that users want to make use of, instead of forcing users to participate in the training -Include an awareness increasing mechanism -Require no prior knowledge from the user -Be short and easy to absorb And the guidelines were:

-Delivered to users when it is relevant to their current situation.

-Delivered in short sequences -Relevant to the users' current situation -Include a practical element -Must be possible to opt-out Simultaneously, an experiment where participants were asked to use the defense mechanism before rating fraudulent ads from Swedish online marketplaces was carried out. A control group rated the same ads without training. The experiment showed that the group that performed the training was better at detecting fraudulent ads than the participants in the control group. They were also better at correctly identifying legitimate ads as legitimate suggesting that the defense mechanism could be useful [START_REF] Kävrestad | Online fraud defence by context based micro training[END_REF].

Next, another survey measuring how the respondents perceived using training modules developed according to the framework was performed. In this case, the respondents were asked to follow three different training modules (password creation, ransomware, and phishing) and then asked about their experience. In summary, the participants were positive towards the training modules and stressed that short sequences of training in-the-moment are preferable to training that is timeconsuming [START_REF] Kävrestad | Users perception of using cbmt for informationsecurity training[END_REF]. As such, the framework was established and the research continued to an evaluation phase. The Framework was named Con-textBased MicroTraining (CBMT).

To summarize, CBMT is a teaching method that suggests that information should be presented in short sequences to the learner. It should also a practical element and be of direct relevance to the user's current situation. A visual representation of CBMT is presented in figure 2, below.

Evaluation of CBMT for use in higher education

Following the establishment of the framework, it was evaluated in two settings. First, for use in higher education. In this evaluation, a technical undergraduate course was used and the purpose was to measure learning outcomes of CBMT based training. The course was a Cisco Network Academy course and was selected since it was very practical in nature and it teaches a standardized curriculum and is examined using a standardized test. In this particular case, the course was thought by the researchers and the use of standardized material served as a means of minimizing bias. Applying the framework to a course was selected because it allows for a relatively controlled environment where the actual learning outcomes can be compared to the learning outcomes from previous times the course has been given.

During this evaluation, several learning modules were designed according to the goals and guidelines of the framework. The students were then handed the modules as primary lecturing material. The nature of the modules was that they asked the students to listen to a short theoretical presentation and then do or follow a practical task. One module covered a small bit of theory and the time needed to consume one module was kept to a minimum. Several modules were created and combined into video lectures that covered the full curriculum. A version of the modules can be found and used freely at YouTube 1 The teaching was combined with supervision that allowed the students to ask questions and discuss the content of the learning modules. The course ended with a practical and theoretical test. In terms of learning outcomes, the students that used the material developed according to the CBMT framework performed similar to, or slightly better than students from previous years where the same material was delivered as traditional lectures. The students were handed a survey that measured how they perceived the lecture material and 26/28 students reported that they preferred the CBMT learning modules over traditional lectures, when asked to pick one or the other. Further, the students reported that the CBMT learning modules motivated them in their studies and made them understand the theoretical material [START_REF] Kävrestad | Using context based micro training to develop oer for the benefit of all[END_REF]. In terms of usage, 75% of the students reporting using 9 or 10 of the 10 available video lectures.

Evaluation of CBMT for Information security training

In another evaluation, CBMT was evaluated as a means of assisting users in selecting better passwords. In this case, an interactive CBMT module was created and implemented at the account creation page of a local internet service provider. The module was activated when a user clicked in the "create password" field and is showcased as a demonstrator at GitHub2 . In essence, a window presenting basic password security tips was presented, the guidelines themselves were based on Kävrestad et al. [START_REF] Kävrestad | Constructing secure and memorable passwords[END_REF]. The tip was to use passwords made up of four words or more. The user could then decide to learn more or to create a password. Upon selecting learn more, the user was presented with a series of questions that gave direct feedback and upon clicking create password, the user was taken to a password creation step.

50% of the users on the web site were assigned to use the CBMT module during account creation, the other 50% used the original account creation page. The strength of passwords created by the users was measured using the zxcvbn method by Dropbox [9]. The experiment showed that users that used the CBMT module created stronger passwords than users in the control group. The effect was measured on a 4-graded scale that reflected password entropy as described by [START_REF] Wheeler | zxcvbn: Low-budget password strength estimation[END_REF]. The group using the CBMT module had a median value of 3 while the other group had a median or 2, and the result was statistically significant at the 99% level.

Following the experiment, a survey was executed where participants were presented with password creation guidelines using the CBMT module, in plain text or using a link to plain text. They then received questions about the guidelines just presented to them. The survey suggested that the participants presented with the CBMT module were slightly more aware of the password guidelines than the users presented with plain text. They were significantly more aware of the guidelines compared to the users that received a link to plain text guidelines. The results of this evaluation show that CBMT can serve as a framework for the development of effective information security training that fulfilled the goals of the CBMT framework. The results of this study are accepted for publication in IFIP SEC 2020.

Guideline refinement and establishment

Following the evaluation of the CBMT in higher education and for presentation of password creation guidelines, the framework was further refined. This refinement was used in a three-step process:

1. Insights acquired by the researchers during the evaluation were considered. 2. The framework was presented and discussed at the 19th Seminar within the Swedish IT Security Network for PhD students (SWITS). 3. Free-text answers acquired from the surveys in the evaluation phase were analyzed.

During the evaluation of CBMT for use in higher education is became evident that while the framework suggests that training should be carried out in naturally occurring situations, such as when a user is browsing the Internet, this is not always possible. In some cases, the situations need to be constructed. A constructed situation includes a situation that the user is put in rather than a situation that the user encounters. A user would, for instance, encounter phishing making that encounter a natural situation. On the contrary, a constructed situation would be when the user is asked to carry out a task as part of education or training. Subsequently, when CBMT is used in a natural situation it is used in direct relation to a practical element and does not in itself include the practical element. On the other hand, it must include a practical element itself when used in a constructed situation. The guidelines in the framework were updated to support this insight.

During the discussion at SWITS, several conference participants were positive about the framework but suggested that what the framework presents must in itself be easy to follow. The original intention of the framework was to not consider the actual material presented, only the delivery thereof. However, the consensus in the discussion at SWITS led to a new guideline reflecting that the information presented must be easy to follow. That is certainly in line with the goal that states that no prior knowledge should be required by the users. The need for this addition was further made evident from the evaluation in the context of password guidelines. It is clear that many password creations guidelines are hard to use [START_REF] Kävrestad | Understanding passwords-a taxonomy of password creation strategies[END_REF][START_REF] Biocco | Grid framework to address password memorability issues and offline password attacks[END_REF][START_REF] Woo | Guidedpass: Helping users to create strong and memorable passwords[END_REF] and one can consider the meaning of a good delivery if the information itself is hard to use.

The free text answers from the surveys in two validations steps (O2 and O3) were analyzed using thematic coding. The coding was performed by the authors together simultaneously to enhance inter-coding validity. The coding revealed no negative comments about the framework and 11 comments that were positive but did not otherwise add to the development of the framework.

Several users expressed that they did not follow the guidelines in favor of their own more complex password creation guidelines. None of these users reported being negative about the learning module. This suggests that the learning module was not annoying for advanced users. Typical information security training tools, including this, is targeting all users. We argue that training presented to users that do not perceive that they need the training can be interpreted as an annoyance rather than provide value. It is therefore important that tools built using the CBMT framework are developed so that they minimize interruption and annoyance, and provide a way for users to skip the training, especially if it is repetitive.

In line with this reasoning, it is important that the presented material really highlights the most important aspects of the subject matter, a notion that was also identified in the analyzed material. While it is important that the presented material covers the essential information the users need, it is evident from the analyzed information that most users will only notice some aspect of the presented material. It is therefore important that the most crucial points in the material are, in some way, highlighted even more. One example of highlighting, which was used in the password training module, was to make the most important points bold.

Following the refinements, the final goals and guidelines of CBMT are as follows (modifications in the refinement step are in italic): Goals:

-Provide training that users want to make use of, instead of forcing users to participate in the training -Include an awareness increasing mechanism -Require no prior knowledge from the user -Be short and easy to absorb -Should minimize annoyance for all users, especially users already familiar with the subject Guidelines:

-Delivered to users when it is relevant to their current situation. The situation can be constructed or natural. -Delivered in short sequences -Relevant to the users' current situation -Include or directly relate to a practical element -The information presented must in itself be easy to understand -The most crucial points of the information should be highlighted -Must be possible to opt-out or skip

Discussion

This paper reports on the latest steps of research that has been ongoing for several years and spanned several projects. The overall aim of the research has been to address the area of end-user training in information security. In this area, many suggestions for how to conduct information security and awareness training have been presented and tested, yet we are still in the situation that end-user behavior remains one of the most highlighted threats in the cyber domain.

This research began with a review of the area and initial ideas for how information security training could be conducted leveraging theories about how humans are motivated to learn. It was found feasible to train users about topics that relate to what they are doing, and present training in situations where it is of direct relevance and use to the user. At this point, a suggested framework of goals and guidelines for how to implement training mechanisms was presented.

The suggested framework was tested and analyzed in two different contexts, higher education and password creation. Higher education was chosen because it offered an opportunity to present students with reoccurring training and an ability to measure not only the direct effect but also the learning outcomes some weeks after the training was performed, in the form of exams. Password creation was chosen as the other case since it offered a good way to measure the effects of the training. In this particular case, passwords created after being presented with a password guideline training module were measured and compared with passwords that were not created using the training module and was found to be stronger. As such, the two parts of the testing process shows that the CBMT framework can yield direct results and sustained knowledge for the user.

The emphasis in this paper has been the final refinement of the framework following the testing. The refinement was based on insights drawn during the implementation of the guidelines, conference discussions and qualitative data gathered during the testing phase. The refinement phase revealed that several users were positive to the CBMT learning modules they have used and some refinements that were previously presented.

The scientific contribution of this paper is further insight into how effective information security training should be carried out. It also presents a concrete framework for information security training that we consider to be a version 1.0. It is tested in some contexts but can be developed, tested and extended further and we encourage others to continue to research around the framework that we present. The research also raises an interesting ethical point, is it ethical to continue to use the training methods that are proven not to be effective or should effort be made into developing new and better methods?

The research also brings value to the practitioner community. First, the research has resulted in implementations of CBMT that are free to use 3 . Second, the paper present a concrete and tested framework for how effective information security and awareness training can be implemented.

While this paper present a framework that we argue is ready for use, there is still room for further development and verification. Future projects could take a pedagogical angle and review the framework from a pedagogical perspective. Another area for future work is to implement CBMT in more security-related

Fig. 2 .

 2 Fig. 2. CBMT overview

  and evaluate the results. This can, for instance, include phishing, online fraud and more.

	3 Password	guideline	module:	github.com/rr222cy/SecurityAssistantWidget,
	Cisco	Certified	Network	Associate	training	videos:
	www.youtube.com/playlist?list=PLEjQDf4Fr75qADv9J0UbNaiUmB8zMhw6V

contexts

www.youtube.com/playlist?list=PLEjQDf4Fr75qADv9J0UbNaiUmB8zMhw6V

https://rr222cy.github.io/SecurityAssistantWidget/


Leah Shanley

Michael N Johnstone

Michael Crowley

Patryk Szewczyk

Australian Attitudes Towards Privacy of Information: Will COVID-19 Make a Difference?

Keywords: Privacy, Surveillance, Security, Public Attitudes, COVID-19 1

There has always been tension between security needs (as expressed by a nationstate) and privacy needs (as expressed by the citizens of said nation-state). Achieving this balance is perhaps one of the goals of statecraft. Terrorist attacks tend to shift the balance towards security, whilst proponents of civil liberties tend to want to move the balance in the other direction. We examine Australian attitudes to privacy in the light of the COVID-19 pandemic and consider whether the effect of the pandemic is likely to change Australian's perception of their fundamental right to privacy, as determined by law, enabled by technology and shaped by human concerns.

Introduction

Security concerns have become heightened across Federal, State and Local government agencies alike, primarily due to the severity of international and domestic incidents that relate specifically to terrorism and cybercrime [START_REF] Anzctc | Australia's Strategy for Protecting Crowded Places from Terrorism[END_REF]. Terrorism incidents such as the attacks in the United States of America on September 11, 2001 and the Bali bombings in 2002, among others, have contributed to the growing use of surveillance technologies in both the private and public sectors [START_REF] Mann | Automated facial recognition technology: Recent developments and approaches to oversight[END_REF]. More recently, however, the COVID-19 pandemic has emerged and presented further privacy concerns for the public and privacy advocates. The COVID-19 response has seen an increase in the rapid deployment of surveillance devices in Australia. For instance, the use of drones and smartphone applications to enforce social distancing measures or support contact tracing methods.

The tension between privacy and security is a complex debate between privacy advocates and security proponents; however, public citizens appear to be either indifferent to, or are struggling to grasp, the effect of technological advancements on privacy erosion, especially when privacy infringements are legitimised when contextualised with the War on Terror (Broek, Ooms, Friedewald, Lieshout, & Rung, 2017) and more recently the COVID-19 pandemic. The introduction of public surveillance systems and laws that support their use appear contradictory. Juridical matters bring forth legal implications in relation to data handling, leaving little room for redress with the continued trend of surveillance systems as a remedy to support national security objectives.

This paper examines the privacy-security debate through the lens of the power model developed by [START_REF] Turner | Explaining the Nature of Power: A Three-Process Theory[END_REF]. The balance between privacy and security is at the nexus of technology, law and people. Technology enables what is legitimate under law on behalf of the people. Australians are typically mistrustful of their government with respect to personal data (Lupton, 2019) -they do not like to be identified. A recent survey by the Office of the Australian Information Commissioner (OAIC) showed that this is still an issue for Australians (OAIC, 2017). Witness the "Australia Card" of the 1980s and the more recent "My Health Record" (an opt-out system). Briefly, the Australia Card was a failed attempt to issue a national identity card. Further, approximately 20% of Australians have elected to opt-out of My Health Record. As noted by [START_REF] Hanson | Preventing another Australia Card fail[END_REF], "The controversy over police access to the My Health Record [data] and the need to add further privacy protections in that scheme also point to heightened public awareness and concern about digitisation processes, including about losing control of personal information that might be used to cause harm". The 2017 survey administered by the OAIC showed that government access to personal data continues to concern Australians (OAIC, 2017). The COVID-19 pandemic may prove to be an interesting confounding variable. The use of Bluetooth Low Energy (BLE) technology, in the case of the COVIDSafe application (Department of Health, 2020) appears at first glance to potentially enhance the rapid detection of contacts with an infected person -a laudable public health goal. However, a BLE signal could produce false positives which would hinder, rather than help, the public health effort. Standing outside a closed office for 15 minutes could generate a "contact" where no direct exposure has occurred. This paper hereafter summarises related work on privacy, provides an extensive discussion of legal, technical and human-centred matters pertaining to privacy, shows how the discourse fits an established theory of power in groups (Turner's TPT) and concludes by suggesting that further work can be done in the form of surveying segments of the population to determine if the attitudes of Australians have changed.

Related Work

Privacy is recognised in fundamental documents that define human rights [START_REF] Clark | What's 'Privacy[END_REF]. For example, section 12 of the Universal Declaration of Human Rights states "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks." (UN General Assembly, 1948). Historically, Australians have been at best, reluctant to accept government attempts to impose policies that result in universal identification. In the 1980's the Hawke Government proposed introducing a national identity card (Hawley, 2005) that was quickly consigned to the waste bin of history. Recently, the Morrison Government's COVID-19 application attracted greater acceptance with citizens notwithstanding ongoing technical issues and release of draft legislation to enshrine privacy protections. While this draft legislation seems to exclude the operation of other security legislation the fact remains that Australia's security apparatus has acknowledged that it does at times carry out illegal acts in the course of fulfilling its role in protecting Australians [START_REF] Moorhouse | Australia Under Survelliance[END_REF]. If nothing else Australians are on notice that different Australian agencies hold different approaches to the balancing act that underpins the relationship between privacy and security.

The balance between privacy and security is continually shifting and increasing discord between individual privacy rights and the collective security objectives of a nation state [START_REF] Mann | Automated facial recognition technology: Recent developments and approaches to oversight[END_REF]. [START_REF] Goggin | Digital Rights in Australia[END_REF] conducted a survey of 1,600 Australians. The research explored questions about the nature of digital rights and covered four key issues, namely; (1) privacy surrounding data profiling and analytics, (2) government data matching and surveillance, (3) digital privacy relating to the work place (work), and (4) freedom of expression (speech) with an emphasis on online digital platforms [START_REF] Goggin | Digital Rights in Australia[END_REF]. Key areas of interest drawn from the research were the findings relating to privacy profiling, and government data matching and surveillance. The research revealed that Australians are genuinely concerned about their online privacy in agreeance with research conducted by the OAIC in 2017 that showed similar outcomes (OAIC, 2017). 65% of participants felt they had nothing to hide, whilst 67% actively took steps to protect their online privacy. 57% of participants agreed that corporations were a threat to privacy. With regards to government data matching and surveillance, 47% were concerned about government violating their privacy, however, when questions were framed from a security perspective the percentage changed. When respondents were asked whether they are in favour of law enforcement or security agencies accessing meta data, 42% were in favour, conversely, when framed as an antiterrorism measure 57% were in favour [START_REF] Goggin | Digital Rights in Australia[END_REF]. The change in attitudes suggests that personal views towards privacy breaches varied depending on the context-further highlighting the complexity of the issue.

A 2017 survey on Australian attitudes towards privacy conducted by the OAIC (2017) further identified that 93% of respondents do not want their personal data sent and stored overseas. The desire for personal privacy has seen an increase in the use of encryption technology by consumers and enterprises globally [START_REF] Korolov | Study: Encryption use increase largest in 11 years[END_REF]. The widespread use of encryption has contributed to more recent developments in law, for example, in 2018 the Australian Parliament passed the Assistance and Access Act 2018 (Cth). The Act is designed to improve the ability of Australian law enforcement and security agencies in decrypting information when investigating serious crimes (The Parliament of the Commonwealth of Australia, 2018). Thus, the introduction of the Act is a contributing factor to the rising tensions between privacy advocates and security proponents. Similarly, the Identity Matching Services Bill (2019) implements the Intergovernmental Agreement (IGA) on identity matching services. Under the Intergovernmental agreement, the Commonwealth and all states and territories agree to preserve or introduce legislation to support the sharing of facial images and related identity information via a set of identity-matching services (Parliament of Australia, 2019). While privacy laws in Australia do exist at both State and Federal level, not all government agencies work in unison, furthermore, juridical issues greatly influence law enforcement. As noted by Greenleaf (2020) any COVID-19 legislation needs to avoid 'pseudovoluntary' compliance by which voluntary uptake becomes de facto compulsory. That is, any resultant legislation should make the uptake of the COVID-19 application 'genuinely voluntary and guaranteed by enforceable laws.' (Greenleaf, 2020). In contrast, the exposure draft makes it an offence to 'require another person to download the application or have the application in operation (The Parliament of the Commonwealth of Australia, 2020b). The exposure draft does not use the words 'voluntary'. Section 94B (Object of this Part) could enshrine the principle of voluntary uptake.

Discussion

Paine et al. ( 2007) noted over a decade ago, that advances in technology have altered the way in which information is collected, stored and exchanged. Increasing threats to public safety, whether criminal or health related, have contributed to the accelerated implementation of surveillance technologies in both the public and private sector. An outcome is that regulators are struggling to keep abreast of technological developments and their impact on society [START_REF] Mann | Automated facial recognition technology: Recent developments and approaches to oversight[END_REF]. Public trust, a domain of concern, is found to play a critical role regarding surveillance in society. Major studies, for instance, the Public perception of security and privacy: Assessing knowledge, Collecting evidence, Translating research into action (PACT) survey, found that respondents level of distrust reflected in the preferences for different security and privacy practices [START_REF] Patil | Public Perception of Security and Privacy: Results of the comprehensive analysis of PACT's pan-European Survey[END_REF]. The Australian Government is not exempt from public trust issues on multiple fronts. For example, the government's handling of the Robo Debt process wherein its use of flawed technology [START_REF] Price | Quiet Australians, it's time to ask Centrelink for your money back -loudly[END_REF] to shift the onus of proof of financial entitlement onto those least able to look after themselves indicated either a collective lack of trust in citizens or an unhealthy focus on achieving a budget surplus at all cost.

In a not unrelated vein, the government's pursuit of journalists and whistle-blowers who, respectively, exposed government plans to secretly spy upon Australians [START_REF] Ryall | Federal police raid home of Australian journalist who revealed government's proposal to spy on the public. Business Insider[END_REF][START_REF] Tillett | Top bureaucrats deny report cyber agency wants to spy on Australians[END_REF] and revealed illegal government behaviour against a friendly neighbour during Timor Gap negotiations [START_REF] Knaus | Witness K and the outrageous spy scandal that failed to shame Australia[END_REF][START_REF] Heathcote | Australia and Timor Leste in The Hague[END_REF] further illustrates a preoccupation with secrecy. Furthermore, the government has just introduced into parliament proposed amendments to the Australian Security and Intelligence Act 1979 (Cth) (ASIO Act). These amendments include provision for ASIO to use nonintrusive surveillance devices on Australian citizens without needing to apply to a court for a warrant and to examine articles being delivered by a delivery service provider (The Parliament of the Commonwealth of Australia, 1999). These proposed amendments have been described as 'one more step towards a totalitarian state' [START_REF] Barnes | New ASIO law one more step towards a totalitarian state[END_REF]. This same government now asks Australians to trust it on providing adequate protections of citizen's privacy within its COVID-19 smartphone application. This is the same application that has not achieved universal uptake by all federal politicians, including some ministers of the government (ABC News, 2020). Importantly, one politician has given the protection of the identity of whistle-blowers as the reason why he will not download the COVID-19 application. This raises an important issue, while the draft legislation provides criminal sanctions for misuse of 'tracing application data' beyond medical contact tracing for the purposes of COVID-19, the derivative use of the outcome of such tracing might not be so easily prevented. It might not take much for a well-resourced agency to link a person of interest or to narrow its field of search to persons required to isolate following the identification of a politician, investigative journalist or lawyer who has become a recent victim of COVID-19. For clever people, knowing where to start looking is almost as good as knowing where to search.

Brown, Vandekerckhove, and Dreyfus (2014) confirm that transparency is indeed important to the public in Australia and the UK, thus public trust relies on increasing the responsibility of institutions to recognise and protect whistle-blowers. Brown, Vandekerckhove, and Dreyfus (2014) show in their research regarding transparency and whistleblowing, that public attitudes towards whistleblowing is divided. Half of the respondents (50%) surveyed felt information was kept to secret demonstrating public opinion in these domains has the potential to impact political support. Therefore, introducing intrusive means of data collection in combination with legislative amendments that threaten public trust is paramount. As such public figures, for example, Julian Assange, have potential to not only influence public opinion but contribute to the increasing pressure of trust in modern institutions.

Recent developments with respect to COVID-19 have prompted governments of the world to canvas technological solutions capable of contributing to the response effort. For instance, drone deployment has been trialed in some countries to enforce social distancing polices while other technological solutions such as GPS ankle monitoring devices have been acquired to help police track citizens who should be in quarantine or self-isolation (Sky News, 2020). In contrast, automatic number plate recognition (ANPR) cameras have been purchased in the state of Western Australia to enforce statewide travel restrictions [START_REF] Hendry | WA to electronically track COVID-19 patients who defy isolation orders[END_REF]. Mann and Smith (2017) astutely point out that Australia is following the trend of expanding its surveillance capabilities, noting the most significant development that occurred in 2015. The National Facial Recognition Biometric Matching Capability (NFRBMC) was announced and intended to become operational in 2016. The NFRBMC provides for the sharing of facial templates across state and federal agencies. According to more recent reports, Western Australia as a case in point, at present is preparing for the upload of licence and photographs to be shared, while other states (Victoria, South Australia and Tasmania) have already supplied driver's licence details and photographs to the National Driver's Licence Facial Recognition System (NDLFRS) [START_REF] Hendry | WA prepares for national face matching database upload[END_REF]. The NDLFRS, hosted on a Department of Home Affairs platform, contributes data to the NFRBMC system. The end result will probably result in the driver's licence becoming by stealth what Australian's had collectively rejected with the Hawke Government (the national identity "Australia" card). A government focused on identification and secrecy may find the lure of surreptitiously linking such data to Australians using the same phone application very tempting.

One particular technological response measure of interest is the introduction of a smartphone application for the purpose of social distancing and contact tracing. Countries around the world such as Singapore, Israel, South Korea and the United States have adopted surveillance methods leveraging mobile location data to enforce social distancing policies and contact tracing [START_REF] Ng | Location data used for tracking COVID-19 has its limits, ACLU warns[END_REF]. Contact tracing aims to identify citizens that have come into close contact with a COVID-19 positive case or who have tested positive, thus the data can be used to promptly notify people who may be at risk or should be in quarantine. The COVIDSafe application, released in Australia on 26 April, 2020 (Department of Health, 2020), underwent some consultation prior to its release. The Department of Health released a Privacy Impact Assessment (PIA) prior to the application being released that documented recommendations yet to materialise.

In addition, the PIA performed a compliance analysis against the Australian Privacy Principles (APPs). Whilst there are rhetorical moves to enforce penalty for breach of information privacy [START_REF] Dentons | New tougher penalties to apply in Australia for breach of privacy[END_REF], it is important to note that the APPs are not enforceable (Australian Law Reform Commission, 2014, p. 21), in other words, legal remedy for encroachment does not currently exist in Australia. Furthermore, the Australian Privacy Act (that incorporates the APPs), provide exemptions to a number of Federal and State agencies, thus it is questionable as to what protections exist for the Australian public should a breach be realised.

As the privacy debate continues, there exists an emerging discourse with regards to public surveillance and security, or put another way, national security versus information security. The balance between privacy and surveillance for the purpose of national security -a debate that continues to gain ground, demonstrates the discourse with the introduction of Acts such as the Assistance and Access Act (2018), designed to improve the ability of Australian law enforcement and security agencies in decrypting information, is in contradiction to the advocacy of privacy. The Australian Government purportedly promotes privacy on the one hand while simultaneously implementing legislation that supports intrusive means of data collection. The primary legislation for regulating privacy in Australia is the Privacy Act 1988 (Cth). The Australian Privacy Principles (APPs), included in schedule 1 of the Privacy Act, outline how personal information should be managed and handled by entities subject to the Act. Exemptions to the Act include entitles with an annual turnover of less than three million AUD, local and state governments are also exempt (OAIC, n.d.). In addition, defence and intelligence agencies are either partially or completely exempt (Australian Law Reform Commission, 2008). The Australian Law Reform Commission (2008) stated that "Australia is yet to achieve uniformity in the regulation of personal information".

Due to public concern, Australia's Federal Health Minister, Greg Hunt, shared a Determination under the Biosecurity Act 2015 (Cth) in an attempt to protect people's privacy and quell fears. The Determination restricts access to state and territory health authorities only, for the purpose of contact tracing. The Determination declares that a person must not retain the data on a database outside Australia, and the Commonwealth must cause COVID-19 application data in the National COVIDSafe data store to be deleted after the COVID-19 pandemic has concluded (Australian Government, 2020). A better option would be to insert a sunset clause in the proposed legislation requiring the approval of parliament to extend the use of the COVID-19 application legislation notwithstanding a Determination can be amended or appealed at the discretion of the government anytime. Thus, the finalisation of the draft COVID-19 application legislation is crucial for clarity. As legal experts have warned, legislation would be a better instrument [START_REF] Bogle | Will the Government's coronavirus app COVIDSafe keep your data secure Here's what the experts say[END_REF]. Law Council of Australia president Pauline Wright stated, "there was some potential legal ambiguity around whether laws authorising the law enforcement and intelligence warrants could override the Determination's prohibition on access" [START_REF] Bogle | Will the Government's coronavirus app COVIDSafe keep your data secure Here's what the experts say[END_REF]. In addition to the ambiguity that exists in Australian law, international requests for data deserves the serious consideration of the current Parliamentary Joint Committee on Intelligence and Security (PJCIS) review. To illustrate further, the Department of Health has contractual agreements with Amazon Web Services (AWS) for the COVIDSafe application data store. The use of AWS, an American company, raises some juridical issues. AWS has an annual turnover of more than three million AUD qualifying AWS as an APP entity. However, a bilateral agreement between Australia and the United States following enactment of the United States CLOUD Act (Clarifying Lawful Overseas Use of Data), enacted in 2018, may or may not weaken protections afforded under Australian's Privacy Act. This agreement is subject to the outcome of the PJCIS review and is currently being negotiated (see Second Reading Speech on the Telecommunications Legislation Amendment (International Production Orders) Bill 2020 by Minister Mr Tudge (Parliament of Australia, 2020). In the meantime, The PJCIS has commenced a review into the effectiveness of the Telecommunications Legislation Amendment (International Production Orders) Bill 2020 with a reporting date of 26 June 2020 (The Parliament of the Commonwealth of Australia, 2020a). As recently as 14 May 2020, Taylor (2020) has canvassed concerns about US law enforcement accessing COVID-19 data making the PJCIS review crucial for those concerned with privacy.

Another issue worthy of consideration is the Archives Act 1983 (Cth), an Act that sets out requirements for the retention of data. This means that archived data needs considerable attention in relation to data access, storage, backups and retention timeframes. Other pertinent issues worthy to note include function creep and exemptions to current Australian law. Function creep in generic terms addresses the originally intended purpose of a particular surveillance system. The originally intended purpose does not necessarily mean the surveillance technology will cease to operate once the originating use case ceases. A case in point is the COVIDSafe application. Whilst the Australian Government has stated that the data store must be deleted when the pandemic ends, as noted by Ahmed et al (2020), the term "end of pandemic" is vague. Whilst use of the technology by the government of the day may have well-deserved intentions, this does not guarantee future governments will hold the same values. Therefore, legislative guarantees to protect against a host of potentially lucrative markets or temptation of the security apparatus (both public and private) require mitigation to balance the potential unforeseen effects or secondary uses.

Turning to the implication of exemptions, certain Australian laws such as the Privacy Act 1988 (Cth) allow for state and federal exemptions across agencies. Should Pauline Wright's concerns come to fruition, laws that authorise state, federal and intelligence agency warrants override the Determination's prohibition on access, therefore, requirement for entities to share information with foreign governments exists and requires rigorous investigation, fortunately this is currently part of the PJCIS review mentioned above.

Instruments to investigate data protection and information privacy are widely available. PIA's are one such mechanism designed to consider the impacts and issues that may arise due to deployment of surveillance systems, In addition, PIA's aim to bring forth alternatives or safeguards to mitigate negative impacts to stakeholders [START_REF] Wright | Sorting out smart surveillance[END_REF]. The PIA officiated by the Department of Health failed to adequately address these issues relating to the COVIDSafe application data. The PIA raised concerns in the form of recommendations prior to release. However, until legislation concerning usage and contractual arrangements is enacted, information privacy related matters will continue to emerge. Moreover, public trust will continue to decline. It is not desirable that a PIA for an application critical for the health and safety of Australians, and by extension privacy, did not seek independent expert or community input prior to release. The Australian government has openly stated that returning to normal life is dependent upon the application being downloaded and used (Ruiz and Moore, 2020). In contrast, Professor McLaws, a member of the WHO coronavirus response panel stated "What's not clear is who the custodian of the data is and where the data are stored. It's not true informed consent" and in another statement "Until we know what the source code is and until we know whether Amazon has to fulfil Australian law, I won't download the application" (White, 2020). Amazon's relationship with Australian law in releasing data held within Australia to the United States of America will hopefully crystallise after the PJCIS review into the Telecommunications Legislation Amendment (International Production Orders) Bill 2020 is completed.

Privacy of one's information is significantly important in the pursuit of public trust, a critical factor that may impact on citizens' support for a security practice (Friedewald, van Lieshout, Rung, & Ooms, 2016), thus acceptance of intrusive technological solutions rely heavily on trust in the institutions that advocate such practices. The aim of the Privacy and Security Mirrors: "Towards a European Framework for integrated decision making" (PRISMS) project, was to gain better understanding of the relation between surveillance, security and privacy that could inform public policy and decision makers. The PRISMS project, a relatively large study, found a strong correlation between public trust and privacy intrusive measures, thus public trust played a critical role in the acceptance of security practices [START_REF] Friedewald | The Context-Dependence of Citizens' Attitudes and Preferences Regarding Privacy and Security Data Protection on the Move[END_REF]. The introduction of the General Data Protection Directive in May of 2018, otherwise referred to as the GDPR, illustrates that privacy of personal data is a serious issue in the European Union. The PRISMS project successfully informed policy makers in the EU, and by implication, influenced policy makers worldwide to follow suit (van Lieshout, Friedewald, Wright, & Gutwirth, 2013).

We acknowledge that any solution that enables health professionals to effectively and efficiently detect COVID-19 transmissions is a benefit to society as a whole and that contact tracing is effective. Conflicting views are however apparent with Norway's health authority for instance ceasing to use the country's COVID-19 application and deleting existing data [START_REF] Kelio | Coronavirus: Contact-tracing apps face further hitches[END_REF]. Within Australia, there are concerns about the technical implications of the use of the COVIDSafe application. We have already suggested a scenario where a false positive might occur. Interesting, the OAIC recommends turning Bluetooth 'off' to preserve privacy (although the pandemic might be considered a special case). Perhaps more seriously, there have been reports of the application interfering with medical devices that also use Bluetooth. Bluetooth may also be resource-intensive and drain a phone's battery prematurely, so users might be reluctant to enable it, thus invalidating the data collected by the application. Furthermore, the application does not function correctly on Apple products. Notwithstanding the functionality issue, Apple and Google are jointly designing a different privacy-preserving contact tracing protocol. The Apple/Google solution is different to the COVIDSafe application in several respects, in that their solution does not collect location data from a user's phone, nor does it share the identities of users with each other (or with Apple/Google for that matter). Further, random Bluetooth identifiers rotate every 10-20 minutes, which helps prevent tracking.

We now examine the above evidence and frame it in terms of Turner's Three Process Theory (TPT) of power. [START_REF] Turner | Explaining the Nature of Power: A Three-Process Theory[END_REF] contends that the "standard" theory of power is really a set of general assumptions about the relationship between power and influence. He addresses this by providing a more formal model of the factors that influence power (see figure 1). Turner's model is interesting in that, contrary to the standard model of power, group formation or the development of a shared social identity is the catalyst for influence, and this influence (separated by the different elements of persuasion, authority and coercion) is the foundation of power.

Applying Turner's TPT to the constructs of figure 1, we find evidence (or, at least the semblance) of a shared social identity (group formation), driven by the COVID-19 threat and expressed by frequent television advertising as "We are all in this together". Examining the three elements of influence, there is evidence of persuasion or convincing someone that your view is the correct one (advertising campaigns exhorting citizens to download the application), authority or the belief that someone else can control what you do (the government wants citizens to download the application) and coercion or someone can control your behaviour, even against your own interests (you may not be able to attend certain events if you have not downloaded the application). Notwithstanding concerns expressed about the security of the application's data and potential future uses (cross-matching) of said data, there is also an "appeal to the gallery" implicit in the conversation around Facebook and other social media platforms capturing more personal data than the application (therefore, why not use the application?). One could argue that end-user's perceptions of Facebook data collection processes are camouflaged through the perceived leisurely benefits of the application. Patil and Shyamasundar (2019) suggest that end-users believe they may exercise a degree of control over Facebook's data collection process, despite not actively reviewing or adjusting any controls. In contrast COVID-19 centric applications are often managed by the governing body thus minimising opportunities for end-users to exercise control. The final element of Turner's model, gaining control of resources, is evidenced by considering the data collected by the application to be a resource.

Conclusion

The number of private and public sector organisations deploying surveillance technologies is increasing rapidly [START_REF] Mann | Automated facial recognition technology: Recent developments and approaches to oversight[END_REF]. This trend is expected to continue as new challenges emerge, for example, the outbreak of COVID-19. Recent law developments, for example, the Identity-Matching Services Bill (2019) or the Assistance and Access Act 2018 (Cth), have generated significant concern in regard to the erosion of privacy. In Australia, the uploading of facial images and licence plate information to the National Database is now a reality with little oversight and little debate regarding the rollout of such technologies.

It is clear from the literature that privacy is important to the public. With the introduction of new surveillance methods such as the deployment of drones, GPS tracking devices and contact tracing apps, public concern will likely continue to increase. An important finding from the EU PRISMS project was that public trust was paramount. The research concluded that public trust played a critical role in the acceptance of security practices [START_REF] Friedewald | The Context-Dependence of Citizens' Attitudes and Preferences Regarding Privacy and Security Data Protection on the Move[END_REF]. If surveillance technologies are to be deployed as solutions to security objectives, or in the case of COVID-19, a rapid response to unforeseen circumstances, then the Australian Government has a responsibility to address the ambiguity that surrounds the public's perception of technological solutions and the laws that purport to protect privacy. A clear and definite roadmap for the reversal of intrusive technological surveillance systems would contribute to public trust, however such debate is absent from the discussion. The Australian Privacy Act offers little redress for breach of information privacy, moreover, the plethora of Acts, Bills and other Amendments provides for a contradictory landscape that is difficult to navigate leaving the average Australian often confused and mislead when new surveillance systems are introduced. It is time to consolidate these nuances surrounding law and design a solid framework for the deployment of surveillance technology. Worthy of consideration among all the newly, or otherwise predicated surveillance systems, is the continued advocacy of surveillance technology as a primary solution to national and state security objectives. The trade-off paradigm, that is, the assumption people are willing to trade privacy for more security, has been debated among scholars and academic circles for considerable time. People desire both security and privacy [START_REF] Broek | Privacy and security: Citizens' desires for an equal footing Surveillance, privacy and security : citizens' perspectives[END_REF], thus finding the balance is pertinent in the pursuit of public trust. Friedewald, Lieshout, Rung, Ooms, and Ypma (2015) showed in research concerning the trade-off paradigm, evidence against the trade-off hypothesis and found no significant statistical correlation between people's valuation of privacy and security concern, therefore, generalising that Australian citizens are willing to trade privacy for more security is not consistent with the evidence.

We are not arguing that privacy trumps security in all cases. All nations keep secrets and it is in their national interest to do so. What we observe is that, by nature, Australians are reticent to share their personal information with any government entity. In order to test if this is true, we propose to undertake a survey of segments of the population to evaluate current Australian attitudes to privacy and to evaluate if the COVID-19 pandemic changes these attitudes in any significant way.

The COVID-19 pandemic has seen the suspension of parliamentary sittings potentially setting a precedent for future emergency protocols to be established. Laws have been passed without opposition and surveillance systems are in the process of rapid deployment, thus the absence of political safeguards reduces the potential for external scrutiny. While the gravity of the pandemic can be appreciated, and we are indeed chartering unfamiliar waters, still it is unequivocally necessary that a well-informed sense of assurance that information risks and controls are in balance is paramount, in other words, a clear and concise Business Continuity Plan on behalf of Federal and State governments is crucial to enable continuation of government and democratic debate. Furthermore, decision making without practicing due diligence and regard for the impact on the Australian public deserves criticism. As stated by Zedner ( 2009) "Do we want to be completely secure in a police state?".

Fig. 1 .

 1 Fig. 1. Turner's Power Model (adapted from Turner, 2005).