Gurpreet Dhillon
email: gdhillon@vcu.edu

Spyridon Samonas
email: ssamonas@gmail.com

Ugo Etudo
email: etudouo@vcu.edu

Developing a Human Activity Model for Insider IS Security Breaches Using Action Design Research

Keywords: Human Activity Model, Insider Threats, Security Culture, Action Design Research

Insider security breaches in organizations have been identified as a pressing problem for academics and practitioners. The literature generally addresses this problem by focusing on the compliance of human behavior to stated policy or the conformance with organizational culture. The cultural stance and resultant activities of organizational insiders are key determinants of information security. However, whilst compliance with security policies and regulations is of great importance, the very structure of human activities that facilitates or hinders such compliance have seldom appeared in the literature. In this paper we present a human activity model that captures different aspects of a security culture. The model elucidates the patterns of behavior in organizations. Applying the model before and after an insider security breach allows us to make salient, critical areas that need attention.

Introduction

Cyber-security threats are not always embedded in the technical infrastructure and operations of the enterprise. Vulnerabilities often arise in the socio-technical space of norms, beliefs and shared models of reality that embody an organization's culture. Developing analytics that incorporate the socio-technical environment of the organization is technically and conceptually complex.

The problem of increased security breaches that are instigated by insiders was first recognized by Denning [START_REF] Denning | An intrusion-detection model[END_REF]. In later years, issues related with insider threats were further vocalized through a series of reports by the now defunct Audit Commission in the UK [START_REF]Audit Commission, Losing an empire, finding a role[END_REF], [START_REF]The Audit Commission for Local Authorities and the National Health Service in England and Wales[END_REF], [START_REF]Opportunity makes a thief. Analysis of computer abuse[END_REF] and the Office of Technology Assessment in the US [START_REF]Information security and privacy in network environments[END_REF]. These studies highlighted the importance and the role played by insiders in perpetuating computer related crimes. Subsequently, several case studies on Barings Bank, Kidder Peabody and Societe Generale provided evidence that, indeed, the majority of computer related threats reside within organizations (see [START_REF] Bowen | Designing host and network sensors to mitigate the insider threat[END_REF]). Similar evidence has been provided by other research organizations, such as the Computer Security Institute and the CERT division of the Software Engineering Institute at Carnegie Mellon University.

Insider threats mainly refer to the intent of dishonest employees to commit some form of cyber-crime ( [START_REF] Dhillon | Computer Crimes: theorizing about the enemy within[END_REF]; [START_REF] Warkentin | Behavioral and policy issues in information systems security: The insider threat[END_REF]). Insiders are capable of disrupting operations, corrupting data, infiltrating sensitive information, or generally compromising an IT system, thereby causing loss or damage ( [START_REF] Cappelli | Common Sense Guide to Prevention and Detection of Insider Threat[END_REF]; [START_REF] Cummings | Insider Threat Study: Illicit Cyber Activity Involving Fraud in the U.S. Financial Services Sector[END_REF]). As the discussion on the insider threat has evolved considerably over the past decade, so has the very definition of the term 'insider'. Nowadays, it is not only employees who have privileged access to the assets of an organization, but also volunteers, consultants and contractors ( [START_REF] Brancik | Insider Computer Fraud: An In-depth Framework for Detecting and Defending against Insider IT Attacks[END_REF]; [START_REF]Risk of Insider Fraud: Second Annual Study[END_REF]). Access is also given to business partners or fellow members of a strategic alliance, whereas contractors now include employees of a cloud service provider [START_REF] Hartel | Cyber-crime Science = Crime Science + Information Security[END_REF]. Hence, a more appropriate alternative to the term 'insider' would be a '(person with) specialized access' [START_REF] Hartel | Cyber-crime Science = Crime Science + Information Security[END_REF].

In this paper, we build on the Action Design Research (ADR) concept as proposed by Sein et al. [START_REF] Sein | Action design research[END_REF] to develop a method for modeling insider security threats. This is undertaken in the context of an online business -Crown Confections. Our model is based on an in-depth understanding of human activities at the workplace and aims to capture both malicious and non-malicious insider threats. We draw on the organizational studies literature to argue that human activities and the silent messages that are emanated by individuals can be used as key indicators of insider cyber-security breaches. The application of E. T. Hall's theory of silent messages allows us to identify any possible trouble areas with respect to insiders and prioritize cyber-security interventions that could take the form of strategy, training or policy initiatives.

The paper adopts the publication schema for a design science research study as suggested by Gregor and Hevner [START_REF] Gregor | Positioning and Presenting Design Science Research for Maximum Impact[END_REF] and is organized as follows. The following section presents a review of the literature on insider threats. The third section examines relevant literature on ADR and outlines the different stages of the method. In the fourth section, we sketch our conceptual basis for developing a human activity model of insider threats at Crown Confections. The fifth section discusses the evaluation of the model. The sixth section paper presents an analysis of the key findings, and the final section includes a summary of our research and its limitations, as well as directions for future research.

Literature Review

In the insider threat literature, three main informing bodies can be identified. First, studies that present ever so sophisticated technical approaches to manage insider threats. Second, studies that examine the socio-organizational aspects of insider threats. Third, studies that address different response mechanisms following an insider breach.

In the realm of technical approaches to insider threats, Denning's [START_REF] Denning | An intrusion-detection model[END_REF] intrusiondetection model was one of the earlier works to identify attempted system break-ins by outsiders, as well as abuse by insiders who misuse their privileges. In subsequent years several other similar models have been proposed. For instance, Bowen [START_REF] Bowen | Designing host and network sensors to mitigate the insider threat[END_REF] define a threat model designed to deceive, confuse and confound attackers so that they ultimately abandon the impregnation efforts. This is undertaken by introducing host and network sensors in the architecture. Yet in other cases, honeypot technologies have been proposed as a means to catch insider threats [START_REF] Spitzner | Honeypots: Catching the insider threat[END_REF]. Insider threats within database systems have also been well researched, where user tasks are mapped to the transactions (see [START_REF] Chagarlamudi | Insider Threat in Database Systems: Preventing Malicious Users' Activities in Databases[END_REF]). Generally speaking, the wealth of research in technical approaches to insider threats has focused on restricting access, technical monitoring or, at most, predictive modeling. While important, an exclusive focus on these approaches falls short of providing a holistic perspective in modeling and managing insider threats.

Socio-organizational aspects of insider threats have also been well researched (see [START_REF] Warkentin | Behavioral and policy issues in information systems security: The insider threat[END_REF] and [START_REF] Hartel | Cyber-crime Science = Crime Science + Information Security[END_REF]). Although the problem of the insider threat is defined and framed in different ways, and this has resulted in an abundance of approaches, the majority of studies share one thing in common: they treat all insiders as potentially malicious. In this strand of literature, insider threats emanate from available opportunities, work situations and personal factors [START_REF] Dhillon | Computer Crimes: theorizing about the enemy within[END_REF]. Based on monitoring and profiling, this literature primarily addresses issues of policy compliance, sanctions, deterrence and neutralization techniques ( [START_REF] Boss | If someone is watching, I'll do what I'm asked: mandatoriness, control, and information security[END_REF], [START_REF] Bulgurcu | Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness[END_REF], [START_REF] D'arcy | User awareness of security countermeasures and its impact on information systems misuse: a deterrence approach[END_REF], [START_REF] Herath | Encouraging information security behaviors in organizations: Role of penalties, pressures and perceived effectiveness[END_REF], [START_REF] Warkentin | Behavioral and policy issues in information systems security: The insider threat[END_REF]). Non-malicious violations are also examined in the insider threat literature [START_REF] Guo | Understanding nonmalicious security violations in the workplace: a composite behavior model[END_REF]. These are typically associated with lapses, errors and mistakes, which are unintentional ( [START_REF] Reason | Achieving a safe culture: theory and practice[END_REF], [START_REF] Reason | The human contribution: unsafe acts, accidents and heroic recoveries[END_REF]). However, more recent studies transcend the distinction between malicious and non-malicious insiders, and consider the insider threat as the departure of human behavior from compliance with security policies, irrespective of whether this is the result of malice or disregard for such policies ( [START_REF] Greitzer | Combining Traditional Cyber-security Audit Data with Psychosocial Data: Towards Predictive Modeling for Insider Threat Mitigation[END_REF], [START_REF] Hoyer | Fraud Prediction and the Human Factor: An Approach to Include Human Behavior in an Automated Fraud Audit[END_REF]).

Research that examines the response to insider threats has largely been related to aspects of compliance with stated policy. As a result, the focus has been more on deterrence and the disciplinary actions that might influence human behavior. Several studies have focused on identifying antecedents to cyber-security compliance. For instance, Vance [START_REF] Vance | Motivating IS security compliance: insights from habit and protection motivation theory[END_REF] found that routine activities of employees along with past behavior have a significant effect on compliance behavior. Herath [START_REF] Herath | Protection motivation and deterrence: a framework for security policy compliance in organisations[END_REF] also found social influence to have a strong impact on compliance intention. In a related piece of research, Herath [START_REF] Herath | Encouraging information security behaviors in organizations: Role of penalties, pressures and perceived effectiveness[END_REF] investigated the role of penalties in encouraging positive information security behavior. Their findings indicate that certainty of detection has a positive impact on compliant behavior, whereas severity of punishment has a negative impact on intention to comply.

The lack of consensus in research regarding compliance antecedents has led to an exploration of other factors that might help achieve security compliance as well as ensure an adequate response to insider threats. Prominent amongst these strands of research is the work of Ramachandran [START_REF] Ramachandran | Variations in Information Security Cultures across Professions: A qualitative study[END_REF] on security culture, Hedström [START_REF] Hedström | Value conflicts for information security management[END_REF] on value conflicts, Talib [START_REF] Talib | Invited Paper: Employee Emancipation and Protection of Information[END_REF] on employee emancipation. Along similar lines, Dhillon et al. [START_REF] Dhillon | Organizational Transformation and Information Security Culture: A Telecom Case Study[END_REF] suggest the modeling of silent messages as a way of monitoring insider threats. In this paper we heed to these assertions and provide a human activity model for insider threats.

Method

ADR helps in developing a prescriptive design artifact in an organizational setting. Typically, ADR is used to address a particular organizational problem through intervention and evaluation. This is followed by the construction and evaluation of the artifact, which would allow for the problem to be solved. Over the years, ADR has been extended to areas such as business intelligence and security breach detection. However, despite its significant contributions to knowledge creation in IS, both in the form of viable artifacts and abstract theoretical constructs [START_REF] Gregor | Positioning and Presenting Design Science Research for Maximum Impact[END_REF], the adoption of ADR in computer security research is still underdeveloped. Most notably, Chen et al. [START_REF] Chen | Correlated Failures, Diversification, and Information Security Risk Management[END_REF] adopted ADR to build a model to assess the risk of system downtime in computer networks due to the exploitation of software vulnerabilities. Puhakainen and Siponen [START_REF] Puhakainen | Improving Employees' Compliance Through Information Systems Security Training: An Action Research Study[END_REF] developed a theory-based IS security training approach, which they then validated empirically through an action research intervention. Other relevant applications of ADR include the work of Waguespack et al. [START_REF] Waguespack | Towards a Design Theory for Trustworthy Information Systems[END_REF] in the formulation of security design through Thriving Systems Theory, as well as the risk reporting prototype that Beer et al. [START_REF] Beer | A Prototype for Information-Dense IT Project Risk Reporting: An Action Design Research Approach[END_REF] developed for information-dense IT projects.

Methodologically, any ADR project follows four well-defined stages: 1) Problem Formulation; 2) Building, Intervention, and Evaluation (BIE); 3) Reflection and Learning; 4) Formalization and Learning. The problem formulation of this research project is presented in the two preceding sections. In building, intervening and evaluating, we define the alpha version of the model (see Fig. 1). We then engage in reflection and learning to identify any new requirements that emerge from our exercise. Finally, we formalize our learning and prepare a second iteration of the model, which would lead to the development of the beta version of the model. This paper presents an early alpha version of our insider cyber-security threat model and identifies possible research directions in further refining the model towards the development of the beta version.

Fig. 1. Action Design Research adopted in this project (based on [7])

The development of an artifact is central to ADR. In our research, we consider artifacts as ensembles. As Orlikowski and Iacono [START_REF] Orlikowski | Research commentary: Desperately seeking the "IT" in IT research-A call to theorizing the IT artifact[END_REF] note, there are multiple ways in which IT artifacts come into being. In this research project, we articulate ADR following the 'technology as development process' conception of the artifact [START_REF] Orlikowski | Research commentary: Desperately seeking the "IT" in IT research-A call to theorizing the IT artifact[END_REF]. This view of the artifact focuses on the social processes that are related to the design, development and implementation of the technical artifact.

In our research, the artifact in question is the computer-based model for insider cybersecurity threats. Using the Orlikowski and Iacono [START_REF] Orlikowski | Research commentary: Desperately seeking the "IT" in IT research-A call to theorizing the IT artifact[END_REF] vocabulary, this kind of artifact "examines the role of key stakeholders… [and] how such roles engender conflict, power moves, and symbolic acts." Our computer-based model offers valuable insights into the complex organizational and socio-political processes that are involved in the formulation and implementation of cyber-security strategies and policies. Hence, the model of insider threats becomes a management tool for constant monitoring and assessment of threats as these emerge. In due course, the artifact may reshape itself to influence structure of operations and the related business processes (as postulated by [START_REF] Jones | Gidden's Structuration Theory and Information Systems Research[END_REF] among others). Finally, we argue that given an instrument that faithfully measures the constructs of the model as they manifest in the subjects, the responses of individuals are patterned with (and are therefore not independent of) organizational cyber-security rules, best practices, and technical controls. In other words, our instantiation of the human activity model is sensitive to cyber-security rules, best practices, and technical controls.

Artifact Description

To develop our insider threat model, we draw on a conceptual framework that is based on Hall's theory of silent messages. Hall [START_REF] Hall | The silent language[END_REF] argues that silent messages are emanated via human activity interactions, such as language, greeting protocol, gender and status roles, and these get manifested at three levelsformal, informal and technical. In this paper, we argue that an understanding of these cultural streams at the formal, informal and technical levels can be critical for the defense of the organization against insider threats, and should, therefore, be assessed on a regular basis. In our human activity model for insider threats, there are two concepts that need elucidation. First, the Primary Message System (PMS) and cultural streams as proposed by Hall [START_REF] Hall | The silent language[END_REF]. Second, the manifestation of these cultural streams in terms of formal, informal and technical. These are discussed below.

Hall's [START_REF] Hall | The silent language[END_REF] taxonomy of behavioral patterns allows us to capture, at a moment in time, the attitudes of employees on matters of security. Each application of the taxonomy generates a panel of data allowing for analyses of changes in organizational security culture over time and between events of interest. In this paper we provide an example of how our adaptation of Hall's [START_REF] Hall | The silent language[END_REF] taxonomy of behavioral patterns allows us to monitor and interpret the change in attitudes of different employees before and after the occurrence of a security breach. In his intercultural communication theory, Hall [START_REF] Hall | The silent language[END_REF] argues that "no culture has devised a means for talking without highlighting some things at the expense of other things." Put another way, cultures demonstrate their idiosyncrasies in observable ways. He attempts to unearth different aspects of human behavior that are taken for granted and are often ignored by classifying them into streams that interact with each otherthe silent messages. Laying emphasis on the concepts of time and space, Hall identified ten cultural streams that are rooted in physiology and biology. These streams form the primary message system (PMS), which is essentially a map of a wide variety of cultural and behavioral manifestations. A brief summary of each of the cultural streams is presented below:

-Interactional (Int): Speech is one of the most elaborate forms of interaction, and it is reinforced by the tone, voice and gesture. Interaction lies at the hub of the "universe of culture", and hence, every social action grows from it. -Organizational (Org): Refers to the complexity of associations. Hall uses the analogy of bodies of complex organisms as being societies of cells. In his view, association begins when two cells join. Hall [START_REF] Hall | The silent language[END_REF] also argues that culture operates at three distinct levels, which are in a state of constant interaction: formal, informal and technical. His theory of culture is, essentially, a theory of change. Formal beliefs shape informal adaptations in behavior; and these, in turn, lead to technical analysis. Each of the ten streams is further broken down into formal, informal and technical to represent the different modes of behavior.

For each impact of the cultural stream at the three levels, we developed an emergent scenario. Each scenario took the form of a statement with a 5-point Likert scale to assess how members of the organization feel about the given situation (refer to Table 1).

Evaluation

In our research, we have employed our artifact to undertake an assessment of insider threats at a small, fledgling business. Crown Confections offers an assortment of confections for online or phone-in purchase. Customers have the option of phoning-in their orders or purchasing their pastries from Crown's website. Crown accepts credit card payments and uses PayPal's commercial suite to process these payments in a secure manner. The Crown staff consists of 20 individuals. The company wanted to develop a mechanism for monitoring insider threats. As researchers, we proposed the use of silent message theory to eventually develop an artifact in the form of a dashboard. It was agreed that the researchers would work with the Crown Confections employees to first develop an alpha version, which would then lead to the development of a beta version following evaluation and feedback from the end users. In this paper we are sharing the model as it has been shaped in the alpha version [START_REF] Sein | Action design research[END_REF].

For the purposes of our research, we administered the human activity model presented here to the Crown Confections staff twiceonce prior to the breach, and again after the breach. The breach included a spear-phishing and a brute force attack that compromised admin and user credentials. All members of the company provided usable responses. Our aim in administering the instrument at Crown Confections is to illustrate its ability to capture nuanced cultural aspects of an organization with respect to the attitudes, behaviors, and perceptions of its members concerning cyber-security.

Given the formative evaluation of the artifact during the alpha-cycle, we conducted multiple rounds of semi-formal interviews with organizational members to give them the opportunity to share their experience and shape different aspects of the instrument. This feedback was invaluable as it helped us review key features of the instrument, such as the content and phrasing of certain questions. Alongside areas of improvement, organizational members praised the fact that the questions comprising the instrument touch upon aspects of cyber-security that are often overlooked in typical questionnaires of cyber-security risk assessment. For instance, organizational members highlighted the importance of examining issues of gender or the financial motivation of employees with respect to cyber-security. Furthermore, organizational members also agreed that regular monitoring of the instrument could pinpoint actionable insights on how to improve different aspects of cyber-security across the organizationwhich is our main research goal in this project. Hence, considering the application of the instrument in Crown Confections, it appears that the alpha version represents an insightful canvas for the examination of cyber-security as a diverse and granular socio-technical concept in contemporary organizations.

Discussion

The results of our artifact can provide useful visualizations for managers and executives who are interested in 'soft' aspects of cyber-security. Table 2 is a heat map that represents graphically the spectrum of positive and negative changes that were recorded in the post-breach perception of employees in relation to cyber-security. Positive changes indicate a move that is directed towards the high end of our Likert scale ('strongly agree'), whereas negative changes indicate a move in the opposite direction. In terms of formalizing our learning, the analysis from the heat map can be represented graphically in the form of a radar map (see Fig. 2). The graphic representation shows how silent messages and attitudes of individuals change following a breach. Even without the occurrence of a breach, the radar maps can form the basis of an insider threat analytics dashboard that benchmarks and monitors different aspects of cybersecurity culture. In this way, the model can help us build the cyber-security culture profile of a given organization. In the following subsection, we will discuss a small number (three) of cases where a change in the perception of cyber-security has been recorded in our study.

Int Org Eco Gen Ter Tem Ins Rec Pro Exp

Formal layer

At the formal layer, we noticed a positive change in the Territorial stream, which examines how employees welcome suggestions from security professionals, which may change the way their Department or work group operates. A positive change shows higher agreement rates with the statement that comprises this cell, and it is, in fact, a reasonable reaction to a security breach. Following the breach, there may be an increasing need for openness as organizational members seek to share better security practices and get answers from others with more knowledge. However, an opposite reaction, namely a decreased rate of agreement with the statement, could also be seen as an expected outcome. The insider breach could cause organizational members to isolate themselves in small clusters that do not communicate with each other, or prevent them from reaching out to colleagues to openly discuss cyber-security related issues altogether. Similar effects have been noted in the literature with regards to the moral disengagement that security-related stress seems to produce D'Arcy [START_REF] D'arcy | Understanding employee responses to stressful information security requirements: a coping perspective[END_REF]. This type of organizational stress triggers an "emotion-focused coping response in the form of moral disengagement from [information security policy] ISP violations, which in turn increases one's susceptibility to this behavior" [47, p. 285]. Stress that stems from work overload, complexity and uncertainty in response to a security breach could activate said coping mechanisms and provide the basis for the rationalization of non-compliant security behavior.

Informal layer

At the informal layer, the Instructional stream refers to how receptive employees are to learning from peers. As the security breach represents a moment of organizational crisis, organizational members increasingly seek help from their peers in order to mitigate difficulties associated with navigating the new, equivocal organizational situation. This would be particularly true in the case where there is a lack of a structured and well-prepared security incident response [START_REF] Plester | The Complexity of Workplace Humour: Laughter, Jokers and the Dark Side of Humour[END_REF].

Technical layer

The Interactional stream of the technical layer refers to the understanding of technical jargon in cyber-security issues and communications. Following the breach, there seems to be less agreement with the reference statement of this cell, which is a plausible outcome. A negative change indicates that some employees may feel challenged with the technical jargon associated with a security breach. Despite the increasing investment in cyber-security training and education, organizational members that occupy non-technical posts are not required to use this technical jargon in their day-today work. This means that it may be more difficult for them to understand the technical terminology and the details of how a security breach came about.

Conclusions

We have examined here the efficacy of a human activity model in providing insights to security culture where this efficacy can, in a sense be characterized as the sensitivity of the human activity model to changes in security culture. We highlight this sensitivity by examining pre and post breach instantiations of the model and the ensuing changes.

We do this for a single organization. Naturally, generalizability of these findings to other organizational settings becomes "problematic." We argue here that this taken-asgiven conception of generalization is inappropriate in this case. We have applied a theory (i.e. Hall's [START_REF] Hall | The silent language[END_REF] human activity model) in a setting that is different from the one in which it was developed. Our findings as discussed in section 5 demonstrate that our application of the theory is valid in our setting. This work is an example of type TE generalizationgeneralizing from theory to description Lee and Baskerville [START_REF] Lee | Generalizing Generalizability in Information Systems Research[END_REF]. Lee and Baskerville write of this form of generalization: "researchers are interested not only in pure or basic researchthe development, testing and confirmation of theoriesbut also in the utility of their theories in the actual business settings of executives, managers, consultants and other practitioners." By applying the human activity model in this setting we demonstrate its ability to be generalized to different settings and provide evidence consistent with its theoretical assertions.

There has been a limited amount of research that focuses on pre-and post-breach attitudinal changes. Berezina [START_REF] Berezina | The impact of information security breach on hotel guest perception of service quality, satisfaction, revisit intentions and word-ofmouth[END_REF] undertook a study of hotel guest perceptions following a breach and found changes in perceived service quality, satisfaction and likelihood of recommending a hotel. Similarly, Rosoff [START_REF] Rosoff | Behavioral Experiments Exploring Victims' Response to Cyber-based Financial Fraud and Identity Theft Scenario Simulations[END_REF] conducted a behavioral experiment to explore individual response to cyber-crimes. The results suggest differences in messages that individuals exhibit following a breach. The Rosoff [START_REF] Rosoff | Behavioral Experiments Exploring Victims' Response to Cyber-based Financial Fraud and Identity Theft Scenario Simulations[END_REF] study was an experimental design, which covered predefined scenarios. In one scenario, Rosoff [START_REF] Rosoff | Behavioral Experiments Exploring Victims' Response to Cyber-based Financial Fraud and Identity Theft Scenario Simulations[END_REF] explored if attack characteristics and attack mode had any influence of victim's behavior following a breach. In the second scenario, they assessed if the motivation of the attacker and the resolution of the breach had any impact on the behavior of the victim.

While studies such as those of Rosoff [START_REF] Rosoff | Behavioral Experiments Exploring Victims' Response to Cyber-based Financial Fraud and Identity Theft Scenario Simulations[END_REF] and Berezina [START_REF] Berezina | The impact of information security breach on hotel guest perception of service quality, satisfaction, revisit intentions and word-ofmouth[END_REF] do shed some light on the manner in which breaches manifest and how individual behavior changes or how victims respond, they fall short of providing an ongoing assessment of the cybersecurity situation. Our research project addresses this gap in the literature by presenting a proof-of-concept demonstration of a human activity model for insider cyber-security threats that considers the perceptions of insiders prior and after a security breach.

Future research will be concerned with the development of a beta version of our model. A more mature version of the instrument could be administered across different organizations and industries to get a more informed understanding of the granularity of cyber-security as a socio-technical concept. Different research contexts and organizational settings may result in different iterations of the instrument. Although Crown Confections helped researchers gather sufficient feedback on the design and functionality of the instrument, a larger organization could provide a more challenging research setting with a larger number of responses, and perhaps more contradictory responses and feedback that would lead to more fine-detailed iterations of the model.

  -Economic (Eco): Subsistence relates to the physical livelihood, income and work. -Gender (Gen): Refers to the cultural differentiation of sexes and their interactions and associations. -Territoriality (Ter): Refers to the division of space in everyday life, and ownership. -Temporality (Tem): Refers to the division of time and sequencing. -Instructional (Ins): Refers to a basic activity of life that includes learning and teaching. According to Hall, culture is shared behavior that is acquired, and not taught. -Recreational (Rec): Refers to fun and recreation as part of work and occupation. However, this stream also captures competitive human behavior. -Protective (Pro): Defense is a key element of any culture. Different cultures have developed different defense principles and mechanisms. The Protective stream is closely related to the Recreational stream since humor is often used as an instrument to hide or protect vulnerabilities. -Exploitational (Exp): Hall draws an analogy with the living systems to highlight the importance of evolutionary adaptation to "specialized environment conditions." By extension, the Exploitational stream represents the sophistication in the use of tools, techniques, materials and skills in a competitive and changing environment.

Fig. 2 .

 2 Fig. 2. Radar maps showing pre and post breach scenarios (blue line represents pre-breach situation and black line represents post breach).

Table 1

 1 of green and white account for the different levels of gradation between the most positive and most negative changes. In Table2, the positive changes are depicted with dark color accents, whereas the negative changes are depicted with white color accents. Shades in between indicate that no change or minor changes (positive or negative).

	interactions
	activity
	human
	depicting
	. Framework

Table 2 .

 2 Heat map of human activity interactions


Gurpreet Dhillon
email: gdhillon@vcu.edu

Chandrashekar Challa
email: challacd@longwood.edu

Kane Smith
email: smithkj6@vcu.edu

Defining Objectives for Preventing Cyberstalking

Keywords: Cyberstalking, cyber security planning, values, strategic objectives

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Stalking has been well recognized in the academic and practitioner literature; however with the advent of newer technologies such as social media a new threat has emerged, cyberstalking. An increased reliance of individuals on interpersonal contact has resulted in a corresponding increase in possibility of interpersonal intrusion, referred to as cyberstalking [START_REF] Mcfarlane | An exploration of predatory behavior in cyberspace: Towards a typology of cyber stalkers[END_REF]. Institutions and government bodies struggle to manage cyberstalking due to a lack of understanding of the phenomenon. The problem question is twofold: First, what are the objectives to ensure protection against cyberstalking. Second, what priority areas should institutions focus on to ensure that cyberstalking is minimized. In this paper we present a comprehensive set of individual value based objectives which can form the basis for strategic planning to prevent cyberstalking. Theoretically we are informed by the value focused thinking concept purported by Keeney [START_REF] Keeney | Value-Focused Thinking[END_REF]. The paper is organized into five sections: introduction, literature pertinent to cyberstalking, the theoretical and methodological aspects of this research, the fundamental and means objectives for minimizing cyberstalking and finally in the limitations and future research directions.

A Review of Existing Cyberstalking Literature

The internet is beneficial in connecting us globally on all fronts and is available in nearly every corner of the globe [START_REF] Jaishankar | Cyber stalking: A global menace in the information superhighway[END_REF]. It is also the cause of many unique crimes such as cyberstalking because it is cheap, easy to use, and the anonymity it offers in seeking out victims and avoiding detection [START_REF] Reno | report on cyberstalking: A new challenge for law enforcement and industry[END_REF]. Cyberstalking is a type of crime in which there is no face-to-face contact between victims and offenders [START_REF] Eck | Classifying common police problems: A routine activity approach[END_REF]. According to McFarlane & Bocij [START_REF] Mcfarlane | An exploration of predatory behavior in cyberspace: Towards a typology of cyber stalkers[END_REF], there are four types of cyber stalkers: the Vindictive Cyber stalker, the Composed Cyber stalker, the Intimate Cyber stalker and the Collective Cyber stalker.

In the past, cyberstalking victims have not had success in being recognized as victims by law enforcement agencies due to a lack of enforcement training and expertise [START_REF] Petrocelli | Cyber stalking[END_REF]. A study that analyzes cyber stalking crimes, legislative intervention measures, and preventative initiatives created specifically to curtail this emerging global crime was undertaken by Pittaro [START_REF] Pittaro | Cyber stalking: An Analysis of Online Harassment and Intimidation[END_REF]. The study concluded that cyberstalking is a serious and growing problem, but proper training and guidance could allow law enforcement agencies can track the stalkers online [START_REF] Reno | report on cyberstalking: A new challenge for law enforcement and industry[END_REF]. However, educating society is still the most effective approach to bringing awareness about cyberstalking and enacting initiatives prevent this Internet based crime. [START_REF] Petrocelli | Cyber stalking[END_REF]. California was the first state in the USA to adopt stalking laws in 1989 [START_REF] Zona | A Comparative Study of Erotomanic and Obsessional Subjects in a Forensic Sample[END_REF]. Since then stalking laws in general have been adopted elsewhere, but cyberstalking is related to one's behavior in cyberspace as opposed to the physical world [START_REF] Basu | Regulating Cyberstalking[END_REF]. Therefore, it is suggested that there should be an investigation of these regulations and ways to adapt new regulations to apply in cyberspace and how these regulations can help prevent cyberstalking.

While cyberstalking is still in its infancy, it is expected to increase significantly as the Internet becomes more popular [START_REF] Hutton | Cyber stalking[END_REF]. For this reason, there are studies such as the one by Spitzberg and colleagues [START_REF] Cupach | Obsessive Relational Intrusion and Stalking[END_REF][START_REF] Cupach | Obsessive Relational Intrusion: Incidence, Perceived Severity, and Coping[END_REF][START_REF] Spitzberg | Exploring the Interactional Phenomenon of Stalking and Obsessive Relational Intrusion[END_REF][START_REF] Spitzberg | Obsessive Relational Intrusion and Sexual Coercion Victimization[END_REF][START_REF] Spitzberg | Obsessive Relational Intrusion, Coping, and Sexual Coercion Victimization[END_REF] that conducted pilots and introduced the concept of cyber-obsessional pursuit (COP). Further, new research extended these earlier pilot studies to develop and refine measures of cyberstalking victimization [START_REF] Spitzberg | Cyberstalking and the technologies of interpersonal terrorism[END_REF]. Another study by Goodno [START_REF] Goodno | Cyberstalking, a New Crime: Evaluating the Effectiveness of Current State and Federal Laws[END_REF] examined how differences in state and federal law create gaps in stalking statutes increasing the difficulty in prosecuting all aspects of cyberstalking and suggests ways to close these gaps. Finally, the study also examines the potential issues in criminalizing cyberstalking and how these issues might be resolved by changing the laws so they address the newer cyber security crimes as a result of cyberstalking. Additional work with respect to cyberstalking has sought to develop and adapt a lifestyle-routine activities theory [START_REF] Reyns | Applying Cyberlifestyle-Routine Activities Theory to Cyberstalking Victimization[END_REF] to explain opportunities for victimization in cyberspace environments where traditional conceptions of time and space are less relevant. A related earlier study on the extent and nature of Cyberstalking victimization from a lifestyle/routine activities perspective by Reyns [START_REF] Reyns | Being Pursued Online: Extent and Nature of Cyberstalking Victimization from a Lifestyle/Routine Activities Perspective[END_REF] also corroborates the theory. Findings from this study indicate that the number of differing factors such as the number of online social networks an individual owns or low self-control are significant predictors of cyberstalking victimization, suggesting moderate support for lifestyle/routine activities theory in explaining cyberstalking [START_REF] Reyns | Being Pursued Online: Extent and Nature of Cyberstalking Victimization from a Lifestyle/Routine Activities Perspective[END_REF].

Methodology

In order to identify values one must ask the concerned people [START_REF] Keeney | The value of Internet commerce to the customer[END_REF]. Within the literature, there is a significant variance in the number of individuals that should be interviewed. As an example, Hunter [START_REF] Hunter | The use of RepGrids to gather data about information systems analysts[END_REF] used the interviews of 53 people from two different organizations to do a content analysis to elicit individual conceptions. However, Phythian & King [START_REF] Phythian | Developing an Expert System for tender enquiry evaluation: a case study[END_REF] used two managers who were experts in assessing tender enquiries to identify key factors and rules that influence tender decisions. Additionally, Keeney [START_REF] Keeney | The value of Internet commerce to the customer[END_REF] obtained interviews from over 100 individuals to obtain their values to develop objectives that influenced Internet purchases. For this study, over 100 persons of varying background and experience were interviewed to identify general values for managing cyber stalking related information security.

The following three-step process is used to identify and organize the values that an individual might have with respect to cyberstalking [START_REF] Keeney | Value-Focused Thinking[END_REF]: First, interviews are conducted which elicit the values an individual might have within a decision context. Second, individual values and statements are converted into a common value format, such as an objective oriented statement. Then similar objectives are grouped together in order to form clusters of objectives. Finally, the objectives are then classified as either fundamental to the decision context, resulting in a fundamental objective, or simply a means to achieve the fundamental objectives, or what's called a means objective.

Identifying values

To begin, interviews are conducted with the concerned peoples as a process of identifying values. At the beginning of each interview, the purpose is clarified and context and scope of the interview are established. The core objective is to understand the fundamental objectives for preventing cyberstalking. To set the decision context, we emphasize that the scope for eliciting these values is limited only to individuals. After defining the scope of the interview, explanations are provided to the interviewee so that they can understand what 'cyberstalking' is to establish a common understanding. Cyberstalking is thusly defined as 'the use of the internet, email, or other electronic communications devices to stalk another person' [START_REF]Cyberstalking: A New Challenge for Law Enforcement and Industry[END_REF]. It is made clear to respondents that the goal is to understand values that people might have with respect to cyberstalking. To identify these values four questions are posed about their personal values toward cyberstalking and those of individuals who commit acts of cyberstalking. The questions were: What do you think are your values and wishes in order to prevent cyberstalking? What values might lead you to behave in a certain manner towards cyberstalking? What kind of information do you think people use to engage in cyberstalking? What personal values lead people to use this information for their own benefit while cyberstalking? All questions were open-ended. As individuals can express values differently, so difficulty exists with the quiescent nature of the values, so different probing techniques are used to identify latent values. Keeney [START_REF] Keeney | Value-Focused Thinking[END_REF] suggests words like trade-offs or consequences etc. as useful in making implicit values explicit.

Structuring values

Once values have been identified, value structuring and objectives development begins.

Step one is that all statements are restated in a common form with duplicates are removed, then common form values are considered and converted into sub-objectives. According to Keeney [START_REF] Keeney | The value of Internet commerce to the customer[END_REF], an objective is constituted of the decision context, an object and a direction of preferences, which in this case is cyberstalking. With all values systematically reviewed and converted into subobjectives a number of sub-objectives that deal with a similar issue exists. By carefully reviewing the content of each of these sub-objectives, clusters are developed that group similar ones together and then each cluster of sub-objectives is labeled by its overall theme that becomes the main objective.

Organizing objectives

The list of sub-objectives and corresponding clusters initially include both means and fundamental objectives so we must differentiate the two. This is accomplished by repeatedly linking objectives through means-ends relationships then specifying the fundamental objectives. To identify fundamental objectives, the question is asked, 'Why is this objective important in the decision context? [START_REF] Keeney | Value-Focused Thinking[END_REF].' If the objective is an essential reason for interest in the decision context, then the objective is a candidate as a fundamental objective. If the objective is important due its implications with respect to some other objective, then it is a candidate as a means objective. This is termed by Keeney [START_REF] Keeney | Creativity in decision making with value-focused thinking[END_REF] as the 'WITI test.'

Objectives for Preventing Cyberstalking

In this section we present fundamental and means objectives for preventing cyberstalking. In our research we found twenty total objectives: five fundamental objectives and fifteen means objectives. In this section we discuss the fundamental and means objectives and how these can collectively contribute to the prevention of cyberstalking.

Fundamental Objectives for Preventing Cyberstalking

The five fundamental objectives identified in this research include: Protecting Online Interactions; Establishing cyberstalking security procedures, Ensuring technical security, Developing strong value systems and Defining intermediaries to minimize cyberstalking. The fundamental objectives resonate well with what has been defined in the literature and the main characteristic for cyberstalkingrepeated event, invasion of personal privacy, evidence of threat and/or fear [START_REF] Spitzberg | Cyberstalking and the technologies of interpersonal terrorism[END_REF]. Scholars term stalking as a form of Obsessive Relational Intrusion (ORI), which is the unwanted pursuit of intimacy [START_REF] Cupach | Obsessive Relational Intrusion and Stalking[END_REF][START_REF] Cupach | Obsessive Relational Intrusion: Incidence, Perceived Severity, and Coping[END_REF].

FO1 Protecting Online Interactions. Respondents found protection of online interactions to be defined as both precautionary and regulatory objectives. Exercising caution when meeting people online is fundamental, however it is also important to ensure that protection mechanisms exist in online forums; however the means are addressed in some of our means objectives. A response by one respondent noted: "It is the responsibility of Internet Companies to ensure safety in an online forum through regulation and technical means." In an interesting paper, Chik [START_REF] Chik | Harassment through the Digital Medium-A Cross Jurisdictional Comparative Analysis of the Law on Cyberstalking[END_REF] discusses international cyberstalking regulatory considerations. He notes that there are two basic types of anti-stalking legislations -the list model and the closed model. The list model lists types of offences and provides certainty, but is rather restrictive. An alternative is the general prohibition model, which is used in some US states and UK. Chik argues that the more open general prohibition model is the favored option [START_REF] Chik | Harassment through the Digital Medium-A Cross Jurisdictional Comparative Analysis of the Law on Cyberstalking[END_REF].

FO2 Establishing cyberstalking security procedures. Respondents felt that good cyberstalking security procedures will go a long way in ensuring security and safety. Cyberstalking security procedures can include an identification of appropriate authentication measures or availability of cyberstalking prevention tools. A respondent noted: "There is no way to tell which site provides adequate security and which one has loose controls, I wish we had a way to do this." Website trustworthiness is an important topic area and has been well researched.

At the advent of e-commerce, online vendors were facing similar challenges. Moores and Dhillon [START_REF] Moores | Do privacy seals in e-commerce really work?[END_REF] found that web assurance seals did help in ensuring a trusting relationship with the consumers. They note: "The relative success of the privacy seals suggests that many sites recognize the issue of privacy and strive to uphold the highest standards. These sites are not the problem. The problem is with those sites that violate their stated obligations, those sites that make no commitment, and those sites that actively seek to exploit the data they collect."

FO3 Ensuring technical security. The role of technologies in ensuring security in cyberstalking cannot be underestimated. Unequivocally our respondents made a call for investing in safe browsing technologies and increased abilities to monitor online security settings. Ability to create online filters to block negative behavior was also considered important. One respondent noted: "Now-a-days it is virtually impossible to ensure that the filters are installed properly. People need a high level of competence. Why can't the technologies be made simple and easy to use?" Technical means to ensure online security and its benefits in preventing cyberstalking incidents has been noted by Goldberg [START_REF] Goldberg | Why is it taking so long to secure Internet routing?[END_REF], who summarizes the problem as one dealing with secure Internet routing. Goldberg notes that secure Internet routing can be achieved through simple cryptographic whitelisting techniques, which can prevent attacks such as prefix hijacks, route leaks, and path-shortening attacks. Some of these attacks are the basis for website compromises, which can then subsequently lead to increased incidents of cyberstalking.

FO4 Developing strong value systems. Early detection of negative behaviors can come about through strong family values and the related social pressures. In a study by Pereira and Matos [START_REF] Pereira | Cyber-Stalking Victimization: What Predicts Fear Among Portuguese Adolescents?[END_REF] the complexity of family values is reviewed as well as their impact on cyberstalking. In particular Pereira and Matos found fear following victimization plays a major role in management of cyberstalking [START_REF] Pereira | Cyber-Stalking Victimization: What Predicts Fear Among Portuguese Adolescents?[END_REF].

One respondent noted: "I have been cyberstalked. Support from my family was critical in helping me carry on with life."

FO5 Defining intermediaries to minimize cyberstalking. This fundamental objective is somewhat related to the fundamental objective of ensuring secure procedures. Critical to trust forming relationships is the role of intermediaries.

Cybersecurity insurance research has suggested that it is indeed possible to minimize threats by appropriately focusing on insurance practices. Pal et al [START_REF] Pal | Will cyber-insurance improve network security? A market analysis[END_REF] note: "To alleviate this issue a security vendor can enter the cyber-insurance ecosystem and via a symbiotic relationship between the insurer can increase its profits and subsequently enable the cyber-insurer to always make strictly positive profits keeping the social welfare state identical. As a special case the security vendor could be the cyber-insurer itself (p. 8)."

Means Objectives for Preventing Cyberstalking

MO1 Increase responsibility of social media sites. This objective pertains to organizations responsible for creating, maintaining, regulating and implementing social media sites. These organizations have an obligation to ensure their sites are safe in order to prevent cyberstalking. Many organizations consider this a corporate social responsibility (CSR) and make efforts to shape CSR policies to present themselves as good corporate citizens [START_REF] Melissa | Why Social Media Is Vital to Corporate Social Responsibility[END_REF] and the importance of CSR has been emphasized by many in the literature [START_REF] Bauer | Communicating Corporate Social Responsibility: Perspectives and Practice (Critical Studies on Corporate Responsibility, Governance and Sustainability[END_REF].

MO2 Increase safe information sharing. This objective addresses the need for users to have more tools to safely share information on the Internet and social media sites can provide those tools. Types of tools that could be included are increased privacy settings or private web browsing methods. Responses indicate support for this belief such as; "I want more privacy settings and ways to protect my information if I choose to share it."

MO3 Increase law enforcement. This objective deals with ensuring useful laws exist to protect online users from cyberstalking. One study analyzed was the police use of Twitter, including the structure of networks and the content of the messages [START_REF] Crump | What Are the Police Doing on Twitter? Social Media, the Police and the Public[END_REF]. The study concluded that due to the constraints of police culture, Twitter has been used cautiously as reinforcement for existing means of communication [START_REF] Crump | What Are the Police Doing on Twitter? Social Media, the Police and the Public[END_REF]. Responses such as; "law enforcement needs to be more involved in monitoring and policing social media activity" show users want an active law enforcement approach to help prevent cyberstlaking.

MO4 Increase awareness of cyberstalking consequences. This objective addresses the consequences for cyberstalking, specifically making people aware of the negative effects on victims and society as a whole. A survey response supporting this is "as a society we need to increase awareness about the harmful effects of cyberstalking" which speaks to the lack of awareness.

MO5. Minimize trolling. This objective deals with discouraging people from posting offensive content in their online postings. A study by Hopkinson [START_REF] Hopkinson | Trolling in Online Discussions: From Provocation to Community-building[END_REF] researched the practice of trolling in online discussion forums and its findings suggest that the definition of trolling varies depending on the discussion topic [START_REF] Hopkinson | Trolling in Online Discussions: From Provocation to Community-building[END_REF]. The study found a paradoxical view of trolling in that it is considered destructive and have a negative connotation, but cases exist where it can have a positive constructive effect [START_REF] Hopkinson | Trolling in Online Discussions: From Provocation to Community-building[END_REF].

MO6 Decrease tracking ability. This objective deals with ensuring that your current location is unknown to people from whom you wish to remain hidden from. For example, Facebook had a program, which sent messages to users' friends about what they were buying on Web sites; it had to retract this feature after protest from a number of their users due to complaints about sharing without permission [START_REF] Story | Facebook Retreats on Online Tracking[END_REF]. To prevent features like these from being abused for cyberstalking, the ability of companies and individuals to track people online needs to be minimized.

MO7 Increase deterrence.

This objective deals with the use of punishment as a threat to stop or prevent people from engaging in cyberstalking. Individuals behave rationally to maximize their utility and commit crime when the expected utility of law breaking far exceeds the expected disutility of punishment [START_REF] Kahan | Social Influence, Social Meaning, and Deterrence[END_REF]. So to promote obedience and discourage crime communities should adopt a policy to raise the price of crime. Deterring cyberstalking was a common response, for example, one of our respondents said; "Well-defined laws and stricter enforcement of cyber stalking laws would help prevent cyberstalking."

MO8 Ensure online social responsibility. Organizations and individuals alike have a significant stake in achieving this objective to prevent cyberstalking. There are conflicting views from certain studies whether "Doing Good Always Leads to Doing Better" [START_REF] Sankar Sen | Does Doing Good Always Lead to Doing Better? Consumer Reactions to Corporate Social Responsibility[END_REF]; however organizations and individuals should proactively take responsibility for making online experiences positive by following basic and fundamental norms of conduct and behavior.

MO9 Personal accountability.

Accountability protects public health and safety, facilitates law enforcement, and enhances national security, but it is more than a bureaucratic concern for corporations, public administrators, and the criminal justice system [START_REF] Allen | Why privacy isn't everything: Feminist reflections on personal accountability[END_REF]. In our study we found that respondents have given significant importance to this aspect where one respondent said, "I believe each person is responsible for taking steps towards preventing cyberstalking. That means being mindful of what personal information you share about yourself on the Internet."

MO10 Increase ability to control personal information. Users desire the ability to control their personal information; how it is shared, stored and distributed over the Internet. Information available online about consumers is striking and the media is filled with horror stories about the misuse of personal information, such as the availability of information most people consider confidential like social security numbers or their home location [START_REF] Sovern | Opting in, opting out, or no options at all: The fight for control of personal information[END_REF]. Many respondents felt this way with one responding; "I want as many options on social media as possible to prevent as much personal information from being publicly available."

MO11 Ensure monitoring of children. This objective deals with the ability to monitor children's online activity and behavior. This is a difficult objective that is highly complex. For example, a national study in Great Britain on children and their parents used focus group interviews and observation of children's use of the internet to reveal the following: Parents seek to manage their children's internet use, but face challenges in helping their children use internet safely. Disagreement between parents and children exists as most children do not want restrictions and have take measures to hide their online activity from their parents demonstrating a gap in the understanding between parents and children on these issues [START_REF] Livingstone | UK children go online: Final report of key project findings[END_REF]. Their policy recommendations were; direct children and young people towards valuable content, develop online advice resources with young people etc. [START_REF] Livingstone | UK children go online: Final report of key project findings[END_REF].

MO12 Reduce opportunities for online victimization. This objective emphasizes the importance of safe browsing and online behavior in order to reduce the opportunity an offensive act can be undertaken by someone. For example, cyberbullying is one major issue in schools and communities due to the emotional, psychological, and even physical harm to which victims can be subjected. One study looked at general strain theory to identify the emotional and behavioral effects of cyberbullying victimization [START_REF] Hinduja | Offline consequences of online victimization: School violence and delinquency[END_REF]. Data collected indicated that cyberbullying is a potent form of stress that may be related to school behavior problems and delinquent behavior offline [START_REF] Hinduja | Offline consequences of online victimization: School violence and delinquency[END_REF]. Another study from a national survey of teenagers in the UK (N=789) analyzed the demographic factors that influence skills in using the Internet and then sought to determine whether these skills make a difference to online opportunities and online risks [START_REF] Livingstone | Balancing opportunities and risks in teenagers' use of the Internet: The role of online skills and Internet self-efficacy[END_REF]. Findings show that those who take up more opportunities encounter more risks and vice versa. Further, those groups inclined to gain more opportunities also encounter more risks [START_REF] Livingstone | Balancing opportunities and risks in teenagers' use of the Internet: The role of online skills and Internet self-efficacy[END_REF].

MO13 Increase Regulation of Online Social Networks. This objective deals with agencies and government organizations monitoring online social networks and determining the rules and actions that need to be taken to prevent cyberstalking. One study investigated a sample (n = 704) of college students to understand online disclosure and withdrawal of personal information [START_REF] Tufekci | Can you see me now? Audience and disclosure regulation in online social network sites[END_REF].

Findings show little to no relationship between online privacy concerns and information disclosure on online social network sites as students manage unwanted audience concerns by adjusting profile visibility and using nicknames but not by restricting the information within the profile [START_REF] Tufekci | Can you see me now? Audience and disclosure regulation in online social network sites[END_REF]. This behavior suggests that people can still easily gain access to all the free information on Internet, hence why our study suggests social network organizations adopt various counter-measures.

MO14 Increase mental health screening. Mental health can adversely influence one's ability and judgment to conduct themselves properly online. A survey study of 371 British students showed that 18.3% of the sample was considered to be pathological Internet users, whose excessive use of the Internet was causing academic, social, and interpersonal problems [START_REF] Niemz | Prevalence of pathological Internet use among university students and correlations with self-esteem, the General Health Questionnaire (GHQ), and disinhibition[END_REF]. This would lead one to consider that Internet usage, cyberstalking and mental health are a connected and important area of concern.

MO15 Cyberstalking education. Cyberstalking and its negative affects are not well known to many people. One study of note was done using students from two universities, which gathered their responses to a cyberstalking scenario as well as their use and experiences with the Internet [START_REF] Alexy | Perceptions of cyberstalking among college students[END_REF]. Then the study conducted an analysis and comparison of students who reported having been stalked to those who had been cyberstalked [START_REF] Alexy | Perceptions of cyberstalking among college students[END_REF]. An interesting finding was that male students were statistically more likely than female students to have been cyberstalked [START_REF] Alexy | Perceptions of cyberstalking among college students[END_REF]. Additionally, for individuals who were cyberstalked, the stalking perpetrator was most likely to be a former intimate partner [START_REF] Alexy | Perceptions of cyberstalking among college students[END_REF].

Further research, Limitations and Conclusions

Based on the research presented in this paper, there are three broad categories, which exist for future research opportunities. The first opportunity is that the list of objectives identified in this research can be subjected to psychometric analysis using separate large samples. This can help, for example, in developing a model for measuring cyberstalking by organizations on social media sites. A second opportunity exists for intensive research to be undertaken to establish relationships between particular fundamental and means objectives; however, while Keeney [START_REF] Keeney | Value-Focused Thinking[END_REF] contends that fundamental and means objectives are related and an implicit; logical relationships appear to exist between the fundamental and means objectives, but specific relationships need to be researched. The final opportunity is such that further quantitative work should be carried out to assess how the subscales of means and fundamental objectives relate to each other.

The findings of this research lay a suitable foundation for developing multidimensional measures and protections against cyberstalking. For example, Keeney [START_REF] Keeney | The value of Internet commerce to the customer[END_REF] conducted an extensive study, which interviewed over 100 people to assess their values with respect to Internet commerce. And based on this work, Torkzadeh & Dhillon [START_REF] Torkzadeh | Measuring factors that influence the success of internet commerce[END_REF] were then able to develop instruments, which measured factors that influence Internet commerce success. Much in the same way, the research presented within this paper has established values and objectives that would be a basis for measures and protections against cyberstalking. Within the IS domain, many examples exist of research that involves in-depth qualitative research aimed at the development of theoretical concepts which includes research on organizational consequences of IT [START_REF] Orlikowski | Information technology and structuring of organizations[END_REF], relationship between IS design, development and business strategy [START_REF] Walsham | Information systems strategy and implementation: a case study of a building society[END_REF] and communication richness [START_REF] Lee | Electronic mail as a medium for rich communication: an empirical investigation using hermeneutic interpretation[END_REF].

In the cybersecurity field, the topic of cyberstalking is constrained by the absence of well-grounded concepts that are developed in a systematic and a methodologically sound manner as the topic itself is still a newer concept. The fundamental and means objectives that are presented in this paper make a contribution towards the development of theory specific to cyberstalking and measures and protections from it, a largely overlooked IS research stream. This research was only the first step to identify means and fundamental objectives as it relates to cyberstalking values. The next step in this research is to conduct a quantitative study as was done earlier by Torkzadeh & Dhillon [START_REF] Torkzadeh | Measuring factors that influence the success of internet commerce[END_REF] to come up with an instrument that measures fundamental objectives as it relates to cyberstalking as there is a need to develop theory that is IS specific [START_REF] Benbasat | Editorial note[END_REF].

As with most qualitative research, this study is subject to some limitations. The process of identifying values from interview data is largely subjective and interpretive and while as researchers we maintain a professional distance, there is always a possibility that some of our own biases may influence the results; however, we were conscious of this during all three phases. The previous basis for this research and the critical reflections of the interviewee's statements was useful in helping us show how these various interpretations emerged in the research [START_REF] Klein | A set of principles for conducting and evaluating interpretive field studies in information systems[END_REF].

For this reason, it is believed that being aware of the intellectual biases actually helped us to be objective within our analysis of the data. Further, Walsham [START_REF] Walsham | Interpretive case studies in IS research: nature and method[END_REF] recognized this to be an issue when carrying out intensive research and in regard to the role of the researcher wrote; "the choice should be consciously made by the researcher dependent on the assessment of . . . merits and demerits in each particular case (p. 5)." It is our goal that in strictly following the value-focused thinking method and being conscious that our interpretations should not serve to influence our research, it can provide confidence in the outcome of this study.

In conclusion, the research presented in this paper examines the relatively unexplored area of cyberstalking in the field of information systems. This qualitative investigation, which used value-focused thinking, revealed 75 subobjectives, grouped into five fundamental and 15 means objectives, which are essential for developing measures and protections against cyberstalking. The objectives developed in this study are grounded socio-organizationally and provide a way forward in developing measures and protections against cyberstalking. Therefore, this is a significant contribution as previous research in this area is underdeveloped and as such falls short of being able to propose tangible measures and protections against cyberstalking.


Markus Tschersich

Shinsaku Kiyomoto

Sebastian Pape

Toru Nakamura

Gökhan Bal

Haruo Takasaki

Kai Rannenberg

On Gender Specific Perception of Data Sharing in Japan

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In the Western world privacy and its protection is an important part of the culture. In the United States and especially in Europe people care about their privacy and therefore also the majority of research about privacy is based on data collection in North-America and Europe [START_REF] Smith | Information privacy research: An interdisciplinary review[END_REF]. Despite some efforts by Asoh et al. [START_REF] Asoh | An Acceptance Model of Recommender Systems Based on a Large-Scale Internet Survey[END_REF] and Takasaki et al. [START_REF] Takasaki | A Study on Causes for Privacy Concerns about Personalized Services on Mobile Devices[END_REF], literature in the field of privacy lacks empirical data from Japan. Thus, compared to the USA and Europe, it is difficult for foreign researchers to understand the situation in Japan. In Hofstede's taxonomy for cultural patterns [START_REF] Hofstede | Culture's Consequences: comparing values, behaviors, institutions, and organizations across nations[END_REF][START_REF] Hofstede | Cultures and Organizations : Software for the Mind[END_REF] individualism versus collectivism as a cultural norm is identified as one important criterion. Japanese cultureinspired by Confucian and Buddhism philosophydiffers from western culture where individualism is emphasized [START_REF] Nakamura | Privacy: Current Status and Pending Issues in Japan[END_REF] and therefore, the protection of oneself has a higher importance. As opposed to this, people of the Japanese culture try to identify their role within the groups they are interacting with [START_REF] Miltgen | Cultural and generational influences on privacy concerns: a qualitative study in seven European countries[END_REF]. Societal harmony is very important to Japanese people and they try to avoid troubling others [START_REF] Orito | Privacy protection in Japan: cultural influence on the universal value[END_REF]. This leads them to be more open to share personal information. Additionally, not sharing data is also often understood as isolation from a group. As data sharing often has a major impact on one's privacy, the perception of sharing is very relevant for the behaviour with regard to privacy and its protection. Besides general cultural differences, also the role of men and women differ between the western and the eastern society. This matches another criterion set by Hofstede [START_REF] Hofstede | Culture's Consequences: comparing values, behaviors, institutions, and organizations across nations[END_REF][START_REF] Hofstede | Cultures and Organizations : Software for the Mind[END_REF], which distinguishes between cultures that emphasize masculinity versus femininity. Based on tenets of Confucianism, taking care on major caregiving responsibilities is the traditional role of women in the Japanese culture [START_REF] Hashizume | Gender Issues and Japanese Family-Centered Caregiving for Frail Elderly Parents or Parents-in-Law in Modern Japan: From the Sociocultural and Historical Perspectives[END_REF]. Caused by women's responsibilities in society, the concept of privacy could be more unfamiliar for women than for men. Even though the Japanese society is highly influenced by the western culture, it is interesting to see whether women and men differ in the perceived benefits of sharing data for others and their willingness to e.g. share data.

The paper is structured as follows. Section 2 gives an introduction into privacy research in Japan. Further, Section 2 describes the research model and the hypotheses. In Section 3 the used methodology is explained. Section 4 summarizes the results of the study, followed by a discussion and conclusions in Section 5.

2

Background and Hypotheses

Related Work

The economics of privacy including empirical studies relating to the consumer's privacy calculus have been evolving [START_REF] Taylor | Consumer privacy and the market for customer information[END_REF]. Especially, from late 1990, with the emerging of the Internet, empirical studies have focused on online shopping or online banking. From 2003, online search and 2005 social networks were in the focus. Chellappa and Sin [START_REF] Chellappa | Personalization versus privacy: An empirical examination of the online consumer's dilemma[END_REF] and other research papers around the same years are mostly based on online shopping or personalized services, which are almost the same category of applications. Consumers' benefits are mostly financial ones (discounts, points, etc.). But for the usage of social networks the consumers' benefits are not financial ones but nonfinancial ones including sharing feelings in a group. A study by Lu et al. [START_REF] Lu | Inducing customers to disclose personal information to internet businesses with social adjustment benefits[END_REF] demonstrated that social adjustment benefits, i.e. the opportunity of establishing a social identity by integrating into desired social groups, can also have an effect on the intended disclosure behaviour.

The "Act on the Protection of Personal Information" was passed in 2003 and has been enforced in Japan since 2005 [START_REF] Japan | Act on the Protection of Personal Information[END_REF]. The objectives of this act are to balance the usability of personal information and the protection of individual rights and benefits, and to protect any information that could identify an individual. The act is under revision in terms of expanding coverage of intended data and building an auditing system including privacy commissioners. Recently, for adjusting to the change of international privacy attitudes such as the change in the Privacy Guideline by OECD in 2013 [START_REF] Oecd | OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data[END_REF], a Consumer Privacy Bill of Rights in US in 2012, and the regulation on the protection of individuals with regards to the processing personal data was passed the European parliament, the law reform proposal on privacy in Japan was published in Jun., 2014. Asoh et al. [START_REF] Asoh | An Acceptance Model of Recommender Systems Based on a Large-Scale Internet Survey[END_REF][START_REF] Asoh | An Analysis on the Intention to Use Recommendation Services Using Lifelogs[END_REF] presented users' privacy concerns in recommendation services using personal data in Japan, and showed that service categories (shopping, navigation and healthcare) did not directly affect to users' privacy concerns. Takasaki et al. [START_REF] Takasaki | A Study on Causes for Privacy Concerns about Personalized Services on Mobile Devices[END_REF] analysed privacy concerns for on-line personalization services in Japan. However, in this field there is a lack of empirical data in Japan. This paper intends to show relevant input for designing and implementing privacy protection policies based on empirical data in Japan.

Hypotheses

Ahead of a potential revelation of personal information humans perform an economic decision-making process [START_REF] Awad | The personalization privacy paradox: An empirical evaluation of information transparency and the willingness to be profiled online for personalization[END_REF]. In the so called privacy calculus, users of information systems weigh the potential costs and benefits of sharing their personal information with specific services, institutions, or persons [START_REF] Smith | Information privacy research: An interdisciplinary review[END_REF][START_REF] Culnan | Consumer awareness of name removal procedures: Implications for direct marketing[END_REF][START_REF] Dinev | An Extended Privacy Calculus Model for E-Commerce Transactions[END_REF][START_REF] Tschersich | Understanding the impact of default privacy settings on self-disclosure in social networking services: Building a conceptual model and measurement instrument[END_REF][START_REF] Kline | The Handbook of Psychological Testing[END_REF]. On the risk side, users take into account the privacy concerns as well as the perceived likelihood and damage of a privacy violation.

On the benefit side, users consider positive effects of the revelation of personal information. The benefits highly depend on the type of service a user could reveal personal information to. Literature describes different examples especially from the field of social network sites [START_REF] Tschersich | Exploring the Impact of Restrictive Default Privacy Settings on the Privacy Calculus on Social Networking Sites[END_REF]. However, literature so far focused on personal benefits from the revelation of personal information. A focus on the western world literature might explain all benefits by focusing just on the user itself. For example, Kobsa [START_REF] Kobsa | Privacy-enhanced personalization[END_REF] determined that gender effects on internet privacy concerns could not be clearly established. From our studies, we confirm the gender effects (especially, women with children are more concerned about privacy protection also they tend to show the strong willingness of personalized service usage).

However, in the Japanese culture privacy is a construct that is tied to egotism [START_REF] Ess | Lost in Translation'?: Intercultural Dialogues on Privacy and Information Ethics (Introduction to Special Issue on Privacy and Data Privacy Protection in Asia)[END_REF][START_REF] Kitiyadisai | Privacy Rights and Protection: Foreign Values in Modern Thai Context[END_REF]. Consequently, Japanese users also reflect the benefits for others and also companies. Earlier studies [START_REF] Asoh | An Acceptance Model of Recommender Systems Based on a Large-Scale Internet Survey[END_REF][START_REF] Takasaki | A Study on Causes for Privacy Concerns about Personalized Services on Mobile Devices[END_REF][START_REF] Asoh | An Analysis on the Intention to Use Recommendation Services Using Lifelogs[END_REF] suggest gender effects in Japan. Especially, women with children are more concerned about privacy protection and also tend to show the strong willingness of personalized service usage. Thus, based on the even higher responsibility of Japanese women in society we hypothesize: ─ H1a: Female and male Japanese will differ in their perception that they themselves can benefit when they reveal personal information. ─ H1b: Female and male Japanese will differ in their perception that others can benefit when they reveal personal information. ─ H1c: Female and male Japanese will differ in their perception that companies can benefit when they reveal personal information.

Result of the Privacy Calculus is the intension to reveal personal information [START_REF] Dinev | An Extended Privacy Calculus Model for E-Commerce Transactions[END_REF]. Thus, if users decide to share personal information, they will be willing to reveal for their personal benefit or the benefit of someone else. Also in the willingness to share we expect an impact of the gender due to women's responsibility in the Japanese culture. Therefore, we hypothesize: ─ H2a: Female and Male Japanese will differ in their willingness to share personal information for their personal benefit. ─ H2b: Female and Male Japanese will differ in their willingness to share personal information for others' benefit. ─ H2c: Female and Male Japanese will differ in their willingness to share personal information for companies' benefit.

Fig. 1: Overview of the hypotheses and the influencing factors

Users' decisions in the context of computer systems are highly depending on the selfefficacy to specific technologies. Self-efficacy is about what individuals believe about their ability to use a system e.g. effectively [START_REF] Lu | Inducing customers to disclose personal information to internet businesses with social adjustment benefits[END_REF], and the higher the self-efficacy the greater is the performance achievement. Computer self-efficacy is based on users' attitudes towards computers and their anxiety [START_REF] Torzadeh | Torzadeh: The Development of a Tool for Measuring[END_REF]. Users can differ in their attitude and anxiety and this could bias their decision-making in the privacy calculus and their perceived willingness. Thus, attitude and anxiety are added to our model (cf. Figure 1) as covariates to address this potential bias.

Methodology

Participants

To get generalizable results, we ran the study with male and female participants with different age and educational background. Overall 9,287 persons participated in the study. For both female and male participants the average age is about 45 years and the distribution to the gender and age groups is also quite equal as shown in Figure 2. We removed responses from people who engaged in research business and advertising business from the participants. We did not select the participants according to where they lived, whether they were married, or whether they had a child, etc.

Measurement Instrument

An instrument was built to measure impact on the perceived benefits or the willingness to share. The measurement instrument is built out of three to five items for each of the six constructs. As literature and theories do not give items for this construct, we created items by ourselves. Table 1 displays the used items per construct.

The use of new and not tested items increases the need of testing their validity and reliability. Therefore, to test the validity a confirmatory factor analysis (CFA) was performed. The results confirm the items of each construct. Subsequently, the reliability of the scale was tested by checking Cronbach's alpha. According to [START_REF] Kline | The Handbook of Psychological Testing[END_REF] the alpha values as listed in Table 3 are excellent. Further, there was no need to skip items based on the Kaiser-Meyer-Olkin value, because for no construct the dropping of an item increased this value. Thus, we ended up with a measurement instrument including 22 items for the six constructs to be analysed.

Procedure

The questions were implemented on a web-based questionnaire system by a research company. Selected participants received an instruction for the system from the company, and accessed the system via their own devices. The participants entered their answers via the web-interfaces. Sharing personal information with online service providers can provide me with personalized services tailored to my activity context.

.926 Sharing personal information with online service providers can provide me with more relevant information tailored to my preferences or personal interests.

Sharing personal information with online service providers can provide me with the kind of information or service that I might like.

In general, I believe that I can profit from sharing personal information with online service providers. I think that I benefit from sharing personal information with online service providers.

Perceived data sharing benefits ("Others")

It can provide benefits for other people if I share my personal information with online companies.

.946

If I share my personal information with online companies, other people can profit from it.

In general, I think that it is good for other people if I share my personal information with online companies.

It can be useful for other people if I share my personal information with online companies. I'm willing to share personal information with online companies if it is useful for them. I'm in general willing to share personal information with online companies, if I see a benefit for them.

Perceived data sharing benefits ("Companies")

I believe that online companies can profit from my personal information if I share it with them.

.892 I believe that it is good for the success of online companies if I share personal information with them.

I can support online companies by providing them with my personal information.

I think that it is good for online companies if I provide them with my personal information.

Results

Descriptive Statistics

We analysed the data set and calculated the mean value and the standard deviation (SD) of the descriptive statistics. Both groups, female and male, were handled individually. This allows a comparison of both groups to identify deviations as displayed in Table 1. The comparison shows that the mean values are lower in the case of the female participants than in the case of the male participants. So compared to the male participants the female participants perceived lower sharing benefits in general. Further they have a lower willingness to share personal information. Further, in the case of the data sharing benefits, all participants perceive most benefits for companies compared to benefits for themselves or even for others. Participants' highest willingness to share personal is for their own benefit. They are less willing to share for others' benefits and even less for the benefit of companies.

Impact Analysis

To identify the impact of the gender on the different perceived privacy benefits and the willingness to share we run an Analysis of covariance (ANCOVA) for each con-

Construct Items Cronbach's alpha

Willingness to share (I benefit)

In general, I'm willing to share personal information with online companies if I can profit from it.

.916 I'm willing to share personal information with online companies if they provide me with useful services.

If I see a benefit for myself, I'm in general willing to share personal information with online companies.

Willingness to share (others benefit)

In general, I'm willing to share personal information with online companies if other people can profit from it.

.950 I'm willing to share personal information with online companies if they provide other people with useful services.

If I see a benefit for other people, I'm in general willing to share personal information with online companies.

Willingness to share (companies benefit)

In general, I'm willing to share personal information with online companies if they can profit from it.

.951 I'm willing to share personal information with online companies if it is useful for them. I'm in general willing to share personal information with online companies, if I see a benefit for them.

struct. The ANCOVA is used, because this statistical method allows handling the influencing factors "Attitudes" and "Anxiety" (that we had identified in Section 2.2) as covariates and so allows filtering out the effect of these influencing factors on the impact. Thus, the bias of attitudes and anxiety of the participants on the result can be prevented, which increases the accuracy of the result. However general linear models like ANCOVA require some assumptions to be fulfilled by the data:

1. The assumption of normality was tested with the Kolmogorov-Smirnov test [START_REF] Massey | The Kolmogorov-Smirnov test for goodness of fit[END_REF] and reveals that the data of the analysed six constructs is not normal distributed. However, according to the Central Limit Theorem a parametric test can still be used [START_REF] Field | Discovering statistics using SPSS[END_REF]. 2. Further, in the case of using ANCOVA the independence of variable (in this case gender) and covariate needs to be checked. The results of the Levene's test [START_REF] Field | Discovering statistics using SPSS[END_REF] indicate that the covariates are independent from each of the analysed six constructs. The results of the ANCOVA show a highly significant impact of the gender to each of the six analysed constructs. Thus, female and male Japanese people differ in their perception of privacy benefits for oneself, for others and for companies. The same is true for the willingness to share for someone's benefits.

Table 4 shows the result of the ANCOVA. The F-value displays the result of the Ftest as a calculation of the quotient of the variance of the answers of the different experimental groups (in our case women and men). This first step allows the next step, which is the check, whether the null hypothesis (H 0 ), that there would be no significant difference between the different experimental groups (men and women), can be falsified. For this we look at the significance levels (Sig., p-values): A p-value below .05 reveals a significant difference between both experimental groups, a pvalue below .001 reveals that the difference is highly significant. Both thresholds are commonly used for this kind of experiments [START_REF] Torzadeh | Torzadeh: The Development of a Tool for Measuring[END_REF]. In our case all the p-values are so small, that they are closer to 0.000 than to 0.001. The high significance (Sig., p-value < .001) of the covariates "Attitudes" and "Anxiety" as shown in Table 4, demonstrates that the covariates predict the particular dependent variables. Therefore, the perceptions and the willingness are influenced by participants' anxiety and attitudes towards using computer systems. After the effect of anxiety and attitudes has been filtered out by the ANCOVA, the adjusted effect of the gender on the six analysed constructs has a significance value of p < .001 as displayed in Table 4 as well. Thus, the statistical tests show that the Hypotheses H1a, H1b, and H1c as well as H2a, H2b, and H2c can be accepted and that the gender of Japanese participants has a significant impact on the perceived benefits and the willingness to share for someone's benefit.

Discussion and Conclusion

The results show a highly significant impact of the gender to each of the six analysed constructs. Thus, female and male Japanese people differ in their perception of privacy benefits for oneself, for others and for companies. The same is true for the willingness to share for someone's benefits. Anxiety and attitudes were identified as biases on the measured effects. However gender still has a significant impact on the effects. Future research should be done to investigate the differences in the perception of privacy in respect to the peoples' culture. It will be interesting if there is a difference between the obtained result for Japan and e.g. Europe or the USA. Additionally, it would be interesting to investigate "Cross-cultural Sharing": Does the willingness to share data with someone belonging to the same culture differ from sharing with someone belonging to another culture? Further research should also be done regarding the age groups of people. Does the willingness to share data depend on whether they are e.g. Digital Natives or Digital Immigrants [START_REF] Prensky | Digital Natives, Digital Immigrants[END_REF]? Finally, practical consequences of our findings should be examined. E.g. would it make sense to offer different services to the different groups?

Fig. 2 :

 2 Fig. 2: Gender and age distributionParticipants were collected by publishing an online survey which collected 10000 questionnaires and was executed by a research company. Data was collected from March 12, 2015 until March 19, 2015. We removed responses from people who engaged in research business and advertising business from the participants. We did not select the participants according to where they lived, whether they were married, or whether they had a child, etc.

Table 1 :

 1 Used items per construct

	Female		Male
	̅	SD	̅	SD

Table 2 :

 2 Constructs on "Perceived privacy benefits"

	Construct	Items	Cronbach's alpha
	Perceived
	data
	sharing
	benefits
	("Me")

Table 3 :

 3 Constructs on "Willingness to share"

Table 4 :

 4 Results of the ANCOVA

			Oneself		Others		Companies
			F	Sig.	F	Sig.	F	Sig.
			(p-value)		(p-value)		(p-value)
	Perceived	Anxiety	135,503	.000	140,548	.000	56,401	.000
	benefit for…	Attitudes	104,633	.000	43,152	.000	79,175	.000
		Gender	27,316	.000	105,988	.000	51,217	.000
	Willingness to	Anxiety	114,074	.000	145,547	.000	167,888	.000
	share for …	Attitudes	90,705	.000	31,918	.000	29,131	.000
	benefit	Gender	148,010	.000	233,217	.000	213,816	.000