Eve Caroli
email: eve.caroli@dauphine.fr

Mathilde Godard
email: mathilde.godard@ensae.fr

Sylvie Blasco

Isabelle Chort

Andrew Clark

Clémentine Garrouste

Florence Jusot

Maarten Lindeboom

Mathilde Peron

Roland Rathelot

Nigel Rice

Luigi Siciliani

Does job insecurity deteriorate health? A causal approach for Europe

Keywords: Job insecurity, Health, Instrumental Variables Job insecurity, Health, Instrumental Variables

This paper estimates the causal effect of perceived job insecurity -i.e. the fear of involuntary job loss -on health in a sample of men from 22 European countries. We rely on an original instrumental variable approach based on the idea that workers perceive greater job security in countries where employment is strongly protected by the law, and relatively more so if employed in industries where employment protection legislation is more binding, i.e. in industries with a higher natural rate of dismissals. Using cross-country data from the 2010 European Working Conditions Survey, we show that when the potential endogeneity of job insecurity is not accounted for, the latter appears to deteriorate almost all health outcomes. When tackling the endogeneity issue by estimating an IV model and dealing with potential weak-instrument issues, the health-damaging effect of job insecurity is confirmed for a limited subgroup of health outcomes, namely suffering from headaches or eyestrain and skin problems. As for other health variables, the impact of job insecurity appears to be insignificant at conventional levels.

Does job insecurity deteriorate health? A causal approach for Europe. 1 Introduction

There is evidence in the recent literature that losing one's job has health-damaging effects1 which may go as far as inducing a higher risk of mortality.2 Although job loss is a highly traumatizing event, it is fortunately not very frequent. In contrast, the fear of involuntary job loss, i.e. perceived job insecurity, is likely to be much more widespread and one may wonder whether its health impact is as negative as that of actual job loss.

This is an important question from a policy point of view since perceived job insecurity has increased in a large number of industrialised countries over the past twenty years.

Following several downsizing episodes in the USA and in Europe, a widely shared view has developed according to which employment relationships have become more unstable than they used to be. Internal labour markets characterised by long careers within firms [START_REF] Doeringer | Internal Labor Markets and Manpower Analysis[END_REF]) have been undermined. Long-term employer-employee relationships have declined [START_REF] Cappelli | Career jobs are dead[END_REF]; [START_REF] Givord | Changes in job security and their causes: An empirical analysis for France, 1982-2002[END_REF]) and the labour market seems to have been increasingly working like a spot market [START_REF] Atkinson | A critique of the transatlantic consensus on rising income inequality[END_REF]). Correspondingly, the perception of job insecurity has increased in most OECD countries since the 1990s (OECD ( 2004)).

The importance of job insecurity for workers' well-being has been underlined in the literature. [START_REF] Böckerman | Job security and employee well-being: Evidence from matched survey and register data[END_REF] provide evidence of a strong negative impact of job insecurity on job satisfaction. This impact is actually much stronger than that of the actual type of work contract held by workers -permanent vs. temporary -( [START_REF] Bardasi | The impact of atypical employment on individual wellbeing: Evidence from a panel of British workers[END_REF]; [START_REF] Chadi | Flexibilisation without hesitation? Temporary contracts and workers' satisfaction[END_REF]). In a recent paper, [START_REF] Origo | Flexicurity and job satisfaction in Europe: The importance of perceived and actual job stability for well-being at work[END_REF] have shown that the level of job satisfaction of workers who do not experience job insecurity3 is not statistically different whether they have a permanent or a temporary contract. In contrast, workers who feel that their job is insecure are significantly less satisfied than workers who do not, whatever their type of work contract. This suggests that perceived job insecurity is at least as important as the type of work contract in determining workers' job satisfaction.

Since the latter has been shown to impact individual health (see [START_REF] Fischer | Does job satisfaction improve the health of workers? New evidence using panel data and objective measures of health[END_REF]), perceived job insecurity is also likely to be a key determinant of the health statuspotentially even more important than the actual type of work contract.

The literature in epidemiology, occupational psychology and public health has indeed long suggested that job insecurity may be harmful to health because it increases stress (Sverke and Hellgren (2002)). Psychologists have shown that the anticipation of a stressful event represents an equally important or even greater source of anxiety than the event itself [START_REF] Lazarus | Stress, appraisal, and coping[END_REF]). Consistently, job insecurity appears to raise self-reported general and psychological morbidity but also sickness absence and health service use -see the review of the literature by [START_REF] Ferrie | Is job insecurity harmful to health?[END_REF]. In particular, it is strongly associated with specific symptoms such as eyestrain, skin and ear problems, stomach and sleep disorders [START_REF] Cheng | Job insecurity and its association with health among employees in the Taiwanese general population[END_REF]). It is also negatively correlated with mental health, as measured by a 30-item psychiatric morbidity scale and a subscale for depressive factors [START_REF] Ferrie | Self-reported job insecurity and health in the Whitehall II study: Potential explanations of the relationship[END_REF]).

However, evaluating the causal impact of job insecurity on health raises a challenge which requires an adequate identification strategy. Perceived job insecurity is indeed likely to be endogenous. If pessimistic individuals perceive higher job insecurity and, at the same time, report a lower health status, results are likely to be biased. Reverse causality is also likely to be a concern if unhealthy individuals are more likely to be employed in insecure (or, on the contrary, more secure) jobs or if negative health shocks make individuals more likely to fear that they could be fired. In all cases, standard OLS or probit estimates will be biased and will only capture the mere correlation between health and job insecurity.

In this paper, we implement an original identification strategy based on an instrumental variable approach in order to estimate the causal effect of job insecurity on health in a sample of men from 22 European countries. We consider that workers are likely to feel more secure with respect to their job if living in a country where employment is strongly protected by the law, and relatively more so if employed in sectors where employment protection legislation (EPL) is more binding. We thus instrument perceived job insecurity by the stringency of the employment protection legislation in the country where the individual lives interacted with the natural rate of dismissals in the sector where she is employed. This instrument is valid if workers do not self-select into sectors-by-country on the basis of characteristics correlated with their health. We show that this condition holds so that our instrument is truly exogenous. Using cross-country data from the 2010 European Working Conditions Survey (European Foundation for the Improvement of Living and Working Conditions ( 2012)),

we show that when the potential endogeneity of job insecurity is not accounted for, the latter appears to deteriorate almost all health outcomes (self-rated health, suffering from back problems, muscular pain, headaches or eyestrain, stomach ache, depression or anxiety, overall fatigue and insomnia). When tackling the endogeneity issue by estimating an IV model and dealing with potential weak-instrument issues, the health-damaging effect of job insecurity is confirmed for a limited subgroup of health outcomes, namely suffering from headaches or eyestrain and skin problems. As for other health variables, the impact of job insecurity appears to be insignificant at conventional levels.

Our paper contributes to the existing literature in several ways. To our knowledge, we are the first to provide a causal estimate of the impact of perceived job insecurity on health.

Most of the literature on this topic estimates mere correlations. Part of it focuses on "attributed" job insecurity as captured by atypical employment (i.e. temporary rather than permanent work contracts) and finds no association between temporary work and general health, but a positive correlation with ill mental health [START_REF] Bardasi | The impact of atypical employment on individual wellbeing: Evidence from a panel of British workers[END_REF]).

The largest strand in this literature deals with perceived job insecurity, as we do. A metaanalysis conducted by Sverke et al. (2002) on 72 papers shows that both physical and mental health are found to decrease as perceived job insecurity increases. However, the magnitude of the effects appears to be ambiguous. On Taiwanese data, [START_REF] Cheng | Job insecurity and its association with health among employees in the Taiwanese general population[END_REF] find that job insecurity is associated with poor self-rated health, with the coefficient being larger for men than for women and, among women, for those employed in managerial and professional occupations. Using a cross-national survey, [START_REF] László | Job insecurity and health: A study of 16 European countries[END_REF] find differences across countries :

job insecurity is associated with poor health in the Czech Republic, Denmark, Germany, Hungary, the Netherlands and Poland while the correlation is insignificant in countries such as Austria, France, Greece, Italy, Spain and Switzerland. In all cases, these papers estimate multivariate linear or logistic models disregarding the possibility that job insecurity be endogenous. [START_REF] Mandal | Job loss and depression: The role of subjective expectations[END_REF] use a different approach : they estimate a randomeffect model and use a lagged measure of job insecurity, arguing that this measure is not endogeneous in their data. They find that subjective expectation of job loss is a significant predictor of depression among older workers aged 55 to 65 years old. A few papers take into account the fact that time-invariant omitted variables may bias their results and estimate fixed-effect models. Using such an approach on Australian data, [START_REF] Green | Unpacking the misery multiplier: How employability modifies the impacts of unemployment and job insecurity on life satisfaction and mental health[END_REF] finds that perceived job insecurity negatively affects mental health. On German data, [START_REF] Reichert | The causal impact of fear of unemployment on psychological health[END_REF] try to tackle endogeneity issues by instrumenting job insecurity by recent staff reductions in the company where the worker is employed. Thus doing, they show that employees who are concerned about losing their jobs are less psychologically healthy than those in secure jobs. One may wonder, however, whether staff reductions in the company are really uncorrelated with psychological health conditional on job insecurity, which is a necessary condition for their instrument to be exogeneous.

Another attempt to deal with endogeneity issues is made by [START_REF] Ferrie | Health effects of anticipation of job change and non-employment: Longitudinal data from the Whitehall II study[END_REF] in a study considering the health impact of in-firm changes potentially incurring job insecurity. The authors use the British Whitehall II sample and exploit the foreseen privatisation of the Property Services Agency, which used to be part of the London-based civil service. More specifically, they use a difference-in-difference approach and compare the health outcomes of those workers who knew they would be affected by privatisation and a control group of civil servants who knew they would not, before and after privatisation was announced.

This set-up allows them to estimate the effect of an exogenous shock on firm ownership and organisation on health. The authors find major negative effects on a large range of health outcomes for men, whereas health-damaging effects appear to be milder for women. They interpret these results as providing evidence that job insecurity damages health since expected privatisation must have been associated by civil servants to an increased risk of involuntary job loss. However, [START_REF] Ferrie | The health effects of major organisational change and job insecurity[END_REF] show that this very episode of privatisation was associated with major organisational changes. More recent work by [START_REF] Rathelot | Organizational Change and Employee Health[END_REF] considers the effect of an episode of major in-firm restructuration in French energy utilities. They find that these restructurations have a strong negative effect on the mental health conditions of the civil servants employed in these companies. As a consequence, using anticipated privatisation as an exogenous shock does not permit to identify the effect of rising job insecurity -as opposed to anticipated organisational changes -on health.

We improve with respect to this literature in two respects. First, using an IV strategy allows us to control for both time-invariant and time-varying omitted variables and/or reverse causality. Second, we are able to identify the causal impact of perceived job insecurity as opposed to any organisational change since our instrument is strongly correlated with the former while it has no reason to vary with firm organisation.

The rest of the paper is organised as follows. Section 2 presents our empirical strategy. Section 3 describes the data that we use. Section 4 reports our results and Section 5 concludes.

Empirical Specification

We investigate the impact of perceived job insecurity on health. As a first step, we estimate the following model by a standard probit4 :

Health * ijs = α + γJobIns ijs + X ijs β + D j + D s + u ijs (1)
where Health * ijs denotes the latent health status of individual i in country j and industry s and is only observed as:

Health ijs = 1 {Health * ijs >0}
(2) JobIns ijs denotes the perceived job insecurity of individual i in country j and industry s. X ijs is a vector of individual and firm characteristics. D j and D s are respectively country and industry dummies and u ijs is an error term.

In some specifications we control for working conditions and psychosocial environment characteristics. The former capture adverse physical working conditions. The latter include indicators of job strain (job pressure, decision latitude and skill discretion) consistent with the Job Demand Control Model proposed by [START_REF] Karasek | Job demands, job decision latitude, and mental strain: Implications for job redesign[END_REF] as well as a measure of Effort-Reward Imbalance which may be an additional source of job strain according to [START_REF] Siegrist | Adverse health effects of high-effort/low-reward conditions[END_REF]. Both working conditions W orkCond ijs and psychosocial work environment P sychoSoc ijs are indeed likely to be correlated with health and perceived job insecurity. If jobs which are insecure are simply lousy jobs, they may also be characterised by bad working conditions and high job strain. In that case, omitting the latter two variables generates an upward bias in the estimate of γ. In order to control for both physical working conditions and psychosocial work environment, we estimate the following equation :

Health * ijs = α + γJobIns ijs + X ijs β + µW orkCond ijs + P sychoSoc ijs ξ + D j + D s + v ijs (3)
However, perceived job insecurity JobIns ijs is likely to be endogeneous in which case the probit estimate of γ is inconsistent. Endogeneity may arise either from omitted variable bias or reverse causality. As job insecurity and health variables are both self-declared, our estimates are biased if pessimistic individuals systematically tend to report higher job insecurity and lower health status (and the reverse holds for optimistic individuals). Reverse causality is another potential source of bias if unhealthy individuals are more likely to be employed in more insecure (or more secure) jobs. This is also a concern if negative health shocks make individuals fear that they could be fired.

In order to overcome potential endogeneity problems, we jointly estimate the following IV system of 2 equations by conditional maximum likelihood:

Health * ijs = α + γJobIns ijs + X ijs β + D j + D s + u ijs (4) JobIns ijs = δEP RC j * DR s,U SA + X ijs ζ + D j + D s + η ijs (5)
where Health * ijs is the latent health status and is only observed as a dichotomous variable (see equation 2), JobIns ijs is assumed to be continuous 5 , DR s,U SA is the dismissal rate in industry s in the USA and EP RC j denotes the employment protection legislation for regular contracts and collective dismissals in country j. Equation (4) is the same as (1) and equation 5Our results are robust to dichotomising job insecurity -by opposing those who either disagree or strongly disagreee with the idea that they may lose their job in the next six months and those who neither agree nor disagree, agree and strongly agree with this statement -and running a 2SLS estimation of equation ( 4) where dichotomised job insecurity is instrumented by EP RC j * DR s,U SA .

(5) is a linear regression with EP RC j * DR s,U SA as the instrument.

The intuition behind the choice of the instrument is the following. Perceived job insecurity JobIns ijs is likely to be higher in countries where employment protection legislation EP RC j is less stringent. 6 The index for employment protection legislation is provided by the OECD -see [START_REF] Venn | Legislation, collective bargaining and enforcement: Updating the OECD employment protection indicators[END_REF] -and refers to the legislation regarding individual and collective dismissals of workers on regular labour contracts. An additional component of overall employment protection legislation has to do with regulations of temporary work contracts.

We do not include it in our EPL index (and restrict our sample accordingly to permanent workers) because it is not clear whether the rules restricting the use of temporary contracts actually protect temporary workers or rather permanent ones, by making temporary work either more costly or less convenient to use (OECD ( 2014)).

Of course, the stringency of employment protection legislation cannot be used, per se, as an instrument since its variability would be very low and it would capture all heterogeneity existing across countries. This is why we instrument job insecurity by the stringency of employment protection legislation EP RC j in the country where the individual lives interacted with the extent to which EPL is binding in the sector where the individual is employed. As is classical in the job and worker flow literature -see [START_REF] Bassanini | Job protection legislation and productivity growth in OECD countries[END_REF][START_REF] Haltiwanger | Cross country differences in job reallocation: the role of industry, firm size and regulations[END_REF] -we consider that EPL is particularly binding in sectors where the natural rate of dismissal is high. We proxy the latter by the industry-level dismissal rate in the USA.

The reason for choosing this country as a benchmark is that EPL is almost nonexistent in the USA -see Venn (2009) -so that the observed dismissal rates may be considered as capturing the natural dismissal propensity in the corresponding industries.

Overall, the assumption underlying our instrument is that workers living in countries with a strong employment protection legislation will feel comparatively more secure, as far as their job is concerned, when employed in industries with a high natural rate of dismissal because this is where the stringency of EPL makes more difference. Our instrument is valid if workers do not self-select into sectors-by-country on the basis of characteristics which may be 6 In contrast, [START_REF] Clark | Job security and job protection[END_REF] suggest that employment protection legislation is negatively correlated with the satisfaction with job security. According to them this negative correlation is due to the fact that their satisfaction variable captures two components of job security : the probability of job loss and the cost of it. The former decreases with EPL -which is consistent with our assumption -but the latter strongly rises with EPL since finding a new job is quite harder in countries where employment is strongly regulated.

correlated with their health. We will provide evidence that this is not the case in Section 4.3.

Note that our instrument captures the risk of being dismissed which is likely to be a good predictor of the perceived risk of losing one's job, i.e. our job insecurity indicator. Finding a good instrument would have been more complicated should our variable of interest have been the individual's satisfaction with her job security. The latter is indeed likely to be determined not only by the risk of losing one's job, but also by the expected level of unemployment benefit and the probability of re-employment if dismissed. In the present case, our job insecurity variable captures the perceived risk of dismissal which is easier to predict since it does not depend on expectations about future well-being but only on the actual risk of dismissal faced by the individual.

Data

Presentation of the sample

We use the fifth wave of the European Working Conditions Survey (EWCS). Since its launch in 1990, the EWCS measures and monitors trends and changes in working conditions in Europe. It has been conducted every five years on a random sample of workers (salaried employees and self-employed) in a growing number of European countries (from 12 in 1990 to 34 in 2010).

The European Foundation for the Improvement of Living and Working Conditions commissioned the fifth wave of the EWCS to be carried out in winter-spring 2010. Face-to-face interviews were conducted with persons in employment in the 28 member states as well as in Norway, Macedonia, Turkey, Albania, Kosovo and Montenegro. The questionnaire covers issues such as employment status and the general job context : working time, work organisation, earnings and financial security, job insecurity, psychosocial work environment, work-life imbalance and access to training. It also covers several aspects of health, well-being and psychological conditions as well as demographic and socio-economic characteristics. Response rates vary substantially across countries from 31.3% in Spain to 73.5% in Latvia with an average response rate of 44.2% across all countries -see the Fifth EWCS Technical Report (2010). As underlined in the technical report, "EWCS had lower-than-desired response rates particularly in countries reporting low response rates in similar random face-to-face social surveys : Poland, Slovenia, the United-Kingdom, France, Belgium and the Netherlands".

In the 2010 wave almost 44,000 workers were interviewed. The original sample included all persons aged 15 and above who were resident in the country that was being surveyed and who were in employment 7 during the reference week.

Our empirical strategy uses the employment protection legislation index for individual and collective dismissals of workers on regular work contracts (EPRC). This index is available for only 22 countries (out of 34). 8 Moreover, as it is defined only for individuals employed with a regular contract in the business sector, we exclude from the sample self-employed individuals, individuals working in non-business sectors 9 , as well as individuals who did not have a regular work contract at the time of the survey. As is standard in the literature -see OECD (2010) -we also exclude individuals working very short hours (less than 15 hours during the reference week). We further restrict our sample to men only since in our data women are overrepresented in very small establishments (less than 5 employees) 10 for which the scope of employment protection legislation is reduced in most countries. Overall, our final sample consists of 5,541 men across 22 countries. Once conditioning on having no missing value on any dependent variable and/or covariate, our sample goes down to 4,749 observations for all health outcomes.

Variables

Perceived job insecurity is assessed by asking workers their opinion about the following statement : "I might lose my job in the next 6 months". Five answers are available ranging from 7 Being in employment was defined as having done any work for pay or profit during the reference week for at least one hour.

8 The EPRC index is available for the following countries : Austria, Belgium, the Czech Republic, Germany, Denmark, Spain, Finland, France, the United-Kingdom, Greece, Hungary, Ireland, Italy, the Netherlands, Norway, Poland, Portugal, the Slovak Republic, Sweden, Turkey, Slovenia and Estonia.

9 Agriculture, mining and fuel are excluded too because of problems of data reliability, so that the sectors included in our study correspond to sectors 15 to 74 in the NACE Rev. 1 classification.

10 They have a 60% higher probability than men to be employed in very small establishments.

"strongly agree" to "strongly disagree". 11 We standardise job insecurity to mean 0 and 1 standard deviation.

Measuring health using survey data is always a challenge. The EWCS questionnaire includes a question on self-rated health where respondents are asked to rate their health on a 5-point scale : very good, good, fair, bad or very bad. We dichotomise the responses into good (very good and good) and bad health (fair, bad or very bad). There is evidence in the literature that self-rated health is a good indicator of individual overall health [START_REF] Ferrie | Health effects of anticipation of job change and non-employment: Longitudinal data from the Whitehall II study[END_REF]). It has been found to be a good predictor of mortality even after controlling for more objective measures of health [START_REF] Idler | Health perceptions and survival: Do global evaluations of health status really predict mortality?[END_REF]; [START_REF] Idler | Self-rated health and mortality: A review of twentyseven community studies[END_REF]; [START_REF] Bath | Differences between older men and women in the self-rated healthmortality relationship[END_REF]). However, the probability of reporting good or bad health may suffer from individual reporting heterogeneity [START_REF] Etilé | Income-related reporting heterogeneity in selfassessed health: Evidence from France[END_REF]; [START_REF] Tubeuf | Social heterogeneity in self-reported health status and measurement of inequalities in health[END_REF]). This is why we also use more objective measures of health capturing specific diseases or symptoms. In the EWCS database, respondents are asked whether they have suffered over the last 12 months from either backache, skin problems, muscular pain in shoulders, neck and/or upper limbs, muscular pain in lower limbs, headache or eyestrain, stomach ache, cardiovascular diseases, depression or anxiety, overall fatigue, or insomnia or general sleep difficulties. For each above-mentioned health disorder, we build a corresponding dummy variable taking value 1 if the individual suffered from it, 0 otherwise.

We also use some information on individuals' well-being. We build a dummy variable equal to 1 if the individual answers "All the time", "Most of the time" or "More than half of the time" to at least one of the following assertions : "[Over the past two weeks] I have felt cheerful and in good spirits"; "I have felt calm and relaxed"; "I woke up feeling fresh and rested"; "My daily life has been filled with things that interest me". Our well-being dummy indicator is equal to 0 otherwise.

Our baseline specification includes a set of covariates capturing individual and firm characteristics. Some specifications also control for working conditions and psychosocial work environment.

Individual and firm characteristics include age (entered as a continuous variable), the pres-ence of a spouse or partner in the household, occupation12 (managers and professionals, technicians and supervisors, white collars, blue collars) and education13 (higher education, secondary education, below secondary). As the income variable in the EWCS has many missing values and is not quite reliable, we use a question on the "household's ability to make ends meet given its total monthly income". We build a dummy variable equal to 1 if individuals report that their household makes ends meet "with some difficulty", "with difficulty" or "with great difficulty", and equal to 0 otherwise. We interpret this indicator as a measure of households' deprivation. We also use a question reporting whether the individual was unemployed immediatly before this job (dummy variable equal to 1 if so, 0 otherwise), information on establishment size (five classes) and the presence of an employee representative at the workplace (dummy variable equal to 1 if so, 0 otherwise).

Working conditions are captured by an index taking values 0 to 10, where 10 denotes adverse working conditions. It is the normalised sum of 15 dummy variables taking value 1 if the individual is exposed half of the time or more to a given working condition, and 0 otherwise.

The 15 working-condition components are : being exposed to vibrations from hard tools or machinery; to noise so loud that one would have to raise one's voice to talk to people; high temperatures which make one perspire even when not working; low temperatures whether indoors or outdoors; breathing in smoke, fumes, powder or dust; in vapors such as solvents and thinners; handling or being in skin contact with chemical products or substances; breathing tobacco smoke from other people; handling or being in direct contact with materials which can be infectious, such as waste, bodily fluids, laboratory materials; having a job that involves tiring or painful positions; lifting or moving people; carrying or moving heavy loads;

standing; performing repetitive hand or arm movements; handling angry clients or patients.

As for psychosocial work environment characteristics, they are measured through a series of indicators adapted from the Job Content Instrument of [START_REF] Karasek | Job demands, job decision latitude, and mental strain: Implications for job redesign[END_REF]) and the Effort-Reward Imbalance Questionnaire [START_REF] Siegrist | Adverse health effects of high-effort/low-reward conditions[END_REF]). These indicators include job pressure, decision latitude, skill discretion and reward, and are measured as follows. Job pressure is built out of three components : not having enough time to get the job done (measured on a 5-point scale where response categories range from "always" to "never"), working at high speed (7-point scale ranging from "all the time" to "never"), and working to tight deadlines (7-point scale ranging from "all the time" to "never"). We combine the responses into a summary scale and normalise it to [0;10], where 10 denotes high job pressure. We then divide the scale into tertiles, i.e low job pressure, moderate job pressure and high job pressure. A measure of decision latitude is obtained using three dummy variables : the ability to choose or change the order of tasks, the methods of work and the speed or rate of work (all variables taking value 1 if the individual has control over the corresponding decision, 0 otherwise). We combine the responses into a summary scale, normalise it to [0;10], where 10 denotes high decision latitude, and divide it into tertiles. Skill discretion is measured by a single question asking whether one's job involves learning new things (dummy variable equal to 1 if so, 0 otherwise). Finally, workers' reward is assessed by two questions : being well paid to do one's work (measured on a 5-point scale where response categories range from "strongly disagree" to "strongly agree"); having a job that offers good prospects for career advancements (5-point scale ranging from "strongly disagree" to "strongly agree").

Responses are summed into a summary scale that is normalised to [0;10] and divided into tertiles.

Instrument

We instrument perceived job insecurity by the stringency of employment protection legislation EPRC in the country where the worker lives interacted with the US rate of dismissals in the industry where he is employed. We borrow US dismissal rates from [START_REF] Bassanini | Dismissal protection and worker flows in OECD countries: Evidence from cross-country/cross-industry data[END_REF] it is built out of information on notification procedures, delays before the notice period can

14 Following the evidence provided by [START_REF] Bassanini | Job protection legislation and productivity growth in OECD countries[END_REF], we assume that the natural dismissal propensity in the USA is stable over time and we average it over a complete cycle, 2000-2006. start, the length of the notice period and size of severance payments, the circumstances under which a dismissal is considered unfair and compensation and extent of reinstatement following unfair dismissal. Regarding collective dismissals, the index takes into account the number of workers above which dismissals are considered as collective as well as additional notification and delay requirements and other special costs to employers. 15 The theoretical value of the EPRC index varies from 0 to 6 (where 6 is the most stringent legislation). 16 The list of industries and countries that we use, together with the US sectoral dismissal rates and the national EPRC indices can be found in Appendix Table A.4. As shown in Figure A.1, 32% of the workers strongly disagree with the statement that they might lose their job in the next six months, while 34% simply disagree, 18% neither agree nor disagree, 12% agree and 4% strongly agree. In the sample, the average age is 41 years old, 71% of our individuals live with a spouse or partner, and 35% report having difficulties to make ends meet. 7% report having had a period of unemployment immediately before their current job, and 48% have an employee representative at their workplace. A majority of workers in our sample (61%) are employed in establishments with less than 50 employees, while only 9% are employed in large establishments (more than 500 employees). While 78% of individuals declare being in good health (good or very good self-rated health), we do see a number of health disorders -see Table A.2. 47% of workers report suffering from backache, 43% from muscular pain in upper limbs, 30% from muscular pain in lower limbs, 34% from headache or eyestrain, 34% from overall fatigue and 18% from insomnia or sleep difficulties. However, fewer workers report suffering from skin problems (8%), stomach ache (12%), cardiovascular diseases (5%), or depression or anxiety (8%). 93% of the individuals in the sample experienced well-being the week preceding the interview. We also control for the industry where the worker is employed. The largest proportions of respondents are found in the construction sector (15%), in renting and business activities (10%) and in retail trade (10%) -see Table A.3. We also provide a country-by-country breakdown of our sample.

Descriptive statistics

Belgium, France and Germany are the most represented countries and Ireland is the country with fewest respondents.

Results

Probit estimates

Probit estimates of equations ( 1) and ( 3) are reported in Table 1. Each line presents the point estimate (resp. standard error) of perceived job insecurity (γ) for a different health outcome. 17 In column 1 we only control for individual and firm characteristics, i.e. age, education, occupation, marital status, difficulties to make ends meet, period of unemployment immediatly before current job, establishment size, presence of an employee representative in the establishment where the person is employed, industry and country dummies. Job insecurity appears to be positively correlated with all health disorders in our data except skin problems and cardiovascular diseases. In particular, it is associated with a long series of physical troubles (back problems, muscular pain, headaches or eyestrain, stomach ache) as well as with depression or anxiety, overall fatigue and insomnia, all of these at the 1% significance level. When computing average marginal effects 18 , we find that the impact of a one-standard-deviation increase in job insecurity on the probability of reporting health disorders ranges from 1.9% for stomach ache to 4.2% for muscular pain in upper limbs. Unsurprisingly, job insecurity is also associated with poorer self-rated health. Coefficients in Table 1 imply that when job insecurity increases by 1 standard deviation, the probability of reporting bad self-rated health increases by 3% on average in our sample. Beyond its healthdamaging effect, we also find that job insecurity decreases the probability of reporting at least one dimension of well-being over the past two weeks (either feeling cheerful or relaxed 17 The point estimates and standard errors on individual and firm controls are reported in Appendix Table A.5 for one particular health outcome, namely self-rated health. As could be expected, age is negatively correlated with self-rated health. When controlling for education, occupation does not appear to be significantly correlated with health. Living with a spouse or partner, establishment size and the presence of employee representatives in the establishment do not seem to significantly affect self-rated health either. In contrast, having problems to make ends meet is associated with poorer self-rated health which is unsurprising if this variable captures to some extent low income levels. Suprisingly enough, being unemployed immediately before the current job is associated with better health (at the 10% significance level).

18 Average marginal effects are computed by first calculating the marginal effect for each observation and then averaging over the entire sample.

or rested or having an interesting life). So, job insecurity appears to be uniformly harmful to health and to our measure of well-being.

Results are very similar when controlling for bad physical working conditions -see column (2). Whatever the health outcome or well-being variable we consider, the point estimate on job insecurity is slightly lower than when we do not include any indicator of working conditions. However, its magnitude remains in the same range as in column (1) and it is highly significant at conventional levels, except for skin problems and cardiovascular diseases. The same pattern of results is also found when adding psychosocial factors to our specificationsee column (3). A one-standard-deviation increase in job insecurity increases the probability of reporting bad self-rated health by 1.9%. 19 Overall, the results from these simple probit estimates are consistent with most findings in the literature suggesting that job insecurity is associated with ill physical and mental health and with lower well-being [START_REF] Ferrie | Is job insecurity harmful to health?[END_REF]).

IV estimates

Baseline estimates

However, as mentioned in section 2, job insecurity is likely to be endogenous both because of potential omitted variable bias and of reverse causality. In order to deal with this issue, we estimate an instrumental variable probit in which JobIns ijs is instrumented by the stringency of employment protection legislation in the country where worker i lives interacted with the natural rate of dismissals in the industry where he is employed. Results obtained when estimating equation ( 5) are reported in Table 2. 20 As expected, we find that workers living in countries with more strigent EPL feel comparatively less insecure when employed 19 The point estimates and standard errors on working conditions and psychosocial work environment characteristics are reported in Appendix Table A.5 for one specific health outcome -i.e. self-rated health. Unsurprisingly, bad working conditions deteriorate self-rated health. Low job pressure is associated with better health than high job pressure. As suggested by [START_REF] Siegrist | Adverse health effects of high-effort/low-reward conditions[END_REF], higher rewards for given effort levels are important to workers' well-being and they appear to be correlated with better self-rated health. The same holds for high decision latitude which appears to be positively correlated with self-reported health.

20 Equation ( 5) is jointly estimated with equation ( 4). The estimates shown in Table 2 are obtained when the health outcome on the left-hand side of equation ( 4) is self-rated health. The coefficients and standard errors on all control variables are reported in Appendix Table A.6. All standard errors are clustered at the country*industry level (466 clusters).

in sectors characterised by a high natural rate of dismissals. When controlling for both bad working conditions and psychosocial work environment, the estimates yield very similar results.

When instrumenting job insecurity, our estimates 21 of equation ( 4) suggest that it does damage a limited number of health outcomes -see Table 3. Results in column (1) show that job insecurity increases the probability of reporting poor self-rated health and this effect is significant at the 5% level. It also raises the frequency of a couple of more specific health symptoms, namely skin problems and headaches and/or eyestrain -with both point estimates significant at the 1% level. Surprisingly, overall fatigue seems to decrease with job insecurity, although the effect is not highly significant in all specifications. As regards the other health outcomes, the coefficients of job insecurity are not statistically significant.

As evidenced in columns ( 2) and ( 3), these findings are robust to controlling for working conditions and/or psychosocial work environment : the point estimates remain stable across specifications.

One concern with these results is that the point estimates reported in Table 3 are much larger than those estimated by naive probit 22 and the corresponding standard errors are also quite large. 23 This increase in the coefficients when estimating the IV model may, of course, be due to the combined outcome of many potential sources of endogeneity. Measurement error may be one of those [START_REF] Card | Estimating the return to schooling: Progress on some persistent econometric problems[END_REF]). Another source of endogeneity may also arise from unhealthy individuals self-selecting into more secure jobs, in which case the naive probit coefficients would underestimate the true health effect of job insecurity.

However, one could also worry that our large IV estimates be due to a weak instrument 21 All standard errors are clustered at the country*industry level. 22 This increase in the coefficients does not seem to be due to the estimation method that we use : when estimating our model by 2SLS the coefficients we obtain are in the same range of magnitude as the average marginal effects corresponding to the point estimates presented in Table 3. Results are available upon request.

23 Note that, using our complete specification, the coefficients estimated for self-rated health, skin problems and headaches/eyestrain are significantly different from those estimated by probit since the confidence intervals do not overlap. For self-rated health, the confidence interval of the IV estimate is [-1.227;-0.252] problem since the F-test of the exluded instrument in equation ( 5) is slightly below 10. 24 To tackle this issue, we derive weak-instrument-robust confidence intervals for the impact of job insecurity on each of our health outcomes. In doing this, we follow the method proposed by [START_REF] Boeri | Moving to segregation : Evidence from 8 Italian cities[END_REF] who extend to non-linear models the reduced-form approach developed by [START_REF] Angrist | Instrumental Variables and the Search for Identification: From Supply and Demand to Natural Experiments[END_REF] and [START_REF] Chernozhukov | The reduced form: A simple approach to inference with weak instruments[END_REF] for linear models.

More specifically, as suggested by [START_REF] Boeri | Moving to segregation : Evidence from 8 Italian cities[END_REF], we first define A as a wide enough range of potential values for γ in equation ( 4). For each a ∈ we rewrite equation (4) as follows :

Health * ijs = α + (γ -a)JobIns ijs + aJobIns ijs + X ijs β + D j + D s + u ijs (6)
We then replace the first instance of JobIns ijs by its expression in equation ( 5) :

Health * ijs = α + δ(γ -a)EP RC j * DR s,U SA + aJobIns ijs + X ijs [ζ(γ -a) + β] +D j + D s + (γ -a)η ijs + u ijs (7)
We then estimate equation ( 7) as a constrained probit, forcing the coefficient of the endogenous variable JobIns ijs to equal a. By doing so, the endogeneity of JobIns ijs becomes irrelevant for the consistent estimation of δ(γ -a). In such a modified reduced-form equation, the usual test statistics for the significance of δ(γ -a) tests the null γ = a (conditional on δ = 0). Iterating over several values of a allows constructing a confidence interval for γ that is robust to weak instruments since it does not use information about the strength of the correlation between the instrument and the endogenous variable.

In practice, we proceed as follows :

1. We set A as the set of real numbers in [m 1 ; m 2 ]25 , spaced 0.01.

2. We estimate equation ( 7) for each a ∈ A and retain the z-statistics for δ(γ -a).26

3. We construct the 1 -p confidence interval as the set of a's such that the z-statistics is smaller than c(1 -p) where c(1 -p) is the (1 -p) th percentile of a χ 2 1 distribution.

Applying this procedure yields a 95% confidence interval for γ. For headaches or eyestrain, this interval is [0.37;2.46] which has to be compared to the narrower interval [0.45;1.14] derived from the usual maximum likelihood asymptotics. As regards skin problems the corresponding intervals are [0.1;2.66] and [0.51;1.21]. What matters here is that, for both health outcomes, the intervals only contain strictly positive values, which confirms that the positive impact of job insecurity on headache and/or eyestrain and skin problems that we estimate is robust to potentially weak instruments. In contrast, for all other health outcomes -including self-rated health and overall fatigue -the weak-instrument-robust confidence systematically contain 0 so that the impact of job insecurity is not significant at conventional levels when estimated in this conservative way.

Overall, this method allows us to derive weak-instrument-robust confidence intervals from reduced-form estimates. The price to pay for this is that we cannot derive precise point estimates for the impact of job insecurity on health outcomes since the corresponding confidence intervals are very large. In contrast, it allows us to claim with a high degree of confidence that job insecurity has a positive causal impact on the probability of reporting headaches and/or eyestrain and skin problems.

Robustness checks

One may worry that unhealthy workers might self-select into low-dismissal industries and that this selection pattern may vary according to country-specific levels of EPL. If this were the case, our instrument would no longer be valid since the identifying assumption -according to which workers do not self-select into sectors-by-country on the basis of a characteristic correlated with health -would not hold anymore. In order to test for this, we estimate the following equation :

HighDismiss ijs = λ + ξHealth ijs + ψHealth ijs * EP RC j + X ijs θ + D j + υ ijs (8)
where HighDismiss ijs is a dummy variable equal to 1 if worker i is employed in a highdismissal industry and 0 otherwise. Other variables are defined as in Section 2. We use different definitions of high-dismissal industries : industries with dismissal rates higher than (i) the median, (ii) the quartile and (iii) the upper decile. Whatever the threshold we use for defining high-dismissal industries and whether or not we control for job insecurity in the regression, ψ is never significant at conventional levels. 27 This suggests that workers do not self-select into industries on the basis of their health status in a different way according to the level of EPL in their home country. Hence, our IV is valid to uncover the causal impact of job insecurity on health.

Another concern has to do with potential sample selection bias. If high-dismissal industries tend to rely more on temporary contracts in high-EPL countries in order to meet their needs in terms of labour force turnover, a disproportionate part of their workforce will be left out of our sample to the extent that we exclude temporary workers. If unhealthy workers are more likely to be employed on temporary contracts than healthy ones, workers employed in high-dismissal/high-EPL sectors*countries in our sample are likely to enjoy a better health status than those employed in high-dismissal/low-EPL sectors*countries. To the extent that our instrument predicts a lower job insecurity for workers employed in highdismissal/high-EPL sectors*countries, we may overestimate the negative health impact of job insecurity. We check that the probability of being employed on a temporary contract is not higher in high-dismissal/high-EPL sectors*countries than in high-dismissal/low-EPL sectors*countries. On the sample of permanent and temporary workers, we regress the probability of holding a temporary contract on the EP RC j * DR s,U SA interaction. 28 The coefficient on the interaction term is insignificant with a point estimate of 0.058 (standard error : 0.070), which suggests that our results are unlikely to be driven by selection bias due to the exclusion of temporary workers.

Our results derive from estimates run on a sample of workers aged 15 years old and above.

27 When high-dismissal industries are defined as industries with dismissal rates higher than the median, the point estimate of ψ is -0.071 -with standard error 0.061 -when controlling for firm and individual characteristics along with working conditions and psychosocial factors. When adding job insecurity as an additional control, the point estimate of ψ is -0.074 with standard error 0.061.

28 This specification includes controls for individual and firm characteristics together with working conditions and psychosocial factors, as well as country and industry dummies.

However, senior workers may overreact to job insecurity since in most countries, their probability to get back to employment if dismissed is lower than for younger workers (OECD (2011)). In this case, one could be afraid that our results be driven by a particularly strong effect of job insecurity on health for specific age group. We check that our findings are robust to the exclusion of older workers by re-running our complete IV estimates29 on the group of prime-age workers (aged 25 to 59). The results are virtually unchanged. 30 Unfortunately, we cannot run similar estimates on the younger and older age groups since the number of observations is too low (294 and 215 respectively) to allow us to properly estimate our model.

Controlling for a measure of income when explaining individual health differences is standard in the literature [START_REF] Lundborg | The health returns to schooling-what can we learn from twins?[END_REF]). Given the scarce quality of income data in the European Working Conditions Survey, we use information on "problems to make ends meet" as an alternative in our baseline specification. However, one could be concerned that this variable might be endogenous if unhealthy workers have got problems making a living.

In order to make sure that this does not generate a bias in our estimates, we re-estimate our complete IV specification dropping this covariate. The results are essentially unaffected.31

Conclusion

In this paper, we provide evidence of the causal effect of perceived job insecurity on various health outcomes in a sample of men from 22 European countries. We instrument perceived job insecurity by the stringency of employment protection legislation in the country where the individual lives interacted with the natural rate of dismissals in the industry where he is employed. Using cross-country data from the 2010 European Working Conditions Survey, we show that when the potential endogeneity of job insecurity is not accounted for, the latter appears to deteriorate almost all health outcomes (self-rated health, suffering from back problems, muscular pain, headaches or eyestrain, stomach ache, depression or anxiety, overall fatigue and insomnia). When tackling the endogeneity issue by estimating an IV model and deriving weak-instrument-robust confidence intervals, findings more mixed.

The health-damaging effect of job insecurity is confirmed for a limited subgroup of health outcomes, namely the probability of suffering from headaches or eyestrain and skin problems.

In contrast, the impact of job insecurity on other health variables comes out as insignificant.

Our results are robust to controlling for individual and firm characteristics but also for adverse working conditions and psychosocial environment characteristics.

The method that we use does not allow us to derive precise point estimates. However, we show that the fear of involuntary job loss has clear worsening effects on two specific health disorders, i.e. headaches and/or eyestrain and skin problems. As regards other health outcomes, job insecurity does not seem to have any significant impact. However, let us underline that the method that we use to derive weak-instrument-robust confidence intervals is extremely conservative, so that our results cannot be interpreted as ruling out any damaging impact of job insecurity on those outcomes.

The health-damaging effects that we find for a couple of health outcomes raises the issue of the mechanisms through which perceived job insecurity affects both mental and physical health. The psychology literature has long emphasised the role of stress. Another (complementary) explanation might be that workers who are afraid of losing their job tend to increase precautionary savings and hence reduce investments, in particular in health. The lack of information about health consumption in our data does not allow us to test such a hypothesis. Moreover, it is unclear how relevant this mechanism may be since time is one of the most important inputs in health investments. In any case, investigating the consequences of job insecurity for health investments would be extremely valuable and improve our understanding of the mechanisms through which the fear of job loss deteriorates health.

Whatever the mechanism through which perceived job insecurity affects health, this effect is likely to be stronger for workers with low employability, i.e with a low probability of finding a new job if losing the current one. According to [START_REF] Green | Unpacking the misery multiplier: How employability modifies the impacts of unemployment and job insecurity on life satisfaction and mental health[END_REF] employability is indeed a key determinant of the impact of job insecurity upon job satisfaction. Unfortunately, the information available in the EWCS database does not allow us to tackle this issue properly.

A promising avenue for future research would in investigating the potential role of employability on the health-damaging effects of perceived job insecurity using reliable measures of employability. Notes : (1) The results shown here are obtained when estimating equation (4) -jointly with equation ( 5) -by conditional maximum-likelihood. (2) *** : significant at the 1% level, ** : significant at the 5% level, * : significant at the 10% level.

(3) Standard errors in parentheses are clustered at the country*industry level. (4) Baseline specifications include controls for individual and firm characteristics : age, education, occupation, marital status, difficulties to make ends meet, period of unemployment immediately before this job, establishment size, presence of an employee representative in the establishment where the person is employed, industry and country dummies.

(5) Working conditions is a summary indicator of 15 adverse working conditions. (6) Psychosocial factors include job pressure, decision latitude, skill discretion and reward.

  . Their database contains dismissal rates over 1996-2006 and uses an industry classification that can be matched, at a sufficiently disaggregated level, to the Nace Rev. 1 classification used in the EWCS. To capture the natural dismissal propensity at the industry level, we compute a quantitative indicator equal to the average US industry dismissal rate between 2000 and 2006. 14 Overall, we have information on 23 industry-level US dismissal rates. Data on employment protection legislation are provided by the OECD. The EPRC index that we use refers to the legislation regarding individual and collective dismissals of workers on regular labour contracts and varies at the country level. As regards individual dismissals,

Figure

  Figure A.1 and Tables A.1, A.2 and A.3 provide the descriptive statistics for our sample.

Figure A. 1 :

 1 Figure A.1: Descriptive statistics : Job insecurity distribution.

  whereas it is[-0.122;-0.031] for the probit estimate. For skin problems the corresponding intervals are [0.512;1.213] and [-0.040;0.079]. For headache/eyestrain, they are [0.449;1.138] and [0.035;0.115]. In contrast, for overall fatigue, the IV and probit estimates are not statistically different.

Table 1 :

 1 Probit model : Coefficients of job insecurity

	Health outcome	Baseline	Baseline	Baseline
			+Working conditions +Working conditions
				+Psychosocial factors
		(1)	(2)	(3)
	Self-rated health	-.116***	-.110***	-.077***
		(.023)	(.023)	(.023)
	Backache	.095***	.084***	.068***
		(.020)	(.020)	(.021)
	Skin problems	.042	.033	.019
		(.029)	(.029)	(.030)
	Muscular pain in upper limbs .114***	.105***	.084***
		(.020)	(.020)	(.021)
	Muscular pain in lower limbs	.073***	.061***	.047**
		(.021)	(.021)	(.022)
	Headaches, eyestrain	.096***	.091***	.075***
		(.020)	(.020)	(.020)
	Stomach ache	.098***	.096***	.081***
		(.025)	(.025)	(.025)
	Cardiovascular diseases	-.009	-.014	-.026
		(.039)	(.039)	(.040)
	Depression, anxiety	.181***	.173***	.147***
		(.029)	(.029)	(.029)
	Overall fatigue	.095***	.087***	.062***
		(.021)	(.021)	(.021)
	Insomnia, sleep difficulties	.133***	.127***	.104***
		(.023)	(.023)	(.023)
	Well-being	-.156***	-.153***	-.128***
		(.030)	(.030)	(.031)
	Observations	4,749	4,749	4,749
	Notes : (1) *** : significant at the 1% level, ** : significant at the 5% level, * : significant at the
	10% level. (2) Robust standard errors in parentheses. (3) Baseline specifications include controls for
	individual and firm characteristics : age, education, occupation, marital status, difficulties to make
	ends meet, period of unemployment immediately before this job, establishment size, presence of an
	employee representative in the establishment where the person is employed, industry and country
	dummies. (4) Working conditions is a summary indicator of 15 adverse working conditions. (5)
	Psychosocial factors include job pressure, decision latitude, skill discretion and reward.

Table 2 :

 2 Instrumenting perceived job insecurity

	Dependent variable : Job insecurity	Baseline	Baseline	Baseline
			+Work. cond.	+Work. cond.
				+Psychosoc. fact.
		(1)	(2)	(3)
	Country-specific EPRC*
	Sectoral US dismissal rate	-.087***	-.088***	-.096***
		(.029)	(.029)	(.028)
	Controls for individual & firm characteristics	yes	yes	yes
	Controls for working conditions	no	yes	yes
	Controls for psychosocial factors	no	no	yes
	Observations	4,749	4,749	4,749
	Notes : (1) The results shown here are obtained when estimating equation (5) -jointly with
	equation (4) -by conditional maximum-likelihood. The estimates are obtained when the health
	outcome on the left-hand side of equation (4) is self-rated heath. (2) *** : significant at the
	1% level, ** : significant at the 5% level, * : significant at the 10% level. (3) Standard errors
	in parentheses clustered at the country*industry level. (4) EPRC denotes employment protection
	legislation (5) Individual and firm characteristics include age, education, occupation, marital status,
	difficulties to make ends meet, period of unemployment immediately before this job, establishment
	size, presence of an employee representative in the establishment where the person is employed,
	industry and country dummies. (6) Working conditions is a summary indicator of 15 adverse
	working conditions. (7) Psychosocial factors include job pressure, decision latitude, skill discretion
	and reward.

Table 3 :

 3 IV coefficients of job insecurity

	Health outcome	Baseline	Baseline	Baseline
			+Working conditions +Working conditions
				+Psychosocial factors
		(1)	(2)	(3)
	Self-rated health	-.689**	-.734***	-.740***
		(.311)	(.278)	(.249)
	Backache	.178	.224	.207
		(.488)	(.465)	(.426)
	Skin problems	.888***	.899***	.862***
		(.165)	(.152)	(.179)
	Muscular pain in upper limbs	-.201	-.141	-.123
		(.516)	(.499)	(.453)
	Muscular pain in lower limbs	.263	.311	.224
		(.523)	(.505)	(.476)
	Headaches, eyestrain	.821***	.831***	.794***
		(.177)	(.167)	(.176)
	Stomach ache	.614	.627*	.580
		(.394)	(.382)	(.382)
	Cardiovascular diseases	-.667	-.623	-.699
		(.526)	(.581)	(.465)
	Depression, anxiety	-.409	-.393	-.377
		(.542)	(.564)	(.548)
	Overall fatigue	-.613**	-.589*	-.558*
		(.308)	(.318)	(.310)
	Insomnia, sleep difficulties	-.071	-.042	-.041
		(.551)	(.552)	(.498)
	Well-being	.077	.012	.011
		(.880)	(.885)	(.854)
	Observations	4,749	4,749	4,749

  Table A.1: Descriptive statistics : Individual and firm characteristics, working conditions and psychosocial factors.

		Mean Standard deviation
		(1)	(2)
	Job insecurity (standardised)	0	(1)
	Age	40.93	(11.09)
	Education
	Higher education	.29	(.45)
	Secondary education	.66	(.47)
	Below secondary	.05	(.22)
	Occupation
	Managers and professionals	.17	(.38)
	Technicians and supervisors	.14	(.35)
	White collars	.18	(.38)
	Blue collars	.51	(.50)
	Marital status
	Lives with a spouse or partner	.71	(.45)
	Difficulties to make ends meet	.35	(.48)
	Establishment size
	Less than 10 employees	.28	(.45)
	Betweeen 10 and 49 employees	.33	(.47)
	Between 50 and 99 employees	.12	(.32)
	Between 100 and 499 employees	.17	(.38)
	More than 500 employees	.09	(.29)
	Period of unemployment immediatly before this job	.07	(.26)
	Presence of an employee representative	.48	(.50)
	Bad working condition index (0 to 10)	3.24	(2.90)
	Job pressure index (0 to 10)	4.45	(2.42)
	Decision latitude index (0 to 10)	6.48	(3.94)
	Reward index (0 to 10)	5.05	(2.32)
	Skill discretion	.71	(.45)
	Observations	4,749	4,749
	Notes : (1) Standard deviations in parentheses.

  Table A.2: Descriptive statistics : Health variables. Standard deviations in parentheses.(2) All variables are binary so that the mean can be interpreted as the average frequency in the sample.

		Mean Standard deviation
		(1)	(2)
	Good self-rated health	.78	(.41)
	Backache	.47	(.50)
	Skin problems	.08	(.27)
	Muscular pain in upper limbs	.43	(.50)
	Muscular pain in lower limbs	.30	(.46)
	Headache, eyestrain	.34	(.47)
	Stomach ache	.12	(.32)
	Cardiovascular diseases	.05	(.21)
	Depression, anxiety	.08	(.27)
	Overall fatigue	.34	(.47)
	Insomnia, sleep difficulties	.18	(.39)
	Well-being	.93	(.25)
	Observations	4,749	4,749
	Notes : (1)

  Table A.3: Descriptive statistics : Countries and industries. Table A.4: Employment Protection Legislation Index (EPRC) in Europe (2008) and industry-level US dismissal rates (mean value for 2000-2006).

	Country	Frequency(%) Industry	Frequency(%)
	Country	EPRC index Industry	US dismissal rate
	Austria	3.35	Food and beverages	3.92
	Belgium Austria	13.86 2.62	Textiles, wearing app. and leather Food and beverages	1.45 2.83
	Czech Republic Belgium	2.80 2.42	Wood and wood products Textiles, wearing app. and leather	1.20 6.06
	Denmark Czech Republic	4.63 2.79	Paper, printing and publishing Wood and wood products	2.13 5.16
	Estonia Denmark	2.48 2.06	Chemicals and chemical products Paper, printing and publishing	2.27 3.61
	Finland Estonia	3.81 2.69	Rubber and plastics Chemicals and chemical products	1.47 3.22
	France Finland	10.80 2.23	Non-metallic mineral products Rubber and plastics	1.24 3.28
	Germany France	10.44 2.37	Basic metals and fabricated metal Non-metallic mineral products	5.26 3.47
	Greece Germany	2.46 3.21	Machinery Basic metals and fabricated metal	3.20 4.08
	Hungary Greece	3.87 2.59	Electrical and optical equipment Machinery	2.55 4.76
	Ireland Hungary	2.17 2.19	Transport equipment Electrical and optical equipment	3.26 5.93
	Italy Ireland	4.25 1.82	Manufacturing, recycling Transport equipment	2.82 3.08
	Netherlands Italy	3.05 2.66	Electricity, gas and water supply Manufacturing, recycling	2.23 4.58
	Norway Netherlands	3.94 2.80	Construction Electricity, gas and water supply	15.46 1.78
	Poland Norway	3.58 2.43	Motor trade and repair Construction	5.41 5.09
	Portugal Poland	3.50 2.51	Wholesale trade Motor trade and repair	5.05 2.67
	Slovak Republic Portugal	2.88 3.52	Retail trade Wholesale trade	10.17 3.80
	Slovenia Slovak Republic	3.92 2.86	Hotels and restaurants Retail trade	4.61 2.98
	Spain Slovenia	3.33 3.07	Transport and storage Hotels and restaurants	8.82 2.99
	Sweden Spain	3.24 2.65	Post and telecommunications Transport and storage	1.79 3.35
	Turkey Sweden	3.26 3.11	Financial intermediation Post and telecommunications	4.38 4.16
	United Kingdom Turkey	4.36 2.51	Real estate activities Financial intermediation	1.03 2.56
	United Kingdom	1.62	Renting and business activities Real estate activities	10.25 2.06
	Observations	4,749	Renting and business activities	4,749 4.19

See Eliason and Storrie (2009b),Eliason and Storrie (2009a) and[START_REF] Deb | The effect of job loss on overweight and drinking[END_REF].

See Sullivan and Von Wachter (2009) and[START_REF] Browning | Effect of job loss due to plant closure on mortality and hospitalization[END_REF].

Workers are considered as not experiencing job insecurity if they report that it is not very likely or not at all likely that they lose their job in the next 12 months.

All health outcomes are binary variables. Further details are available in the data section.

This is a standard way to measure perceived job insecurity in the literature. For example, in the Karasek's Job Content Questionnaire (JCQ), job insecurity is measured on a 4-point scale by the proposition "My job is secure", where response categories range from "strongly agree" to "strongly disagree"[START_REF] Karasek | The Job Content Questionnaire (JCQ): An instrument for internationally comparative assessments of psychosocial job characteristics[END_REF]).

Based on the 1988 International Standard Classification of Occupations (ISCO 88).

Based on the International Standard Classification of Education (ISCED).

Further details on the construction of the employment protection index can be found in[START_REF] Venn | Legislation, collective bargaining and enforcement: Updating the OECD employment protection indicators[END_REF].

The EPRC index that we use refers to year 2008. We pre-date it because, over the period under study, a number of EU countries implemented reforms of employment protection legislation. Given that it takes a while for employees to understand how the new rules really work, people tend to base their expectations on prior information.

For all health outcomes, the F-test of the excluded instrument is about 9 in the baseline specification, 9 when controlling for working conditions and 11 when controlling both for working conditions and psychosocial factors.

For each health outcome, we choose [m 1 ; m 2 ] so that it contains a wide enough range of potential values for γ. For headaches and/or eyestrain it is set, for example, to[-1;2.5].

Note that under the null, the term (γ -a)η ijs disappears from equation (7), thus simplifying its estimation.

This specification includes controls for individual and firm characteristics together with working conditions and psychosocial factors, as well as country and industry dummies.

 30 The point estimates (resp. standard errors) are -0.869 (0.173) for self-rated health, 0.839 (0.219) for skin problems and 0.800 (0.190) for headaches and

eyestrain.31 The point estimates (resp. standard errors) of the job insecurity variable are -0.735 (0.250) for self-rated health, 0.855 (0.179) for skin problems and 0.788 (0.176) for headaches and eyestrain.

Winter School and the TEPP conference on "Research in Health and Labour Economics" for useful comments and suggestions. The authors acknowledge financial support of Health Chair -a joint initiative by PSL, Université Paris-Dauphine, ENSAE and MGEN under the aegis of the Fondation du Risque (FDR). EWCS data was kindly provided by the European Foundation for the Improvement of Living and Working Conditions.

Notes : (1) The results shown here are obtained when estimating equation ( 5) -jointly with equation (4) -by conditional maximum-likelihood. The estimates are obtained when the health outcome on the left-hand side of equation ( 4) is self-rated heath.

(2) *** : significant at the 1% level, ** : significant at the 5% level, * : significant at the 10% level.

(3) Standard errors in parentheses clustered at the country*industry level.


Hassane Aissaoui-Mehrez

Pascal Urien
email: pascal.urien@telecom-paristech.fr

Guy Pujolle
email: guy.pujolle@lip6.fr

Global Identity Management of Virtual Machines Based on Remote Secure Elements

Keywords: Microcontrollers, Secure Elements, User-Centric Identity, Virtualization, Cloud Computing. I

The work presented in this paper is part of the cooperative project Security for Future Networks (SecFuNet 1 ), which aims to develop a security framework for Cloud Computing. This framework introduces, among many services, authentication and authorization controls for Cloud Computing environments.

The objective is to develop a highly secure identification scheme based on Authentication and Authorization Infrastructures. A particularly innovative aspect of SecFuNet is related to the global Identity Management (IdM) system. The proposed scheme is important for the security of the entire framework.

The identification system is based on secure microcontrollers. One of the ambitious goals of SecFuNet is to demonstrate and experiment these proposals of IdM in order to reach a standard solution for identifying users and nodes in the SecFuNet architecture. The SecFuNet identity model addresses two kinds of elements: users and nodes. For each of them an identity platform is provided dealing with OpenID Server, and grids of secure elements.

INTRODUCTION

The SecFuNet project proposes solutions for integrating secure microcontrollers in order to develop a security framework for Cloud Computing. This framework introduces, among its many services: authentication and authorization functions for Cloud Computing environments, based on smartcards and user-centric attribute control policies.

The IdM system will be based on several authentication servers composed by secure microcontrollers. The objective of this paper is to describe the IdM architecture of SecFuNet (hardware and software) achieved for the global IdM system, based on the authentication servers and secure microcontrollers. The proposed SecFuNet IdM makes use of OpenID2 protocols for establishing trust relationships among users, VMs, IdPs and SPs. To eliminate the vulnerabilities like phishing attacks, this IdM is heavily dependent on protected hardware. User/VM authentication is done directly between smartcards (owned by users or VM) and a grid of secure processors arranged in a SecFuNet IdP. The OpenID servers' security is enforced by grids of secure elements.

The rest of this paper is structured as follows. The related work on the main classes of secure microcontrollers has been studied in Section II. In Section III, we present the SecFuNet Global IdM architecture and we will explain the different layers visibility. We will present afterwards, in Section IV, the user and VM interactions with Grid of Secure Elements operations. The conclusion ends this paper.

II. RELATED WORK

This work describes the development achieved in the global IdM system, based on the OpenID authentication servers and secure microcontrollers developed in SecFuNet project [START_REF] Secfunet | Infrastructure of the authentication server[END_REF] [START_REF] Secfunet | Array and software of authentication server[END_REF].

A. Secure Microcontrollers

Two classes of secure microcontrollers have been studied, smartcards and TPMs (Trusted Platform Modules). These electronics chips have different computing capabilities, smartcards usually run a Java Virtual Machine (JVM) and therefore are able to execute complex procedures (such as the TLS protocol), while TPMs are dedicated to the RSA algorithm. However these devices may be used in order to enforce trust for the TLS protocol or to guarantee secure storage for cryptographic keys. These security properties are directly provided by smartcards (thanks to dedicated embedded software), but require additional software components for TPMs. In this document we call secure element a device such as smart card or a TPM, which is able to totally or partially handle the TLS protocol and to realize the secure storage or computing of a cryptographic key. To access smartcard grids driven by proprietary protocols, we recently introduced the RACS protocol [3][4], working over a TLS/TCP/IP stacks which provides a standardized way.

B. OpenID

The OpenID concept was initially developed by Brad Fitzpatrick in 2005. About one million of WEB sites were compatible with this standard in 2012. OpenID is based on common Web technologies (basically URLs), which makes the protocols light and relatively simple to implement. The OpenID is a set of specifications that define protocols for IdM on the Web.

There are many ways to perform authentication between the user and the OpenID server. The most popular is the simple password mechanism. In the SecuFuNet context, we propose a new model of IdM to authenticate the nodes in Cloud, also we use a strong mutual authentication based on a TLS session running in the EAP-TLS device, in which both (client/VM) and server are identified by their X509 certificates and associated private keys. The SecFuNet node is divided into three layers of visibility, whose components are identified by a certificate. The first one (the infrastructure layer) directly uses the services of a secure element. Upper layers (N) delegate their authentication to the layer N-1 (i.e. layer N-1 identity and private keys) but need a cryptographic token establishing the logical link between the N and N-1 layers. The interaction between SecFuNet components dealing with identities and tokens, implies the existence of a root entity that delivers certificates, and which is referred to as the Identity and Access Management (IAM). The IAM is the root Certification Authority of the SecFuNet architecture. The Global IdM architecture of SecFuNet is illustrated by "Fig. 1,".

The IAM delivers certificates to users, administrators of the infrastructure, platform, and applications layer. According to the OpenID architecture, services are interfaced by service providers, which require authentication from OpenID servers and tokens. OpenID authentication servers are equipped with certificates provided by the IAM entity.

The SecFuNet Users (or Administrators) are associated with certificates, which instantiate their identities (ID user ). They are equipped with secure elements, able to establish TLS connections to remote servers. Both entities (client and server) hold a certificate and a private key in order to realize a strong mutual authentication. This mechanism establishes trusted TLS channel between users and SecFuNet WEB servers. Trusted TLS channels are also used for strong mutual authentication with OpenID authentication servers; these mechanisms are detailed in sections VI.

According to the OpenID terminology SecFuNet services are accessed through service provider (SP) portals, which need an identity provider server (IdP) in order to achieve user's authentication.

It is important to notice that EAP-TLS and PKC#11 smartcards may be merged in the same physical device, in one or two JavaCard applications [START_REF] Jurgensen | Smartcards: The Developer's Toolkit[END_REF] [START_REF] Chen | Java CardTM Technology for Smartcards: Architecture and Programmer's (The Java Series)[END_REF]. Tokens are delivered by dedicated SP and IdP entities. Tokens may also be stored in secure elements for services that need a user centric model, such as the Microsoft Cardspace paradigm.

A. The SecFuNet Nodes

Nodes are composed of three main layers of visibility, the infrastructure layer, the platform layer and the application layer. Each of them is associated with an administrator in order to manage it.

The Infrastructure Layer: Includes hardware resources (servers, grid of secure elements GoSE) and hypervisors (HV), running in the Domain0 (in the sense of Xen technology).

Each hypervisor has a certificate, which instantiates its identity (ID HV ). It is optionally associated to a secure microcontroller storing its private key. In order to enforce a high trust and security level, TLS sessions with strong mutual authentication between HV and administrators are mandatory for all virtual machines (VM) transfer operations based on a WEB interface. Administrators are equipped with secure elements. However, and for legacy reasons, classical SSH sessions working with a private key on the HV side, and a login/password credential on the administrator side could be still supported.

The Platform Layer: Is a set of Virtual Machine (VM), running in the domain (DomainU in the sense of Xen technologie). Each VM holds a certificate (that instantiates its identity ID VM ), but its private key is stored in a GoSE [START_REF] Secfunet | Infrastructure of the authentication server[END_REF] [START_REF] Secfunet | Array and software of authentication server[END_REF].

For example each VM is associated to a secure element (smartcard) plugged in a SIM array "Fig. 2,". All cryptographic procedures dealing with secret keys (such as signing, symmetric encryption or decryption) are performed by the secure element linked to the VM.

The smartcard grid is interfaced by a service provider (SP), which may be OpenID compliant or a classical WEB interface. The protection of asymmetric cryptographic key is a critical issue for the SecFuNet Node. The authentication between the VM and an OpenID authentication server requires the HV private key and VM-Auth-Token (VM Authentication Token). The VM-Auth-Token establishes the proof that the VM (identified by its certificate ID VM ) is attached to the HV (identified by its certificate ID HV ).

Conceptually the VM-Auth-Token is a signed piece of information (such as certificate) comprising ID VM , ID HV and a validity date; it works with HV public key. Therefore TLS sessions dealing with this certificate imply the use of the HV private key: VM-Auth-Token = {IDVM, IDHV, Validity-Date}Sign-PrivHV.

The SP, which controls the grid services, needs three elements in order to authorize an operation with the secure element bound to a VM: a successful authentication with the authentication server dealing with the ID HV , the ID VM , and the possession of the VM-Auth-Token attribute. This last parameter may be dynamically provided by the OpenID server (Option1) or statically assigned by the platform administrator during the transfer of the VM (Option2).

 The Application Layer: This layer is a set of guest applications (APPs) executed by a virtual machine (VM), which are managed by dedicated administrators. Applications are identified by certificates (ID APP ) and a secret key stored in the secure element grid. The smartcard grid is interfaced by a service provider (SP), which may be OpenID compliant or a classical WEB interface. The authentication between the APP and an OpenID authentication server requires the VM private key and APP-Auth-Token (Application Authentication Token). This token establishes the proof that the APP (identified by its certificate ID APP ) is attached to the VM (identified by its certificate ID VM ).

Conceptually the APP-Auth-Token is a signed piece of information (such as certificate) comprising ID APP , ID VM and a validity date; it works with VM public key. Therefore TLS sessions dealing with this certificate imply the use of the VM private key: APP-Auth-Token={IDAPP, IDVM, Validity-Date}Sign-PrivVM

The SP, which controls the grid services, needs three elements in order to authorize operations with the secure element bound to an APP. A successful authentication with the authentication server dealing with the ID VM , the ID APP , and the possession of the APP-Auth-Token attribute "Fig. 3,". This last parameter may be dynamically provided by the OpenID server (Option 1) or statically assigned by the application administrator (Option 2).

IV. GRID OF SECURE ELEMENTS OPERATIONS

In order to remotely work with its private key, the VM must interact with the SP that interfaces the secure element grid. The VM is authenticated by the ID VM , the ID HV (and the HV private key) and the VM-Auth-Token. Two use cases are described: the use of an OpenID platform, and the use of RACS Protocol [START_REF] Urien | Remote APDU Call Secure[END_REF] compliant smartcard grids.

A. OpenID use case

As illustrated by "Fig. 4," the VM may access to the private key of the hypervisor stored in a secure element. It establishes a session with the grid service provider, and provides the ID HV , ID VM and VM-Auth-Token parameters (Step 1). It also request cryptographic operation with the grid, such as encryption or decryption with the VM private key. It is thereafter redirected toward the OpenID server (Step 2) that performs the authentication process with the HV secure element (Step 3).

Strictly speaking the OpenID server, authenticates the hypervisor, and is not aware of an existing functional link with the VM. At this step the service provider knows that the remote entity has access to the HV private key and is supplied with the appropriate credential (VM-Auth-Token).

Step 5-6, the grid service provider realizes the requested operation and returns the result ( Step 7).

Obviously the session between the VM and the grid service provider must be secured by the TLS protocol. In order to get a greater security level, the grid service provider may pack the result in a container, which is made of three parts:

 A header, which is the encrypted value of a symmetric AES key, with the HV public key, according to the PKCS#1 standard.  A body, which is the encrypted value of the result of the requested operation, according to an AES-CBC procedure.  A trailer, which is the signature by a trusted authority (identified by its public key) of the header concatenated to the body, according to the PKCS#1 standard. A trust issue may exist between the grid SP and the VM, because they do not necessarily share the same ring of confidence. In that case the container could be directly generated by the VM secure element, previously bound to the ID HV . This operation is performed by secure element administrator thanks to Global Platform mechanisms grid.

B. Grid Administration

The Grid administration is a sensitive topic, because the Secure Elements are not necessarily managed by the grid service provider. Hopefully the Global Platform Standards [START_REF]Global Platform standards[END_REF] provide all the mechanisms needed for a remote and secure management.

Secure Elements are equipped with symmetric secret keys used for mutual authentication purposes; secure channels are available for embedded application, loading, activation or deletion.

Thanks to these facilities, secure elements may be bound to an ID (such as ID HV or ID VM ) and protect their produced information by containers, which can be only decrypted by the authorized entity (either a hypervisor or a virtual machine).

However, a specific access is needed for allowing these operations. A TLS proxy could be used such as RACS (Remote APDU Call Secure protocol) [3][4], in order to transport ISO7816 commands and to convert them in a format compatible with the grid protocol.

V. CONCLUSION

The architecture proposed and implemented in this paper presents a solution for the IdM in the context of the SecFuNet project, which aims to develop a highly secure identification scheme, for Cloud Computing, based on the OpenID protocols integrated with secure elements (smartcards and the secure elements grids).

The SecFuNet identity model addresses two kinds of elements and some layers of visibility. For each of them an identity platform is provided dealing with OpenId server, secure elements and grids of secure elements.

This integration provides a higher level of security when compared to traditional password authentication, and establishes trust relationships among the resources (users, IdPs and SPs), and eliminates the vulnerabilities like phishing attacks. This IdM is heavily dependent on those classes of secure elements. User strong authentication is done directly between smartcards (owned by users) and a grid of secure processors arranged in a SecFuNet IdP. The OpenID security is also enforced by these grids.

For the future, we intend to extend the base protocols to enable the federated IdM as well as a user-centric attribute control approach, i.e. establishment of trust relationships and transposition of attribute assertions to access services on all SecFuNet domains. Another ambitious goal of SecFuNet is to demonstrate and experiment with these proposals of IdM in order to reach a standard solution for identifying users and nodes in the SecFuNet architecture.

  III. GLOBAL MODEL OF IDM PROPOSAL As mentioned above, The SecFuNet architecture distinguishes two classes of entities: Nodes and user. The SecFuNet Users are equipped with two classes of secure elements: EAP-TLS smartcards or PKCS#1 smartcards, used to open TLS secure channels with strong mutual authentication.

Fig. 1 .

 1 Fig. 1. SecFuNet : Global Model of IdM Architecture

Fig. 2 .

 2 Fig. 2. Operations dealing with the VM private key in SecFuNet

Fig. 3 .

 3 Fig. 3. Operations dealing with the Application private key in SecFuNet

Fig. 4 .

 4 Fig. 4. Grid Service Provider in an OpenID Context

SecFuNet Project: "Security for Future Networks" is a coordinated project supported by the European Commission through the 7th Framework Programme, and by the Brazilian National Counsel of Technological and Scientific Development (CNPq).

OpenID Project: http://openid.net/specs/openid-authentication-2_0.html.

ACKNOWLEDGMENT

This work has had financial support from CNPQ through process 590047/2011-6 (SecFuNet project) and also through processes 307588/2010-6 and 384858/2012-0. We also thank CAPES for the financial support with PhD scholarship.