Mamadou Camara
email: mamadou.camara@ims-bordeaux.fr

Yves Ducq
email: yves.ducq@ims-bordeaux.fr

Rémy Dupas

Remy Dupas
email: remy.dupas@ims-bordeaux.fr

Methodology for Prior Evaluation of Interoperability

Keywords: Enterprise Interoperability, Interoperability Measurement, Business Process Modeling, Business Activity Monitoring, Business Process Simulation

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Interoperability is the ability of two or more systems or components to exchange information and use the exchanged information without special effort on either system [START_REF]Access, Committee on Cataloging: Description &. Task Force on Metadata[END_REF]. Approaches developed in the literature to measure and improve interoperability can be categorized into qualitative and quantitative models. Qualitative models propose interoperability evaluation methods based on maturity models. Quantitative models use indicators to measure interoperability characteristics like time, cost and quality of interoperation. The main limitation of these approaches is that they are partial because the considered interoperability is disconnected from enterprise objectives. In this study, the goal is to propose a quantitative methodology for interoperability evaluation and improvement. For this, it is necessary to evaluate how interoperability investments participate to the achievement of enterprise objectives. A framework is proposed as a foundation to address this issue. This framework is based on the physical and the decisional systems of the GRAI conceptual reference model [START_REF] Doumeingts | The GRAI Methodology[END_REF]. The framework is composed of three complementary and connected layers: the interoperability investments layer, the operational interoperability impact layer, and the tactical and strategic interoperability impact layer.

The paper is structured in six sections. Section two presents the state of the art of Performance Measurement System and Causal Performance Measurement Models. Section three introduces interoperability measurement methods existing in the literature. Section four describes framework. The structured methodology is described step by step in the fifth section. To finish, a short example is given in section six.

Performance measurement system and causal performance measurement models

To evaluate interoperability we must connect it with enterprise objectives. For that purpose, we need, in the one hand, a Performance Measurement System to define performance indicators. In the other hand, we need a Causal Performance Measurement Models to analyze causation between indicators in the Performance Measurement System. A performance measurement system is a set of strategic objectives and performance metrics applied throughout the entire enterprise [START_REF] Managementor | Performance Measurement Systems[END_REF]. If we consider the literature, there are a lot of methods to define performance indicators or more generally performance measurement system starting from enterprise strategy or from customer satisfaction. Balanced Scorecard [START_REF] Kaplan | The Balanced Scorecard: Translating Strategy Into Action[END_REF] or the Performance Prism [START_REF] Neely | The Performance Prism:The Scorecard for Measuring and Managing s[END_REF] or QMPMS [START_REF] Bititci | Strategy management through quantitative modelling of performance measurement systems[END_REF] define the indicators focusing only to the strategic level. The definition of objectives in coherence with performance indicators and decision variables, and its extension to all levels are the main reasons why we've chosen to work with ECOGRAI. According to Kasperskaya [START_REF] Kasperskaya | Essays on Causal Performance Measurement Models[END_REF], causal performance measurement models were substituted for traditional performance measurement systems, because they enable not only to measure and control but, also guide the companies' performance. Balanced Scorecard strategy map [START_REF] Kaplan | Strategy maps: converting intangible assets into tangible outcomes[END_REF], Action-profit linkage (APL) [START_REF] Epstein | Linking Actions to Profits in Strategic Decision Making[END_REF] and the graph of decomposition [START_REF]Coherence analysis methods for production systems by performance aggregation[END_REF] belongs to the most important existing causal performance measurement models. For the methodology for interoperability evaluation a causal performance measurement model will be defined using elements from these three models.

Interoperability measurement

This section presents the literature of qualitative and quantitative measurement of interoperability. The INTEROP framework is used first to give some basic definition of concepts related to interoperability. It provides three explicitly defined interoperability dimensions to allow defining interoperability: interoperability barriers, interoperability concerns and interoperability approaches [START_REF]Architectures for enterprise integration and interoperability:Past, present and future[END_REF]. Barriers are incompatibilities of various kinds and at various enterprise levels. The incompatibilities obstruct the sharing of information and prevent from exchanging services. Interoperability concerns represent the various enterprise levels where interoperations can take place: Data, Services, Process and Business [START_REF]Architectures for enterprise integration and interoperability:Past, present and future[END_REF].

Interoperability approaches are basic ways to remove barriers: integrated approach, unified approach and federated approach [START_REF]Architectures for enterprise integration and interoperability:Past, present and future[END_REF].Solutions for interoperability remove barriers at a particular enterprise level (concerns), through a specific interoperability approach [START_REF]Towards a systemic formalisation of interoperability[END_REF]. The solutions are then respectively related to the three dimensions. Interoperability models that have proposed interoperability measures can be classified into qualitative and quantitative models. Mostly, qualitative models are designed as a mean of attaching a label or maturity level to a specific type of interoperability [START_REF] Thomas | [END_REF].

Each maturity level of a qualitative model is equivalent to an interoperability sophistication degree [START_REF] Tolk | The Levels of Conceptual Interoperability Model[END_REF]. Levels of Conceptual Interoperability Model [START_REF] Tolk | The Levels of Conceptual Interoperability Model[END_REF], System of Systems Interoperability (SoSI) Model [START_REF] Morris | System of Systems Interoperability (SOSI): Final Report[END_REF] and Organizational Interoperability Agility Models (OIAM) [START_REF] Kingston | An Organizational Interoperability Agility Model[END_REF] can be cited as qualitative models based on maturity levels.

Quantitative models are approaches that have numerical measures of interoperability characteristics [START_REF] Kasunic | Measuring Systems Interoperability: Challenges and Opportunities. s.l. : Software Engineering Measurement and Analysis Initiative[END_REF], [START_REF] Thomas | [END_REF], [START_REF] Ford | International Command and Control Research and Technology Symposium[END_REF], [START_REF] Chen | An Approach for Enterprise Interoperability Measurement[END_REF], [START_REF] Lebreton | Interoperability Impact Assessment Model: An Overview. Enterprise Interoperability II: New Challenges and Approaches[END_REF], [START_REF] Grandin-Dubost | Using IIAM to Assess Interoperability Investments: A Case Study. Enterprise Interoperability II. New Challenges and Approaches[END_REF]. The measurement of interoperability is done in operational phase of the collaboration between two enterprises and allows them quantifying their interoperability and being able to improve it. Some equivalence can be noted between interoperability measures defined in the literature:

• Quality of exchange [START_REF] Chen | An Approach for Enterprise Interoperability Measurement[END_REF] and connectivity [START_REF] Kasunic | Measuring Systems Interoperability: Challenges and Opportunities. s.l. : Software Engineering Measurement and Analysis Initiative[END_REF].

• Time of interoperation [START_REF] Chen | An Approach for Enterprise Interoperability Measurement[END_REF], data latency [START_REF] Kasunic | Measuring Systems Interoperability: Challenges and Opportunities. s.l. : Software Engineering Measurement and Analysis Initiative[END_REF] and cycle time [START_REF] Lebreton | Interoperability Impact Assessment Model: An Overview. Enterprise Interoperability II: New Challenges and Approaches[END_REF] • Reliability [START_REF] Lebreton | Interoperability Impact Assessment Model: An Overview. Enterprise Interoperability II: New Challenges and Approaches[END_REF] and conformity [START_REF] Chen | An Approach for Enterprise Interoperability Measurement[END_REF] In our opinion, time, cost and quality are limited number of measures which encompasses all other types of interoperability efforts. Measuring interoperability with these three characteristics is an interesting option that we want to develop in this study.

Interoperability evaluation framework

This work proposes a framework for evaluating interoperability in each one of partners collaborating in a supply chain (Fig. 1). The framework should enable an understanding of how interoperability influences the achievement of enterprise objectives. The framework is partly inspired by the Lebreton, et al.'s [START_REF] Lebreton | Interoperability Impact Assessment Model: An Overview. Enterprise Interoperability II: New Challenges and Approaches[END_REF] IIAM, but it is organized according to the GRAI conceptual reference model. The framework is composed of three layers: the interoperability investments layer, the direct (operational) impact layer and the tactical and strategic impact layer. The interoperability investments layer is aimed to study relations between elements located in the structural level of the physical system of the GRAI conceptual reference model. Theses elements are interoperability barriers, solutions for interoperability, internal or collaboration business processes and the business and interoperation activities they contain (Fig. 1). The main hypothesis of our model is that business processes can be broken up into business activities and interoperation activities.

Business activities are those which create value in business process. Interoperation activities are non-value-added activities representing efforts for the interoperability of information exchanges between partners. Solutions for interoperability eliminate interoperation activities by deleting interoperability barriers. This is the way internal or collaboration business processes are transformed by solutions for interoperability.

The direct (or operation) interoperability impact layer is composed of two sublayers. Its first sub-layer measures the interoperability impact on the operational level of the physical system of the GRAI conceptual reference model. This sub-layer contains business indicators, interoperation indicators and key performance indicators. Interoperation indicators are defined on interoperation activities and business indicators defined on business activities. Key performance indicators (KPI) are considered as aggregations of business and interoperation indicators of all activities of a business process in order to measure the performance of the latter. In the general case, this aggregation corresponds to the summation of indicators values of all activities. Interoperation indicators, business indicators and key performance indicators (KPI) are all of three types: Average Elapsed Duration, Average Cost and Percentage of Failure. These measures are first quantifications of the operational impact of interoperability investments on business processes in terms of performance. The second sub-layer is composed of decision centers of the operational level of the decisional system of GRAI conceptual reference model. It enables to measure the impact of interoperability in terms of achievement of objectives of the operational level. Some operational objectives are directly related to process key indicators while the others only indirectly.

Fig. 1. Interoperability Impact Evaluation Framework

In the first category, the objectives are measured by operational performance indicators that are equivalent to key performance indicators because they are defined as process cost, time or quality (left side Fig. 1). In the second case, performance indicators are not defined as measures of time, cost and quality of business processes (right side Fig. 1). They can be related for example to equipments used or peoples working on physical level. Objectives are not directly related to key performance indicators in this situation. The tactical and strategic impact layer uses the tactical and strategic performance indicators of the GRAI decisional system to evaluate impact of interoperability investments on high level objectives (Fig. 1). The framework is founded upon a performance measurement system and a causal performance measurement model. Indicators in the performance measurement system are grouped in four components: process KPIs, operational performance indicators (O_PI), tactical performance indicators (T_PI) and strategic performance indicators (S_PI).The causal performance measurement model links together indicators of the four components, and materializes relation between the layers of our framework. It establishes how interoperability impact at operational level translates into benefits at tactical and strategic levels.

Methodology for interoperability evaluation and improvement

The methodology that we propose aims to evaluate the interoperability and its impact in a supply chain. It is based on the interoperability evaluation framework. The methodology provides prior evaluation of interoperability in order to validate solutions for interoperability to be implemented on the basis of their capacity to improve the achievement of enterprise objectives. This prior evaluation takes place during "As-is" and "To-be" situation of the project. "As-is" situation describes how activities (physical system) and decisions (decisional system) are actually performed in the supply chain. "To-be" situation represents the transformations of the "As-is" situation expected as a result of the implementation of solutions for interoperability.

Steps in the methodology can be grouped in three blocks: Learning, Design and Validation. The learning builds a causal performance measurement model linking together process KPIs to performance indicators of the different levels in the decisional system (Fig. 2.). As all the variables of our causal performance measurement model are continuous, the task of predicting performance indicators from process KPIs is a numerical prediction. Our model is built with regression analysis because, according to Han, et al. [22 p. 24] it is the most often used statistical methodology for numerical prediction. The learning block builds also the "As-is" performance measurement system which represents averages of measures collected in the "As-is" situation. The Design block is aimed to find transformations needed in physical and decisional systems to solve problems related to interoperability (Fig. 2.). The validation block is aimed to validate solutions for interoperability by evaluating their improvement capacity. The first task is the evaluation of the "To-be" performance measurement system which is released in two stages (i Fig. 2.).

Fig. 2. Interoperability impact evaluation

First the "To-be" KPIs are estimated a prior by simulation of the "To-be" process model (i.1 Fig. 2.). The impact of the KPI improvement on operational, tactical and strategic performance indicators is predicted using the causal performance measurement model built in the learning block (i.2 Fig. 2.). The comparison between the "As-is" and the "To-be" performance measurement systems represents the improvement capacity. The validation of solutions for interoperability is the second task of this block (ii Fig. 2.) and it is based on the results of this comparison.

Application of the methodology

The example used to illustrate the applicability of our methodology is about a supply chain where an interoperability investment is undertaken to improve the quality of the collaboration. Partners involved in this collaboration are: the customer (an ecommerce company), the stockist, the customs declarant and the customs. The first element of our example is a "As-is" goods entry (collaboration) process in which all the four partners participate. To get the "To-be" goods entry process model, it suffices to take the model of "As-is" process and remove its interoperation activities. Influence relations between the variables of the causal performance measurement model were established by managers. The process KPIs component of the Performance Measurement System contains only the Computerization time measure. The Computerization time represents the delay between the moment when the customer places his order for goods entry and the moment when the Stockist informs him that goods entry is closed and the Material Accounting is updated. It is in the same time the Average Elapsed Duration of the goods entry process and an operational performance indicator for the objective "satisfy demand" of the goods entry decision center. The customers can run the goods output process and sell goods only once the goods are registered in the system. For this reason managers hypothesize that there is a causal relationship between Computerization time variable (process KPIs), and number of outputs of pallets per month (O_PI), number of outputs of boxes per month (O_PI) and number of outputs of units per month (O_PI). The Handling Turnover (T_PI) receives influence from theses three operational performance indicators. An improvement in Handling Turnover will drive an increase Handling Turnover in relation to staff (T_PI) and Sales turnover (T_PI). Both the Price of logistic services (S_PI) and Total turnover compared to department cost (S_PI) are impacted by the Handling Turnover in relation to staff (S_PI). The Sales turnover indicator belongs to the customer while others belong to the stockist.

Conclusion

This study aimed to provide the means for evaluating the interoperability and its impact on enterprises in a supply chain. We have proposed an analytical framework that introduces concepts related to interoperability and establishes their relations. The core element of this framework is the causal relationship between process key performance indicators and the objectives of partners, at all decisional levels. A structured methodology has been also proposed to perform the priori evaluation of interoperability. This methodology is organized around the validation and implementation solutions for interoperability. The use of business process models to locate interoperation activities and interoperability barriers and to measure performance is an important contribution of the methodology. That enables quantifying interoperation indicators with existing simulation and monitoring tools used in business process management.

In future work, the methodology can be completed with a posterior evaluation which would take place once improved business processes have been implemented using solutions for interoperability. Posterior evaluation would build "Implemented" Performance Measurement System and compare it with the one of the "As-is" situation in order to measure real benefits of interoperability investments.

Acknowledgement

This work was done in the frame of ASICOM (Architecture de Système d'information Interopérable pour les industries du Commerce), a project labeled by the "Pole de Compétitivité" PICOM of the region Nord-Pas-de Calais (Lille) in France and funded by the FUI (Fonds Unifié Interministériel). The Goal of the ASICOM project is to allow e-commerce companies to be connected at low cost, in short time and with flexibility to their partners and to the custom administration, using an interoperable information system. Examples used to illustrate the applicability of our methodology are taken from this project.


Adam Marks
email: marksa@erau.edu

Yacine Rezgui
email: rezguiy@cardiff.ac.uk

Keywords: Virtual Collaboration, Research Community, Security Awareness

Internationalization of research is reflected in the distributed nature of research communities. Research has a strong collaborative dimension. It is often carried out by non-collocated individuals and teams in the context of national / international funded programs, institutionally led projects, or simply self-motivated initiatives. Universities form a strong and influential component of these virtual research communities. Advances in information and communication technologies (ICT), including the Internet, have helped sustain these virtual research communities. However, despite the strategic nature of research, there exist various levels of awareness about the security risk factor linked with virtual collaboration. This study examines the security awareness of academics and researchers across higher education institutions with a focus on three different academic settings. The paper suggests that a security awareness program aimed at academics should be initiated across universities to pave the way to security aware research collaborative communities.

Security Awareness in Virtual Communities: The Case of Non-collocated Academic Research Collaborations 1 Introduction

Universities are among the least Information Systems (IS) secured environments [START_REF] Updegrove | Computers and Network Security in Higher Education[END_REF]. Only a fraction of universities provide security and conduct awareness training [START_REF] North | Computer Security Ethics Awareness in University Environments: A Challenge for Management of Information Systems[END_REF]. Colleges and universities are targeted for cyber attacks for two main reasons; first, is the vast amount of computing power they posses; and second, is the open access they provide to their constituents [START_REF]Governance, strategy, and practice in Higher Education[END_REF]. In addition, universities have a considerable amount of confidential and strategic information that makes them prone to IS security threats [START_REF] Katz | The Effect of a University Information Security Survey on Instructing Methods in Information Security[END_REF]. Most IS managers tend to focus more on technical security solutions such as firewalls, routers, and intrusion detection software; but much less on hazards caused by end users' lack of awareness [START_REF] Katz | The Effect of a University Information Security Survey on Instructing Methods in Information Security[END_REF]. And, while in general information security awareness is acknowledged, the number of studies that consider it in depth is limited. This may be attributed to (a) the non-technical nature of security awareness [START_REF] Siponen | A Conceptual Foundation for Organizational Information Security awareness[END_REF] and / or (b) its scope, as it falls outside the traditional engineering and hard computer science domains [START_REF] Dunlop | Social Relationship in Electronic Commerce[END_REF]. Never the less, organizations with strong technical security countermeasures, may still fail to protect their information systems. The human factor is considered the weakest link in the IS security chain [START_REF] Mitnick | The Art of Deception: Controlling the Human Element of Security[END_REF].

In any given network in today's connected globe, the level of one user's IS security awareness may have a direct impact on the level of IS security exposure of all directly or indirectly connected users within that network. Information technology and the Internet have helped create non-collocated communities. Academic and researchbased groupings form an important and influential component of these virtual collaborative research communities. However, despite the strategic nature of research (some of which subject to Intellectual Property Rights), there exist various levels of awareness about the security risk factor linked with virtual collaboration.

This study examines the IS security awareness levels of academics / researchers across different higher education institutions. The paper is structured into five sections. Following this introduction, the research methodology that underpins the research and relevant related work are summarized. Fieldwork results are then presented, followed by a discussion of the main findings. The paper concludes with key recommendations and directions for future research.

Methodology

The purpose of this study is to explore the levels of information systems security awareness of the virtual community of academic researchers who collaborate across different higher education institutions and environments.

The authors have used their own collaboration, extended to their institution and national academic environment, as the focus of this research. The first author used to be a member of staff of Zayed University in the UAE, prior to returning to the US as an academic member of Embry-Riddle Aeronautical University. The second author has during this period worked in two academic institutions in the UK, namely Salford University and Cardiff University. The focus of the research spans a duration of 4 years during which the two academics have collaborated across their respective institutions. Therefore, this study focuses on three academic environments in the UK, UAE, and the US and addresses the following main research question: Are higher education research communities aware of the security challenges involved with virtual collaborative working that underpins academic research?

An interpretive philosophical stance is adopted to conduct the research. The selected case study institutions not only exist in different environments, but also exhibit varying levels of security awareness and maturity while presenting some notable differences in their higher education vision, procedures and processes. To ensure consistency and validity of findings, multiple sources of data are gathered through the use of four main instruments: Interview, Questionnaire, Documentation, and Observation. The field work in Zayed University, Salford University, and Embry-Riddle University targeted research academics in different schools. This involved gathering 36 questionnaire responses and 10 interviews in the context of Zayed, 22 questionnaire responses and 10 interviews have been obtained in Salford, and 24 questionnaire responses and 8 interviews in Embry-Riddle University. Additional data was captured in the mode of direct observation [START_REF] Yin | Applications of case study research[END_REF] throughout the entire study. To measure the levels of users IS security awareness; the sources of data of this study targeted the following 10 themes: (a) User's IS security awareness of available and accessible IS systems, and their intended use; (b) User's IS security awareness of existing IS security policies, standards, and guidelines; (c) User's IS security awareness of existing IS security laws and legislation; (d) User's IS security awareness of available IS staff and personnel; (e) User's IS security awareness of possible IS security threats and concerns; (f) User's IS security awareness of possible IS security solutions; (g) User's IS security awareness of available IS security training session and materials; (h) User's IS security awareness of available IS security documents and help material; (i) User's IS security awareness and perception of the value of university data; (j) User's IS security awareness and perception of their role in university's IS security. The chosen 10 themes were selected from a variety of prior IS security awareness studies [START_REF] Cooper | Information Security Training-Lessons Learned Along the Trail[END_REF], [START_REF]Governance, strategy, and practice in Higher Education[END_REF], [START_REF] North | Computer Security Ethics Awareness in University Environments: A Challenge for Management of Information Systems[END_REF], [START_REF] Puhakainen | A Design Theory for Information Security Awareness[END_REF], and [START_REF] Siponen | A Conceptual Foundation for Organizational Information Security awareness[END_REF].

Related work

Information security awareness is concerned with creating and maintaining securitypositive behavior [START_REF] Kruger | A prototype for assessing information security awareness[END_REF]. According to the Information Security Forum [START_REF]The Forum's Standard of Good Practice for IS security[END_REF], information security awareness can be defined as (a) the degree to which every user understands the importance of information security, (b) the appropriate level of information security to the organization, (c) users' security responsibility, and (d) users' behaviors and acts. Reference [START_REF] Siponen | A Conceptual Foundation for Organizational Information Security awareness[END_REF] defines information security awareness as the state where users in an organization are aware of, and ideally committed their security mission defined by the organization's end-user security guidelines. Information security awareness may cover a range of topics, including: password construction, password management, authentication, Internet usage, telephone fraud, physical e-mail usage and security, private information, virus protection and detection, PC security, software licensing, backups, building access, social engineering, identity theft and home office security [START_REF] Rezgui | Information security awareness in higher education: An exploratory study[END_REF].

The majority of today's IS attacks are not concerned with only circumventing the authentication process of an individual or an organization; they are more inclined to access confidential information. This has resulted in IS threats like phishing, identity theft, and social engineering [START_REF] Dlimini | Information security: The moving target[END_REF]. While technical solutions are with no doubt necessary to address IS security problems, the consideration of humans, and more generally human factors, is equally important [START_REF] Rezgui | Information security awareness in higher education: An exploratory study[END_REF], [START_REF] Dlimini | Information security: The moving target[END_REF]. The effective implementation and use of IS security awareness practices can lead to improved security for organizations. Reference [START_REF] Bray | Security actions during reduction in workforce efforts: what to do when downsizing[END_REF] suggests that in order to avoid IS security breaches, organizations should provide users with IS security awareness training programs. The training program should cover areas like social engineering, password protection, and heightened physical security alertness. Reference [START_REF] Kovacich | Information system security Officer's Guide: Establishing and Managing an Information Protection Program[END_REF] takes a step further by suggesting that organizations should implement a continuous security awareness training programs as part of the corporate asset protection program. But while information security is a key organizational goal and users have a responsibility to maintain this goal, it is important to understand that the implementation of an information security awareness program does not warrant that all users within the organization will understand their roles and responsibilities when it comes to information security [START_REF] Albrechtsen | The information security digital divide between information security managers and users[END_REF]. Perhaps, this is why reference [START_REF] Puhakainen | A Design Theory for Information Security Awareness[END_REF] recommends a combination of measures to increase users IS security awareness. Reference [START_REF] Puhakainen | A Design Theory for Information Security Awareness[END_REF] suggests that organizations use IS security awareness training, campaigning, and reward and punishment to establish an effective IS security awareness program. Reference [START_REF] Cooper | Information Security Training-Lessons Learned Along the Trail[END_REF] believes that Continuous reinforcement of proper IS security practices is needed to remind individuals of their role in information security. Both [START_REF] Rezgui | Information security awareness in higher education: An exploratory study[END_REF] and [START_REF] Kruger | A prototype for assessing information security awareness[END_REF] recommend that a systematic approach to measure the effect of a security awareness program should be implemented to evaluate the contribution and the return on investment of such programs [START_REF] Kruger | A prototype for assessing information security awareness[END_REF].

Field work

This section provides a summary of relevant fieldwork data across the three selected academic environments extended to their regional and national context. This is structured according to the above listed driving themes that underpin the research.

User They also believed that the full responsibility of IS security falls on the shoulder of the Information Service Division. Surprisingly, many of these are IS users who had some sort of IS background, tend to take for granted and fully trust their institution in implementing security policies. On the other hand, the remaining 13%, was mainly academics from computer science and information technology disciplines who viewed their role as "first line of defense" to university IS security. 96% of the respondents in the UK university of Salford, and 86% of respondents from Embry Riddle viewed their role in the overall IS security cycle as important. More than 70% in both cases viewed the protection of their PC password and data as the main goals.

Discussion

The findings of this study indicate a considerable difference between the level of IS security awareness of academic researchers in the UAE and those of academic researchers in the UK and the US. The level of IS security awareness of academic researchers in each environment correlated with the level of IS security awareness supporting tools utilized in that environment as shown in table [START_REF] Rezgui | Information security awareness in higher education: An exploratory study[END_REF] and figure [START_REF] Rezgui | Information security awareness in higher education: An exploratory study[END_REF].

Respondents in the University of Salford and Embry-Riddle University appeared more aware of IS security-related matters than their counter parts in Zayed University. The higher level of IS security awareness in the case of the UK and the US can mainly be attributed to the existence of IS security awareness supporting tools and activities. The IS security function in the examined institutions in the UK and the US appeared more supported, coordinated, regulated, and centralized than that in the UAE. The majority of academic researchers in Zayed University were not aware of possible IS security threats and their role in defending against them. They were not aware of whom to reach in case of an IS security problem, and they were not aware of proper policies, standards, and guidelines that should govern their access and use of IS systems. It should be noted that (a) Academics from areas other than computer science and information systems exhibited a lower level of security awareness than academics with a computing background, (b) users with a computer science background tend to take for granted and fully trust their institution in implementing security policies which may result in overlooking basic security threats, and (c) academics tend to work from home, or while on the move (including conference venues, hotels, etc…) which makes them prone to wireless network security threats. The low-perceived value of IS security and the data stored by the examined institution in the UAE is a natural result of the lack of emphasis shown by the university management; which is visible through: (a) Lack of IS security training, (b) Lack of IS security policies, (c) Lack of IS security coordination. Inversely, the higher level of IS security awareness in the examined institutions in the UK and the US can be attributed to the university emphasis and commitment to IS security awareness, by: (a) Establishment, communication, and enforcement of IS security training programs, (b) Establishment, communication, and enforcement of IS security policies; (c) Establishment of a coordinated IS security function. While understanding that no single practice described will work everywhere, from the findings of this study, and in correlation with [START_REF] Mitnick | The Art of Deception: Controlling the Human Element of Security[END_REF] and [START_REF] Puhakainen | A Design Theory for Information Security Awareness[END_REF], the authors believe that the following steps have the potential to increase the level of IS security awareness, and consequently the level of IS security awareness in UAE and more generally academic institutions in developing economies:

Conclusion

The paper explores if higher education research communities are aware of the security challenges related to the virtual collaborative working that underpins academic research. The examined institutions are believed to be a typical representation of higher education institutions within the selected communities.

The findings of this study indicate that although the examined institutions presented a similar IS infrastructure, and employed similar IS security technical measures, the level of IS security awareness varied considerably. This variance can be directly attributed to the level of IS security awareness supporting tools and activities utilized by the institution. The study indicates that the level of IS security awareness correlated with the availability and enforcement of IS security awareness supporting tools such as training, policies, documents, and coordination. The low level of IS security awareness of academic researchers in the case of the UAE, and more generally academic institutions from developing countries, constitute a higher level of possible risk of IS security threats to other academic researchers from developed countries who undertake joint collaborative research. Developing countries tend to have a large underground market for illegal software [START_REF] Joseph | IT in the Middle East: Overview[END_REF] and an increased number of unaware users who can easily become easy targets to criminals and hackers.

Case Study

IS Security Policies

IS security Training

The main research question that underpins the paper deserves further and more indepth exploration using larger samples of academic users across institutions, while using larger collaborative academic networks or communities as case studies. This constitutes ongoing research to be reported by the authors in future publications.

Fig. 1

 1 Fig. 1 User's IS Security Awareness

  (a) Establishment and communication of IS security policies and procedures to academic members of staff; (b) Campaign and advertise IS security awareness best practices and IS security training sessions and materials; (c) Train academic members on IS security best practices to increase their awareness; (d) Reward secure academic collaborations and identify / disseminate ill security practices; and (e) Conduct continuous evaluation and readjustment.

's IS security awareness of available and accessible IS systems and their intended use

: The data evidence gathered for this category portrays that the examined institutions have a comparable IS infrastructure in terms of software, hardware, and network resources. The majority of academic researchers examined were aware of available IS resources. 87% of Zayed University respondents, 92% of University of Salford respondents, and 89% of Embry-Riddle University respondents referred to the availability of email, Internet, Intranet, extranet, IP telephony, wireless connectivity, course delivery, and administration applications, e-library system, and electronic databases. Most respondents were also aware of the intended use of these services. User's IS security awareness of existing IS security policies, standards, and guidelines: The examined institutions varied considerably in this category. Zayed University did not have any IS security policies, standards, or guidelines in place, while University of Salford and Embry-Riddle did. In terms of awareness, 74% of the respondents in Zayed University could not confirm the existence or the lack thereof of IS security policies, standards, and guidelines. Only 16% of the respondents in Zayed were able to confirm that no policies exist. 76% of the examined respondents in Salford, and 68% were able to reference existing universities' IS security policies, standard, and procedures.

User's IS security awareness of existing IS security laws and legislation:

  In 2006, the UAE government issued two laws to combat electronic trading and cyber crimes. All respondents in Zayed University were not aware of existing IS legislation. 64% of the respondents in Salford referred to the Computer Misuse Act and the Data Protection Act. 90% of the users learned about the two acts through the Information Services Division, while the remaining 10% were informed through other resources. Similarly, 41% of the respondents in Embry-Riddle referenced the Data Protection Act and the Computer Misuse Act, the Digital Millennium Copy Right Act, and the Electronic Communication Privacy Act. 74% of the respondents were informed of many of these laws through the Information Technology Department web site.

	respondents in Zayed University were able to identify whom and how to contact
	in case of IT-security related problem or question. 65% of the respondents in
	Salford, and 76% of the respondents in Embry Riddle referred to the IT
	department web site for contact information of IT support staff. While the IT
	department in Zayed University maintained a web page for the university, it did
	not maintain a web page for the department with the exception of the hardware
	and software Help Desk.
	User's IS security awareness of possible IS security threats and concerns:
	Respondents in Salford and Embry-Riddle scored higher than their counterparts
	in Zayed in terms of awareness of IS security threats. 74% of IS users in Salford
	and 82% in Embry-Riddle respondents were able to identify several possible IS
	security threats including denial of service attack, social engineering, shoulder
	surfing, and email spam, compared to 41% in Zayed University. Many of which
	had an IS background.
	User's
	User's IS security awareness of available IS staff and personnel: 32% of

IS security awareness of possible IS security solutions:

  Respondents in Salford and Embry-Riddle University also scored higher than their counterparts in Zayed in terms of awareness of IS security solutions. 80% of IS users in Salford and 84% of respondents were familiar with security solutions such as data back up procedures, virus protection, and password change rules, compared to 46% of the respondents in Zayed University.

User's IS security awareness of available IS security training session and materials: Although the Information Services Division in Zayed University offers periodical training session in Microsoft Office applications, it did not offer a single IS security training since the university inception in 1998. Naturally, none of the respondents were aware of any IS security training sessions. Respondents at Salford are required to attend an IS security training session as part of their orientation (Faculty, staff, and students). In addition to the mandatory session, the IS security coordinator offers periodical sessions throughout the academic year. In the Embry-Riddle University, IS security training is also part of the induction program for both faculty and students. Training materials are also available online.

User's IS security awareness of available IS security documents and help material:

  Similar to the training category, respondents in Zayed University were not aware of IS security documents and help material mainly due to nonavailability. 54% of the respondents at Salford, and 67% of respondents at Embry-Riddle University were able to locate key IS security documents and help materials. User

's IS security awareness and perception of the value of university data:

  46% of the respondents in Zayed University viewed university data as valuable and worthy of protection, while 54% viewed the university data as "of no interest to hackers". Many of these came from academics with less computer/IS background. 96% of the respondents in the University of Salford, and 88% Embry-Riddle University viewed university data as valuable, private, confidential, and worthy of protection.

	User's

IS security awareness and perception of his/her role in university's IS security:

  In this last category, 88% of the respondents in Zayed University believed that they have a role in IS security, 65% of which could not define it.

Table 1 -

 1 Used IS Security Tools

√ USA √ √ √


Giacomo Fiumara
email: gfiumara@unime.it

Dario Maggiorini

Alessandro Provetti

Laura A Ripamonti
email: ripamonti@dico.unimi.it

Knowledge Representation in Virtual Teams: a Perspective Approach for Synthetic Worlds

Keywords: Virtual worlds, Virtual teams, Ontologies, Folksonomies

Thanks to ICT, new organizational forms are emerging that keep the pace of an increasingly demanding competitive environment. Among them, Virtual Enterprises (VEs) and Virtual Teams (VTs) represent two challenging organizational forms from the point of view of effective management. An open issue in VEs/VTs is the social and economical sustainability of knowledge sharing in virtual environments, which is often underestimated. We address it from the point of view of "virtual worlds" and developed a prototypal solution that facilitates the cooperative building/sharing of knowledge representation.

Introduction

Barriers against effective integration among people belonging to different organizational functions/organizations are a well known phenomenon, whose complexity grows with the degree of virtualization of the organization: this problem becomes particularly relevant when "virtual enterprises" (VEs) and/or "virtual teams" (VTs) are involved. Barriers to integration proceed from socio-cultural misalignment among people belonging to different organizational environments, and they could be classified into five main classes (personality, cultural, language, organizational and physical barriers [START_REF] Vandevelde | Managing the design-manufacturing interface[END_REF]). Integration among different organizational units has been often addressed through the integration of information systems, achieved through the use of appropriate software applications. Anyway, this approach leads to failure in many cases, since it solves only part of the problem [START_REF] Tan | Barriers to virtual collaboration[END_REF]: good interaction among different functions/people can be achieved only when a good (social) interaction pattern is established among all the actors involved. This means that not only data and information systems should be integrated, but also -and perhaps mainly -social systems and social networks. This issue could be looked at as a problem of sustainability, For the purpose of this work, we adopt a description of sustainability which puts sustainable systems at the intersection of social, economic and environmental sustainability. In particular, we will put the accent on the interplay between the first two subtypes of sustainability (nevertheless, we underline that virtual organizations may positively impact on the environmental problems due, e.g., to a lesser need for trips and physical meetings [START_REF] Ripamonti | Managing the Design-Manufacturing Interface in VEs through MUVEs: a perspective approach[END_REF]). The economic sustainability of an effective VE/VT is intertwined with its social (from the perspective of its members) sustainability. In particular, we claim that the problem of social sustainability can be tackled through the lenses of a semiotic ladder [START_REF] Stamper | Signs, information, norms and systems[END_REF], which offers us a key to understand how to unfold integration into its different components (physical, empiric, syntactic, semantic, pragmatic and social), as shown in Fig. 1.

This paper is based on the theoretical assumptions derived in [26], that highlight how a sound and appropriate support to the higher levels of the semiotic ladder could be achieved through a perspective approach -rooted into both the socio-semantic web [START_REF] Cahier | Socio-Semantic Web applications: towards a methodology based on the Theory of the Communities of Action[END_REF] and the pragmatic web [START_REF] Schoop | The Pragmatic Web: a Manifesto[END_REF] paradigms -which couples formal and social interaction in virtual worlds. In particular, Multi User Virtual Environments (MUVEs) are considered suitable environments for supplying digital habitats to VEs/VTs which are sustainable both from a social and economic point of view. The idea is to combine the social capabilities of the current web2.0 applications with those of the semantic web in representing, managing, and retrieving explicit knowledge, within an immersive virtual world which extends and augments the actual one. Building on these bases, we describe the characteristics of a prototypal implementation of a tool for creating three-dimensional representations of knowledge in virtual worlds (see also [START_REF] Kahai | Team Collaboration in Virtual Worlds[END_REF]).

Three Paradigms for Sharing Knowledge and Social Interaction

We can define a VT as "a temporary arrangement of individuals belonging to different organizations and cultures, possessing different functional backgrounds, and working across different time zones on a common task" ([7], p. 61). This definition well describes how VTs are structured, nevertheless it is worth noting that the key factor for the existence of VTs is the possibility to rely on an effective communication system, based on digital technologies. This aspect has been too long underestimated, perhaps also due to the fact that digital-based infrastructures are more and more perceived as commodities, forgetting the increasingly relevant social implications of their use. And, as a consequence, forgetting that effective interaction among different organizational units must rely upon communication and not only on the mere sharing of data and information. To exploit effectively the opportunities offered by ICTs as enabler of integration, it is of fundamental importance to understand how ICTs can support communication, social interaction and knowledge generation and sharing among people, also and mainly when they become the principal (if not the only) means of interaction among the actors of the organization. Form this standpoint, three different paradigms have different pros and contras, as shown in Fig. 1 (for an exhaustive discussion on this topic, see: [START_REF] Ripamonti | Managing the Design-Manufacturing Interface in VEs through MUVEs: a perspective approach[END_REF]): -Semantic Web (SW) offers powerful tools for managing and retrieving explicit knowledge (i.e., ontologies, semantic search tools, etc.), while underestimates the aspects linked to social interaction and tacit knowledge management. Moreover, knowledge representations cannot be modified, updated or integrated with the degree of agility and flexibility needed by virtual organizations. This paradigm could be used to address at most the semantic level of the semiotic ladder. -Web2.0 (and Pragmatic web - [START_REF] Schoop | The Pragmatic Web: a Manifesto[END_REF]) is the expression of the social use of the web.

Through tools for sharing knowledge and information on a social basis (e.g., social tagging and folksonomies), it adds agility, flexibility, and portability to knowledge representations. Anyway, it has a number of drawbacks; such as the lacking of semantic tools for searching, the impossibility to create complex knowledge maps, etc. Moreover, the web2.0 is a mesh-up of different technologies, information sources, web sites, etc., thus lacking one specific point of aggregation able to become the "environment" for building relations supporting integration. Again, this paradigm is unable to support effectively enough the last two levels of the semiotic ladder, while -compared to SW -it could enhance the support to the semantic level. -Multi User Virtual Environments (MUVEs) are exceptional for augmenting actual lives of their users [START_REF] Boellstorff | Coming of Age in Second Life. An Anthropologist Explores the Virtually Human[END_REF]. They support effectively the extension of people actual social networks and they can be moulded into places that may become synthetic loci for sharing tacit knowledge and expertise (see, e.g. the SUN OpenWonderland Project). MUVEs can be exploited as synthetic environments for supporting the higher levels of the semiotic ladder (pragmatic and social world), hence they can be of help in lowering certain integration barriers. Unfortunately, at the moment, even the more developed MUVEs (i.e., Second Life -SL) are quite lacking from the point of view of formalized systems for collecting, sharing, retrieving and reusing knowledge (even in its explicit form). Again this approach alone is not enough. Hence, none of these paradigms -when adopted alone -seems to be a solution good enough to address effectively the problem of integration.

Towards Collaboratively Built, Shared, 3D Representations of Knowledge

Since its appearance, SL attracted the attention of researchers and practitioners, and several have been the experiments aiming at coupling virtual environments with semantic web applications running on external web servers [START_REF] Bogdanovych | Developing virtual heritage applications as normative multiagent systems[END_REF], [START_REF] Galanis | Naturalowl: Generating texts from OWL ontologies in Protégé and in Second Life[END_REF], [START_REF] Galanis | An open-source natural language generator for OWL ontologies and its use in Protegé and Second Life[END_REF], [START_REF] Kleinermann | Adding semantic annotations, navigation paths and tour guides to existing virtual environments[END_REF], [START_REF] Schneider | SEMSL: Tagging and data linking for Second Life[END_REF], and [START_REF] Oberlander | Building an adaptive museum gallery in second life[END_REF]; anyway, none of them seems to put the accent on the fundamental importance of the social factor in the process of sharing knowledge. On the other hand, several organizations (e.g., IBM, SUN, Northrop Grumman Corporation, etc.) are experiencing with SL as an environment for team building, but without coupling it with any semantic software application.

Representing Knowledge in a MUVE

In our project, we have designed and implemented a software application that brings into the virtual world the organization of a folksonomy, intended as a keywordsdeployed user annotation. The folksonomy is located outside SL and represented in the standard RDF notation (thus maximizing flexibility and accessibility by nonhuman agents), but it can be updated also by users (avatars and/or agents) from within SL. Hence, our solution blurs the distinction between consulting/annotating objects inside and outside SL and the distinction between user and agent annotations. The application is potentially available to all authorized avatars approaching its 3D representation. The conceptual representation can evolve through collaborative concepts' annotation and updating, thus making a shared semantic to emerge. From a strictly technical point of view, the long-term goal of our project is the creation of a knowledge base within SL that is accessible both to human users (through their avatars) and software applications. Our knowledge base will support automated access, selection, and consultation of the objects appearing on one or more specified SL loci.

Composition of the Knowledge Base: the SCOT Ontology

A Knowledge Base (KB) can be seen as a set of formulae that express information (knowledge) about an object or a resource which is to be described. By now, almost all semantics annotations on the web are expressed by means of RDF (Resource Description Framework). At the very bare, the attributes of a resource are described by means of properties which in turn are described within ontologies, which are publicly available through the web. In order to describe the composition of declarative languages used in our application, we have adopted the SCOT (Semantic Cloud of Tags) ontology [START_REF] Kim | Review and Alignmnet of Tag Ontologies for Semantically-Linked Data in Collaborative Tagging Spaces[END_REF], [START_REF] Kim | The State of the Art in Tag Ontologies: A Semantic Model for Tagging and Folksonomies[END_REF]. We briefly recall the properties of the SCOT ontology that were used more frequently in our application: -TagCloud. This class describes the main repository of the tagging activity, namely the cloud of tags. All other properties derive from this one.

-HasTag. This property describes the set of tags associated to an object. This property belongs to another ontology, namely SIOC (Semantically-Interlinked Online Communities). -Tag. This class describes the single tag belonging to a cloud of tags. It is a string used to identify a specified resource. -OwnAFrequency is a RDF DataTypeProperty used to describe the absolute frequency of occurrences of a tag; fore in detail, the total number of times the specified tag containing this property has been associated to an object. These properties have a hierarchical structure: TagCloud contains HasTag which in turn contains Tag, which contains OwnAFrequency.

Taxonomies and Folksonomies

A taxonomy defines both a hierarchical classification of concepts and the complex of ideas and rules with which object are classified. The taxonomic model seems to be in contrast with the folksonomic model, as in the former there is a well-founded rule to bind concepts while in the latter there is no rule at all. In this application we created a hybrid model which exploits hierarchical features of taxonomic model and the lack of rules of folksonomic model. In short, we created a folksonomy organized as a taxonomy. The only relationship established between concepts is that of inheritance between a concept and its ancestor. Since no other relationship is expresses, not even ordering among siblings to a common ancestor, the tree format is natural and sufficiently expressive. Of course, the scalability of this model is somewhat limited since the tagging of all conceivable concepts would produce a graph rather than a tree. Nevertheless, the goal of the model is the creation of a topic map, with an arbitrary depth, derived from a single concept.

Bridging the Gap between 3D Conceptual Maps and Web-based Folksonomies

The main result of the application is a KB with semantic models. The KB resides in a RDF native repository, and is reachable by the application within SL and/or HTTP protocols and/or plain TCP/IP connections. The database, being multi-protocol, allows for the content to be usable in different contexts, assuring the stability and availability of data from within different applications developed in environments different from SL. An high-level architecture of our application is depicted in Fig. 2.

Our application works as follows: associated to the 3D objects in SL there are scripts coded in LSL, the scripting language available in SL. When an avatar interacts with any of them one of the following actions takes place: a query to the RDF repository located outside SL, a tagging action of a resource, or the representation of the KB. Queries coded in SPARQL, the RDF query language, can be submitted from avatars as well as from users in the real world. The same tool allows to build multi-level topic maps. Topic maps can cover great lengths (w.r.t. Second Life virtual land), and may be composed by a large number of 3D objects; hence, the client application must be activated in locations where suitable resources are available. In order to preserve performances of the hosting server, topic maps undergo an automatic self-destruction after a timeout. The prototype of our application has been tested for a period of three months against a varying number of avatars. The response time and the scalability seem encouraging, even if estimating the performances of this application is not easy, as they depend on various factors. Among these factors the most relevant are the degree of network congestion, the load on servers, the number of 3D objects to manage, and the complexity of the submitted query.

Conclusions and Future Development

The virtualization of teams/organizations may negatively affect the quality of interaction and knowledge sharing among individuals, thus generating problems of socio-economical sustainability. VEs/VTs may exploit opportunities offered by ICT (that should be considered a critical success factor) as enablers of social interaction and knowledge sharing to partially overcome those constraints. To achieve this goal, it is necessary to deploy solutions able to build trust and empathy, improve and develop social relations, increase opportunities to interact, reflect interdependencies of tasks, formalize knowledge representation, bridge long distances, and create (in)formal meeting places. The major part of these requirements could be addressed through a socio-technical approach, aimed at designing solutions and applications able to foster knowledge sharing into digital social environments. At the moment the principal approaches to this problem (i.e., SW, Web2.0) are too focused on one or another of the problem's facets, lacking a holistic vision. In particular, they lack in supporting effectively online (synthetic) extension of people identity and relations, as well as the creation of synthetic "places" where social networks can live and evolve. These latter aspects of synthetic life can instead flourish in synthetic worlds (MUVEs), which are unable to offer a convincing solution for managing knowledge in a formalized way. To overcome those limits, we have presented a perspective approach that intersects SW, Web2.0 and MUVEs, aiming at providing tools for sharing knowledge in a synthetic social environment.

Fig. 1 .

 1 Fig. 1. Support offered by SW, Web2.0 and MUVEs to the "semiotic ladder".

Fig. 2 .

 2 Fig. 2. Schema of the application

  , variety, noise, entropy, channel capacity, codes, efficiency, redundancy, … PHYSICAL WORLD: signals, traces, physical distinctions, hardware, physical tokens, component density, speeds, economics, laws of nature, …

	SOCIAL	WORLD:	beliefs,	expectations,
	commitments, contracts, social law, culture, …
	PRAGMATICS: intentions, communications, conversation,
	negotiations, speech acts, …
	SEMANTICS: meaning, propositions, validity, truth, signification,
	denotations, …
	SYNTACTICS: formal structure, language, logic, data, records, deduction, software,
	files, …
	EMPIRICS: pattern


Paolo Crosetto
email: paolo.crosetto@unimi.it

To Patent or not to Patent: a Pilot Experiment on Incentives to Copyright in a Sequential Innovation Setting

. We study in the lab the choice of copyrighting or copylefting subsequent innovations in a dynamic setting à la Bessen and Maskin, introducing an innovative experimental design requiring real effort on the part of subjects. The players are asked to actually 'innovate' producing words from given letters, and face the choice to copyright or copyleft their words. Preliminary results show that copyleft is more likely to emerge when royalty fees are relatively high, and when the extendability, modularity and manipulability of inventions is enhanced.

Introduction

The standard economic argument in favour of patents and copyright states that, since knowledge is a public good with a high fixed cost of production and a relatively small cost of imitation, the state needs to grant for limited time a monopoly on the invention to allow the inventor to recover his costs, thus giving him an incentive to invest in the first place. While a long-standing debate in economics exists over the exact nature of the cost-benefit tradeoff at the base of intellectual property regulations from society's point of view, it has been widely assumed that an innovator would copyright/patent his innovation whenever given the chance to do so. This assumption seems to need further inquiry as we witness the rise of FOSS.

It has recently been suggested in the economics of innovation literature that the very nature of software -encoded, algorithmic knowledge -could generate incentives to disclose the creation of one's labour and ingenuity. It has been shown by [START_REF] Bessen | Sequential innovation, patents, and imitation[END_REF] that when innovations are sequential and research efforts are complementary, in a dynamic setting it is optimal for innovators to fully disclose their work, since every inventor gains from the marginal future contributions of others to his own innovation, made possible by the open nature of his contribution.

The converse argument, i.e. that in dynamic, sequential settings introducing intellectual property can slow down innovation, has been made several times in economics [START_REF] Scotchmer | Standing on the shoulders of giants: Cumulative research and the patent law[END_REF], and has recently been the focus of the literature about the socalled tragedy of the anticommons. The name derives from the famous tragedy of the commons paper by [START_REF] Hardin | The tragedy of the commons[END_REF]: while in the commons the absence of exclusive usage rights generated overutilisation and waste, in the anticommons the presence of overlapping and fragmented exclusion rights generates underuse and waste. The imposition of patents on research results generates an anticommons whenever every right holder independently sets a price for the license without taking into account negative externalities, with the result of general stagnation of downstream innovation. This mechanism has been outlined theoretically [START_REF] Buchanan | Symmetric tragedies: Commons and anticommons[END_REF][START_REF] Schulz | Fragmentation in property: Towards a general model[END_REF], analysed experimentally [START_REF] Depoorter | Putting humpty dumpty back together: Experimental evidence of anticommons tragedies[END_REF] and proved to be at work in the field of biomedical research [START_REF] Heller | Can patents deter innovation? the anticommons in biomedical research[END_REF].

In this paper we present the preliminary results of a new real-effort experimental design that enables to explore jointly, in a controlled setting, the intellectual property choices of subjects in a dynamic sequential innovation game and the aggregate consequences of individual behaviour in terms of anticommons. [START_REF] Buchanan | Symmetric tragedies: Commons and anticommons[END_REF] The model in Bessen and Maskin [START_REF] Bessen | Sequential innovation, patents, and imitation[END_REF] When innovations are sequential, each innovation is both an output and an input for further innovations developed by different inventors; the true value of the first invention might only be revealed when the original idea is extended, in directions possibly unforeseen by the first innovator.

In this context, copyright has ambiguous effects, from both the society and individual points of view, as Intellectual Property is likely to affect not only the revenue, but also the costs of the innovator. Copyright generates an expected stream of revenues for the copyright holder, thus providing incentives to put effort into the (costly) innovating activity. At the same time, follow-on innovators face the cost of licensing and increasing transaction costs if bundling of many innovations patented by different inventors is needed, thus generating a negative effect on the number of follow-on innovations.

A possible -if radical -solution to the anticommons problems in R&D would be for the innovator to release its discovery under copyeft licences ('privatecollective' innovation mode, [START_REF] Hippel | Open source software and the 'private-collective' innovation model: Issues for organization science[END_REF]). Nonetheless, while it is straightforward to see why a 'private-collective' solution could spread once initiated -innovators can freely use and improve upon increasing amounts of knowledge -it is harder to see why a self-interested innovator should voluntarily forgo any direct appropriation of revenue from his discovery, releasing it free to the public.

According to [START_REF] Bessen | Sequential innovation, patents, and imitation[END_REF], the very sequential nature of innovations can provide incentives to start sharing and to forgo direct appropriation through IP. In their theoretical paper patents are shown to be a valid policy tool -enhancing social welfare as well as providing incentives to innovate to all firms involved, thus increasing the likelihood of discovery -in a static model; when the same model is enlarged to include dynamics and sequential and complementary innovations, though, patents have a counterintuitive effect, and are shown, in line with the anticommons literature, to become hurdles to innovation rather than spurs, the social welfare being higher without patents than with them. More to our point, Bessen and Maskin show that if profit dissipation due to increased competition is low -i.e. if the availability of further innovations expands the market, increasing opportunities for further R&D on the one side and increasing the number of interested customers on the other -the firms themselves have an incentive not to patent their discoveries even if a patent system is available at no cost to them.

The present paper presents preliminary results of a new experimental design developed to test in the lab the argument of [START_REF] Bessen | Sequential innovation, patents, and imitation[END_REF].

Experimental design

The experiment has been designed to create a dynamic, interdependent setting in which subjects make choices in a collectively and dinamically co-created landscape. To simulate innovative activity, the experiment follows a real effort protocol; the players have to actually innovate -over a set of given rules -using both economic (experimental money) and cognitive (creative effort) resources.

The real effort task chosen is a sort of Scrabble game. The idea of using creation of words to mimic innovative activity in investigating FOSS has been pioneered by Lang et al. [START_REF] Lang | Designing markets for co-production of digital culture goods[END_REF], who design a double-auction market for words, inducing demand but leaving players free to make supply decisions. The design here presented differs greatly from theirs, their interest being in market design, while the main focus here is on sequential innovations.

The design chosen creates a situation in all respects similar to the [START_REF] Bessen | Sequential innovation, patents, and imitation[END_REF] model, but it is not a formal equivalent of the latter; rather, it is a transposition of the assumptions and workings of the model into an intuitive but controlled setting.

The copyleft game

1. Game structure. The game is played by 6 players. Players play in turns until there are no letters left in the letter set, with random assignment of starting positions. The players aim to maximise their monetary payoff from the game. Players get payoffs from two sources: 'use value' of the words they produced or extended, and '(net) royalty fee revenue'. The game interface is shown in Figure 3. 2. Letter set. The letter set is composed of 200 letters (see Figure 1). Frequencies of letters are the same as in standard Scrabble. Every letter comes with an attached payoff this letter will give the player when inserted into a produced or extended word. 3. Turns. In any turn, a player can make at most three actions: buy a random letter (for a fixed price); either produce a word or extend an existing word; decide whether to copyright or copyleft the produced word. Players 4. Buy phase. When it is their turn, players can buy a random letter for a fixed price, out of their show-up fee. If a player buys, a letter is drawn from the letter set (without substitution) and assigned to the player. The price is set at 2 experimental points, which is slightly above the expected value from the set, 1.89. 5. Words phase. Players collect payoffs by composing or extending words. A spelling check is performed on produced words. At every turn, every player can perform only one action in the words phase, either producte a new or extend an existing word.

-Producing words. Players may produce from scratch only three-letter words, called roots. This rule mimics the fact that an innovation must be more-or-less working when released. Production of a word generates a 'use value' payoff that is the sum of the values of the letters used to form the word. This payoff is incurred only once, the moment the root is produced. Produced words are common knowledge; the use of the root as input for extensions is instead subject to the IP choice of the creator. -Extending words. Players may extend existing words, by one letter at a time, inserting this letter in any position within the word or at its edges. Anagrams are not permitted. Words have no length constraints apart from the ones implicit in the English language. Example extension paths for the root car are car → care → scare → scared, or car → card → cards. Extending a word gives as payoff the sum of all the letters composing the extended word but might be subject to copyright fees to be paid to the word original creator. 6. Spellchecker. To avoid language skills biases, the players are provided with an interactive free-access spellchecker embedded in the main game interface. 7. Word availability. Extended words do not replace existing roots, but exist in parallel to them. A root can be used by different extenders to generate different word trails. 8. Intellectual Property Phase. Players that have produced new roots must decide whether to copyright or copyleft the word or extension. The IP choice cannot be undone in later stages and lasts throughout the game. (a) Copyrighting. Copyright can be obtained free of charge, and gives the copyright holder the exclusive right over the use of his root/extension. This implies that no other player can produce the same root/extension and that the copyright holder will receive a royalty fee every time some player uses it for an extension. The fee is fixed, and is proportional to the value contributed to the word. A root which value is v generates a fee of αv, in which 0 < α < 1 is a fixed known parameter. Every extension falls under the same rule, and if the value added to the word is w, an extension generates a right to obtain a royalty fee of αw. The n th extender of a word of value v + w pays α(v + w) in fees, distributed automatically to other players according to the value contributed. Free copyright (an irrealistic assumption) has been introduced to strengthen the external validity of the emergence of copyleft in the lab. (b) Copylefting. Copyleft is free of charge. It gives the copyleft owner no exclusive rights, but it endows users with a large set of use, redistribution and modification rights. Extenders can use the word as an input for free, but they are not allowed to copyright their extension. When extending a word, a copyleft extender earns all of the use value of the word, without having to pay any fee, but not getting any further fee from extenders either.

The game described above has been designed to share as many features as possible with the model in [START_REF] Bessen | Sequential innovation, patents, and imitation[END_REF], but it is not a perfect match. Every deviation from Fig. 3. The main interface for the Copyleft Game the model was made on the safe side, lowering the likelihood that the Bessen and Maskin outcome would emerge.

Experimental results

The pilot experiment was held in October 2009 in the EXEC lab, University of York, UK. The software was developed in Python [START_REF] Van Rossum | Python reference manual[END_REF]. The experiment involved in total 23 English native speakers. Four sessions of 6 players were run, divided into two treatments: in the low-fee treatment the royalty parameter was set to α = 0.7, while in the high-fee treatment it was set to α = 0.9. We expected the low-fee session to show less copyleft activity and anticommons problems than the high-fee sessions.

Copyleft emerged in three out of four sessions (the two high-fee and one of the low-fee), dominating one; anticommons features (underuse of resources, low cooperation, lower payoffs) emerged in the two high-fee sessions as expected.

General results

The sessions differed from one another in many respects. Two main problems for data analysis emerged: first, Session 4 featured only 5 players instead of the standard 6; second, in Session 3 the players found a clever way of altering the game rules to their advantage, and hence played a completely different game. Safe comparisons can be made between Session 1 (low-fee) and Session 2 (highfee). Results from Session 3 will be separately discussed (Section 4.4).

The experiment showed significant emergence of copyleft in the high-fee treatments, and a number of recurring features.

1. The number of roots created is 30 in all sessions. What differentiates the sessions is the number and nature of extensions; the behaviour of follow-on innovators determines social welfare and payoffs. 2. Payoffs are significantly higher in the low-fee Session 1 w.r.t. the high-fee Session 2 (Mann-Whitney U, p-value = 0.041, K-S p-value = 0.1429) and less so w.r.t. Session 4 (Mann-Whitney U, p-value = 0.129, K-S p-value = 0.5909). 3. The high-fee treatment sessions resulted in a lower number of words created, and in a higher waste of productive resources (unused letters), resulting in lower average payoffs. In high-fee sessions players tended to extend their own roots and to avoid other player's roots, to access which they had to pay royalties; this behaviour created quite isolated word trails and lower extension opportunities. 4. Copyrighted roots are much more likely to be created than copylefted roots.

Players did not create any (but one on the very last period) copylefted root in Session 1 (low-fee), but did create 5 and 1 copylefted roots in Sessions 2 and 4 (high-fee)

Low-fee High-fee Session1 (6) Session3 ( 6) Session2 ( 6

5.

Copylefted roots are three to seven times more likely to be extended than copyrighted roots. Once copylefted words exist, the incentives to extend them are higher, because the foregone royalty from one's extension is more than counterbalanced by the fact that no royalties are paid on the root. 6. Copylefted roots generate a two to four times higher exploration of extension possibilities (see 'Relative Extensions' rows in Table 1). The 'average relative extensions per root' index was computed as the average of the ratio of the actual number of extension of each root and the theoretically possible number of extensions of each root allowed by the English language. 7. Copylefted words are on average longer and have higher value than copyrighted words. This is because copylefted words are extended more and new roots tend to be copyrighted but not extended: when faced with the choice of copyrighting or copylefting a root, the player most of the time decides to copyright it; but this decreases the likelihood of follow-on innovations to be built on top of that root, and hence slows down the pace (extensions per root), and reduces the exhaustivity (relative extensions per root) of further inventions. 8. The amount of royalties paid or received is higher in low-fee sessions. When fees are low, players tend to seize the best opportunities available to them irrespectively of the fact that there is a royalty to be paid: this results in a high number of words, lower letter waste, and a high amount of royalties exchanged. When royalties are higher (high-fee treatment) players tend to restrict their innovative efforts to the 'free' roots, either copylefted or owned by the extender, and hence many opportunities are missed, a higher number of letters is left unused and a lower amount of royalties flows in the system. 9. Players used the spellchecker extensively -on average more than 100 times -in all sessions. There is no significant correlation between the use of the spellchecker and the result in terms of payoff for the player.

A treatment effect can be argued to exist. Copyleft emerged and saw sustained contributions in high-fee sessions, while it did not emerge in low-fee session; anticommons features appeared in (high-fee) sessions, in which payoffs were lower, number of unused letters higher, and royalty flows reduced.

The paradoxical effect that better patent protection results in a lower amount of innovations, one of the central points in [START_REF] Bessen | Sequential innovation, patents, and imitation[END_REF] is reproduced in the lab; moreover, players recognise the mild incentives to copyleft, and provide some (though not many) copylefted roots; once a copylefted root exists, players reap much more benefits from it, extending it further and deeper, than from copyrighted roots. There is not enough evidence, though, to support the stronger argument in Bessen and Maskin's paper that in a sequential settings the firms prefer not to patent their innovations, relying on subsequent innovations rather than on royalties from upstream contributions: if that were the case, we would have recorded a surge in copylefted roots as the game progressed. What happened instead was that in all sessions players preferred to release the roots created as copyright, even when this generated a suboptimal anticommons situation; nonetheless, players preferred to extend existing copylefted roots much more than they extended copyrighted roots, and hence copylefted words appeared and accounted for up to a quarter of all words created.

Session 1 (low-fee): copyright and business as usual

Six subjects participated in Session 1, a low-fee treatment. In the session 112 words, all copyrighted but one, were produced: on average, every player produced 18.7 words, 3.6 words per period. The only copyleftd word was created in last turn by the last player, when the choice was of no importance any more. The session describes a 'business as usual' situation. Players copyrighted every root created and pursued the most profitable extensions without taking into account the royalty fee. 81.4% of the extensions came from extending a root created by other players, and hence incurring the royalty fee; conversely, only 18.6% of extensions were built upon own words (Figure 4). Since a player is likely to produce one sixth of the roots, this figure implies that, on average, the players extended any root available and had no biases favouring their own creations.

Royalties make up an important share of players' payoffs. In the session the net added value created was 471 experimental points (worth 47.1£); royalties exchanged were worth 268.8 points, i.e. 57% of the value added.

The effect of royalty flows on individual payoffs can be appreciated in Figure 5: some players produced a lot of added value, but paid high amounts in royalties to do so, while other players produced fewer -but more likely to be extended -roots and extensions, and received a consistent amount of royalties. The two strategies are somewhat complementary: some inventors prefer to create many, if marginal, innovations; others focus on seminal, if fewer, innovations. The session showed an intellectual property system working well: copyright does not get in the way and royalty fees are considered low enough not to block follow-on innovations. Copyright generates considerable incentives to innovate rewarding the creators of the best innovations (in this case, the most extendable) through royalties and the hard-working 'marginal' inventors through usevalue of their marginal inventions. No 'tragedy of the anticommons' appears, as downstream innovators are not blocked in their endeavour by excessively high royalties, upstream inventors can trust that their roots will be used, and royalties flow from the marginal inventors, extending existing technologies, to the basic inventors, creating promising roots. In an ideal situation of perfect information, with no transaction nor legal costs associated with IP and with low, fixed and ex-ante known royalty fees, the copyright system works and delivers incentives to different types of innovators.

Session 2 (high-fee): copyleft and anticommons

Six players took part in Session 2, a high-fee treatment. The players left 23 letters unbought and 23 more unused. The players created 84 words, of which 22 copylefted: 14 words per player and 2.5 per period. The session showed both the emergence of copyleft and of anticommons gridlock: players in Session 2 created less words and enjoyed lower final payoffs w.r.t. Session 1 (see Table 1); moreover, the letter waste was double (46 vs 23 unused letters), the net value added half (237 vs 471), the average length (3.76) and value (6.6) of the words produced was substantially lower than in Session 1 (4.18 and 7.45).

73.8% of the words created were copyrighted, 26.2% copylefted. The players created 32 copyrighted extensions from 30 roots (1.07 per root), and 17 copylefted extensions from 5 roots (3.4 per root, three times as much). Copylefted words are furthermore longer and more valuable (see Figure 6). The best efforts of the players were directed to extend copylefted words. The players showed a somewhat schizophrenic behaviour: when creating new roots, players opted for copyright, hoping to enjoy a royalty stream from extenders, but, when extending, preferred to extend either their own or copylefted roots (Figure 8, right). This resulted in a mild but significant 'tragedy of the anticommons'; the players could have broke out of it either by adopting a 'business as usual' strategy as seen in Session 1 (but the high royalty fee seems to have made this less likely) or by starting to create copylefted roots. Having failed to do both, the players ended up producing less words and earning lower payoffs. Players started copylefting roots at the very beginning, and switched to copyright after the first 'defections', replicating the usual 'decay of contributions' phenomenon of Public Good games (Figure 8, left). After period 8 all newly created roots were copyrighted; nonetheless, copylefted roots continued to be extended during all the rest of the game, possibly to avoid paying royalty fees to the other players.

The players tended to extend other player's roots much less than in the lowfee treatment: only 51% of the extensions came from a root owned by another player, down from 81.4% in Session 1 (Figure 8, right). This resulted in many opportunities for extension being lost.

In Session 2 anticommons effects appeared, breaking the flow of innovations and resulting in lower value added and lower payoffs. Awarding a higher royalty to innovators generates the perverse effect of lowering the amount of innovation created in the system, at the same time not benefiting the inventors. Upstream patents, coupled with high royalty fee, discourage follow-on inventors to innovate on top of someone else's basic research on the one side, and to invest tout-court on the other hand (unused letters). Contrary to expectations, though, players fail to see the incentive to get rid of the patent system altogether, as argued by [START_REF] Bessen | Sequential innovation, patents, and imitation[END_REF]: they extend copylefted roots but do not forgo the (low, given the behaviour of players) expected stream of royalties from copyright. This fact could lead to argue that while incentives to copyleft exist, they imply a much more forward looking attitude than the one displayed by subjects in this session.

Session 3 (low-fee): learning to cheat and copyleft

Six subjects participated in Session 3, a low-fee treatment. The session is radically different from the others, because of cheating behaviour on the part of the subjects that was not foreseen and hence not stopped by the software. When the cheating behaviour was noticed, it was decided to let the session proceed to see what this 'innovative' behaviour would mean in terms of aggregate statistics.

Early in the game, a player accidentally found a bug in the software: she extended 'new ' into 'wine', and was not stopped by the system. The software was not designed to check the order of the remaining letters of the root, thus leaving the door ajar for a particular kind of anagram, generated by adding one letter in any position and displacing the other letters at will. Actually created examples of this anagrams are given by lady → delay, preen → opener. All other types of extensions were correctly turned down by the software, including simple displacement (with no added letter, e.g. not → ton) and inclusion of more than one letter (e.g. sit → shift). This new rule implies higher tinkering possibilites and higher payoffs, but at much higher cognitive costs, and it allows for a highly enhanced extendability of words, thus giving less incentives to create new roots.

After the first player successfully anagrammed a root to form an extension, the other players noticed and, all but one, endorsed the new practice. Around period 20, five out of six players were exclusively using the new rule. A further consequence of this endogenous discovery of value-enhancing rules was that the players eventually abandoned copyright completely: given the much enhanced extendability, players found it much more profitable to copyleft the word and then build on the contributions of the other players than to rely on royalty fees that were unlikely to be received anyway.

The results of the new rules were striking. In the session 154 words were created, 25.6 per player and 4.5 per period; the net value added reached the level of 968, twice the level of Session 1, and four times the level of Session2; the royalty flow accounted for a mere 7.4% of it, and the unused letters were just 16, the lowest value of the experiment. The average value and length of copylefted words increased during the experiment much more than those of copyrighted words (see Figure 10), and the percentage of copyrighted words dropped steadily, ending at 29.2% (see Figure 11).

In Figure 12, left, it can be seen the point, around period 10, when the new rule began to spread. The creation of new copyrighted roots did not stop altogether, but continued at a much lower pace. The breakdown of payoffs records the importance of copyleft for the very high final payoff enjoyed by subjects (Figure 13). The number of extensions generated using a copyrighted root (see Figure 12, right) dropped to 12%, as did the use of own roots; three-quarters of extensions were built on top of the existing 4 copylefted roots, with an impressive 26.25 extension for each copylefted root.

The session showed two important facts: first, the players learned, from observation and trial and error, a superior set of rules and adopted it quickly; second, when extendability is enhanced the incentives to copyleft are much higher, and the role of copyright is more limited.

Session 4 (high-fee): copyleft and anticommons

Only five subjects participated in Session 4, a high-fee treatment. The players created 91 words, of which 9 copylefted; 18 words per player and 2.67 per period. The session had many results in common with Session 2, the other high-fee session: the players were affected by the high royalty fee and preferred to extend their own roots rather than pay royalties to the other players (Figure 14, right); this resulted in a substantial letter waste (47 unused letters), low payoffs (average 15.7£), a low number of words produced (even though higher than in Session 2), low average word length (3.89) and value (6.76).

In this session copylefted roots were extended deeper and further than copyrighted ones, but the players failed to find a way out of the anticommons: all roots but one were copyrighted, despite the fact that players were not likely to extend other player's roots (just 28% of extensions came from a paid root). The 'isolation' of players was the highest of all sessions, with 58% of extensions created from one's own set of roots (Figure 14, right). As in all other sessions, the copylefted words showed a higher average value and length than the copyrighted ones (see Figure 15); here they represented just 10% of the overall value, though, and had a minor impact on payoffs (Figure 17). Royalties also played a minor role: the total net value added was 288, with royalty flows at a low 71.1, 24.7% of the added value. This was due to the high reliance of players on own roots rather than on cross-fertilisation of word trails with other players.

Session 4 confirms that when royalty fees are high, players fail to build innovation on top of other players' roots, reducing the number of profitable opportunities. Copyleft is a possible way out of this gridlock situation, but players fail to recognise this fact.

Conclusions

This paper sets up a dynamic real-effort experimental game to test the argument of [START_REF] Bessen | Sequential innovation, patents, and imitation[END_REF] that in a dynamic setting featuring sequential and complementary innovations the innovators themselves would, at certain conditions, prefer not to impose copyright on their creation and instead welcome imitation.

Even if the statistical validity of such a small experiment is admittedly very low, preliminary results show that both anticommons problems copyleft are more likely to emerge when royalty fees are relatively high. Increasing intellectual property rights leads to less innovation and to potential gridlock on the one hand, and to firms giving up copyright protection and embracing 'open' innovations. Copyleft emerged and saw sustained contributions in high-fee sessions, while it did not emerge in the low-fee session; anticommons features appeared in highfee sessions, resulting in less innovations created, lower payoffs, higher number of wasted resources (on the form of unused letters), and reduced royalty flows, w.r.t. low-fee sessions.

The paradoxical effect that better patent protection (higher fees) results in a lower amount of innovations is reproduced in the lab. There is not enough evidence, though, to support the argument that in a sequential settings the firms prefer not to patent their innovations, relying on subsequent innovations rather than on royalties from upstream contributions.

The experiment is also potentially able to account for the gradual engagement in the production of Open Source software of more and more corporate giants. In the experiment, while it is hard to find someone willing to start a copyleft trail, the incentives to contribute to the copyleft commons with extensions once such an alternative exists are high. This leads, in time, to the building of a sizeable body of copyleft roots and extesions. As this grows, more and more subjects -even the ones that would strongly prefer copyright -have incentives to extend the copyleft words, because they take out more and more value from the commons. The copyleft rule forces them to give away any rights on their marginal contributions; but, as the size of the copyleft commons increases, the cost-benefit balance of contributing to it shifts gradually to the benefit side. The copyleft clauses are able to create a growing commons; no matter why the first contributors decided to forgo their copyright fees, the existence of a free alternative is an attractor for a larger and larger number of developers.

The preliminary experimental evidence calls for further exploration of this experimental design, both deepening -i.e. with more replications of the same treatments, to gain statistical significance -and widening the research agneda. The word-game design could be used as a platform for testing the effect of different intellectual property policies or different technological settings on the amount of innovative activity, licensing choices, social welfare, commons and anticommons problems. The experimental design would allow for instance to test the consequences on innovation levels and quality of varying the length and breadth of patent protection, or varying the menu of licenses available, or allowing patent pools.

Fig. 1 .

 1 Fig. 1. Letter set used for the game

Fig. 2 .

 2 Fig. 2. Actions available to the players in every turn

Fig. 4 .

 4 Fig. 4. Distribution of extensions by root type, session 1

Fig. 5 .

 5 Fig. 5. Breakdown of payoffs, session 1

Fig. 6 .

 6 Fig. 6. Average word value and length per period per type, session 2

Fig. 7 .

 7 Fig. 7. Share of copyrighted words, length and value per period, session 2

Fig. 8 .Fig. 9 .

 89 Fig. 8. Session 2: Words created by period and by type (left) and extensions by root type (right)

Fig. 10 .

 10 Fig. 10. Average word value and length per period per type, session 3

Fig. 11 .Fig. 13 .

 1113 Fig. 11. Share of copyrighted words, length and value per period, session 3

Fig. 15 . 4 Fig. 16 .

 15416 Fig. 14. Session 4: Words created by period and by type (left) and extensions by root type (right)

Table 1 .

 1 Summary data for the four experimental sessions

	) Session4 (5)