Table Of ContentMessages that Motivate Safe Computing Behaviors 1
Messages that Motivate the Adoption of Safe Computing Behaviors
Kelline Greaves
July 5, 2017
University of Minnesota
School of Journalism and Mass Communication
Professional M.A. in Strategic Communication Capstone
MESSAGES THAT MOTIVATE SAFE COMPUTING BEHAVIORS 2
Table of Contents
Executive Summary ........................................................................................................................ 4
Introduction ..................................................................................................................................... 6
Literature Review ............................................................................................................................ 8
Health Belief Model .................................................................................................................. 10
Extrinsic Motivators .................................................................................................................. 10
Theory of Planned Behavior ..................................................................................................... 11
Function of Attitudes ................................................................................................................ 12
Persuasion ................................................................................................................................. 13
Fear Appeals ......................................................................................................................... 13
Rational, Confidence-Building Appeals ............................................................................... 14
Method .......................................................................................................................................... 15
Institutional Review Board Approval ....................................................................................... 16
Recruitment ............................................................................................................................... 16
Participants ................................................................................................................................ 18
Findings ........................................................................................................................................ 23
Perceptions of Safe Computing ............................................................................................ 23
Fear-Based Messaging Compared to Rational, Confidence-Building Messaging ................ 31
Discussion ..................................................................................................................................... 37
Attitudes, Social norms, and Behaviors ................................................................................ 37
MESSAGES THAT MOTIVATE SAFE COMPUTING BEHAVIORS 3
Fear-Based Versus Rational, Confidence Building Messages .............................................. 37
Limitations and Future Research .................................................................................................. 39
Recommendations for Communicators ......................................................................................... 41
References ..................................................................................................................................... 43
Appendices ..................................................................................... Error! Bookmark not defined.
Appendix A – Consent Form .................................................................................................... 47
Appendix B – Focus Group Instructions .................................................................................. 49
Appendix C – Fear-Based Flyer ............................................................................................... 50
Appendix D – Rational, Confidence-Building Flyer ................................................................ 51
Appendix E – Focus Group Notes ............................................................................................ 52
Focus Group 1 ....................................................................................................................... 52
Focus Group 2 ....................................................................................................................... 66
Participants ................................................................................................................................ 67
Focus Group 3 ....................................................................................................................... 91
MESSAGES THAT MOTIVATE SAFE COMPUTING BEHAVIORS 4
Executive Summary
Cybercrimes are becoming more prevalent, sophisticated, and costly. Information
security’s technology interventions alone cannot stave off all cyberattacks. Rather, individual
behaviors are instrumental to cybercrime prevention and self-protection. Research into
motivating safe computing behaviors examine a range of strategies, including leveraging the
health belief model, incentives, and persuasive communication. While the reviewed studies had
promising results, no authoritative remedy emerged, suggesting that the method selected be
tailored to audience. In addition, fresh research is required as the behavioral responses to
cybercrime adapt and change to meet the challenges of rapidly changing technologies. This
project intends to expand upon and advance safe computing persuasion research. Pursuant to the
theory of planned behaviors, through focus groups, this capstone project seeks to gain insight
into the attitudes, social norms, and behaviors of University of Minnesota employees in relation
to safe computing behaviors. Attitudes that emerged among focus group participants included
resignation, personal responsibility, practicality, and confidence. Several common social norms
were also identified, including that people do not tend to talk about their safe computing
behaviors with others; they tend to rely on businesses or organizations to safeguard their
information, rather than taking personal action to protect themselves; when dealing with highly
sensitive data, they follow required guidelines; and under normal circumstances people tend to
perform some, but not all of the safe computing behaviors they believe that they should. Finally,
perceptions of one’s ability to perform safe computing behaviors varied among participants
according to levels of confidence with technology, knowledge, and access.
In addition to applying the theory of planned behavior, this study also examines the
efficacy of fear-based appeals in comparison to rational, confidence-building appeals in
MESSAGES THAT MOTIVATE SAFE COMPUTING BEHAVIORS 5
motivating the adoption of safe computing behaviors. The majority of focus groups members
indicated that fear-based messaging conveyed greater urgency and a more salient rationale to
adopt the safe computing intervention, than did the more positive, confidence building message.
While many preferred a positive tone, they felt it was less motivating. The insights gained from
this research can inform messaging strategies used to persuade people to adopt safe computing
behaviors.
MESSAGES THAT MOTIVATE SAFE COMPUTING BEHAVIORS 6
Introduction
Cybercrimes can have devastating political, reputational, financial, and psychological effects.
Perhaps the most prominent example of cybercrime in headlines today is the phishing attack that
allegedly enabled the Russian government to interfere with the American democratic process
during the 2016 presidential election campaign. In part, the interference was made possible
through the theft of former presidential hopeful Hillary Clinton’s campaign emails which were
then leaked to the press to undermine her credibility as a candidate. The emails were susceptible
to theft because John D. Podesta, Clinton’s campaign manager, gave up his username and
password to a phishing attack that appeared to be a password reset notification. The information
security breach led to a chain of events that, many argue, had direct impact on the election of
Donald Trump (Lipton, E, Sanger, D & Shane S., 2016).
Another prominent example is the May 2017 “Wannacry” attack that installed
ransomware onto Windows computer hard drives, essentially holding the affected device
hostage until the owner paid money to the criminals. The computer owner’s only alternative
to paying the ransom was to wipe the hard drive clean, losing all data stored within. The
ransomware leveraged a vulnerability in Microsoft’s operating system, a problem for which
there was a remedy. Only people who had not installed Microsoft’s software updates were
exposed to this threat (Lee, 2017).
A common factor in these scenarios is human behavior. In each case, criminals relied on
people’s failure to perform safe computing behaviors that would help protect them from
attack. This assertion is supported by business leaders: “A recent survey of IT managers of
global companies indicates that people remain the weakest link for information security in
organizations...” (Van Kessel, 2008). Research studies have also found that users are not
MESSAGES THAT MOTIVATE SAFE COMPUTING BEHAVIORS 7
adopting behaviors to safeguard themselves or their organizations (Boss, S, Galetta D., et. al
2009; Siponen M., Mahmood M., Pahnila. S, 2009).
Scholars who study cybersecurity and safe computing behaviors have sought to understand
the nature and cause of this inaction in order that effective interventions and influence can be
developed to increase awareness and adoption of safe computing behaviors. The body of
literature on the topic is small in comparison to other areas of study as the academic world races
to catch up with the speed of technological innovation. Recent scholarship is focused in the areas
of cyber security awareness, attitudes, perceived behavioral control, motivations, and messaging.
A survey of studies on affecting safe computing behaviors reveals conflicting opinions on the
most effective approach. Some studies focus on incentives (external and internal), some believe
that role models and organizational culture hold the key, still others look to influence through
messaging. Because there are abounding audiences and disparate cultures, structures, and levels
of awareness, and because there are ever-changing threats, ways to address them, and
perceptions about efficacy or personal responsibility to safeguard one’s self, there may be no
panacea. However, if we are to curb the effects of cybercrime, it is valuable to understand the
variables affecting persuasion, attitudes, and behavior. Therefore, this existent body of safe
computing scholarship must be explored, validated, and expanded upon.
The study will apply insights from the literature and communications theories on fear-based
messaging and rational, confidence-building messaging. In addition, focus groups will be
convened with the intention of gaining insights into participants’ attitudes, social norms, and
perceived ability to conduct of safe computing behaviors. The purpose of this study is to advance
the understanding of ways in which messaging can motivate the adoption of safe computing
behaviors.
MESSAGES THAT MOTIVATE SAFE COMPUTING BEHAVIORS 8
Literature Review
Cyber security includes systems, policies, and behaviors designed to protect the data and
integrity of computing hardware and software belonging to or associated with an organization or
an individual. Cyber-attacks can include “Viruses erasing entire computer systems, intruders
breaking into computer systems and altering files, intruders using your computer or device to
harm others, or intruders stealing confidential information. The spectrum of cyber risks is
limitless” (Cyber Incidents, 2017).
For the purposes of this study, safe computing is defined as a subset of cyber security dealing
with the behaviors of individuals to guard against cybercrime. These include activities relating to
protecting access to information, such as using strong passwords, using unique passwords for
different accounts, using two-factor authentication, educating one’s self on how to identify cyber
scams, and updating software to ensure security patches are installed.
Globally, the costs to businesses are projected to top two trillion dollars by 2019 (Morgan,
2016). Costs to individuals are also being felt acutely. One form of cyber-attack is identity theft,
a crime in which someone steals one’s personal information, such as a Social Security Number,
to commit fraud. A recent report shows that in America, victims of identity theft lost more than
57 million dollars (see figure 1).
MESSAGES THAT MOTIVATE SAFE COMPUTING BEHAVIORS 9
Figure 1
Beyond the financial risk, there is also risk to one’s well-being. “While the financial losses
from identity theft are significant and the economic effects are far reaching, the socio-
psychological harm to victims is incalculable. One police officer observed that identity theft can
result in emotional and psychological trauma comparable to that experienced by victims of
repeated physical assault” (Dadisho, 2005).
Cybercrime is increasing in frequency, breadth, and severity, but most people’s defensive
behavior is not adapting quickly enough. Therefore, research has been undertaken to understand
and explain the lack of action by many to protect themselves from cyber-attack and ways in
which to affect changes to behaviors.
MESSAGES THAT MOTIVATE SAFE COMPUTING BEHAVIORS 10
Health Belief Model
Some researchers have looked toward the field of health and wellness as an analog to safe
computing. This stands to reason, as in both subject areas, individuals are asked to learn and
enact personal behaviors in order to prevent harm to one’s self and promote wellbeing. The
model was first developed in the 1950s by social psychologists who were working to understand
the failure of a free tuberculosis screening program. The theory attempts to understand patient’s
reluctance to adopt preventive health behaviors as related to patients’ beliefs and attitudes
(Finfgeld, D. L., et. al, 2003, Rosenstock I.M., 1974). The health belief model constructs of
susceptibility, perceived severity, cues to action and general health orientation are easily
translated to information security. In applying the health belief model to the context of cyber
security, researchers found that adoption of safe computing behaviors were increased when the
subjects had better awareness about the particular cyber-attack (e.g., malware), understanding of
the likelihood of the cyber-attack having an effect on the individual, and knowledge of
interventions they believed would work and they were capable of performing (Dodel, M., &
Mesch, G., 2017; Ng, B., Kankanhalli, A., & Xu, Y. 2009, Öğütçü, G., Testik, Ö M., &
Chouseinoglou, O., 2016).
Extrinsic Motivators
Other researchers examined the efficacy of extrinsic motivators (e.g., pressures or rewards)
as a means of promoting better safe computing habits. Research found that creating an external
pressure in the form of a perception of mandatoriness had a positive impact on adoption of safe
computing habits. Specifically, there was an impact in cases where subjects perceived that a
behavior was required by management, that management could evaluate whether or not the
behavior was performed, and where subjects believed that their compliance would be rewarded
Description:Messages that Motivate the Adoption of Safe Computing Behaviors. Kelline Greaves. July 5, 2017. University of Minnesota. School of Journalism and
