Identifying the values associated with users ’ behavior towards anonymity tools through means-end analysis

A B S T R A C T Concerns about privacy and frustration over censorship and content blocking urge a great number of users to use privacy enhancing products. This research focuses on anonymity tools, as a Privacy Enhancing Technology (PET), investigating the human values associated with users ’ behavior towards them. We use means-end analysis, a methodology we consider to be appropriate for investigating users ’ conceptions and incentives that determine acceptance and use of anonymity tools. In this context we use the laddering technique, a qualitative method based on in-depth interviews, to identify the chains of attribute-consequence-value of anonymity tools users and to construct a Hierarchical Value Map. The results show that freedom, personal privacy, economic prosperity, professional development and fear-free living are the core values users achieve as a result of anonymity tools use. The aim of our research is to provide insights and enhance understanding of anonymity tools users ’ behavior, which we expect to bene ﬁ t both researchers and software engineers to design more effective tools.


Introduction
Privacy is recognized as a fundamental human right (Warren & Brandeis, 1890). The concept of privacy involves social, cultural, legal, economic, political and technical aspects (Wang, 2009, pp. 203-227). Clarke (1999) identifies four features of privacy: personal communication privacy, privacy of a person, personal data privacy and personal behavior privacy. Nowadays, due to the digitization of communications and data archiving, data privacy and personal communication privacy can be consolidated within the notion of information privacy. Therefore, information privacy can be considered as a subset of the comprehensive notion of privacy.
Privacy issues have drawn considerable attention in society, as a result of the rapid spread and progress of novel information technologies, such as the Internet, mobile computing, and ubiquitous computing (Wang, 2009, pp. 203-227). The adoption of the General Data Protection Regulation (GDPR) (EU General Data Protection Regulation, 2016) and the ePrivacy Directive (Directive 2002/58/EC, 2002 by the European Union indicates the importance society places on information privacy in our era. Acquisti et al. (2015) argue that "if this is the age of information, then information privacy is the issue of our times. Activities that were once private or shared with the few now leave trails of data that expose our interests, traits, beliefs, and intentions".
In response to the challenge of protecting Internet users' privacy, researchers in the field, as well as software industries, have developed various tools and technologies known as Privacy Enhancing Technologies (PETs) (Enisa, 2016). PETs refer to a wide range of technologies and tools that can assist users to protect their information privacy. Recent studies show that the adoption of PETs is limited. Vemou et al. (2015) conducted an empirical study and found that most of the participants in their study were not familiar with any of the PETs discussed. On the other hand, The Guardian (2014) reports that 28% of the online population surveyed by Global Web Index stated that they are using tools to disguise their identity or location.
One of the reasons why the adoption and use of PETs is challenging, according to Vemou et al. (2015), is that users seem to ignore, or underestimate, the privacy implications of permissions given to third party applications. On the other hand, Benenson et al. (2015) argue that privacy awareness is high and emphasize that perceived ease of use determines the intention to use PETs. Another factor that may affect the adoption and use of PETs is their cost. Acquisti (2004) argues that while the real cost of using PETs is low when adopted, their adoption involves significant switching costs. Thus, research findings pertaining to the adoption of PETs are contradictory and indicate that there are unexplored factors influencing users' decisions to use or reject using such protective mechanisms.
Some of the most popular PETs are anonymous proxy servers and onion routing networks. Anonymous proxies enable Internet users to browse the web anonymously by hiding the IP address and other userrelated information. Anonymous proxies are provided by either commercial companies, which may request subscription fees, or nonprofit organizations (e.g., hide-my-ip.com, proxysite.com, kproxy.com). Onion routing is based on the concept of "mix network" (Chaum, 1983). A mix network is a sequence of proxy servers, called mixes. In onion routing, a layer of encryption corresponding to each mix node is added to the message. The resulting encryption is layered like an "onion" and the original message is hidden in the internal layer. As the message traverses through the network, every mix node peels its own encoding layer to see where to send the message after. Based on this method onion routing achieves untraceability, unless all mix nodes are compromised (Wang, 2009, pp. 203-227). Nowadays, The Onion Router (TOR) is the most popular anonymous communication system based on onion routing technology.
This research has been motivated by the following research question: What are the values associated with users' behavior towards anonymity tools? We assert that Internet users' decision to use an anonymity tool is influenced not only by the attributes and functionalities of the tool itself, but as well by personal needs fulfilment, social influence elements, and personal values. On this basis, we investigate the psychological procedures related to anonymity tools use and reveal the underlying values that drive people's anonymity-related decisions and behavior. Specifically, the objective of this research is to investigate which human values are associated with users' behavior towards anonymity technologies. To achieve this, we drew on the means-end theory and applied the laddering interview technique (Gutman, 1982) as our research method.
In the following, the paper provides a critical analysis of relevant literature, describes our research approach, and presents and discusses our findings.

Related work: adoption of privacy enhancing tools
Although the concept of PETs was introduced in 1995 (van Rossum et al., 1995), PETs are still considered as a technological innovation (Bagozzi & Dholakia, 1999). Xiao et al. (2014) attribute this to the fact that security tools are what Rogers (2010) calls a preventive innovation. Preventive innovations are technologies that reduce the risk of some undesired future events, e.g. vaccines. Preventive innovations diffuse slowly due to the time gap existing between their usage and the impacts they bring upon. Thus, PETs, considered as preventive innovations, are expected to have a slow adoption pace. Additionally, as Kokolakis (2017) pointed out, individuals are optimistic when considering a potential online privacy breach which in turn affects negatively the adoption of privacy protective behaviors. The so-called optimism bias prevents individuals from defending themselves against a privacy violation, and thus makes them less prone to use PETs. Another reason for the slow adoption of PETs can be attributed to the lack of awareness. Pavone and Pereira (2009) argues that the most important issue regarding the adoption of PETs is the inadequate comprehension of privacy risks. Due to the lack of privacy risks awareness, the demand for PETs is poor and thus there is no powerful driving force for the advancement of privacy technologies. Moreover, the fact that most Internet users have not faced the implications of losing their privacy leads to a limited understanding of its significance (META Group, 2005).
In contrast, Vemou and Karyda (2013) argued that the significance of awareness is somewhat overestimated, as many consumers are aware of specific PETs, but are still not using them. Often, individuals underestimate the hazards related to information disclosure and thus they unveil too much personal data. This behavior is partly explained by the weak connection between actions (the revealing of personal data) and consequences (e.g., fraud, profiling, identity theft, etc.). This lack of feedback also inhibits individuals from becoming cautious about their privacy (London Economics, 2010). In addition, behavioural economics research has identified various cognitive biases that may explain this phenomenon.
In various circumstances, the average user accepts losing control over his own private data. An example of this might be patients who give access of their medical records to their doctor. Another example is the acceptance of video monitoring, personal search or other privacy violations to diminish the risk of terrorist attacks. Therefore, privacy requirements are always balanced with other more significant demands (META Group, 2005).
Previous research has also found that privacy concerns can have a negative effect on the adoption of Web-based applications (Malhotra et al., 2004) and therefore these concerns are a main threat to the Internet economy. The Eurobarometer survey on Europeans' attitudes towards cyber security (European Commission, 2015) found that the most important issues of Internet users remain the misuse of private information and the safety of online payments. Nearly half (45%) of respondents are concerned about the risk of misuse of their data by a third party. The percentage of those concerned has significantly increased since 2013, when this view was retained by less than four out of ten (37%) (European Commission, 2015). Harborth et al. (2017) pointed out that despite a growing public awareness of the need for data protection, anonymization services have not yet achieved "wide everyday and mass appeal". As a result, they argue that most Internet users today leave digital traces that can be used by Internet Service Providers (ISP) or third parties to construct comprehensive profiles without the user's awareness. Smith et al. (1996) associated personal values with concerns about information privacy by noting the connection between information privacy concerns of individuals and their level of trust, distrust and social criticism. What causes people to worry about something in life can be clarified by the importance they attach to it based on their own personal values. Values are illustrated as "trans-situational goals which differ in importance as guiding principles in a person's or group's life" (Schwartz et al., 2012, p. 664). Values can be perceived as "what matters to us in life" (Schwartz, 2012, p. 3), and what guides an individual in pursuing a goal is the trade-off between related and competitive values (Schwartz, 2012). Hup (2017) explains that key values of privacy are of utmost significance as a motivating factor for PET adoption and diffusion. In this paper we extend this stream of research by identifying the human values that drive users to adopt and use anonymity tools.
Conclusively, though related research indicates that privacy protection behavior is shaped, among others, by personal values and beliefs, the relationship between personal values and privacy protection remains largely unknown and understudied. Moreover, empirical research on how and why people dismiss or obtain various protective measures is rare (Cho et al., 2009). Therefore, this paper aims to bridge this gap, by identifying how personal and social values shape privacy behavior.

Means-end theory
The means-end chain analysis model has as focal point the connection among product's or service's attributes, consequences and values (Gutman, 1982) and illustrates the way the use of a product or a service facilitates the individual's understanding of his/hers ends needs. Attributes are connected to product or service features and consequences are specified as the psychological or physiological outcomes obtained directly or indirectly by the consumer from product or service usage. The core feature of this approach is that "… consumers choose actions that produce desired consequences and minimize undesirable consequences" (Reynolds & Gutman, 1988). The model of Gutman has two fundamental assumptions: (a) values are associated with consequences, as far as the connotations of consequences are positive or negative, and (b) consequences have a direct connection with the characteristics of the product since the users acquire the product that can lead to the anticipated outcomes (Gutman, 1982). The means-end chain is a model that seeks to clarify how the choice of products or services makes it easier to achieve the required end states (Gutman, 1982). The means-end theory conceptually considers users to be goal-driven decision makers who choose behavior that will probably lead to desired results (Bagozzi & Dabholkar, 1994). Users' perceptions of the attributes of the product contain different degrees of abstraction. These degrees of abstraction are attributes, consequences and values, which are hierarchically related (Reynolds & Olson, 2001). A hierarchical goal system is a system that provides the motivational basis to determine what is the goal of a user (Bagozzi & Dholakia, 1999). Therefore, we investigate the association between the values of a user and a set of product's attributes (Pieters et al., 1995).
In the context of the means-end theory consumers select actions that generate desirable consequences and/or reduce unwanted ones. Thus, consumers learn to combine tangible implications with product attributes. This knowledge facilitates consumers to select products that have the respective attributes and enable them to achieve their desired purpose. A major hypothesis of the means-end theory is that consumers' product or service understanding exhibits a hierarchical order, with solid thoughts connected to more abstract thoughts in a chain that advances from means to end. Hence, the more solid features of a product or service, the attributes (A), are linked to notional concepts about social or psychological consequences (C) of the attributes. These socio-psychological consequences or advantages emerging from product use are successively associated to the utmost abstract component, the values (V).

Laddering technique
The laddering technique is the approach employed to disclose the means-end structure (Reynolds & Gutman, 1988). Its goal is to recognize the characteristics of a specific product which offer preference to a certain class of products, where product class is defined as a class of products that provides a substitute for another category. The attributes of services or products and the consequences relate to their use are the "means". The "ends" are the results articulated regarding the consumer's personal values (Reynolds & Gutman, 1988). The term ladder is assigned to the connection among attributes, consequences and values. It is a conceptual representation of the relationship between the product and the mental process of the consumer that drives to a direct and helpful knowledge of his/her perception regarding the product or service. Laddering involves an in-depth individual interview seeking to understand the choices of the individual. It translates product attributes into relations appropriate to individual's "self" (Reynolds & Gutman, 1988).
Typically, in the laddering interview the interviewee is at start encouraged to recognize notable attributes of a certain product class, often initiated by asking for distinctive choice alternatives between instances of a product class. After this initial attribute extraction phase, the interviewer attempts to disclose the product attribute which the interviewee associates with a ladder, by asking: "Why is this attribute important to you?". This question also aims to challenge the interviewee to understand what motivates his/her attribute selection by describing the anticipated and favored related consequences. (Vanden Abeele et al., 2012). Therefore, the laddering technique can provide a valuable tool for understanding behavior (Veludo-de-Oliveira et al., 2006).
Recent studies have employed means-end analysis to explore users' behavior in various domains, such as online document management systems (Chiu, 2005), online shopping (Lin & Wang, 2008), Second Life (Jung & Kang, 2010), e-learning systems (Sun et al., 2009), mobile service usages (Mcmanus, 2009), and social networking sites (Pai and Arnott, 2012). Due to the similarity of these online contexts with the use of anonymity tools, laddering can be considered appropriate for investigating users' incentives for adopting anonymity tools. In addition, the laddering interview technique is a flexible method. Using open-ended questions, interviewees are unrestricted to respond in their own way and these responses tend to be more detailed than just simply "yes" or "no." Participants have the convenience to reply more sophisticated and in greater detail. In turn, researchers also have the chance to react to what the respondents say instantly by customizing sequential questions.
Further to the above, taking into consideration that means-end chain is a model that aims to clarify how the choice of product or service facilitates the accomplishment of desired end states (Gutman, 1982), it can be applied to the investigation of anonymity tools use.

Sampling
Basic threshold for laddering interviews is considered to be 20 respondents (Pai & Arnott, 2013;Reynolds, Dethloff, & Westberg, 2001;Saaka et al., 2004). In this research, we interviewed twenty-seven participants, which ensures the sample size is sufficient for an exploratory research that provides insight into the key attributes, consequences, and values relating to anonymity tools use. Due to the exploratory character of our research, the only essential prerequisite for sampling was that participants had used anonymity tools before. Participants were selected randomly, and the sample consisted of Greek Internet users. Male respondents dominated the sample (n ¼ 24). 93% of the sample were aged between 25 and 54 years old, and 85% were university graduates while 85% of them stated that were employees.
The interviews were conducted in the Greek language. Sample demographics are presented in the Appendix (Table 1).

Data collection
According to Reynolds and Gutman (1988), it is important to select a relaxed location without distractions for the participants for laddering interviews. We conducted the interviews via a popular video conferencing application and ensured the participation of two of the authors in all of them, one having the role of interviewer the other the role of the observer. The researchers introduced the background of the research to the participants and requested their permission to record the interview. All participants agreed to recording. The interviews had an average duration of 30 min, ranging between 18:13 min and 43:04 min.
The interviewer described the scope and objective of the research to the respondent and informed him/her that there is no "right-wrong answer". This clarification is critical in the laddering technique due to the personal essence of the investigating process, which creates a slight sense of vulnerability on the part of the interviewee. Stating there is no "rightwrong answer" allows the interviewer to help the respondent realize that the interviewer is simply a qualified coordinator of this discovery process and not a judge or evaluator of the respondent's ideas. We informed the respondents that many of the questions might seem "slightly apparent and perhaps even dumb", this predicament is therefore associated with the interview method and creates the impression that the interviewer is just a coordinator following certain guidelines.
Preference differences device was used for eliciting distinctions between onion routing networks and anonymous proxy servers. Respondents were asked to classify their preferences and to explain why one is better than the other.
In order to lead the discussion into revealing the means-end hierarchy, we also emphasized on the question "why is that important to you?" Indicative, we present some questions and responses from the pilot interview we conducted, and the way attributes, consequences and values are generated: Q: "When and how did you first use an anonymity tool?" A: "Friends introduced them to me, few years ago." Q: "Which one was the most interesting attribute of the tool that you used?" A. Skalkos et al. Computers in Human Behavior Reports 2 (2020) 100034 A: "The fact that I could browse anonymously." (Attribute). Q: "Why is it important to you to browse anonymously?" A: "Because I want to have access to banned websites". (Consequence). Q: "Why is it important to you to have access to those websites?" A: "Because I want to feel free." (Value).

Data analysis
Following the laddering technique guidelines provided in Grunert, Beckmann, and Sørensen (2000), data from each interview was independently analysed by two of the researchers; one of them had participated in the interview and the other had not. Both researchers listened to the recorded interview independently, performed data coding and constructed the A-C-V ladders. Coding results were then compared and discussed by the whole research team to produce the final coding.
The researchers established for each interview the extent of convergence by the two codings. If the extent of convergence was high, then the two or more sets of codes were merged into a combined set (e.g., respondents references to economic survival, personal growth, income, and price discrimination overcoming were merged into the code economic prosperity). If there were significant differences between the two codings, the researchers discussed further to develop a more robust set of codes. The comparison process revealed that during the independent construction of the two codings by the two participating researchers there were cases in which the same attributes, consequences, or values, were expressed by the coders with different terms. In those cases, the research team discussed and consolidated the wording accordingly.
Following this, the researchers constructed the Hierarchical Value Map (HVM), which provides a way of illustrating laddering data. HVM was produced by using aggregate data to depict "chains". Chains refer to sequences of attributes, consequences, and values. A common approach towards creating an HVM is to assign a "cut off", i.e. a least possible number of links that must be provided before one considers that item to be included in the HVM. Multiple cut-offs should be tested, to allow the researcher to choose the one with the most information and the most stable relationships (Saaka et al., 2004). After we tested multiple cut-offs, we chose a cut-off that provided us with the most information and the most stable set of relations. Pieters et al. (1995, p. 239) stated that a cut-off point is acceptable when the maps represent 60-70 percent of all relationships. Cut-off level 2 had the highest concentration index (the percentage of all links to cells) in our study and was calculated 81,28%.
Finally, in order to analyse the data and produce the HVM, we used LadderUX, 1 which is a tool designed for the quantitative analysis of laddering data and is particularly useful in the generation of HVMs. The tool is designed to help researchers register laddering data in a simple and efficient manner. It is considered a powerful tool for the data analysis and it provides a compelling designed HVM as output.

Content codes
All interview data were examined for sentences or words that reveal respondents' attributes, consequences, and values. We demonstrate 8 examples of phrases that participants used in favour of readability and comprehensibility. For example, participant 18 stated: "I like to use anonymity tools the reverse way. Not to keep my anonymity, but to hide my IP address in order to overcome company policies so I could visit useful for me banned sites thus I could get knowledge in order to develop my skills" was coded as a "hiding IP" attribute of the tool. Consequently, the respondent in the above quote pointed out the consequence "Access to banned sites" of this attribute by saying " …. ….so, I could visit useful banned sites ….", and finally " …...thus I could get knowledge in order to develop my skills" which clearly refer to "professional development" value.
In another interview, participant 14 answered: "I just needed to visit a site that is restricted in my country to retrieve some e-books. I needed the knowledge to do my course assignment" was coded as "hiding IP" attributed also. The consequence was the "access to banned websites" and the value was recognized as "professional development".
Another example is the participant 23 who reported: "By using anonymity tools, the advantage is that I can browse anonymously. I do not want to allow anyone to create a personal profile of myself so that information about my personal interests can be leaked. These are clearly personal data that I want to protect" In this example, we identify "anonymous browsing" as attribute. The related consequence that was identified was "avoid profiling" and the associated value was "privacy".
Another example refers to participant 12 who stated: " I use an anonymity tool to hide my IP so that I can investigate the market as a foreigner in my country. This helped me to get better rates for goods and services" was coded as "hiding ip" attribute. The consequence was identified as "avoiding geoblocking" which leads to the value "economic prosperity".
Participant 22 stated that " I want to keep my anonymity in order not to fear when I visit spicy web sites" was coded as "anonymity" attribute. The related consequence that was identified as "hiding online activities" which leads to "fear-free living".
Also, participant 17 who stated: "I wanted to keep my anonymity by avoiding web sites to keep my tracks so I could protect my privacy". was coded as "anonymity" attribute. The related consequence that was identified as "web surveillance protection" and the associated value was "privacy".
In another interview, participant 25 stated: "I use anonymity tools in order to protect my anonymity regarding confidential information, such as VAT number, social security number, car plate, data that will stress me if a third party could take possession of them." was coded as "anonymity" attribute. The related consequence that was identified as "Protection of sensitive data" and the associated value was "fear-free living". participant 25 stated: " I used the tool few times, but I find it really slow for me and caused me lack of usability, while we live in an era that life is fast paced" was coded as "delay" attribute. The related consequence that was identified as "reduced connection speed" and the associated value was "living a fast paced life".
The coding process identified 14 distinct attributes (Appendix,

Hierarchical Value Map
One critical issue in the construction of an HVM is the choice of a cutoff value. This cut-off point differs depending on the number of participants and chains. Reynolds and Gutman (1988) propose the use of a four immediate associations cut-off with 50 participants, while other researchers (e.g., Subramony (2002)) propose the use of two direct relationships with less (20-30) participants. After testing various cut-off values, we have chosen a cut-off of two direct relationships, as the resulting map maintains the balance between data reduction and retention (Gengler et al., 1995). This is also consistent with the aforementioned literature recommendations, since our respondents were 27.
After the cut-off at the HVM we obtained the following elements (the number in parenthesis indicates the number of instances): 1. Four (4) attributes: 1.  (2) 3.11 Self-control (3) 3.12 Pleasure (2) 3.13 Avoiding frustration (4) 3.14 Reassurance (2) The respondents valued mostly four attributes an anonymity tool should provide: anonymity, anonymous Internet browsing, hiding IP, and delay. Although the three attributes seem almost identical, the respondents associated them with different consequences, thus they gave a different meaning to each one. In terms of consequences that result from the use of an anonymity tool, the responders gave prominence to the following twelve ones: reduces ads, workplace network, web surveillance protection, hiding browsing history, access to banned websites, hiding online activities, avoiding profiling, access to knowledge, avoid legal consequences, reduced connection speed, protection of sensitive data and avoiding location tracking. Of these consequences, hiding online activities was most valued by the responders, demonstrating the need of users in privacy. Also, among the most valued consequence by responders was web surveillance protection, revealing the importance of avoiding the fear of a growing surveillance society. Concerning values, privacy, economic prosperity, professional development, freedom, fear-free living and personal success were the most significant values.
As a result, 285 distinct data points were defined, which translated into 89 distinct ladders with an average of 3.03 elements per ladder and 3.48 ladders per respondent. Appendix (Fig. 1) presents the final HVM that summarizes the most important attributes, consequences, and values and how they relate to each other. Among the most prevalent ladders we found to be the ones stemming from the attribute's "anonymity" or "anonymous web browsing" and were connected to the consequence "hiding online activities", which was then connected to the value "privacy". This agrees with the findings of the literature on the adoption of PETs (META Group, 2005) that argues that Internet users need to understand the value of privacy and the risks involved in Internet activity.

2: Anonymity
The attribute "anonymity" has strong connection with the value "fearfree living". Aligned with this finding Chiang and Tang (2020) found that the behavior of the user is dictated by whether the user experiences fear and the more fearful the user is, the less likely the user is to demonstrate high-risk behavior. According to our finding's users try to overcome this fear by using PETs. Furthermore, Kambourakis (2014) argue that the need to be anonymous is a very important issue because it includes the basis for the protection of fundamental human rights, such as the free expression of ideas and opinions, and allow people to perform their online activities in comfort and privacy.
Additionally, "anonymity" has likewise connections with the value "economic prosperity". Weitzner (2018) further demonstrates this point in his research suggesting that the economic growth of the Internet, and the ecosystem around it, relies on the continued development of the Internet as a work in progress to overcome challenges such as the extensive collection of personal data and outstanding analytical tools that place personal privacy at risk.
Our findings also indicate that users adopt anonymity tools to gain the consequence of hiding browsing history, seeking to protect themselves against potential future misuse of their data. This is aligned with Xiao et al. (2014) who argues that security tools are what Rogers (2010) calls a preventive innovation.

Anonymous Internet browsing
Anonymous internet browsing in our study is strongly connected with the value of privacy through the consequence of "reduces ads" and "workplace network surveillance protection" and enhances the findings of Loshin (2013) who suggests that there are several good reasons to remain private, mostly to avoid unwanted attention to your preferences, whether that attention induces itself in infinite ads targeted to you on the basis of your internet searches, or to prevent unnecessary attention from network administrators to monitor traffic for "prohibited" content.

Hiding IP
There are grounds for concern about the privacy of an IP address. The Internet Service Provider (ISP) may link its addresses to the account owner paying for it and thus information that can be retrieved for a variety of jurisdictional reasons. In addition, if an IP address is augmented with metadata, the true identity of a user can be uncovered-for example using geo-location (Clark et al., 2007), In our study the attribute "hiding IP" is connected with the consequence "access to banned websites" which leads to the end value of "professional development" and "pleasure".

Delay
Taylor et al. (2015) argue that system response delays are a reliable source of user frustration. This is aligned with our study in which we found that the attribute of "delay" is connected with "reduced connecting speed" which leads to the value of "avoiding frustration" for the users of PETs.
We have to point out a common set of relationships linking both the attributes "hiding IP" and "anonymous web browsing" with the consequence of having "access to banned sites". This consequence seems to be A. Skalkos et al. Computers in Human Behavior Reports 2 (2020) 100034 important because, as responders stated, it helps them to achieve their "professional development".

Implications
Τhis research identifies the human values associated with users' behavior towards anonymity tools. Additionally, this exploratory study is expected to deepen our insights and understanding of users' behavior concerning anonymity tools and results in benefits for both researchers and software developers. We provide insights to this issue by creating a Hierarchical Value Map of attribute-consequence-value chains for the adoption of anonymity tools and by providing a comprehensive analysis of the laddering data. Our research also displays the capacity of the means-end approach for studying the use of software tools.
This study identifies the drivers behind users' behavior on anonymity tools and thus informs PETs providers on how to design more useracceptable tools, since they will be closer to their functionality needs and their personal values. Furthermore, our study reveals the relevance of social aspects as a core feature of using PETs, as we illustrate the relationship between anonymity with values such as fear-free living, personal dignity, freedom, economic prosperity.

Theoretical contributions
Our study provides several theoretical contributions adding to or supporting the current knowledge. Graf et al. (2015) suggests that relaying solely on developers to imagine what the needs of users are may not be sufficient, as the mental models of system developers and the mental models of users are hardly the same. The contribution of this research, which offers theoretical aspects, may therefore be useful for the development of mental models that are closest to reality.
We contribute to existing knowledge by revealing the role of the value of economic prosperity, which was found as crucial for the Internet users' decision to adopt anonymity tools. Another significant value that is associated with the users' behavior towards anonymity tools is the users' professional development, which they gain through various consequences of anonymity tools. This aligns with the arguments of Dudin et al. (2017) that professional progress conditions impact staff development efficiency and return on the resources invested and time. Due to privacy policies many companies restrict employees' access to social networks, news sites, software development and security hacking sites, and others. It was also mentioned that some websites are banned at a national/governmental level. However, the respondents stated that many times they seek their professional development via access to those banned sites. This points out that companies and governments may need to consider reforming their information access policies and loosening the rules on banned sites that employees/citizens think they can offer significant knowledge to them, without of course violating copyright privileges. Another important finding of our research is that the fear users feel about web surveillance (either in their work surroundings or in their personal life) may lead to the adoption of anonymity tools.

Practical implications
Our results help providers of anonymity tools to design PETs that better fit users' needs. Moreover, our results confirm conclusions of previous research, that some so-called PETs serve well in order to curb the development of technological surveillance and encourage its use where necessary (Lyon, 2001). The findings of our study also indicate that users adopt anonymity tools to gain the consequence of hiding browsing history, seeking to protect themselves against potential future misuse of their data. This is aligned with Xiao et al. (2014) who argues that security tools are what Rogers (2010) calls a preventive innovation. In addition, our findings demonstrate the importance of the value of freedom and that respondents adopt anonymity tools to hide browsing history and avoid web surveillance and legal consequences, in order to "feel free". This supports a privacy by design principle, which requires that personal data, and their interconnections, should be hidden from plain sight (Hoepman, 2014). Nowadays, a debate on how to choose the right PET is emerging (Harborth et al., 2020;Namara et al., 2020;Srouji & Mechler, 2020). Our study contributes in this debate by clarifying the users' values towards PETs. In parallel, our study provides knowledge to the need of developing new PETs or improving the effectiveness of existing ones, as the Office of the Privacy Commissioner of Canada (2017) argues is needed. Also, Angulo (2015) suggests that a new approach is needed in which people are consider not only as consumers of privacy and security technologies but also as distributors of sources of inspiration and ideas for the development of functional PETs that meet their real needs and concerns for privacy.

Limitations
The findings of this study although it has useful insights about users' behavior towards anonymity tools, they must be seen in light of some limitations. First, since the anonymity tools aren't yet adopted in wide range in society as Abeele and Zaman (2009) argue the means-end chains that are revealed in the context of digital products are different from means-end chains that consumer researchers will find out about well-established consumer products. .
Secondly, the core principle of means-end approach is that people are rational individual decision-makers who select such way to act (e.g. using anonymity tools) that is most likely to accomplish the desired results. This assumption has two obvious flaws: first, it is overoptimizing about the rationality of choice. This could cause bias since Van den Steen (2004) argues that an agent who attempts to choose the action that he perceives most probable to succeed is more likely to choose an action of which he/she overestimated the probability of success, rather than an action that underestimated the probability of success. Second, emotions are underestimated in the decision-making process despite the fact that Zeelenberg et al. (2008) stated that emotions' importance is apparent in the fact that decision-making is always an emotional process itself.
Another limitation is that a potential selection bias exists in our sample, since we had limited capacity to gain access to the necessary type or geographical spread of participants. Besides these limitations, our study still contributes to theory and practice as we discussed above.

Further research
Future research can be focused on predicting the role of determinant factors of anonymity tools' adoption. Because of the exploratory nature of this research we limit our objectives in gaining deeper insights and understanding of the values that are associated with users' behavior towards anonymity tools. Furthermore, a means-end analysis research at both government organizations and corporations' behavior towards the PETs is needed. This is particularly significand nowadays since many people bringing work home, due to the covid-19 health crisis, and can hold organizational data on their home computers and mobile devices, exposing these data at risk of a security breach with significant impact.

Declaration of competing interest
The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.