Modelling the ethical priorities influencing decision-making in cybersecurity contexts

1. Introduction

Emerging technologies such as cloud computing facilitate access and expand usage of software products for end users. These emerging technologies generate huge volumes of data, including sensitive (e.g. personal and financial) data, that need to be protected against threats and made available for appropriate access using increasingly complex cybersecurity techniques. Accordingly, there is a large body of research, supporting technology and policies to address cybersecurity threats to protect the confidentiality, integrity and availability (CIA) of data and services (Brey, 2007). However, the human factors within a cybersecurity system related to ethical decision-making, ranging from behaviours of system administrators and software developers to cybersecurity domain experts, are a vulnerability gap that has received comparatively less attention.

We need to trust our techniques, such as machine learning algorithms, and policies being developed by cybersecurity experts to protect our data against cyber threats. To protect data, we rely on the domain experts who design and implement these techniques, algorithms and policies. Individual domain experts who develop and implement cybersecurity systems, as well as those who make decisions at higher levels of organisational hierarchies, need to understand the human aspects (such as social engineering (Mann, 2008)) of the solutions they design. Solutions will fail to achieve their intended goals if the domain experts who design them are not cognisant of these human aspects which is a key system vulnerability (Safa et al., 2016; Nobles, 2018). To deal with socio-technical issues within an organisation, employees (e.g. designers and managers) may receive training via various mediums, such as online courses, live role-playing games or computer-based serious video games [1]. However, all of these approaches have limitations in transferring knowledge and skills to real situations that will be impacted by human factors, roles and skills (Gee, 2007). Of particular relevance in the context of ethical dilemmas is the situation where a human's personal values override organisational norms, and this results in a decision to breach organisational policies (Schwartz, 2012; Christen et al., 2017). For instance, individuals who value their ingroup highly and seek to follow its social norms and practices might fail to change their password regularly in accordance with an organisational policy because they prioritise acting in accordance with the implicit norms of their ingroup (assuming there is no automated password expiring policy in place).

To study cybersecurity ethical decision-making, we used as our framework the principlist approach developed by Formosa et al. (2021). This framework includes five ethical principles, namely beneficence (cybersecurity technologies should enhance human lives), non-maleficence (cybersecurity technologies should not be used to harm individuals' lives), justice (cybersecurity technologies should improve fairness and provide impartial access for all), autonomy (cybersecurity technologies should not limit users' choices of applications) and explicability (cybersecurity technologies should be both understandable and accountable clearly for their functioning). These principles, along with our reasons for adopting this framework, are described in more detail below.

There is a vulnerability gap related to ethics in cybersecurity, called ethical fading (Bazerman, 2011), that can occur when individuals become oblivious to the ethical implications of a solution by focusing solely on solving the technical aspects of a cybersecurity problem. This can cause a problem for end users. For example, a system administrator who pushes the deployment of two-factor authentication (2FA) on a software application can cause harm (non-maleficence issue) or loss of service (beneficence issue) to vulnerable end users (justice issue) who either have no access to a smartphone or suffer a disability or lack the digital competence needed to use smartphones for 2FA (assuming 2FA is only available via a smartphone's app). Therefore, the system administrator needs to be aware of these ethical implications, and which vulnerable groups are most likely to be impacted, before making final cybersecurity decisions. Though these same general principles will be applicable to a range of computing contexts beyond cybersecurity, our focus here is on the specific ways that these five ethical principles are interpreted and play out in the concrete context of cybersecurity, where there is a vulnerability gap. For most software, the needs of the end user are considered in designing the functionality and usability of the product. This often involves in-depth requirements gathering and understanding of how the user is likely to use the software. However, most cybersecurity software, policies and processes are focused on ensuring privacy and security and not focused on meeting the specific needs of a target end user of the product or on how users may respond to or be impacted by the security decisions being made. This results in a situation where misalignment is possible, perhaps even probable, between the goals of the cybersecurity professional and the end user, potentially leading to a security breach.

A promising approach to addressing this issue is to educate domain experts more effectively in the ethical issues that arise in cybersecurity. A class of traditional approaches to ethical training focuses on closing the value-action gap (Narvaez, 2005). However, the best way to acquire and practice new skills is to learn by doing through using that skill in action, as this enables learners to understand the problem and how to address it in a range of scenarios (Darcia and Lapsley, 2005). Serious games promise to achieve this goal by providing a safe and engaging virtual environment for role-playing ethically significant scenarios (Hodhod et al., 2009; Staines et al., 2017). We therefore propose the need to develop a serious game for ethical training in cybersecurity contexts.

The overall aim of this study is to build profiles by learning how human factors (e.g personality and values) can influence individuals' ethical decision-making in a serious game based around a cybersecurity context and to explore how to improve ethical awareness in players of that game by leveraging these profiles to later develop artificially intelligent (AI) non-player characters (NPCs) to interact with players (cybersecurity trainees). The purpose of the interaction is to provide the players with a tailored training environment that exposes them to possible human experiences and reactions to cybersecurity technologies and administrative controls and policies that they may (later) be involved in recommending, designing or implementing as cybersecurity domain experts. The goal of achieving tailored training that understands the specific knowledge gaps, biases and tendencies of potential trainees requires a good understanding of what is driving the ethical decision-making of individuals in a cybersecurity context.

To study human values and their influence on cybersecurity decision-making, we utilise Schwartz's theory of basic human values (Schwartz, 1994) as it is commonly used and based on studies of human values across approximately 60 cultures and it identifies 10 universal human values that were later refined to 19 values. To provide our ethical framework, we utilise the principlist approach for cybersecurity ethical decision-making developed by Formosa et al. (2021). In this study, we aim to build models that describe the importance of the five principles from that framework (i.e. beneficence, non-maleficence, autonomy, justice and explicability) in different scenarios. We base these models on data collected from studies using earlier prototypes of the serious game, where participants learnt about and had to apply the five principles for cybersecurity ethical decision-making. Our future goal is to use these profiles to build agent-based AI NPCs who encapsulate valid profiles and also adapt their behaviour according to the predicted profile of the player they are interacting with. Drawing on and extending the literature concerning ethical decision-making, we aim to determine which factors are most relevant in influencing cybersecurity ethical decision-making. To create agent profiles and behaviours that plausibly mimic humans, we capture a range of player data including demographics, personality, cyber hygiene practice, knowledge of ethics and moral foundations. Based on players' values, moral stance and individual differences (gender, age, personality and background), we build a descriptive model that we plan to use in the future to provide more tailored and targeted training.

In the following sections, we first present background literature for our work. Section 3 presents our methodology. The results appear in Section 4, followed by discussion, future work and conclusions in Sections 5, 6 and 7, respectively.

2. Background literature

The practice of maintaining a cybersecurity system not only depends on the cybersecurity technologies involved but also on the ethical values that influence human decision-making within that system. Cybersecurity technologies are mainly developed based on the widely used CIA triad. However, these technologies may raise ethical issues in real-world scenarios (Vallor and Rewak, 2018; Formosa et al., 2021). For example, the possible introduction of 2FA described earlier raised issues related to the ethical principles of non-maleficence, beneficence and justice. In this case, the system administrator needs to be aware of these ethical implications before making any final decision. There is therefore a need to educate professionals and other users of the system, including system architects, administrators and privileged users, about the ethical conflicts and dilemmas that may arise (Blanken-Webb et al., 2018). This education can lead to better moral judgement (Jamal et al., 2016). But to develop those educational resources, we need a relevant ethical framework.

To that end, we leveraged a principlist approach to cybersecurity ethics because it connects cybersecurity to basic ethical concerns. We utilised a framework that has been proposed for the cybersecurity domain by Formosa et al. (2021) and which includes five ethical principles: beneficence, non-maleficence, autonomy, justice and explicability. These five ethical principles are modelled on the five AI4People's principles (Floridi et al., 2018) for ethical AI that extends (through the addition of explicability) the same four basic ethical principles developed by Beauchamp and Childress (2001) that are widely accepted in the bioethics domain. The five ethical principles are briefly described below. The reason we selected this ethical framework was that it not only offers a coherent and current framework for cybersecurity ethics based on the literature but it also provides a suitable framework for a pedagogical context. It also helps to keep the range of ethical issues manageable by avoiding the problem of principle proliferation and allows us to move beyond a simplistic focus on privacy by contextualising privacy in terms of a range of differing ethical principles.

Beneficence refers to the opportunity for cybersecurity technologies to enhance individuals' lives. By securing many aspects of activities in day-to-day life, from e-commerce to the private sharing of data, cybersecurity technologies can achieve benefits including promoting human well-being, financial benefits, protecting privacy and strengthening trust. This can shape a safe cybersecurity environment that benefits all. Non-maleficence refers to the importance of cybersecurity technologies not being used to harm individuals. For example, using outdated software as a result of poor cybersecurity practice can harm users of a system by exposing them to vulnerabilities and threats that could compromise their data, cause financial harm and consequently reduce their emotional health and well-being. Autonomy refers to the importance of cybersecurity technologies being developed and deployed in ways that do not unduly limit users' informed choices about how they use that technology. Users, where appropriate, should be given some control to select and manage their own cybersecurity solutions. Failing to obtain informed users' consent for accessing their data also amounts to a failure to respect users' autonomy. Justice refers to the requirement that cybersecurity technologies should improve fairness and provide equitable access for all, while avoiding bias, exploiting the vulnerable and undermining solidarity. For example, designing crucial cybersecurity technologies that are not accessible or useable by members of important social groups, such as the elderly or those with special needs, raises important justice concerns. Likewise, deploying machine learning algorithms trained on deeply biased datasets in cybersecurity contexts risks exacerbating bias and unfairness. Finally, explicability refers to the importance of cybersecurity technologies being both clearly understandable and having clear lines of accountability for their functioning. To achieve this, cybersecurity technologies, for instance, should have a clear definition about responsibility to protect the system and data and how to comply with the responsible use of AI for cybersecurity. Cybersecurity professionals also have responsibilities to maintain and upgrade their professional skills and knowledge, including around the ethical ramifications of the technology.

In a white paper by Yaghmaei et al. (2017), it was found that people even from the same culture may perceive ethical values differently in cybersecurity contexts depending on their professional background. Therefore, it is essential to identify key individual differences in this context. The literature also identifies a problem related to the gap between people's attitudes and ethical intentions (Buchan, 2005). That is, people's ethical values in a cybersecurity context may not match their ethical choices. However, there is a body of research that shows that ethical training can improve ethical decision-making and help to close this gap (Geiger and O'Connell, 1998; Stead et al., 1990; Luthar and Karri, 2005; Cagle and Baucus, 2006). In order to study the link between personal values and ethical behaviour, Mubako et al. (2020) conducted an experiment. They focused on the problem of how personal values, using Schwartz’ personal value scales, relate to ethical behaviour and explored how ethics training as well as gender and religiosity influence the ethical behaviour of accountants. They collected data via an online survey from 252 accountant undergraduate students from a university in the USA. They hypothesised that Schwartz’ personal value scale of openness to change, self-enhancement, conservation and self-transcendence behaviour, as well as ethics training, gender and religiosity all influence ethical behaviour. They created six measures to capture personal use, passing blame, bribery, falsification, padding expenses and deception to evaluate the likelihood of participants engaging in unethical behaviour. Their results show that personal values have a significant effect on ethical behaviour and that conservation and self-transcendence were negatively associated with unethical behaviour. However, openness to change did not influence ethical behaviour. The results also suggest that the likelihood of females engaging in unethical behaviour is lower than males; however, they did not find any meaningful relation between religiosity and ethical behaviour, which they found to be consistent with the literature. Of particular interest to our study, they found that students who reported taking more courses with an ethical component are less likely to be engaged in unethical behaviour (Mubako et al., 2020). This difference in behaviour could be due to the ethics education received in these courses or it could be that more ethically sensitive students choose units with ethics components. In addition, there is evidence in the literature that reminding people about morality may decrease dishonest behaviours (Gino et al., 2009). Gino et al. conducted research to argue that there is a link between active social norms and an individual's reaction to unethical behaviour. Individuals and wider social norms play a crucial role in factors influencing decision-making; therefore, it is essential to study those factors given our concern here for cybersecurity ethical decision-making.

A novel study by Ameen et al. (2020) focused on the differences between female and male cybersecurity behaviours when using their personal electronic devices, such as a smartphones or tablets, for work as part of a bring-your-own-device (BYOD) policy. Ameen et al. (2020) note that while such a policy has obvious benefits, it is also one of the top security risks for companies. They conducted an experiment with the group with the highest use of BYOD from USA (Boston) and United Arab Emirates (UAE) (Dubai) companies. They found significant gender differences in both countries in smartphone security behavioural intentions. The study shows that males and females in both target countries may not be aware of their company's recommendations and policies nor of the security-related risks arising from using their smartphones for work and personal purposes. It also shows that the perceived severity of sanction has a significant effect on males rather than females in the UAE but on both groups in the USA.

The aforementioned studies emphasise that human factors, including demographic information, human values and moral stance, play a crucial role in driving human decision-making in cybersecurity contexts. In the following Table 1, we present a summary of the factors that have been generally found to influence ethical decision-making identified in the above discussed literature and other related studies. Further, given our focus on ethical decision-making, we draw on this table to devise our data collection approach below to evaluate their relevance in a cybersecurity context.

3. Methodology

The literature identified a number of human factors that influence cybersecurity ethical decision-making. Our study aims to use the cybersecurity principlist framework (Formosa et al., 2021) described above to identify a connection between these human factors and ethical reasoning in cybersecurity situations, which leads to our study's research question:

By understanding this connection through a serious scenario-based video game, we can help the player to become aware of the relevance of ethical principles in cybersecurity decision-making, reflect on their own reasoning and values in this process and adapt training to ensure the individual is made aware of other viewpoints. To answer our research question, we conducted an online study approved by our University's Human Ethics Research Committee as described in the following sub-sections.

4. Results and findings

To check the data reliability, we ran the Cronbach's alpha test for each of the constructs. The results are as follows: TIPI (0.4527), MFQ (0.8745) and PVQ (0.9743), which categorises the PVQ dataset as Excellent and MFQ as Good in terms of internal consistency. The low result on the Cronbach's alpha for TIPI is expected for this construct. According to Gosling et al. (2003), TIPI performs poorly in terms of Cronbach's alpha and confirmatory factor analysis (CFA) or exploratory factor analysis (EFA) indices. This is because it was designed to be a very brief instrument for validity. Deng and Chan (2017) suggest that coefficient Omega may be more suitable as Cronbach's alpha relies on four conditions to hold, compared to two conditions for coefficient Omegas. We also ran McDonald's coefficient Omega (McDonald, 1999) (scale's interpretation is same as alpha coefficient) with the following results that confirms the earlier statements: TIPI (0.628), MFQ (0.825) and PVQ (1.000). TIPI is still low but closer to the 0.70 cut-off for Good. In the long term, our aim is to find minimal measures for personality and values and thus TIPI aligns with this goal, unlike longer versions. TIPI has been found to deliver comparable results for convergence with self and observer ratings, test–retest reliability and predicted external correlate patterns (Gosling et al., 2003) with the 44 item big five inventory (John and Srivastava, 1999), which is comparable to the 50-item International Personality Item Pool (IPIP) (Goldberg, 1993). However, to further analyse data reliability, we also ran the greatest lower bound of reliability (Woodhouse and Jackson, 1977) via Bayesian single test (Pfadt et al., 2023) and results offer good (>0.7) and excellent (>0.9) reliability as follows; TIPI (0.736), MFQ (0.917) and PVQ (1.000).

5. Discussion

We sought to determine if models could be uncovered to predict, based on individual factors, the importance to participants of our five ethical principles in the context of cybersecurity decision-making. To ensure that they understood these principles and how to apply them to cybersecurity contexts, our participants first played a serious game designed to achieve this outcome before we captured their rankings of the five principles after they played the game. Without playing the game, participants may not have understood the ethical principles or how they apply to cybersecurity. Further, requiring participants to apply the ethical principles enhances their understanding and internalisation of the principles. Explicit reflection activities within the game also aimed to make participants aware of what principles were driving their choices, thereby enabling them to better assess the most important ethical principles to them. Addressing our research question, we now unpack our results to consider the extent to which an individual's demographics and other human factors (including personality, moral stance and values) relate to the way they prioritise ethical principles in a cybersecurity context.

One of the C5.0 models created sought to predict which ethical principle was deemed, in general, to be the most important one based on participants' features. The classification model identified that 77% of the data could be predicted by the main cultural group variable, the personality factors of extraversion and conscientiousness and the number of hours they play video games. The remaining predictors included age, MFQ ingroup and authority, PVQ humility, “knowledge about ethics in IT” and PVQ self-direction action. Some of these findings are confirmed in the literature and some provide new insights.

In their study to predict preferences from individuals' digital behaviour, Kalimeri et al. (2019) confirms the role of loyalty/ingroup that accounted for 63% of their study's prediction score and found that Schwartz's human values (conservation and universalism) were the most accurate predictors in their study. Regarding personality traits as predictors for ethical behaviour, Kalshoven et al. (2011) found that emotional stability was positively related with ethical leadership. Our model revealed that participants who play computer games more than 1.5 h per week and identified as Oceania prioritise beneficence, suggesting cybersecurity technologies should promote human well-being. Following Jeske and van Schaik (2017) who show that familiarity with threats can mediate Internet attitudes and security behaviours, our finding that previous video gaming experience which constitutes familiarity with a technology (e.g. video games) could mediate ethical decision-making behaviours in cybersecurity contexts that are simulated via a video game.

Lu et al. (1999) also found that cultural difference (e.g. western vs eastern culture) may influence ethical decision-making within Hofstede's (Hofstede, 1984) cultural framework. Their findings indicate that US participants are more individualistic and masculine, while Taiwanese participants are more collectivist, less masculine, and have adopted Confucian principles to a greater degree. Their study also confirms that Taiwanese participants demonstrated a stronger preference for rules and regulations than US participants and that this can limit uncertainty in the workplace. Although our study does not focus on Taiwanese vs US participants, we also found cultural difference is predictive. Similarly, a study by Ameen et al. (2020) show that female participants in both the US and the UAE countries are more affected by the nature of culture around them in their behavioural intention towards smartphone security. For instance, our study also shows participants belonging to the following three cultural groups, Northernwestern European, Southerneastern European, North African and Middle Eastern, have the same preferences (ranked non-maleficence as the most important ethical principle) when facing ethical dilemmas in terms of our five principles, and they mainly think that cybersecurity technologies should not be used to harm anyone (non-maleficence).

The aggregated models for each of the five principles presented in Figure 3 also confirm that cultural background is the most important predictor for three (i.e. beneficence, non-maleficence and explicability) out of the five ethical principles. Schwartz's universalism nature scale is the most important predictor for autonomy, followed by Conformity – interpersonal, fairness and agreeableness, with the cultural background making very little difference. The most important predictor for justice is TIPI conscientiousness scale followed by ingroup and openness to experiences, with the cultural background again making very little difference. In the combined model to find the first ranked principle, the rule snapshot in Table 8 shows that for our participants high conscientiousness (>6.75) was only an important predictor for justice, in comparison to the other four principles where lower conscientiousness was an important predictor. Given the focus of high conscientiousness personality types on adhering to norms and rules, a close association of this trait with the principle of justice is not surprising (Fu and Lihua, 2012; Rice et al., 2020).

Our study sought to investigate the role that personal values might play in influencing ethical decision-making in cybersecurity. Figure 3 shows that 13 of Schwartz's 19 values are predictors of importance, but only 2 influence more than one principle and none predict beneficence. As explained earlier, our aim is to use these models to build AI NPCs with plausible profiles who can predict the ethical priorities (and biases) of the player. The ultimate aim is to tailor the training simulation so that the player becomes sensitised to other viewpoints and the potential ramifications of their cybersecurity decisions and actions concerning the policies, processes and technologies they propose and implement. From a practical perspective, we are seeking to address the situation where, for example, as system administrators, they might choose to force the release of an ethical worm to install security patches to limit harm to users (prioritising non-maleficence), but fail to acquire the consent (autonomy), respect the ownership rights (justice) of users or properly explain (explicability) their actions (Formosa et al., 2021). To that end, before or while playing the game any feature used to predict the players' priorities would need to be captured. This means, we need to minimise how many features are included in our models. Given that many of Schwartz's values are important for only one principle, there may be little value to capturing Schwartz's values by asking 57 questions. We note, however, that for Justice, the two most important features are Schwartz's values. In implementing the models in our game, we will be identifying which features are of most value and ensure that all five principles can be predicted. The results reported here, and our full model not reported due to space and complexity (full models available by request from the authors), provide us with this valuable information.

Regarding the influence of personality, Table 6 and Figure 3 reveal that all five personality dimensions influence the importance of different ethical principles. Table 6 shows extraversion as the next biggest predictor after culture. Gratian et al. (2018) suggested that extraversion is a significant predictor of good device securement behavioural intentions. However, we see in Figure 3 that extraversion only predicts beneficence and non-maleficence to a much lower extent. Conscientiousness is a predictor for all five principles, confirmed further in the rules in Table 8. We can see considerable support in the literature for the influence of personality on decision-making. Özbağ (2016) observed that agreeableness, conscientiousness and openness to experience are positively linked to actions of ethical leadership. Their findings, however, did not confirm any significant link between extraversion and ethical leadership.

Looking at Figure 3, age was a factor for all principles except autonomy. Looking at the rules (not reported here), the split is around 18.5 year old, where participants younger than 19 year old on average prioritise non-maleficence, suggesting that they focus on the harm minimisation aspects of cybersecurity technologies, while those who are older than 19 year old prioritise beneficence, suggesting that they focus more on the potential benefits of cybersecurity technologies rather than avoiding harms. Age has been found to impact ethical decision-making in other studies. A study by Elango et al. (2010), for example, shows that older managers (above 35 year old) were more likely to make ethical choices based on their own values, while younger managers (below 35 year old) were more likely to be influenced by organizational ethics.

The C5.0 decision trees identified that MFQ subscales are another important factor. The ingroup subscale was a feature included in most rules predicting the importance of a principle. Commonly the rule condition used the value of <15.5, which is higher than the mean MFQ score of 10.77. This cut-off indicates that those who scored above 15.5 for ingroup were less driven by ethical principles and more inclined to put the interests of their ingroup above their ethical concerns for others. Chowdhury (2017) also found that loyalty/ingroup was positively associated with unethical consumer actions and negatively associated with perceptions of prosocial consumer actions. These findings suggest that for individuals who highly value their ingroup, it may be important to use strategies, such as our proposed game, to identify and highlight the impact of their ethical choices on those outside their ingroup. A study by Kalimeri et al. (2019) also note the need to do more research about the role of human values and morality in predicting personality and human values from digital behaviours.

While gender differences in ethical behaviour have been widely identified in the literature (Elango et al., 2010; Herington and Weaven, 2008; Nguyen et al., 2008; Sweeney et al., 2010; Valentine and Bateman, 2011), gender was not a salient factor in our machine learning models or our statistical analyses, with the exception of TIPI – emotional stability, MFQ – ingroup and PVQ – universalism – nature. Interestingly, each of these significantly different features appeared in our models, with ingroup being the most salient feature of the three. The salience of these features in identifying principle importance may reflect a gender difference. Since C5.0 uses information gain to split the data, it discards attributes not needed for splitting. Thus, gender may have been discarded resulting in minimal influence in the models. Another reason may be the gender imbalance in our sample population, with a majority of males to females (190:54). This gender imbalance, however, is representative and consistent with the imbalance observed in the unit participants were recruited from and among professionals in the ICT/cybersecurity industry.

6. Implications

Overall, our study has provided a first attempt to model, after ethical training by playing a serious game, the connection between the importance of ethical principles for cybersecurity decision-making and the demographic, personality and ethical profiles of individuals. This has important practical implications as it helps us to understand and predict how people may choose to prioritise competing ethical concerns when they conflict with one another in cybersecurity contexts. While further data collection and analyses are required to build more accurate descriptive models, we suggest an initial generalised model of the rules as presented in Table 6. It is clear that individuals prioritise different ethical principles. While approx. 56% of participants were most concerned with delivery of the potential benefits of cybersecurity technologies (30.55%) e.g. data protection) or the avoidance of harm (25.92% e.g. data loss or breach), those prioritising justice want cybersecurity technologies to be fair and not to perpetuate bias and injustice (including in terms of accessibility). The low percentage of players prioritising autonomy (12.5%), which values asking for consent and allowing users to make their own cybersecurity choices, is somewhat surprising if we contrast autonomy's high importance in ethical decision-making in other domains, such as health (Cullati et al., 2011). Loi et al. (2019) also identified autonomy as the most important bioethics principle in the health domain and noted that prioritising autonomy can result in conflicts with other bioethics principles. Perhaps one's health behaviours are seen as personal choices that have greater impact on one's life. Whereas in the context of cybersecurity decision-making, choices may not be viewed as being as important and individuals may also feel less equipped to make such decisions due to limited technical expertise. While perhaps not surprising, explicability was ranked as the least important principle by participants' (10.26%). This reveals that concerns around explanations of cybersecurity policy, transparency of cybersecurity decision-making and clarity around accountability for cybersecurity technologies were less important ethical considerations for our participants. The low numbers for autonomy and explicability warrant more data collection to build profiles to model those who prioritise these principles and also suggest ethics training on these principles is needed.

As mentioned in the introduction, the dual motivation for this study, beyond understanding which ethical principles participants prioritise, is to build profiles that could be used to create realistic NPC agents in a serious game. This paper reports our first attempt to explore and learn players' profiles based on their responses to prioritising the five ethical principles in cybersecurity contexts. Once we have learnt and built these profiles, we can better tailor the ethical education in the game for the players (e.g. cybersecurity professionals/students). In other words, our plan is to use the predicted profiles outlined here to identify and target individuals that are less focused on or less aware of specific ethical principle/s and their relevance in cybersecurity contexts and then to expose such individuals to viewpoints and scenarios that they are less likely to consider. For example, if a player has a profile that indicates they are unlikely to prioritise explicability, the scenario they are exposed to in the game could consider issues such as transparency, accountability and responsibility and show how these concerns for some users may result in them making a poor cybersecurity decision or failing to follow policy resulting in a breach. This will help the cybersecurity professional to take these viewpoints and possible behaviours into account in the design and implementation of cybersecurity technologies and policies. A key approach for achieving this is to adapt the responses of the AI NPCs to present to the player alternative viewpoints from those held by the player.

Our approach to model players can be applied to different audiences beyond cybersecurity professionals. The next version of the game could, for example, be designed to include scenarios for end users to help them reflect on their ethical choices in the use of cybersecurity technologies. This will require developing scenarios, such as a ransomware attack on private files, that end users (rather than cybersecurity professionals) could experience. Further investigation along these lines is also warranted to help managers and professionals in the cybersecurity domain better understand the possible behaviours of others in their team and across their organisation, as well as their customers or user base.

7. Limitations and future work

The first limitation of our study is the size of the participant dataset. Although the number of valid records in our dataset (N = 216) is not large enough to generalise any rules with confidence, it is enough to generate insights into how people prioritise ethical principles when facing cybersecurity dilemmas and to indicate areas that warrant further research. The second limitation of our study is that our participants were all university students studying introductory cybersecurity and there was a gender imbalance, with many more males compared to females. For more generalisable results, we would need to extend the study to a wider range of target audiences, including cybersecurity professionals, managers, end users and the broader public. These studies could also seek a greater gender balance in accordance with the profile of the target group. To reach different audiences, we need to change the game scenarios and interactions to be relevant to each audience. It may also be necessary to modify game mechanics to suit the targeted demographic. Finally, using different contexts and scenarios could influence which ethical principles are relevant and important for decision-making. We aim to address this issue in future studies by asking participants to rank their ethical principles in a range of specific contexts rather than in general.

8. Conclusions

Given the importance of understanding the impact of human factors in cybersecurity, the main purpose of this study was to learn what factors influence prioritisation of ethical principles in a cybersecurity domain. To learn the participants' ethical profile in a cybersecurity context, we created a serious game that provided training on five ethical principles relevant to cybersecurity decision-making and then exposed participants to a series of cyberethical dilemmas requiring them to apply those principles. After undertaking this training by playing a serious game, we asked participants to rank the importance in general of the five ethical principles they learnt about and practiced using in the game. We found that their rankings could be predicted primarily based on the order of importance; firstly, by their demographic information (cultural background), then personality dimensions (conscientiousness and extraversion), moral foundations (ingroup, authority and purity), Schwartz's human values (humility, stimulation and self-direction action), knowledge about ethics and video game playtime. Our models also show that cultural background was the greatest predictor for ranking the principles of beneficence, non-maleficence and explicability as the most important principle.

Going forward, we intend to use the profiles uncovered here to build AI NPCs which will simulate and reason about a range of human ethical viewpoints in response to cybersecurity scenarios that unfold within a virtual work environment. Through interaction, the NPCs will expose the player to multiple viewpoints. Based on the player's predicted viewpoint, the NPCs will adapt their training to help the player better understand the possible human responses and factors that can impact cybersecurity designs, implementations and policy decisions. In this way individuals that are predicted, based on their profile, to be less familiar with a specific ethical principle in a cybersecurity context could be provided with targeted interactive ethical education that could help them to make moral judgements that more closely adhere to ethical principles.