New Insights into the Justifiability of Organizational Information Security Policy Noncompliance : A Case Study

This is a sel -a chi ed e sion o an o iginal a icle. This e sion may di e om he o iginal in pagina ion and ypog aphic de ails. Au ho (s): Ti le: Yea : Ve sion: Copy igh : Righ s: Righ s u l: Please ci e he o iginal e sion: CC BY-NC-ND 4.0 h ps://c ea i ecommons.o g/licenses/by-nc-nd/4.0/ New Insigh s in o he Jus i iabili y o O ganiza ional In o ma ion Secu i y Policy Noncompliance : A Case S udy © Au ho s, 2022 Published e sion Soliman, Wael; Mohammadnaza , Hoja Soliman, W., & Mohammadnaza , H. (2022). New Insigh s in o he Jus i iabili y o O ganiza ional In o ma ion Secu i y Policy Noncompliance : A Case S udy. In P oceedings o he 55 h Hawaii In e na ional Con e ence on Sys em Sciences (HICSS 2022) (pp. 6812-6821). Uni e si y o Hawai'i a Manoa. P oceedings o he Annual Hawaii In e na ional Con e ence on Sys em Sciences. h ps://doi.o g/10.24251/HICSS.2022.823 2022 New Insigh s in o he Jus i iabili y o O ganiza ional In o ma ion Secu i y Policy Noncompliance: A Case S udy Wael Soliman Uni e si y o Jy askyla wael.soliman@jyu. i Hoja Mohammadnaza Uni e si y o Jy askyla hoja .h.mohammadnaza @jyu. i Abs ac In o ma ion secu i y policies as appa a us o communica ing secu i y p inciples wi h employees a e he co ne s one o o ganiza ional in o ma ion secu i y. Resul an ly, ex an li e a u e has looked a di e en heo ies o be e unde s and he noncompliance p oblem. Neu aliza ion heo y is eme ging as one o he mos popula app oaches, no only as an explana ion bu also as a solu ion. In his in-dep h quali a i e s udy, we ask he ques ion ‘how do employees jus i y iola ing he ISP’? Ou indings e eal nine a ionalizing echniques, h ee o which ha e no been ecognized in p e ious esea ch. We label hem ‘I ollow my own ules’, ‘ma e o me e legali y’ and ‘de ense o uniqueness’. Bu mo e impo an ly, ou in-dep h insigh s poin o he dange o aking hese a ionaliza ions ou o con ex , since wi hou con ex , i becomes impossible o judge whe he he beha io o he ule, needs co ec ing, e lec ing a dilemma ecognized in he o iginal w i ing o neu aliza ion heo y, which has since been o go en. 1. In oduc ion Wi h inc easing eliance o o ganiza ions on cybe en i onmen s o managing hei daily ope a ions, p o ec ion o in o ma ion asse s in such en i onmen s becomes e e mo e c ucial. Va ious h ea classi ica ions ha e been in oduced [1], o which h ea s emana ing om employees (i.e. inside h ea ) is conside ed “ he g ea es h ea o in o ma ion secu i y” [2]. Indeed, i is widely acknowledged among schola s o in o ma ion sys ems secu i y (he ea e , ISS) ha in o ma ion secu i y policy (he ea e , ISP) and i s en o cemen cons i u e he ounda ion o an o ganiza ion’s in o ma ion secu i y [3], [4]. In mos beha io al ISS esea ch, ISP e lec s low-le el policies which con ains “no ma i e lis s o ac ions ha he employees should (o should no ) pe o m” [3]. Fo mally, hese no ma i e lis s o ac ions, o ules, a e he ul ima e au ho i a i e oice agains which employees a e held accoun able. Conside ing he c i ical ole ha ISPs could play in ensu ing he secu i y o o ganiza ional in o ma ion asse s, many ISS schola s ha e emphasized ha policy en o cemen should be non-nego iable, and ha “an unen o ced policy is no wo h he pape i is w i en on” [5]. I would be sa e o a gue ha sol ing he ISP noncompliance p oblem has become he man a o mains eam ISS esea ch. Neu aliza ion heo y [6] is eme ging as a popula lens in ISS esea ch [7]–[9], especially ha i has he capaci y o double bo h as an explana ion and solu ion o he noncompliance p oblem. As an explana ion, neu aliza ion heo y is used o demons a e ha employees apply a ious a ionaliza ions (aka neu aliza ion echniques) in o de o libe a e hemsel es om no ma i e es ic ions, he eby making policy iola ions easie o jus i y [4]. Cu en ISS esea ch p o ides e idence in line wi h his a gumen [10]–[12]. As a solu ion, neu aliza ion heo y is used o de ise aining p og ams ailo ed o he speci ic echniques wi h he aim o de-neu alizing hem [13], [14]. Despi e hese ex emely impo an insigh s in o employees’ use o neu aliza ions and he p oposed solu ions, i is su p ising o ind ha e y li le has been done o hea he employees’ oices ega ding he jus i iabili y o ISP iola ions commi ed in he speci ic con ex o hei wo k en i onmen . Fu he mo e, as o ye , he e is li le e idence o sugges ha ISS esea che s ha e conside ed he possibili y ha ISP, a he han employees’ neu aliza ions, needs co ec ing. A e all, esea ch in c iminology has ecognized ha ‘no all neu aliza ions a e bad’ [15, p. 228]. I his is he case in he ISS con ex as well, hen we migh be missing c ucial insigh s i all employees’ insigh s a e dismissed as (bad) neu aliza ions. Lack o unde s anding o he con ex o iola ion may lead o he adop ion o ‘no-jus i ica ion-allowed’ app oach, which would be p oblema ic in si ua ions whe e e en jus i iable easons o iola ing an ISP ule would be epo ed as ‘making excuses’ [16], when he co ec cou se o ac ion would ha e been a modi ica ion in he secu i y measu e and i s co esponding policy. Resea ch o his na u e is inhe en ly quali a i e, which is cu en ly lacking and much needed [17], [18]. Gi en his esea ch gap, in his a icle we epo ou indings om an in-dep h quali a i e s udy [19], [20]. In conduc ing his s udy, no only ha e we gained insigh s P oceedings o he 55 h Hawaii In e na ional Con e ence on Sys em Sciences | 2022 Page 6812 URI: h ps://hdl.handle.ne /10125/80163 978-0-9981331-5-7 (CC BY-NC-ND 4.0) ha ex ends neu aliza ion heo y h ough he iden i ica ion o no el echniques, bu also, we demons a e ha employees’ jus i ica ions o policy iola ion a e con ex -dependen and in some cases may poin ou a en ion o laws in he ules, a he han in he beha io . 2. Theo e ical backg ound In o ma ion secu i y policy (ISP) is ecognized as he ounda ion o o ganiza ional in o ma ion secu i y since i communica es o he employees wha hey can and canno do wi h he o ganiza ion’s asse s [3]. The e o e, unde s anding o employees’ ISP (non)compliance beha io has become one o he majo conce ns o in o ma ion secu i y esea che s [4], [13], [14], [21]. In his domain, neu aliza ion heo y [6], [22] is eme ging as a popula lens o examine how employees jus i y iola ing wo kplace ISPs. Neu aliza ion heo y [6] was in oduced o explain how delinquen s, especially hose in he ea ly s ages o hei c iminal ca ee , deploy a ious echniques ha enable hem o d i be ween he wo lds o he law-abiding ci izen, and ha o a delinquen . Sykes and Ma za [6] iden i ied i e such echniques and called hem neu aliza ions echniques. These a e, ‘denial o esponsibili y’, ‘denial o inju y’, ‘denial o ic im’, ‘condemna ion o condemne s’, and ‘appeal o highe loyal ies’. Each o hese echniques p o ides a coun e a gumen (hence he name, neu aliza ion) o a ionalize o jus i y he de ian beha io om he o ende ’s poin -o - iew. The ‘denial o esponsibili y’ echnique is used o libe a e onesel om any sense o accoun abili y and con ol wi h espec o he si ua ion a hand, by a guing, o example, ha “I didn’ mean i ” [6, p. 669]. ‘Denial o inju y’ p o ides a a ionaliza ion ha diminishes he impac o he ac , whe eby he o ende would claim, o example, ha “I didn’ eally hu anybody” [ibid]. The ‘denial o he ic im’ echnique in ol es a con on a ional a gumen denying he exis ence o a ic im in he i s place, sugges ing ha he ic im dese ed wha happened and ha “ hey had i coming” [ibid]. The ‘condemna ion o he condemne s’ is a echnique by which he o ende u ns he spo ligh on hose who disapp o e o he ac i i y o unde mine hem usually by a guing ha “e e ybody is picking on me” [ibid]. Las ly, he o ende migh ‘appeal o highe loyal ies’ and a gue ha engaging in he o ense is ou o loyal y o g oups such as amily o iends and i is no due o lack o espec o no ms o he socie y a la ge, o example, “I didn’ do i o mysel ” [ibid]. La e esea ch in c iminology has unea hed u he echniques ha o ende s could deploy o neu alize an i-social beha io . ‘Me apho o he ledge ’ [23], ‘de ense o necessi y’ [24], ‘claim o indi iduali y’ [25] ‘jus i ica ion by compa ison’, ‘jus i ica ion by pos ponemen ’ [26], ‘claim o en i lemen ’ [27], ‘e e ybody does i ’ [27], and ‘claim o ela i e accep abili y’ [25] a e among he echniques ha ha e been de eloped in addi ion o he ini ial i e echniques. In he ISS ield, neu aliza ion heo y has been used o explain de iance in wo main esea ch hemes. The i s heme co e s wo kplace de iance commi ed by employees. Unde he wo kplace de iance heme, wo dis inc opics ha e domina ed his a ea o esea ch: one explo es he jus i iabili y o c imes commi ed by employees, such as hacking and s ealing [28], [29]; and he o he explo es non-c iminal iola ions o o ganiza ional policy, such as, cybe loa ing [12], [30] and shadow IT use [11], [31]. The second esea ch heme, in u n, co e s de ian beha io ou side o o ganiza ional con ex , which explo es he jus i iabili y o so wa e and music pi acy [32]–[34]. To da e, howe e , neu aliza ion-based ISS esea ch design has been p edominan ly con i ma o y in na u e, aiming o es he ex en o which one o mo e neu aliza ion echniques is signi ican ly associa ed wi h a gi en iola ion. In his ega d, mul iple s udies p o ide e idence ha neu aliza ion echniques could inc ease one’s in en ion o engage in ISP iola ion in gene al [8], [35]–[37], commi compu e abuse [29], [38], use he wo kplace In e ne o pe sonal pu poses [30], [39], [40] as well as engage in shadow IT use [11]. Fu he mo e, some s udies sugges ha deploying neu aliza ion echniques may discou age employees om complying wi h ISP [10], [41], [42]. While hese s udies gene ally ocus on es ing he ex en o which neu aliza ion is signi ican ly associa ed wi h a gi en iola ion; mo e ecen esea ch has s a ed de ising neu aliza ion heo y-based solu ions o ISP iola ions. One such solu ion is communica ing an i-neu aliza ion messages [13], [14]. Fo ins ance, a message a ge ing ‘denial o inju y’ would s ess ha “ he e is always he possibili y o ha m” [13]. Resul s om wo s udies ha examined he mi iga ing e ec o an i-neu aliza ion messages showed ha use s who ecei ed such messages we e mo e likely o be discou aged om ISP iola ion compa ed o hose who did no ecei e any communica ion messages [13], [16]. Ano he solu ion ha has been in es iga ed o neu aliza ion p e en ion is an i-neu aliza ion aining [14]. A e conduc ing a aining p og am a ge ing use s’ neu aliza ion o passwo d policy iola ion, Siponen e al. [14] epo ed ha o e all he aining p og ams based on cogni i e dissonance educed neu aliza ion e en hough aining migh ha e been ine ec i e o speci ic echniques such as, ‘claim o en i lemen ’, ‘claim o ela i e accep abili y’ and ‘Jus i ica ion by compa ison’. Page 6813 Despi e he e y impo an insigh s we gain om hese s udies, i is su p ising o ind ha we lack con ex - speci ic and da a-d i en (i.e., induc i e) esea ch [43]– [45] ha aims o unde s and how employees, in hei own wo ds, a ionalize and jus i y ISP iola ions commi ed in hei wo kplace. The only excep ion is Lim and Teo [46] whose wo k on cybe loa ing ecognized he impo ance o he ‘shi ing wo k home’ phenomenon. Beyond his single e o , no a emp has been made o p obe he iola o ’s wo ld iew. Such explo a i e app oach, no only does i o e e idence o he applicabili y (o lack he eo ) o neu aliza ion heo y in di e en con ex s, bu also i o e s a unique oppo uni y o disco e new neu aliza ion echniques speci ic o ISP iola ions. 3. Resea ch app oach The s udy epo ed he e is based on a quali a i e inqui y [19], [20] conduc ed be ween 2016 and 2018, wi h he gene al aim o unde s anding he employees’ pe spec i e ega ding he ole ISP plays in guiding hei e e yday wo k ou ines, in he con ex o a la ge esea ch-o ien ed No dic uni e si y. Se e al calls ha e been made o conduc such esea ch in he ISS ield o complemen he dominan unc ional iew, which gene ally a o s “no ma i e logic and p edic i e capaci y” [47], a he expense o unde s anding wha employees ac ually do in eal li e se ings [17], [18]. In balance, in his esea ch we explo e how he neu aliza ion heo y lens could help us be e unde s and he employees’ in o ma ion secu i y noncompliance beha io . Hence, ou app oach emphasizes he examina ion o a phenomenon in i s na u alis ic con ex , wi h he pu pose o con on ing heo y wi h he empi ical wo ld [48], [49]. No only does ou esea ch app oach suppo he unde s anding o a phenomenon in i s na u al se ing, bu also i ad oca es adop ing neu aliza ion heo y as a sensi izing de ice o ensu e ha we en e he esea ch se ing wi h an ‘open’– a he han ‘emp y’–mind [50]. Resea ch based on neu aliza ion heo y acknowledges he subjec i e in e p e i e na u e o neu aliza ions, and ha he e can be mul iple in e p e a ions o he same e en and he jus i ica ions used wi hin. Ma una and Copes [15] no es: “E e y e en is subjec o mul iple in e p e a ions … [O]ne pe son's a ional explana ion is ano he 's a ionaliza ion. I neu aliza ions a e o ca y any psychological weigh , hey mus , a leas pa ially, be belie ed by he pe son using hem” [15, p. 230]. Wi h his emphasis, we wish o highligh ha in ou analysis and iden i ica ion o he neu aliza ion echniques, we do no ea hem as ‘lies’ o ‘decep ions’; a he as me e jus i ica ions. In e ms o da a collec ion, his s udy builds on mul iple da a sou ces including o mal in e iews, in o mal discussions, o icial documen s (e.g., he o icial in o ma ion secu i y policy), as well as pe sonal obse a ion. Rega ding he in e iews, scheduled in e iews we e conduc ed wi h eigh een pa icipan s be ween Oc obe 2016 and Sep embe 2018. The pa icipan s we e all on he pay oll, and held a ious posi ions in he o ganiza ion, including, adminis a ion s a , eache , doc o al candida e, pos -doc o al esea che , and p o esso . All in e iews we e conduc ed ace- o- ace, and on a e age, each las ed o one hou . All in e iews we e eco ded, and he in e iewees we e p omised anonymi y, so hey will be e e ed o in his s udy as “In e iewee # …”. All eco ded in e iews we e ea ed wi h u mos ca e, and o ensu e anonymi y hey we e ansc ibed and anonymized by he i s au ho alone. Then he ansc ibed ex was sha ed wi h he second au ho o u he analysis. In e iews we e semi-s uc u ed [51], and he main hemes e ol ed a ound each pa icipan ’s pe cep ion o and a i ude owa ds he wo kplace ISP, o gain an in-dep h unde s anding o i s ole in shaping hei pe sonal day- o-day compu e use beha io . As such, he in e iew p o ocol was designed o elici insigh s abou he employees’ pe cep ion o ISPs in gene al, as well as abou speci ic secu i y beha io s [52]. Gene al pe cep ions abou ISP e lec ed ques ions such as o wha ex en hey we e awa e o he o icial ISP, wha i mean o hem in he wo kplace, and how hey el ISP impac ed hei daily ou ines a wo k. Speci ic ques ions, on he o he hand, ocused mo e on discussing he pa icipan ’s iews o speci ic ules as s a ed in he ISP (e.g., passwo d change ule and pe sonal IT use ule), o wha ex en hey comply o iola e hese speci ic ules, and in he case o iola ion wha hey conside ed he bes cou se o ac ion o ix he si ua ion. Du ing each in e iew, he o icial ISP (ei he a p in ou o onsc een) was used o acili a e he discussion. All in e iew ansc ip s we e coded using bo h i s - and second-o de hemes [53] Speci ically, i s - o de codes a e mo e e lec i e o he empi ical da a and ep esen as close as possible he na a i es as gene a ed by he pa icipan s hemsel es. By con as , second- o de codes a e mo e analy ic in na u e as hey e lec he analys s’ in e p e a ion o hese concep s, which in ou case, a e in luenced by he heo e ical lens o neu aliza ion. Fo ins ance, we conside he code ‘ISP_is_S upid’ o be i s -o de code since i e lec s he pa icipan ’s u e ance. Subsequen ly, we code he same u e ance using he second-o de code ‘Condemna ion_o _ he_Condemne s’, which is consis en wi h neu aliza ion heo y. This p ocess allowed ca ego izing he iola ion jus i ica ions Page 6814 acco ding o known neu aliza ion echniques, as well as iden i ying new jus i ica ions. The wo au ho s discussed all esul an echniques in a ious mee ings un il a inal ag eemen was achie ed. 4. Findings This sec ion epo s he main indings ega ding he esea ch ques ion: ‘how do employees jus i y iola ing he ISP’? Due o space limi a ion we decided o epo only ou indings ega ding neu aliza ion echniques ha a e used by a leas one- hi d o he pa icipan s. Wi h his in mind, ou analysis e eals he p e alence o nine neu aliza ion echniques used by ou pa icipan s o jus i y hei ISP iola ions. Th ee o hese echniques a e classical and a e well-known in he li e a u e since hey o igina e in Sykes and Ma za’s [6] wo k. Namely, ‘denial o esponsibili y’, ‘condemna ion o he condemne s’, and ‘denial o inju y’. Th ee echnique ha e been u he de eloped by c iminologis s and a e somewha known in a ious ISS w i ings. Namely, ‘de ense o necessi y’, ‘jus i ica ion by compa ison’, and he ‘e e ybody does i ’ claim. Finally, we in oduce h ee no el echniques speci ic o ISP iola ions ha a e no ecognized in p e ious wo k. Namely, ‘ma e o me e legali y’, ‘de ense o uniqueness’, and ‘I ollow my own ules’. We discuss each o hese ca ego ies in u n. 1. Denial o esponsibili y. The ‘denial o esponsibili y’ echnique is he mos applied echnique o policy iola ion in ou s udy. Sykes and Ma za [6] explain ha ‘denial o esponsibili y’ allows delinquen s o libe a e hemsel es om no ma i e es ic ions by nega ing pe sonal accoun abili y. In his sense, employees who use he ‘denial o esponsibili y’ echnique could a gue ha hey we e no in con ol o he si ua ion, a he , hey we e ac ed upon by o he esponsible ac o s [26]. Fou een pa icipan s used his echnique. The use o his neu aliza ion echnique among ou in e iewees came o ligh when hey we e in oduced wi h a copy o he o icial policy, a which poin many o hem ealized ha hey had no seen i be o e o did no emembe i s con en . Mo eo e , some wen u he o a gue ha no one s opped hem om iola ing he policy and he e o e hey we e no o be blamed. Meanwhile, o he s wished ha someone else would ake he bu den o unde s anding and summa izing he ISP on hei behal . In gene al, he p e alence o his echnique sugges s ha he in e iewees see ha i is no hei esponsibili y o exe an e o on sea ching o he o ganiza ion’s ISP and s udy i s con en . One in e iewee sums up he use o his echnique: “I hink he main esponsibili y lies in he uppe pe sons wo king in hei o ice. I hink i 's he ones who make he policy should make su e e e ybody knows abou i and knows abou he di e en s eps. I hink i , o example, you s a wo king o he uni e si y, people should ell you how o do, and you should no y o ind hings you sel , because he e a e millions o hings ha you ha e o lea n abou . Then I wouldn' pu he esponsibili y on he employee, i 's he esponsibili y o he employe o ell hei employees ha his is he policy o ollow. So, I hink he esponsibili y somewhe e highe han on he a e age wo ke he e.” [In e iewee #11]. 2. Condemna ion o he condemne s. The ‘condemna ion o he condemne s’ neu aliza ion echnique enables an o ende o shi he blame om onesel o hose who disapp o e o he ac ion [6]. When deploying his echnique an o ende may claim ha hose who disapp o e o he ac ion a e hypoc i es who hemsel es commi he o ense [6]. In c iminal esea ch, deploying his neu aliza ion echnique sugges s ha he o ende iews he en o ce as co up [26]. In ISS con ex , his echnique o en e lec s disapp o al o he ISP as being un easonable [8], o ha hose who en o ce IT policy may hemsel es engage in simila beha io [31]. In line wi h he common in e p e a ion in ISS esea ch, we ind ha hi een pa icipan s used his echnique. We obse ed he ‘condemna ion o he condemne s’ neu aliza ion echnique clea ly e lec ed a c i icism owa ds he ISP i sel as being ‘ou da ed’, ‘lame’, ‘ idiculous’ and e en ‘s upid’. Fo ins ance, one pa icipan belie es ha he policy sec ion ela ed o pe sonal IT use “doesn' make oo much sense, because all he hings ha I do on daily basis a e somewha ela ed o p i a e use” [In e iewee #16]. Simila ly, o he s would hink ha his ule is “kind o old ashion” and i could ha e made mo e sense i i was in oduced “ i e o en yea s back” [In e iewee #6]. In addi ion o condemning he ules wi hin he policy, some ha e also c i icized hose esponsible o in oducing hose imp ac ical ules in he policy in he i s place. Fo ins ance, In e iewee #15 c i icized he managemen s yle and wha manage s do wi h hei ime when he ou come is a policy such as his one. They no e: “Bu hese a e he issues ha I ne e unde s ood. Maybe we' e ha ing oo many bosses. Too many high sala y people who do no ha e any hing be e o do. Yeah. Bu ha 's he way i is.” [In e iewee #15]. 3. Denial o inju y. Using he ‘denial o inju y’ echnique allows an o ende o ende hei ac ion as ha mless [6]. Since he e is no ha m, he o ende could a gue ha he beha io is no blame-wo hy. In c iminology, he ‘denial o inju y’ neu aliza ion echnique e lec s he common a gumen ha , o ins ance, a shopli e could a gue ha big s o es make a lo o money so ‘ hey don’ miss he li le bi I ge ’ [26]. Simila ly, In ISS con ex , employees may deploy ‘denial o inju y’ by jus i ying ha hei secu i y iola ion is a Page 6815 mino issue and does no hu anyone [16]. In he s udy a hand, hi een in e iewees used his echnique. The use o ‘denial o inju y’ neu aliza ion echnique was e iden when in e iewees di ec ly no ed ha hei policy iola ions we e ha mless. Gene ally, many in e iewees ega ded he ole o ISP o be sugges i e a bes , and ha iola ing i is accep able as long as no ha m is done. “… somehow he policies a e d awing he bounda y, so as long as people, kind o , wi hin he bounda y, o somehow a li le beyond he bounda y bu , i doesn' eally ha m he secu i y o hose IT esou ces, o i doesn' eally d ama ically c ea e nega i e impac on job pe o mance, hen I hink i 's somehow ok” [In e iewee #5]. When in e iewees we e asked o elabo a e hei iews u he using he speci ic example o he pe sonal IT use ule, some ook a p oduc i i y pe spec i e and cla i ied ha iola ing i is accep able since “ he e's no ha m excep he wo k ime los ha I can make up by wo king a bi la e , o wo king a home when he kids a e in bed.” [In e iewee #17]. O he s, howe e , ook a pu ely inancial pe spec i e and jus i ied ule b eaking on he basis o he economic impac o he iola ion: “unless he e's some hing I don' know abou , I mean, i doesn' cos any mo e money, does i ? … Is he e a loss o money o he uni e si y o me looking a a holiday websi e in my lunch b eak?” [In e iewee #10]. 4. De ense o necessi y. The ‘de ense o necessi y’ neu aliza ion echnique holds ha an o ense is necessa y o achie e a c ucial ou come (Coleman, 1987). Consequen ly, since he o ense is necessa y and he o ende has no o he choice, he e is no need o eeling guil y o ashamed [24], [26]. In c iminal esea ch, hie es o example would use he ‘de ense o necessi y’ echnique o a gue ha s ealing was he only way o eed he amily [26]. In ISS con ex , employees may deploy his echnique by a guing ha due o ime cons ain s, iola ion o he ISP is necessa y o comple ing hei asks [8]. In he cu en s udy, hal o he in e iewees appealed o his echnique. The ‘de ense o necessi y’ was e iden in a gumen s whe eby compliance wi h he ISP was amed as an obs acle o e iciency, o a seconda y p io i y in he ace o he p essing demands o wo k equi emen s. Talking abou he ISP in gene al, se e al in e iewees ad anced a gumen s simila o his one: “So, secu i y and complying wi h he policy is seconda y in p io i ies compa ed o he p ima y hings ha needs o be done; wha I'm he e o do.” [In e iewee #11]. When asked o elabo a e hei a ionale, one in e iewee gi es u he explana ion: “I mean i is like, i you ollow his 100% [poin ing o he pe sonal IT use ule], you couldn' isi any webpage wi h you wo k compu e , o example, ha a e no 100% ela ed o wo k. Then you would all he ime ha e o ca y 2 compu e s wi h you. And hen i you ha e a b owse open in one compu e , hen you would ha e o open he o he one and open a b owse he e jus o isi , o example, one page. So, i would be a lo o hassle, a lo o ex a wo k, and in he end, I hink i would also be de imen al o you wo k e ec i eness.” [In e iewee #11]. 5. Jus i ica ion by compa ison. The idea behind he ‘jus i ica ion by compa ison’ echnique is qui e simple, by a guing ha he iola ion in ques ion is much be e han a much wo se iola ion. When deploying his echnique, an o ende acknowledges ha hey a e engaging in a w ongdoing bu jus i ies hei ac ion by a guing ha hey could ha e done wo se. In c iminal esea ch, shopli e s o ins ance would a gue ha s ealing om a shop is no hing compa ed o obbing people o b eaking in houses [26]. In ISS esea ch, ‘jus i ica ion by compa ison’ has ecei ed li le esea ch a en ion, howe e , a use can u ilize his echnique by a guing ha an ISP iola ion, such as iola ing passwo d policy, is no as bad as was ing he whole day on non- p oduc i e wo k [14]. Nea ly hal o ou pa icipan s (eigh in e iewees) used his echnique, when compa ing hei own (li le) ISP iola ions wi h wha would be conside ed ( uly) se ious iola ions, such as “downloading mo ies” [In e iewee #12], “wa ching po nog aphy” [In e iewee #9], o e en “bi coin mining” [In e iewee #17]. In e es ingly, he e seems o be a gene al ag eemen on compa ing ISP iola ions agains wha would be clea ly in e p e ed as a ha m ul o illegal, o jus i y own iola ions. One in e iewee elabo a es hei pe spec i e: “i s uden s we e unning pee - o-pee ne wo king a [online se ice]. So, ha 's a clea iola ion. I 's illegal ac i i y. So, ha goes beyond he h eshold. A ha poin , yellow ca d. Bu , ob iously, using Facebook, e-comme ce, online banking, doesn' go beyond he h eshold o me o ge a wa ning.” [In e iewee #13]. 6. E e ybody does i . The ‘e e ybody does i ’ echnique in ol es a “ ans e o esponsibili y om he o ende o a la ge and o en aguely de ined g oup o which he o she belongs” [54]. As such, his echnique is commonly used when an o ende ies o a oid sel - blame by poin ing ou ha o he s engage in he same ac i i y and ha he ac i i y is commonplace and no mal in a gi en con ex [26], [27]. ISS esea che s adop ing his echnique in hei s udies ha e o en e e ed o i wi h a ious names, such as ‘de ense o ubiqui y’ [42] o ‘no maliza ion’ [46]. The main poin he e is ha using his echnique o en e lec s he a gumen o a ionaliza ion ha he ISP iola ion in ques ion is commonplace. In he cu en s udy, one- hi d o he in e iewees used his echnique o a gue ha hei iola ion o he ISP was commonly accep able and no mal. When discussing ules in gene al, i was emphasized ha social accep abili y can be mo e Page 6816 impo an han wha he policy dic a es. Fo ins ance, one in e iewee explains “I’m su e he e a e a lo o hings ha I disag ee wi h [in he policy] because o he ac ha I don’ hink socially anybody is complying wi h i .” [In e iewee #18]. When p essed o cla i y hei a ionale u he , some would use he pe sonal IT use ule o poin ou : “I you conside basic ule #1 p esen ed he e, I hink … ha mos people a ound he e a e no awa e o such ule, and I also hink ha i he policy has ules ha you would hink by commonsense ha 95% o he people a e iola ing–… o cou se I can' say o su e–bu I hink ha e e yone he e is iola ing basic ule #1 a some ime du ing hei wo k” [In e iewee #11]. 7. Ma e o me e legali y. The ‘ma e o me e legali y’ jus i ica ion is a p e iously unknown echnique o neu aliza ion iden i ied in his s udy. Nea ly hal o he s udy pa icipan s (eigh pa icipan ) used his echnique o jus i y hei ISP iola ion. Using his echnique, ule iola o s a gue ha a wo kplace policy is me ely a ma e o con ac ual ag eemen and need no be ollowed s ic ly. The employee may asse his posi ion by no ing ha wo kplace policies a e designed o ‘wo s case scena ios’ in o de o p o ec he o ganiza ion om legal liabili ies in ex eme cases, o o p o ide legal g ounds o u he ac ion agains ogue employees. In deploying his echnique, in addi ion o poin ing ou he legal quali ies o he ISP, pa icipan s ha e also no ed ha he ISP is no a documen o communica e in o ma ion secu i y measu es and guidelines bu a legal documen ha is ese ed o g oss iola ion o di icul indi iduals. Bu o as long as he employee is gene ally ca e ul abou no causing any ha m (see ‘denial o inju y’), and doing a gene ally good job (see ‘me apho o he ledge ’), hen hese ISP ules belong only ‘in he d awe ’. Su p isingly, his is an assump ion se e al in e iewees sha e e en wi hou knowing wha he con en o he policy is. One pa icipan no es: “I explained I ha en' ead ha [poin ing o ISP], … and I hink wi hou eading ha –I migh be w ong, o cou se–I hink his manual is 10 pages ha libe a e he [employe ] o whoe e w o e ha , om he, hmm, le 's say, he legal side o hings, i someone does some hing w ong on pu pose. I wasn' w i en o he employee … hmm, he pu pose o ha documen is no o help he employees o do s u , like, in secu e way; i 's jus some hing ha 's equi ed legally”. [In e iewee #2]. Simila ly, In e iewee #18 explains: “I you a e in a si ua ion wi h an employee whe e he employee becomes di icul , you can always say: Okey, he e’s his policy, you’ e supposed o ha e ead i ”, and hen puni i e ac ion can be easily aken agains he ouble-make . Mo e in e es ingly, he ‘ma e o me e legali y’ jus i ica ion does no e lec disg un lemen agains he policy; a he , i e lec s a gene al unde s anding ha his is how policies should be w i en, bu o legal pu poses only. In e iewee #10 exp esses his idea well: “Yeah. I unde s and why hese ha e o be he e. I eally do. Bu , nowadays, and mo e speci ically wi hin his en i onmen , i 's eally o he pu poses o hem being able o ge ing us legally. Because we oughly know wha we' e doing.” In ac , In e iewee #17 hough ha i hey we e asked o w i e a policy, hey would w i e i in ha exac same way, bu ha does no mean ha hey would no iola e i ! 8. De ense o uniqueness. The ‘de ense o uniqueness’ is a newly iden i ied echnique o neu aliza ion in his s udy. Nea ly hal o he s udy pa icipan s (eigh pa icipan ) used his echnique o jus i y hei ISP iola ion. Using his echnique, a policy iola o ques ions he con ex ual ele ance o he policy and a gues ha ce ain policies a e no applicable o he se ing in which he iola ion occu s. In doing his, he iola o aises he issue ha he se ing has unique quali ies ha make ce ain ules inapplicable in ha se ing while d awing compa ison wi h o he se ings in which he ule applies. Al hough his echnique in ol es a compa a i e p ocess like he ‘jus i ica ion by compa ison’ echnique; wha we iden i ied he e is di e en . Speci ically, whe eas he ‘jus i ica ion by compa ison’ is iola ion-o ien ed (i.e., he iola ion in ques ion is no as bad when compa ed wi h much wo se ones); he ‘de ense o uniqueness’ is con ex -o ien ed (i.e., he ule in ques ion may be sui able o o he con ex s, bu no ou s). Pa icipan s in his s udy used his echnique o di e en ia e be ween hei line o wo k wi h o he s, ei he in he same o ganiza ion o in o he o ganiza ions. Fu he mo e, in some cases hey di ec ly a gued ha he ISP is no applicable o hem due o he na u e o hei wo k. One in e iewee explains hei gene al iew ega ding he con ex ual ele ance o ules: “I' e wo ked in a numbe o di e en o ganiza ions wi h di e en le els o educa ion. You ge a lo o a**holes ou he e who, hmm, who would do wha hey wan , and ake he *ck wha hey wan , and don' gi e a sh* abou he consequences. These a e wha hese ules a e he e o . Bu [he e], we' e all gene ally a decen punch o people.” [In e iewee #10] When alking speci ically abou he pe sonal IT use ule, ano he in e iewee gi es a mo e speci ic explana ion o he iola ion: “… I unde s and i I wo k in an o ganiza ion ha is e y, like mili a y, o some hing like ha , I unde s and ha I'm no allowed o do my pe sonal s u by my wo king compu e , o h ough he ne wo k o ha o ganiza ion. Bu he e, hmm, … I don' do any hing like ha , hmm. So my wo k is no ela ed o any hing ha should be so secu e ha I can' use my wo k compu e o ead my emails.” [In e iewee #14]. 9. I ollow my own ules. ‘I ollow my own ules’ is he hi d newly iden i ied echnique which e lec s he Page 6817 a gumen ha a iola o has enough knowledge and/o expe ise o decide which ules o ollow, and which o bypass. This also e lec s an awa eness ha no all ules a e equal; some a e mean o be b oken. Nea ly hal o he s udy pa icipan s (eigh pa icipan ) used his echnique o jus i y hei ISP iola ion. By using his echnique, he iola o a gues ha hey ha e de eloped hei own se o ules, some o hem will be complian wi h he ISP, bu some o he s may coinciden ally iola e i . Ou pa icipan s used his echnique when jus i ying hei dis ega d o he o icial ISP, and ha i is enough o ollow hei own ules. Fo ins ance, In e iewee #4 explains ha i once c ossed hei mind o check he ISP, bu e en ually decided no o. When hey we e asked o explain why hey hink hey did so, hey eplied: “Why do I hink I do ha ? … Because I ha e my own judgmen o wha migh be good and wha migh be bad, hahaha” [In e iewee #4]. In e es ingly, he ‘I ollow my own ules’ seems o equi e p oo o pas success. Tha is, hose ules ha end up in he employee’s own in e nalized ‘ ule-se ’ a e he ones ha ha e so a been e ec i e in keeping hem ou o ouble. One in e iewee poin s ou : “I'll ollow my own habi , because I hink i has been qui e success ul hus a ” [In e iewee #12]. When ano he was asked o elabo a e on how hey de eloped hei own ules; hey eplied: “I 's aken maybe 15 yea s o come up wi h he s anda ds ha I ha e now. When i all s a ed? I don' eally know. Pe haps one o he aspec s is like wa ching people do hei s u , and someone saying ha ‘you should ha e a s ong passwo d’ o ‘you shouldn' lea e hese compu e s open’ ... o be blun , hose 10 pages I ha en' ead, like I said, bu I hink i 's gonna be 10 pages o common-sense.” [In e iewee #2]. 5. Discussion In he p e ious sec ion we p esen ed ou main indings ega ding he neu aliza ion echniques ou s udy pa icipan s used o jus i y iola ing ISP in a No dic uni e si y con ex . Nex , we discuss he mos salien heo e ical and p ac ical implica ions o hese indings. 5.1. Theo e ical implica ions Fi s , ou indings con ibu e o he dep h o knowledge on neu aliza ion heo y in ac i i ies ela ed o in o ma ion secu i y. While he e is a sizeable li e a u e on neu aliza ion heo y in ISS esea ch, much o his esea ch has been conduc ed using a quan i a i e c oss-sec ional esea ch design and li le has been done o explo e use s’ jus i ica ion o eal iola ions in eal con ex s. In ac , wi h a ew excep ions [46], [55], we ha e no ound any s udies ha examined employees’ jus i ica ions in esponse o hei wo kplace policy iola ions. This s udy s eps up o his challenge and in doing so p o ides insigh s ega ding he use o neu aliza ion echniques in ISS con ex . Sykes and Ma za [6] ha e acknowledge ha neu aliza ion echniques a e con ex -speci ic, meaning ha some echniques migh be mo e (o less) ele an in ce ain con ex s. Ou indings lend suppo o he asse ion ha he echniques ‘denial o esponsibili y’, ‘denial o inju y’ and ‘condemna ion o he condemne s’ a e he mos p e alen classical echniques. Meanwhile, some echniques such as ‘denial o he ic im’ [6], hough a classical echnique, migh be less ele an in simila con ex s. In his ega d, ou indings a e in line wi h Siponen and Vance’s [8] con en ion ha he ‘denial o ic im’ neu aliza ion echnique migh be i ele an in ISP iola ion cases due o he di icul y o iden i ying ic ims. Ou indings, he e o e, highligh he need o u he explo a i e s udies in o he ISS ela ed ac i i ies such as compu e abuse, shadow IT use and cybe loa ing o de e mine which echniques may o may no be ele an o each ac i i y. Second, his s udy con ibu es o neu aliza ion heo y by iden i ying h ee p e iously unknown neu aliza ion echniques, namely, ‘ma e o me e legali y’, ‘I ollow my own ules’, and ‘de ense o uniqueness’. These newly iden i ied echniques seem o be associa ed wi h dis inc i e quali ies o ISPs. The ‘ma e o me e legali y’ echnique highligh s he jux aposi ion o ISPs as legal documen s as well as ools o communica ing secu i y do’s and don’ s [56]. The ‘de ense o uniqueness’ echnique, on he o he hand, add esses he con ex -speci ici y o he wo k en i onmen . Since o ganiza ions ha e di e en needs and di e en wo king clima es, an ‘one-size- i s-all’ app oach o ISPs may no be ideal [57]. Las ly, he ‘I ollow my own ules’ echnique unde sco es he impo ance o ecognizing indi idual compe ence and pe sonal expe ience. ISPs may con ain in o ma ion ha equi es high compe ence and skill o implemen [58]. The ca ea , howe e , is ha when an indi idual possesses such compe ence and expe ience, hey may de elop hei own ways o handling in o ma ion secu i y and all in o a alse sense o con idence ega ding hei own abili ies hence ejec ing ISPs as help ul communica ion ools. Al e na i ely, employees’ own ules migh be mo e a uned o he speci ici y o hei si ua ion, han he policy. In such si ua ions, we a e aced wi h a dilemma: wha needs co ec ion, he employee’s beha io o he policy? Answe ing his ques ion poin s o ou hi d heo e ical implica ion. This dilemma ca ies wi hin, a alue judgemen ega ding he adequacy o he neu aliza ions. I he neu aliza ion is adequa e, hen employees’ beha io s need no be co ec ed, which means ha ou a en ion Page 6818 should be placed on changing he policy i sel . So a , esea ch based on neu aliza ion heo y has no add essed his ques ion, which no only does i bea heo e ical implica ions, bu also p ac ical implica ions (see, p ac ical implica ions sec ion). Sykes and Ma za [6] we e well awa e o his dilemma and hin ed o some di ec ion o esol ing i . Speci ically, Sykes and Ma za [6] con empla ed he ques ion “why men iola e he laws in which hey belie e” [6, p. 666]. To answe his, hey poin o “ he ac ha social ules and no ms … seldom i e e ake he o m o ca ego ical impe a i es” (ibid), and because o his con ex ual lexibili y, hey a gue, any unc ioning legal sys em delibe a es abou he “de enses o c imes” be o e gi ing a e dic ega ding a gi en ac . O cou se, in many si ua ions, he jus ice sys em deems jus i ica ions inadequa e, and co ec i e measu es need o be aken. Howe e , in some si ua ions, e en wha is gene ally ega ded as mala in se, o e il-by-na u e c imes [59], [60], such as killing a human being, a e acqui ed because hey we e ‘jus i ied’ (e.g., in sel -de ense). Ye , in o he si ua ions, ce ain ules had o be challenged and iola ed be o e any law i sel needed o change. In e es ingly, despi e Ma za and Sykes’ [6] ecogni ion o his assump ion, i has no a ac ed schola ly a en ion, leading Ma una and Copes, hal -a-cen u y la e , o emind us ha “ he ea men o neu aliza ion echniques as au oma ically ‘bad hings’ in c iminology and co ec ions is an o e simpli ica ion o a complex and subs an ial body o li e a u e” [15, p. 228]. In line wi h hese insigh s, we sugges neu aliza ions should be ega ded as p o isional pleas un il a e dic is made. The p ac ical implica ions o his insigh will be discussed in he nex sec ion. 5.2. P ac ical implica ions The e a e wo challenges ela ed o he p oduc ion o meaning ul p ac ical implica ions: (a) he deg ee o iola ion-speci ici y, and (b) he deg ee o con ex - speci ici y. Deg ee o iola ion-speci ici y ega ds one’s pe cep ion o he ISP as a collec ion o ules and guidelines a he han a single en i y. We lea ned ea ly on ha he pa icipan s did no pe cei e he ISP as a single en i y guiding hei secu i y beha io . Nea ly all ou in e iewees ha e been complying wi h some ISP ules bu iola ing one o mo e o he ules. Fo ins ance, one in e iewee migh be unyielding abou passwo d sha ing (complying wi h passwo d ule) bu using he wo k compu e o pay pe sonal bills o ead he news ( iola ing he pe sonal IT use ule). P ac ically speaking, when employees a e asked gene al ques ions abou he ex en o which hey comply wi h o iola e ISP (in gene al), i is impossible o disce n which neu aliza ion echniques a e ele an o which iola ion. So, we ea ha using such gene ic ques ions will no p oduce meaning ul insigh s o secu i y p o essionals and consul an s ega ding wha he employees a e ac ually doing in he wo kplace. Consequen ly, we sugges ha u u e explo a ions o ISP iola ions o be na owe in hei scope o be mo e p ac ice- ele an [61]. Second, ega ding he deg ee o con ex -speci ici y, we ealized a c i ical p ac ical dilemma, e en a e na owing he scope o iola ion-speci ici y o one speci ic ule. Du ing he cou se o each in e iew a e going h ough gene al discussions ega ding he ISP, each pa icipan was con on ed wi h a ule om he ISP (such as basic ule #1). As no ed ea lie , his basic ule ba s use s om all non-wo k ela ed use. App oaching and analyzing pa icipan s’ esponses o such ules wi hou due conside a ion o con ex using he neu aliza ion heo y indica ed clea use o a ious neu aliza ion echniques om a ‘con ex -less pe spec i e’. P ohibi ing all non-wo k ela ed use o he o ganiza ion esou ces is jus i ied by coun less w i ings on he h ea s o such iola ion. No only does pe sonal use o IT expose he o ganiza ion o a ious secu i y h ea such as i uses, spam, and malwa e [62], bu also in oduces loss o p oduc i i y [12]. These conce ns a e legi ima e, and he e o e he ob ious ecommenda ion o a con ex -less pe spec i e would be o cu b he iola ions by de eloping coun e - neu aliza ion s a egies ailo ed o he speci ic echniques we iden i ied. Rega ding he ‘condemna ion o he condemne s’ echnique, a ypical ecommenda ion is o sugges an i-neu aliza ion communica ion, and aining aimed a co ec ing he employees’ beha io by c ea ing cogni i e inconsis encies be ween wha hey do and he jus i iabili y o hei a ionaliza ions [13], [14], [16]. Following his line o hough , a p ac ical ecommenda ion would be de eloping aining and pe suasi e messages o each he lea ne s ha c i icizing he ISP is no accep able (a gene ic app oach), o ha i is an immo al hing o do o use he o ganiza ion esou ces o pe sonal use (a mo e speci ic app oach). Rega ding he ‘ma e o me e legali y’ echnique, a s aigh o wa d p ac ical ecommenda ion is he en o cemen o moni o ing and immedia e sanc ioning o iola o s o demons a e he se iousness o he ISP [63]. O he echnique-speci ic solu ions a e a ailable, such as ic im-o ende media ion which is hough o be e ec i e wi h he ‘denial o inju y’ echnique [8]. Howe e , conside ing he speci ic na u e o he s udied con ex , one migh see hings di e en ly. In his speci ic esea ch-o ien ed en i onmen whe e employees belie e ha c ea i i y and openness a e co e alues, and whe e he line be ween wha hey do a wo k and a home is hinning, he e is good chance ha he neu aliza ions iden i ied in his esea ch need no be de- Page 6819