This is a sel -a chi ed e sion o an o iginal a icle. This e sion
may di e om he o iginal in pagina ion and ypog aphic de ails.
Au ho (s):
Ti le:
Yea :
Ve sion:
Copy igh :
Righ s:
Righ s u l:
Please ci e he o iginal e sion:
CC BY-NC-ND 4.0
h ps://c ea i ecommons.o g/licenses/by-nc-nd/4.0/
New Insigh s in o he Jus i iabili y o O ganiza ional In o ma ion Secu i y Policy
Noncompliance : A Case S udy
© Au ho s, 2022
Published e sion
Soliman, Wael; Mohammadnaza , Hoja
Soliman, W., & Mohammadnaza , H. (2022). New Insigh s in o he Jus i iabili y o O ganiza ional
In o ma ion Secu i y Policy Noncompliance : A Case S udy. In P oceedings o he 55 h Hawaii
In e na ional Con e ence on Sys em Sciences (HICSS 2022) (pp. 6812-6821). Uni e si y o
Hawai'i a Manoa. P oceedings o he Annual Hawaii In e na ional Con e ence on Sys em
Sciences. h ps://doi.o g/10.24251/HICSS.2022.823
2022
New Insigh s in o he Jus i iabili y o O ganiza ional In o ma ion Secu i y
Policy Noncompliance: A Case S udy
Wael Soliman
Uni e si y o Jy askyla
wael.soliman@jyu. i
Hoja Mohammadnaza
Uni e si y o Jy askyla
hoja .h.mohammadnaza @jyu. i
Abs ac
In o ma ion secu i y policies as appa a us o
communica ing secu i y p inciples wi h employees a e
he co ne s one o o ganiza ional in o ma ion secu i y.
Resul an ly, ex an li e a u e has looked a di e en
heo ies o be e unde s and he noncompliance
p oblem. Neu aliza ion heo y is eme ging as one o he
mos popula app oaches, no only as an explana ion
bu also as a solu ion. In his in-dep h quali a i e s udy,
we ask he ques ion ‘how do employees jus i y iola ing
he ISP’? Ou indings e eal nine a ionalizing
echniques, h ee o which ha e no been ecognized in
p e ious esea ch. We label hem ‘I ollow my own
ules’, ‘ma e o me e legali y’ and ‘de ense o
uniqueness’. Bu mo e impo an ly, ou in-dep h
insigh s poin o he dange o aking hese
a ionaliza ions ou o con ex , since wi hou con ex , i
becomes impossible o judge whe he he beha io o
he ule, needs co ec ing, e lec ing a dilemma
ecognized in he o iginal w i ing o neu aliza ion
heo y, which has since been o go en.
1. In oduc ion
Wi h inc easing eliance o o ganiza ions on cybe
en i onmen s o managing hei daily ope a ions,
p o ec ion o in o ma ion asse s in such en i onmen s
becomes e e mo e c ucial. Va ious h ea
classi ica ions ha e been in oduced [1], o which
h ea s emana ing om employees (i.e. inside h ea ) is
conside ed “ he g ea es h ea o in o ma ion secu i y”
[2]. Indeed, i is widely acknowledged among schola s
o in o ma ion sys ems secu i y (he ea e , ISS) ha
in o ma ion secu i y policy (he ea e , ISP) and i s
en o cemen cons i u e he ounda ion o an
o ganiza ion’s in o ma ion secu i y [3], [4]. In mos
beha io al ISS esea ch, ISP e lec s low-le el policies
which con ains “no ma i e lis s o ac ions ha he
employees should (o should no ) pe o m” [3].
Fo mally, hese no ma i e lis s o ac ions, o ules, a e
he ul ima e au ho i a i e oice agains which
employees a e held accoun able. Conside ing he c i ical
ole ha ISPs could play in ensu ing he secu i y o
o ganiza ional in o ma ion asse s, many ISS schola s
ha e emphasized ha policy en o cemen should be
non-nego iable, and ha “an unen o ced policy is no
wo h he pape i is w i en on” [5]. I would be sa e o
a gue ha sol ing he ISP noncompliance p oblem has
become he man a o mains eam ISS esea ch.
Neu aliza ion heo y [6] is eme ging as a popula lens
in ISS esea ch [7]–[9], especially ha i has he
capaci y o double bo h as an explana ion and solu ion
o he noncompliance p oblem. As an explana ion,
neu aliza ion heo y is used o demons a e ha
employees apply a ious a ionaliza ions (aka
neu aliza ion echniques) in o de o libe a e
hemsel es om no ma i e es ic ions, he eby making
policy iola ions easie o jus i y [4]. Cu en ISS
esea ch p o ides e idence in line wi h his a gumen
[10]–[12]. As a solu ion, neu aliza ion heo y is used o
de ise aining p og ams ailo ed o he speci ic
echniques wi h he aim o de-neu alizing hem [13],
[14].
Despi e hese ex emely impo an insigh s in o
employees’ use o neu aliza ions and he p oposed
solu ions, i is su p ising o ind ha e y li le has been
done o hea he employees’ oices ega ding he
jus i iabili y o ISP iola ions commi ed in he speci ic
con ex o hei wo k en i onmen . Fu he mo e, as o
ye , he e is li le e idence o sugges ha ISS
esea che s ha e conside ed he possibili y ha ISP,
a he han employees’ neu aliza ions, needs
co ec ing. A e all, esea ch in c iminology has
ecognized ha ‘no all neu aliza ions a e bad’ [15, p.
228]. I his is he case in he ISS con ex as well, hen
we migh be missing c ucial insigh s i all employees’
insigh s a e dismissed as (bad) neu aliza ions.
Lack o unde s anding o he con ex o iola ion
may lead o he adop ion o ‘no-jus i ica ion-allowed’
app oach, which would be p oblema ic in si ua ions
whe e e en jus i iable easons o iola ing an ISP ule
would be epo ed as ‘making excuses’ [16], when he
co ec cou se o ac ion would ha e been a modi ica ion
in he secu i y measu e and i s co esponding policy.
Resea ch o his na u e is inhe en ly quali a i e, which
is cu en ly lacking and much needed [17], [18]. Gi en
his esea ch gap, in his a icle we epo ou indings
om an in-dep h quali a i e s udy [19], [20]. In
conduc ing his s udy, no only ha e we gained insigh s
P oceedings o he 55 h Hawaii In e na ional Con e ence on Sys em Sciences | 2022
Page 6812
URI: h ps://hdl.handle.ne /10125/80163
978-0-9981331-5-7
(CC BY-NC-ND 4.0)
ha ex ends neu aliza ion heo y h ough he
iden i ica ion o no el echniques, bu also, we
demons a e ha employees’ jus i ica ions o policy
iola ion a e con ex -dependen and in some cases may
poin ou a en ion o laws in he ules, a he han in
he beha io .
2. Theo e ical backg ound
In o ma ion secu i y policy (ISP) is ecognized as
he ounda ion o o ganiza ional in o ma ion secu i y
since i communica es o he employees wha hey can
and canno do wi h he o ganiza ion’s asse s [3].
The e o e, unde s anding o employees’ ISP
(non)compliance beha io has become one o he majo
conce ns o in o ma ion secu i y esea che s [4], [13],
[14], [21]. In his domain, neu aliza ion heo y [6], [22]
is eme ging as a popula lens o examine how employees
jus i y iola ing wo kplace ISPs. Neu aliza ion heo y
[6] was in oduced o explain how delinquen s,
especially hose in he ea ly s ages o hei c iminal
ca ee , deploy a ious echniques ha enable hem o
d i be ween he wo lds o he law-abiding ci izen, and
ha o a delinquen . Sykes and Ma za [6] iden i ied i e
such echniques and called hem neu aliza ions
echniques. These a e, ‘denial o esponsibili y’, ‘denial
o inju y’, ‘denial o ic im’, ‘condemna ion o
condemne s’, and ‘appeal o highe loyal ies’.
Each o hese echniques p o ides a
coun e a gumen (hence he name, neu aliza ion) o
a ionalize o jus i y he de ian beha io om he
o ende ’s poin -o - iew. The ‘denial o esponsibili y’
echnique is used o libe a e onesel om any sense o
accoun abili y and con ol wi h espec o he si ua ion
a hand, by a guing, o example, ha “I didn’ mean i ”
[6, p. 669]. ‘Denial o inju y’ p o ides a a ionaliza ion
ha diminishes he impac o he ac , whe eby he
o ende would claim, o example, ha “I didn’ eally
hu anybody” [ibid]. The ‘denial o he ic im’
echnique in ol es a con on a ional a gumen denying
he exis ence o a ic im in he i s place, sugges ing
ha he ic im dese ed wha happened and ha “ hey
had i coming” [ibid]. The ‘condemna ion o he
condemne s’ is a echnique by which he o ende u ns
he spo ligh on hose who disapp o e o he ac i i y o
unde mine hem usually by a guing ha “e e ybody is
picking on me” [ibid]. Las ly, he o ende migh
‘appeal o highe loyal ies’ and a gue ha engaging in
he o ense is ou o loyal y o g oups such as amily o
iends and i is no due o lack o espec o no ms o
he socie y a la ge, o example, “I didn’ do i o
mysel ” [ibid]. La e esea ch in c iminology has
unea hed u he echniques ha o ende s could
deploy o neu alize an i-social beha io . ‘Me apho o
he ledge ’ [23], ‘de ense o necessi y’ [24], ‘claim o
indi iduali y’ [25] ‘jus i ica ion by compa ison’,
‘jus i ica ion by pos ponemen ’ [26], ‘claim o
en i lemen ’ [27], ‘e e ybody does i ’ [27], and ‘claim
o ela i e accep abili y’ [25] a e among he echniques
ha ha e been de eloped in addi ion o he ini ial i e
echniques.
In he ISS ield, neu aliza ion heo y has been used
o explain de iance in wo main esea ch hemes. The
i s heme co e s wo kplace de iance commi ed by
employees. Unde he wo kplace de iance heme, wo
dis inc opics ha e domina ed his a ea o esea ch: one
explo es he jus i iabili y o c imes commi ed by
employees, such as hacking and s ealing [28], [29]; and
he o he explo es non-c iminal iola ions o
o ganiza ional policy, such as, cybe loa ing [12], [30]
and shadow IT use [11], [31]. The second esea ch
heme, in u n, co e s de ian beha io ou side o
o ganiza ional con ex , which explo es he jus i iabili y
o so wa e and music pi acy [32]–[34]. To da e,
howe e , neu aliza ion-based ISS esea ch design has
been p edominan ly con i ma o y in na u e, aiming o
es he ex en o which one o mo e neu aliza ion
echniques is signi ican ly associa ed wi h a gi en
iola ion. In his ega d, mul iple s udies p o ide
e idence ha neu aliza ion echniques could inc ease
one’s in en ion o engage in ISP iola ion in gene al [8],
[35]–[37], commi compu e abuse [29], [38], use he
wo kplace In e ne o pe sonal pu poses [30], [39], [40]
as well as engage in shadow IT use [11]. Fu he mo e,
some s udies sugges ha deploying neu aliza ion
echniques may discou age employees om complying
wi h ISP [10], [41], [42]. While hese s udies gene ally
ocus on es ing he ex en o which neu aliza ion is
signi ican ly associa ed wi h a gi en iola ion; mo e
ecen esea ch has s a ed de ising neu aliza ion
heo y-based solu ions o ISP iola ions. One such
solu ion is communica ing an i-neu aliza ion messages
[13], [14]. Fo ins ance, a message a ge ing ‘denial o
inju y’ would s ess ha “ he e is always he possibili y
o ha m” [13]. Resul s om wo s udies ha examined
he mi iga ing e ec o an i-neu aliza ion messages
showed ha use s who ecei ed such messages we e
mo e likely o be discou aged om ISP iola ion
compa ed o hose who did no ecei e any
communica ion messages [13], [16]. Ano he solu ion
ha has been in es iga ed o neu aliza ion p e en ion
is an i-neu aliza ion aining [14]. A e conduc ing a
aining p og am a ge ing use s’ neu aliza ion o
passwo d policy iola ion, Siponen e al. [14] epo ed
ha o e all he aining p og ams based on cogni i e
dissonance educed neu aliza ion e en hough aining
migh ha e been ine ec i e o speci ic echniques such
as, ‘claim o en i lemen ’, ‘claim o ela i e
accep abili y’ and ‘Jus i ica ion by compa ison’.
Page 6813
Despi e he e y impo an insigh s we gain om
hese s udies, i is su p ising o ind ha we lack con ex -
speci ic and da a-d i en (i.e., induc i e) esea ch [43]–
[45] ha aims o unde s and how employees, in hei
own wo ds, a ionalize and jus i y ISP iola ions
commi ed in hei wo kplace. The only excep ion is
Lim and Teo [46] whose wo k on cybe loa ing
ecognized he impo ance o he ‘shi ing wo k home’
phenomenon. Beyond his single e o , no a emp has
been made o p obe he iola o ’s wo ld iew. Such
explo a i e app oach, no only does i o e e idence o
he applicabili y (o lack he eo ) o neu aliza ion
heo y in di e en con ex s, bu also i o e s a unique
oppo uni y o disco e new neu aliza ion echniques
speci ic o ISP iola ions.
3. Resea ch app oach
The s udy epo ed he e is based on a quali a i e
inqui y [19], [20] conduc ed be ween 2016 and 2018,
wi h he gene al aim o unde s anding he employees’
pe spec i e ega ding he ole ISP plays in guiding hei
e e yday wo k ou ines, in he con ex o a la ge
esea ch-o ien ed No dic uni e si y. Se e al calls ha e
been made o conduc such esea ch in he ISS ield o
complemen he dominan unc ional iew, which
gene ally a o s “no ma i e logic and p edic i e
capaci y” [47], a he expense o unde s anding wha
employees ac ually do in eal li e se ings [17], [18]. In
balance, in his esea ch we explo e how he
neu aliza ion heo y lens could help us be e
unde s and he employees’ in o ma ion secu i y
noncompliance beha io . Hence, ou app oach
emphasizes he examina ion o a phenomenon in i s
na u alis ic con ex , wi h he pu pose o con on ing
heo y wi h he empi ical wo ld [48], [49]. No only
does ou esea ch app oach suppo he unde s anding o
a phenomenon in i s na u al se ing, bu also i ad oca es
adop ing neu aliza ion heo y as a sensi izing de ice o
ensu e ha we en e he esea ch se ing wi h an ‘open’–
a he han ‘emp y’–mind [50]. Resea ch based on
neu aliza ion heo y acknowledges he subjec i e
in e p e i e na u e o neu aliza ions, and ha he e can
be mul iple in e p e a ions o he same e en and he
jus i ica ions used wi hin. Ma una and Copes [15] no es:
“E e y e en is subjec o mul iple in e p e a ions …
[O]ne pe son's a ional explana ion is ano he 's
a ionaliza ion. I neu aliza ions a e o ca y any
psychological weigh , hey mus , a leas pa ially, be
belie ed by he pe son using hem” [15, p. 230]. Wi h
his emphasis, we wish o highligh ha in ou analysis
and iden i ica ion o he neu aliza ion echniques, we
do no ea hem as ‘lies’ o ‘decep ions’; a he as me e
jus i ica ions.
In e ms o da a collec ion, his s udy builds on
mul iple da a sou ces including o mal in e iews,
in o mal discussions, o icial documen s (e.g., he
o icial in o ma ion secu i y policy), as well as pe sonal
obse a ion. Rega ding he in e iews, scheduled
in e iews we e conduc ed wi h eigh een pa icipan s
be ween Oc obe 2016 and Sep embe 2018. The
pa icipan s we e all on he pay oll, and held a ious
posi ions in he o ganiza ion, including, adminis a ion
s a , eache , doc o al candida e, pos -doc o al
esea che , and p o esso . All in e iews we e
conduc ed ace- o- ace, and on a e age, each las ed o
one hou . All in e iews we e eco ded, and he
in e iewees we e p omised anonymi y, so hey will be
e e ed o in his s udy as “In e iewee # …”. All
eco ded in e iews we e ea ed wi h u mos ca e, and
o ensu e anonymi y hey we e ansc ibed and
anonymized by he i s au ho alone. Then he
ansc ibed ex was sha ed wi h he second au ho o
u he analysis. In e iews we e semi-s uc u ed [51],
and he main hemes e ol ed a ound each pa icipan ’s
pe cep ion o and a i ude owa ds he wo kplace ISP, o
gain an in-dep h unde s anding o i s ole in shaping
hei pe sonal day- o-day compu e use beha io . As
such, he in e iew p o ocol was designed o elici
insigh s abou he employees’ pe cep ion o ISPs in
gene al, as well as abou speci ic secu i y beha io s
[52]. Gene al pe cep ions abou ISP e lec ed ques ions
such as o wha ex en hey we e awa e o he o icial
ISP, wha i mean o hem in he wo kplace, and how
hey el ISP impac ed hei daily ou ines a wo k.
Speci ic ques ions, on he o he hand, ocused mo e on
discussing he pa icipan ’s iews o speci ic ules as
s a ed in he ISP (e.g., passwo d change ule and
pe sonal IT use ule), o wha ex en hey comply o
iola e hese speci ic ules, and in he case o iola ion
wha hey conside ed he bes cou se o ac ion o ix he
si ua ion. Du ing each in e iew, he o icial ISP (ei he
a p in ou o onsc een) was used o acili a e he
discussion.
All in e iew ansc ip s we e coded using bo h
i s - and second-o de hemes [53] Speci ically, i s -
o de codes a e mo e e lec i e o he empi ical da a and
ep esen as close as possible he na a i es as gene a ed
by he pa icipan s hemsel es. By con as , second-
o de codes a e mo e analy ic in na u e as hey e lec
he analys s’ in e p e a ion o hese concep s, which in
ou case, a e in luenced by he heo e ical lens o
neu aliza ion. Fo ins ance, we conside he code
‘ISP_is_S upid’ o be i s -o de code since i e lec s
he pa icipan ’s u e ance. Subsequen ly, we code he
same u e ance using he second-o de code
‘Condemna ion_o _ he_Condemne s’, which is
consis en wi h neu aliza ion heo y. This p ocess
allowed ca ego izing he iola ion jus i ica ions
Page 6814
acco ding o known neu aliza ion echniques, as well as
iden i ying new jus i ica ions. The wo au ho s
discussed all esul an echniques in a ious mee ings
un il a inal ag eemen was achie ed.
4. Findings
This sec ion epo s he main indings ega ding he
esea ch ques ion: ‘how do employees jus i y iola ing
he ISP’? Due o space limi a ion we decided o epo
only ou indings ega ding neu aliza ion echniques
ha a e used by a leas one- hi d o he pa icipan s.
Wi h his in mind, ou analysis e eals he p e alence o
nine neu aliza ion echniques used by ou pa icipan s
o jus i y hei ISP iola ions. Th ee o hese echniques
a e classical and a e well-known in he li e a u e since
hey o igina e in Sykes and Ma za’s [6] wo k. Namely,
‘denial o esponsibili y’, ‘condemna ion o he
condemne s’, and ‘denial o inju y’. Th ee echnique
ha e been u he de eloped by c iminologis s and a e
somewha known in a ious ISS w i ings. Namely,
‘de ense o necessi y’, ‘jus i ica ion by compa ison’,
and he ‘e e ybody does i ’ claim. Finally, we in oduce
h ee no el echniques speci ic o ISP iola ions ha a e
no ecognized in p e ious wo k. Namely, ‘ma e o
me e legali y’, ‘de ense o uniqueness’, and ‘I ollow
my own ules’. We discuss each o hese ca ego ies in
u n.
1. Denial o esponsibili y. The ‘denial o
esponsibili y’ echnique is he mos applied echnique
o policy iola ion in ou s udy. Sykes and Ma za [6]
explain ha ‘denial o esponsibili y’ allows delinquen s
o libe a e hemsel es om no ma i e es ic ions by
nega ing pe sonal accoun abili y. In his sense,
employees who use he ‘denial o esponsibili y’
echnique could a gue ha hey we e no in con ol o
he si ua ion, a he , hey we e ac ed upon by o he
esponsible ac o s [26]. Fou een pa icipan s used his
echnique. The use o his neu aliza ion echnique
among ou in e iewees came o ligh when hey we e
in oduced wi h a copy o he o icial policy, a which
poin many o hem ealized ha hey had no seen i
be o e o did no emembe i s con en . Mo eo e , some
wen u he o a gue ha no one s opped hem om
iola ing he policy and he e o e hey we e no o be
blamed. Meanwhile, o he s wished ha someone else
would ake he bu den o unde s anding and
summa izing he ISP on hei behal . In gene al, he
p e alence o his echnique sugges s ha he
in e iewees see ha i is no hei esponsibili y o exe
an e o on sea ching o he o ganiza ion’s ISP and
s udy i s con en . One in e iewee sums up he use o
his echnique: “I hink he main esponsibili y lies in
he uppe pe sons wo king in hei o ice. I hink i 's he
ones who make he policy should make su e e e ybody
knows abou i and knows abou he di e en s eps. I
hink i , o example, you s a wo king o he
uni e si y, people should ell you how o do, and you
should no y o ind hings you sel , because he e a e
millions o hings ha you ha e o lea n abou . Then I
wouldn' pu he esponsibili y on he employee, i 's he
esponsibili y o he employe o ell hei employees
ha his is he policy o ollow. So, I hink he
esponsibili y somewhe e highe han on he a e age
wo ke he e.” [In e iewee #11].
2. Condemna ion o he condemne s. The
‘condemna ion o he condemne s’ neu aliza ion
echnique enables an o ende o shi he blame om
onesel o hose who disapp o e o he ac ion [6]. When
deploying his echnique an o ende may claim ha
hose who disapp o e o he ac ion a e hypoc i es who
hemsel es commi he o ense [6]. In c iminal esea ch,
deploying his neu aliza ion echnique sugges s ha he
o ende iews he en o ce as co up [26]. In ISS
con ex , his echnique o en e lec s disapp o al o he
ISP as being un easonable [8], o ha hose who en o ce
IT policy may hemsel es engage in simila beha io
[31]. In line wi h he common in e p e a ion in ISS
esea ch, we ind ha hi een pa icipan s used his
echnique. We obse ed he ‘condemna ion o he
condemne s’ neu aliza ion echnique clea ly e lec ed a
c i icism owa ds he ISP i sel as being ‘ou da ed’,
‘lame’, ‘ idiculous’ and e en ‘s upid’. Fo ins ance, one
pa icipan belie es ha he policy sec ion ela ed o
pe sonal IT use “doesn' make oo much sense, because
all he hings ha I do on daily basis a e somewha
ela ed o p i a e use” [In e iewee #16]. Simila ly,
o he s would hink ha his ule is “kind o old ashion”
and i could ha e made mo e sense i i was in oduced
“ i e o en yea s back” [In e iewee #6]. In addi ion o
condemning he ules wi hin he policy, some ha e also
c i icized hose esponsible o in oducing hose
imp ac ical ules in he policy in he i s place. Fo
ins ance, In e iewee #15 c i icized he managemen
s yle and wha manage s do wi h hei ime when he
ou come is a policy such as his one. They no e: “Bu
hese a e he issues ha I ne e unde s ood. Maybe
we' e ha ing oo many bosses. Too many high sala y
people who do no ha e any hing be e o do. Yeah. Bu
ha 's he way i is.” [In e iewee #15].
3. Denial o inju y. Using he ‘denial o inju y’
echnique allows an o ende o ende hei ac ion as
ha mless [6]. Since he e is no ha m, he o ende could
a gue ha he beha io is no blame-wo hy. In
c iminology, he ‘denial o inju y’ neu aliza ion
echnique e lec s he common a gumen ha , o
ins ance, a shopli e could a gue ha big s o es make a
lo o money so ‘ hey don’ miss he li le bi I ge ’ [26].
Simila ly, In ISS con ex , employees may deploy ‘denial
o inju y’ by jus i ying ha hei secu i y iola ion is a
Page 6815

mino issue and does no hu anyone [16]. In he s udy
a hand, hi een in e iewees used his echnique. The
use o ‘denial o inju y’ neu aliza ion echnique was
e iden when in e iewees di ec ly no ed ha hei
policy iola ions we e ha mless. Gene ally, many
in e iewees ega ded he ole o ISP o be sugges i e a
bes , and ha iola ing i is accep able as long as no
ha m is done. “… somehow he policies a e d awing he
bounda y, so as long as people, kind o , wi hin he
bounda y, o somehow a li le beyond he bounda y bu ,
i doesn' eally ha m he secu i y o hose IT esou ces,
o i doesn' eally d ama ically c ea e nega i e impac
on job pe o mance, hen I hink i 's somehow ok”
[In e iewee #5]. When in e iewees we e asked o
elabo a e hei iews u he using he speci ic example
o he pe sonal IT use ule, some ook a p oduc i i y
pe spec i e and cla i ied ha iola ing i is accep able
since “ he e's no ha m excep he wo k ime los ha I
can make up by wo king a bi la e , o wo king a home
when he kids a e in bed.” [In e iewee #17]. O he s,
howe e , ook a pu ely inancial pe spec i e and
jus i ied ule b eaking on he basis o he economic
impac o he iola ion: “unless he e's some hing I
don' know abou , I mean, i doesn' cos any mo e
money, does i ? … Is he e a loss o money o he
uni e si y o me looking a a holiday websi e in my
lunch b eak?” [In e iewee #10].
4. De ense o necessi y. The ‘de ense o necessi y’
neu aliza ion echnique holds ha an o ense is
necessa y o achie e a c ucial ou come (Coleman,
1987). Consequen ly, since he o ense is necessa y and
he o ende has no o he choice, he e is no need o
eeling guil y o ashamed [24], [26]. In c iminal
esea ch, hie es o example would use he ‘de ense o
necessi y’ echnique o a gue ha s ealing was he only
way o eed he amily [26]. In ISS con ex , employees
may deploy his echnique by a guing ha due o ime
cons ain s, iola ion o he ISP is necessa y o
comple ing hei asks [8]. In he cu en s udy, hal o
he in e iewees appealed o his echnique. The
‘de ense o necessi y’ was e iden in a gumen s
whe eby compliance wi h he ISP was amed as an
obs acle o e iciency, o a seconda y p io i y in he ace
o he p essing demands o wo k equi emen s. Talking
abou he ISP in gene al, se e al in e iewees ad anced
a gumen s simila o his one: “So, secu i y and
complying wi h he policy is seconda y in p io i ies
compa ed o he p ima y hings ha needs o be done;
wha I'm he e o do.” [In e iewee #11]. When asked o
elabo a e hei a ionale, one in e iewee gi es u he
explana ion: “I mean i is like, i you ollow his 100%
[poin ing o he pe sonal IT use ule], you couldn' isi
any webpage wi h you wo k compu e , o example,
ha a e no 100% ela ed o wo k. Then you would all
he ime ha e o ca y 2 compu e s wi h you. And hen i
you ha e a b owse open in one compu e , hen you
would ha e o open he o he one and open a b owse
he e jus o isi , o example, one page. So, i would be
a lo o hassle, a lo o ex a wo k, and in he end, I hink
i would also be de imen al o you wo k e ec i eness.”
[In e iewee #11].
5. Jus i ica ion by compa ison. The idea behind
he ‘jus i ica ion by compa ison’ echnique is qui e
simple, by a guing ha he iola ion in ques ion is much
be e han a much wo se iola ion. When deploying his
echnique, an o ende acknowledges ha hey a e
engaging in a w ongdoing bu jus i ies hei ac ion by
a guing ha hey could ha e done wo se. In c iminal
esea ch, shopli e s o ins ance would a gue ha
s ealing om a shop is no hing compa ed o obbing
people o b eaking in houses [26]. In ISS esea ch,
‘jus i ica ion by compa ison’ has ecei ed li le esea ch
a en ion, howe e , a use can u ilize his echnique by
a guing ha an ISP iola ion, such as iola ing passwo d
policy, is no as bad as was ing he whole day on non-
p oduc i e wo k [14]. Nea ly hal o ou pa icipan s
(eigh in e iewees) used his echnique, when
compa ing hei own (li le) ISP iola ions wi h wha
would be conside ed ( uly) se ious iola ions, such as
“downloading mo ies” [In e iewee #12], “wa ching
po nog aphy” [In e iewee #9], o e en “bi coin
mining” [In e iewee #17]. In e es ingly, he e seems o
be a gene al ag eemen on compa ing ISP iola ions
agains wha would be clea ly in e p e ed as a ha m ul
o illegal, o jus i y own iola ions. One in e iewee
elabo a es hei pe spec i e: “i s uden s we e unning
pee - o-pee ne wo king a [online se ice]. So, ha 's a
clea iola ion. I 's illegal ac i i y. So, ha goes beyond
he h eshold. A ha poin , yellow ca d. Bu , ob iously,
using Facebook, e-comme ce, online banking, doesn'
go beyond he h eshold o me o ge a wa ning.”
[In e iewee #13].
6. E e ybody does i . The ‘e e ybody does i ’
echnique in ol es a “ ans e o esponsibili y om he
o ende o a la ge and o en aguely de ined g oup o
which he o she belongs” [54]. As such, his echnique
is commonly used when an o ende ies o a oid sel -
blame by poin ing ou ha o he s engage in he same
ac i i y and ha he ac i i y is commonplace and no mal
in a gi en con ex [26], [27]. ISS esea che s adop ing
his echnique in hei s udies ha e o en e e ed o i
wi h a ious names, such as ‘de ense o ubiqui y’ [42]
o ‘no maliza ion’ [46]. The main poin he e is ha
using his echnique o en e lec s he a gumen o
a ionaliza ion ha he ISP iola ion in ques ion is
commonplace. In he cu en s udy, one- hi d o he
in e iewees used his echnique o a gue ha hei
iola ion o he ISP was commonly accep able and
no mal. When discussing ules in gene al, i was
emphasized ha social accep abili y can be mo e
Page 6816
impo an han wha he policy dic a es. Fo ins ance,
one in e iewee explains “I’m su e he e a e a lo o
hings ha I disag ee wi h [in he policy] because o he
ac ha I don’ hink socially anybody is complying wi h
i .” [In e iewee #18]. When p essed o cla i y hei
a ionale u he , some would use he pe sonal IT use
ule o poin ou : “I you conside basic ule #1
p esen ed he e, I hink … ha mos people a ound he e
a e no awa e o such ule, and I also hink ha i he
policy has ules ha you would hink by commonsense
ha 95% o he people a e iola ing–… o cou se I can'
say o su e–bu I hink ha e e yone he e is iola ing
basic ule #1 a some ime du ing hei wo k”
[In e iewee #11].
7. Ma e o me e legali y. The ‘ma e o me e
legali y’ jus i ica ion is a p e iously unknown echnique
o neu aliza ion iden i ied in his s udy. Nea ly hal o
he s udy pa icipan s (eigh pa icipan ) used his
echnique o jus i y hei ISP iola ion. Using his
echnique, ule iola o s a gue ha a wo kplace policy
is me ely a ma e o con ac ual ag eemen and need no
be ollowed s ic ly. The employee may asse his
posi ion by no ing ha wo kplace policies a e designed
o ‘wo s case scena ios’ in o de o p o ec he
o ganiza ion om legal liabili ies in ex eme cases, o o
p o ide legal g ounds o u he ac ion agains ogue
employees. In deploying his echnique, in addi ion o
poin ing ou he legal quali ies o he ISP, pa icipan s
ha e also no ed ha he ISP is no a documen o
communica e in o ma ion secu i y measu es and
guidelines bu a legal documen ha is ese ed o g oss
iola ion o di icul indi iduals. Bu o as long as he
employee is gene ally ca e ul abou no causing any
ha m (see ‘denial o inju y’), and doing a gene ally good
job (see ‘me apho o he ledge ’), hen hese ISP ules
belong only ‘in he d awe ’. Su p isingly, his is an
assump ion se e al in e iewees sha e e en wi hou
knowing wha he con en o he policy is. One
pa icipan no es: “I explained I ha en' ead ha
[poin ing o ISP], … and I hink wi hou eading ha –I
migh be w ong, o cou se–I hink his manual is 10
pages ha libe a e he [employe ] o whoe e w o e
ha , om he, hmm, le 's say, he legal side o hings, i
someone does some hing w ong on pu pose. I wasn'
w i en o he employee … hmm, he pu pose o ha
documen is no o help he employees o do s u , like,
in secu e way; i 's jus some hing ha 's equi ed
legally”. [In e iewee #2]. Simila ly, In e iewee #18
explains: “I you a e in a si ua ion wi h an employee
whe e he employee becomes di icul , you can always
say: Okey, he e’s his policy, you’ e supposed o ha e
ead i ”, and hen puni i e ac ion can be easily aken
agains he ouble-make . Mo e in e es ingly, he
‘ma e o me e legali y’ jus i ica ion does no e lec
disg un lemen agains he policy; a he , i e lec s a
gene al unde s anding ha his is how policies should be
w i en, bu o legal pu poses only. In e iewee #10
exp esses his idea well: “Yeah. I unde s and why hese
ha e o be he e. I eally do. Bu , nowadays, and mo e
speci ically wi hin his en i onmen , i 's eally o he
pu poses o hem being able o ge ing us legally.
Because we oughly know wha we' e doing.” In ac ,
In e iewee #17 hough ha i hey we e asked o w i e
a policy, hey would w i e i in ha exac same way, bu
ha does no mean ha hey would no iola e i !
8. De ense o uniqueness. The ‘de ense o
uniqueness’ is a newly iden i ied echnique o
neu aliza ion in his s udy. Nea ly hal o he s udy
pa icipan s (eigh pa icipan ) used his echnique o
jus i y hei ISP iola ion. Using his echnique, a policy
iola o ques ions he con ex ual ele ance o he policy
and a gues ha ce ain policies a e no applicable o he
se ing in which he iola ion occu s. In doing his, he
iola o aises he issue ha he se ing has unique
quali ies ha make ce ain ules inapplicable in ha
se ing while d awing compa ison wi h o he se ings in
which he ule applies. Al hough his echnique in ol es
a compa a i e p ocess like he ‘jus i ica ion by
compa ison’ echnique; wha we iden i ied he e is
di e en . Speci ically, whe eas he ‘jus i ica ion by
compa ison’ is iola ion-o ien ed (i.e., he iola ion in
ques ion is no as bad when compa ed wi h much wo se
ones); he ‘de ense o uniqueness’ is con ex -o ien ed
(i.e., he ule in ques ion may be sui able o o he
con ex s, bu no ou s). Pa icipan s in his s udy used
his echnique o di e en ia e be ween hei line o wo k
wi h o he s, ei he in he same o ganiza ion o in o he
o ganiza ions. Fu he mo e, in some cases hey di ec ly
a gued ha he ISP is no applicable o hem due o he
na u e o hei wo k. One in e iewee explains hei
gene al iew ega ding he con ex ual ele ance o
ules: “I' e wo ked in a numbe o di e en
o ganiza ions wi h di e en le els o educa ion. You ge
a lo o a**holes ou he e who, hmm, who would do
wha hey wan , and ake he *ck wha hey wan , and
don' gi e a sh* abou he consequences. These a e
wha hese ules a e he e o . Bu [he e], we' e all
gene ally a decen punch o people.” [In e iewee #10]
When alking speci ically abou he pe sonal IT use ule,
ano he in e iewee gi es a mo e speci ic explana ion
o he iola ion: “… I unde s and i I wo k in an
o ganiza ion ha is e y, like mili a y, o some hing like
ha , I unde s and ha I'm no allowed o do my pe sonal
s u by my wo king compu e , o h ough he ne wo k
o ha o ganiza ion. Bu he e, hmm, … I don' do
any hing like ha , hmm. So my wo k is no ela ed o
any hing ha should be so secu e ha I can' use my
wo k compu e o ead my emails.” [In e iewee #14].
9. I ollow my own ules. ‘I ollow my own ules’
is he hi d newly iden i ied echnique which e lec s he
Page 6817
a gumen ha a iola o has enough knowledge and/o
expe ise o decide which ules o ollow, and which o
bypass. This also e lec s an awa eness ha no all ules
a e equal; some a e mean o be b oken. Nea ly hal o
he s udy pa icipan s (eigh pa icipan ) used his
echnique o jus i y hei ISP iola ion. By using his
echnique, he iola o a gues ha hey ha e de eloped
hei own se o ules, some o hem will be complian
wi h he ISP, bu some o he s may coinciden ally iola e
i . Ou pa icipan s used his echnique when jus i ying
hei dis ega d o he o icial ISP, and ha i is enough
o ollow hei own ules. Fo ins ance, In e iewee #4
explains ha i once c ossed hei mind o check he ISP,
bu e en ually decided no o. When hey we e asked o
explain why hey hink hey did so, hey eplied: “Why
do I hink I do ha ? … Because I ha e my own judgmen
o wha migh be good and wha migh be bad, hahaha”
[In e iewee #4]. In e es ingly, he ‘I ollow my own
ules’ seems o equi e p oo o pas success. Tha is,
hose ules ha end up in he employee’s own
in e nalized ‘ ule-se ’ a e he ones ha ha e so a been
e ec i e in keeping hem ou o ouble. One
in e iewee poin s ou : “I'll ollow my own habi ,
because I hink i has been qui e success ul hus a ”
[In e iewee #12]. When ano he was asked o elabo a e
on how hey de eloped hei own ules; hey eplied:
“I 's aken maybe 15 yea s o come up wi h he
s anda ds ha I ha e now. When i all s a ed? I don'
eally know. Pe haps one o he aspec s is like wa ching
people do hei s u , and someone saying ha ‘you
should ha e a s ong passwo d’ o ‘you shouldn' lea e
hese compu e s open’ ... o be blun , hose 10 pages I
ha en' ead, like I said, bu I hink i 's gonna be 10
pages o common-sense.” [In e iewee #2].
5. Discussion
In he p e ious sec ion we p esen ed ou main
indings ega ding he neu aliza ion echniques ou
s udy pa icipan s used o jus i y iola ing ISP in a
No dic uni e si y con ex . Nex , we discuss he mos
salien heo e ical and p ac ical implica ions o hese
indings.
5.1. Theo e ical implica ions
Fi s , ou indings con ibu e o he dep h o
knowledge on neu aliza ion heo y in ac i i ies ela ed
o in o ma ion secu i y. While he e is a sizeable
li e a u e on neu aliza ion heo y in ISS esea ch, much
o his esea ch has been conduc ed using a quan i a i e
c oss-sec ional esea ch design and li le has been done
o explo e use s’ jus i ica ion o eal iola ions in eal
con ex s. In ac , wi h a ew excep ions [46], [55], we
ha e no ound any s udies ha examined employees’
jus i ica ions in esponse o hei wo kplace policy
iola ions. This s udy s eps up o his challenge and in
doing so p o ides insigh s ega ding he use o
neu aliza ion echniques in ISS con ex . Sykes and
Ma za [6] ha e acknowledge ha neu aliza ion
echniques a e con ex -speci ic, meaning ha some
echniques migh be mo e (o less) ele an in ce ain
con ex s. Ou indings lend suppo o he asse ion ha
he echniques ‘denial o esponsibili y’, ‘denial o
inju y’ and ‘condemna ion o he condemne s’ a e he
mos p e alen classical echniques. Meanwhile, some
echniques such as ‘denial o he ic im’ [6], hough a
classical echnique, migh be less ele an in simila
con ex s. In his ega d, ou indings a e in line wi h
Siponen and Vance’s [8] con en ion ha he ‘denial o
ic im’ neu aliza ion echnique migh be i ele an in
ISP iola ion cases due o he di icul y o iden i ying
ic ims. Ou indings, he e o e, highligh he need o
u he explo a i e s udies in o he ISS ela ed ac i i ies
such as compu e abuse, shadow IT use and
cybe loa ing o de e mine which echniques may o may
no be ele an o each ac i i y.
Second, his s udy con ibu es o neu aliza ion
heo y by iden i ying h ee p e iously unknown
neu aliza ion echniques, namely, ‘ma e o me e
legali y’, ‘I ollow my own ules’, and ‘de ense o
uniqueness’. These newly iden i ied echniques seem o
be associa ed wi h dis inc i e quali ies o ISPs. The
‘ma e o me e legali y’ echnique highligh s he
jux aposi ion o ISPs as legal documen s as well as ools
o communica ing secu i y do’s and don’ s [56]. The
‘de ense o uniqueness’ echnique, on he o he hand,
add esses he con ex -speci ici y o he wo k
en i onmen . Since o ganiza ions ha e di e en needs
and di e en wo king clima es, an ‘one-size- i s-all’
app oach o ISPs may no be ideal [57]. Las ly, he ‘I
ollow my own ules’ echnique unde sco es he
impo ance o ecognizing indi idual compe ence and
pe sonal expe ience. ISPs may con ain in o ma ion ha
equi es high compe ence and skill o implemen [58].
The ca ea , howe e , is ha when an indi idual
possesses such compe ence and expe ience, hey may
de elop hei own ways o handling in o ma ion
secu i y and all in o a alse sense o con idence
ega ding hei own abili ies hence ejec ing ISPs as
help ul communica ion ools. Al e na i ely, employees’
own ules migh be mo e a uned o he speci ici y o
hei si ua ion, han he policy. In such si ua ions, we a e
aced wi h a dilemma: wha needs co ec ion, he
employee’s beha io o he policy? Answe ing his
ques ion poin s o ou hi d heo e ical implica ion.
This dilemma ca ies wi hin, a alue judgemen
ega ding he adequacy o he neu aliza ions. I he
neu aliza ion is adequa e, hen employees’ beha io s
need no be co ec ed, which means ha ou a en ion
Page 6818
should be placed on changing he policy i sel . So a ,
esea ch based on neu aliza ion heo y has no
add essed his ques ion, which no only does i bea
heo e ical implica ions, bu also p ac ical implica ions
(see, p ac ical implica ions sec ion). Sykes and Ma za
[6] we e well awa e o his dilemma and hin ed o some
di ec ion o esol ing i . Speci ically, Sykes and Ma za
[6] con empla ed he ques ion “why men iola e he
laws in which hey belie e” [6, p. 666]. To answe his,
hey poin o “ he ac ha social ules and no ms …
seldom i e e ake he o m o ca ego ical impe a i es”
(ibid), and because o his con ex ual lexibili y, hey
a gue, any unc ioning legal sys em delibe a es abou
he “de enses o c imes” be o e gi ing a e dic
ega ding a gi en ac . O cou se, in many si ua ions, he
jus ice sys em deems jus i ica ions inadequa e, and
co ec i e measu es need o be aken. Howe e , in some
si ua ions, e en wha is gene ally ega ded as mala in
se, o e il-by-na u e c imes [59], [60], such as killing a
human being, a e acqui ed because hey we e ‘jus i ied’
(e.g., in sel -de ense). Ye , in o he si ua ions, ce ain
ules had o be challenged and iola ed be o e any law
i sel needed o change. In e es ingly, despi e Ma za and
Sykes’ [6] ecogni ion o his assump ion, i has no
a ac ed schola ly a en ion, leading Ma una and Copes,
hal -a-cen u y la e , o emind us ha “ he ea men o
neu aliza ion echniques as au oma ically ‘bad hings’
in c iminology and co ec ions is an o e simpli ica ion
o a complex and subs an ial body o li e a u e” [15, p.
228]. In line wi h hese insigh s, we sugges
neu aliza ions should be ega ded as p o isional pleas
un il a e dic is made. The p ac ical implica ions o his
insigh will be discussed in he nex sec ion.
5.2. P ac ical implica ions
The e a e wo challenges ela ed o he p oduc ion
o meaning ul p ac ical implica ions: (a) he deg ee o
iola ion-speci ici y, and (b) he deg ee o con ex -
speci ici y. Deg ee o iola ion-speci ici y ega ds one’s
pe cep ion o he ISP as a collec ion o ules and
guidelines a he han a single en i y. We lea ned ea ly
on ha he pa icipan s did no pe cei e he ISP as a
single en i y guiding hei secu i y beha io . Nea ly all
ou in e iewees ha e been complying wi h some ISP
ules bu iola ing one o mo e o he ules. Fo ins ance,
one in e iewee migh be unyielding abou passwo d
sha ing (complying wi h passwo d ule) bu using he
wo k compu e o pay pe sonal bills o ead he news
( iola ing he pe sonal IT use ule). P ac ically
speaking, when employees a e asked gene al ques ions
abou he ex en o which hey comply wi h o iola e
ISP (in gene al), i is impossible o disce n which
neu aliza ion echniques a e ele an o which
iola ion. So, we ea ha using such gene ic ques ions
will no p oduce meaning ul insigh s o secu i y
p o essionals and consul an s ega ding wha he
employees a e ac ually doing in he wo kplace.
Consequen ly, we sugges ha u u e explo a ions o
ISP iola ions o be na owe in hei scope o be mo e
p ac ice- ele an [61].
Second, ega ding he deg ee o con ex -speci ici y,
we ealized a c i ical p ac ical dilemma, e en a e
na owing he scope o iola ion-speci ici y o one
speci ic ule. Du ing he cou se o each in e iew a e
going h ough gene al discussions ega ding he ISP,
each pa icipan was con on ed wi h a ule om he ISP
(such as basic ule #1). As no ed ea lie , his basic ule
ba s use s om all non-wo k ela ed use. App oaching
and analyzing pa icipan s’ esponses o such ules
wi hou due conside a ion o con ex using he
neu aliza ion heo y indica ed clea use o a ious
neu aliza ion echniques om a ‘con ex -less
pe spec i e’. P ohibi ing all non-wo k ela ed use o he
o ganiza ion esou ces is jus i ied by coun less w i ings
on he h ea s o such iola ion. No only does pe sonal
use o IT expose he o ganiza ion o a ious secu i y
h ea such as i uses, spam, and malwa e [62], bu also
in oduces loss o p oduc i i y [12].
These conce ns a e legi ima e, and he e o e he
ob ious ecommenda ion o a con ex -less pe spec i e
would be o cu b he iola ions by de eloping coun e -
neu aliza ion s a egies ailo ed o he speci ic
echniques we iden i ied. Rega ding he ‘condemna ion
o he condemne s’ echnique, a ypical
ecommenda ion is o sugges an i-neu aliza ion
communica ion, and aining aimed a co ec ing he
employees’ beha io by c ea ing cogni i e
inconsis encies be ween wha hey do and he
jus i iabili y o hei a ionaliza ions [13], [14], [16].
Following his line o hough , a p ac ical
ecommenda ion would be de eloping aining and
pe suasi e messages o each he lea ne s ha c i icizing
he ISP is no accep able (a gene ic app oach), o ha i
is an immo al hing o do o use he o ganiza ion
esou ces o pe sonal use (a mo e speci ic app oach).
Rega ding he ‘ma e o me e legali y’ echnique, a
s aigh o wa d p ac ical ecommenda ion is he
en o cemen o moni o ing and immedia e sanc ioning
o iola o s o demons a e he se iousness o he ISP
[63]. O he echnique-speci ic solu ions a e a ailable,
such as ic im-o ende media ion which is hough o
be e ec i e wi h he ‘denial o inju y’ echnique [8].
Howe e , conside ing he speci ic na u e o he
s udied con ex , one migh see hings di e en ly. In his
speci ic esea ch-o ien ed en i onmen whe e
employees belie e ha c ea i i y and openness a e co e
alues, and whe e he line be ween wha hey do a wo k
and a home is hinning, he e is good chance ha he
neu aliza ions iden i ied in his esea ch need no be de-
Page 6819