EAGER: Consumer Response to Security Incidences and Data Breach Notification

尽管媒体高度关注数据泄露和身份盗窃，但人们对用户如何应对不利的安全事件知之甚少。有效的安全政策制定和坚定的响应在很大程度上取决于用户在持有其数据的公司被泄露时的反应。许多人认为，用户可能没有对安全事件或数据泄露给予足够的关注。他们可能会忽略公司的违约通知，尤其是当他们收到很多这样的通知或者通知不够具体的时候。即使用户做出了回应，也可能是细微的、微妙的、难以衡量的。该项目通过组装一个大型且唯一的字段数据集来检查用户对安全事件的响应。通过与一家大型金融机构合作，该研究团队可以访问美国不同地区50多万客户6年多来的详细数据。用户的反应可以从离开公司到厌恶互联网和移动银行，再到采用其他银行服务的变化。该项目将计量经济学技术与机器学习技术相结合，旨在确定由于不利的安全事件或违规通知而导致的用户行为变化程度。研究小组的目的是估计用户的反应如何受到用户特征（人口统计）、市场特征（竞争）和违约特征的制约。如果成功，该项目可以回答各种各样的问题，这些问题可能有助于企业如何成功地克服此类事件以及政策制定者如何调整其政策。

Despite intense media attention on data breaches and identity thefts, very little is known about how users respond to adverse security events. Effective security policy making and firm response critically depends on how users respond when the firm holding their data is breached. Many argue that users may not pay adequate attention to security events or data breaches. They may ignore firms' breach notifications, especially if they receive many such notifications or when the notices are not specific enough. Even when users respond, it may be nuanced and subtle and not readily measured. This project examines users' responses to security events by assembling a large and unique field dataset. By collaborating with a large financial institution, the research team has access to detailed data for more than half million customers for more than six years spread over different geographies in the US. User response can range from leaving the firm to aversion to Internet and mobile based banking to changes in adopting other banking services. Combining econometrics techniques with machine learning techniques, this project aims to identify degree of behavior changes in user behavior due to an adverse security event or breach notification. The research team aims to estimate how the user response is conditioned by user characteristics (demographic), market characteristics (competition), and breach characteristics. If successful, this project could answer a wide variety of questions that may prove helpful for how firms can successfully overcome such events and how policy makers can fine tune their policy.