RAPID: Collaborative Research: Employees' Response to OPM Data Breaches: Decision Making in the Context of Anxiety and Fatigue

非技术性描述根据最近的新闻报道，人事管理办公室（OPM）在最近的两次网络攻击中受到重创（OPM 2015）。2015年4月，OPM发现个人数据（例如，420万名现任和前任联邦政府雇员的社会安全号码、全名和出生日期）被盗（以下简称人事记录事件）。2015年6月晚些时候，OPM发现约有2150万名雇员-现任和前任联邦雇员和承包商-受到影响，因为他们的个人信息，如社会安全号码，指纹和背景调查记录（以下称为背景调查记录事件）。与其他信息不同，敏感数据，如背景调查记录，包括个人历史，关系和生物识别信息，揭示了员工的个人生活，很难重新发布。典型的保护，如几个月的信用监测，可能不足以保护受害者免受坚定的攻击者。 到目前为止，人们对个人数据被泄露后如何以及为什么做出决定和采取行动知之甚少。特别是，数据泄露疲劳的作用，表现为对数据泄露不敏感和对欺诈损失的低估计，在影响人们的决策和行动方面是未知的。现有的研究也对员工的决策和对数据泄露的反应保持沉默。为了填补这一研究空白，在本提案中，我们计划进行一项研究，揭示关键决策因素、响应行动以及在对违规可能结果感到焦虑的背景下数据泄露疲劳的潜在影响。研究结果将有助于了解员工对数据泄露的反应。新的知识将帮助行业和政策制定者制定干预策略，避免违规疲劳的影响技术说明本提案将探讨在最近两起OPM数据泄露事件的背景下影响员工反应的关键问题。这项拟议的研究将比较这两种不同的事件及其对不同类型受害者的影响，即收到人事记录事件通知的员工（现在），收到两种事件通知的员工（未来），以及只收到背景调查记录事件通知的员工（未来）。我们还将调查未收到任何通知的员工，作为对照组。除了通过调查获得的自我报告数据外，我们还将通过捕捉2015年两次违规事件相关的自然Twitter消息来扩展这项研究，以研究人们如何应对违规事件。利用自然语言处理，我们打算（1）探索与数据泄露疲劳相关的话语模式，（2）从话语中提取应对机制，（3）比较从调查中识别的员工应对机制和从数据挖掘中获得的应对机制。

Nontechnical DescriptionAccording to recent reports in the press, the Office of Personnel Management (OPM) was hit hard in two recent cyber-attacks (OPM 2015). In April 2015, OPM discovered that personal data (e.g., Social Security Numbers, full name, and birth date) of 4.2 million current and former Federal government employees had been stolen (referred to as personnel records incident hereafter). Later in June 2015, OPM discovered that around 21.5 million employees - current and former Federal employees and contractors - were affected as their personal information such as Social Security Numbers, fingerprints, and background investigation records were compromised (referred to as background investigation records incident hereafter). Unlike other information, sensitive data such as the background investigation records, which include personal histories, relationships, and biometrics, reveal employees' personal lives are difficult to be re-issued. Typical protection such as a few months of credit monitoring may be insufficient in protecting victims from determined attackers. To date, little is known about how and why people decide and act in the aftermath of breaches involving their personal data. In particular, the role of data breach fatigue, manifested by insensitivity to data breaches and low estimate of fraud loss, in affecting people's decisions and actions is unknown. The existing research has also been silent on employees' decision making and reactions in response to data breaches. To fill this research gap, in this proposal, we plan to conduct a study that reveals the key decision factors, response actions, and the potential effect of data breach fatigue in the context of anxiety over the possible outcomes of the breach. Findings of the study will help in understanding employee reactions towards data breaches. New knowledge will help industry and policy makers develop intervention strategies that avert the effect of breach fatigueTechnical DescriptionThis proposal will explore the crucial issues that influence employees' responses in the context of the recent two OPM data breach incidents. This proposed research will compare these two different incidents and their impacts on different types of victims, employees who receive notification of the personnel records incident (now), employees who receive notification of both incidents (future), and employees who only receive notification of the background investigation records incident (future). We will also survey employees who have not received any notification, as a control group. In addition to self-reported data through surveys, we shall extend this study by capturing organic Twitter messages related to the two breach incidents in the respective time periods in 2015 to study how people coped with breach incidents. Utilizing natural language processing, we intend to (1) explore patterns of discourses associated with the data breach fatigue, (2) extract coping mechanisms from the discourses, and (3) compare coping mechanisms of employees, identified from the survey and those derived from the data mining.