RAPID: Collaborative Research: Employees' Response to OPM Data Breaches: Decision Making in the Context of Anxiety and Fatigue

根据媒体最近的报道，人事管理办公室（OPM）在最近的两次网络攻击中遭受重创（OPM 2015）。2015年4月，OPM发现420万现任和前任联邦政府雇员的个人数据（如社会安全号码、全名和出生日期）被盗（以下简称人事记录事件）。2015年6月，OPM发现大约2150万雇员——现任和前任联邦雇员和承包商——受到影响，他们的个人信息，如社会安全号码、指纹和背景调查记录被泄露（以下简称背景调查记录事件）。与其他信息不同，背景调查记录等敏感数据（包括个人历史、人际关系和生物特征）暴露了员工的个人生活，很难重新发放。典型的保护措施，如几个月的信用监控，可能不足以保护受害者免受蓄意攻击者的伤害。迄今为止，对于人们在涉及个人数据泄露的事件中如何以及为何做出决定和采取行动，我们知之甚少。特别是，数据泄露疲劳，表现为对数据泄露不敏感和对欺诈损失的低估计，在影响人们的决策和行动方面的作用是未知的。现有的研究也对员工在应对数据泄露时的决策和反应保持沉默。为了填补这一研究空白，在本提案中，我们计划进行一项研究，揭示在对数据泄露可能结果感到焦虑的背景下，数据泄露疲劳的关键决策因素、响应行动和潜在影响。研究结果将有助于了解员工对数据泄露的反应。新知识将帮助行业和政策制定者制定干预策略，以避免泄露疲劳的影响。技术描述本提案将探讨在最近两起人事管理局数据泄露事件的背景下影响员工反应的关键问题。本研究将比较这两种不同的事件及其对不同类型受害者的影响，收到人事记录事件通知的员工（现在），收到两种事件通知的员工（未来），以及只收到背景调查记录事件通知的员工（未来）。我们还将调查没有收到任何通知的员工，作为对照组。除了通过调查获得的自我报告数据外，我们还将通过在2015年的各个时间段捕获与两起数据泄露事件相关的有机Twitter消息来扩展这项研究，以研究人们如何应对数据泄露事件。利用自然语言处理，我们打算(1)探索与数据泄露疲劳相关的话语模式，(2)从话语中提取应对机制，(3)比较从调查中确定的员工应对机制和从数据挖掘中得出的员工应对机制。

Nontechnical DescriptionAccording to recent reports in the press, the Office of Personnel Management (OPM) was hit hard in two recent cyber-attacks (OPM 2015). In April 2015, OPM discovered that personal data (e.g., Social Security Numbers, full name, and birth date) of 4.2 million current and former Federal government employees had been stolen (referred to as personnel records incident hereafter). Later in June 2015, OPM discovered that around 21.5 million employees - current and former Federal employees and contractors - were affected as their personal information such as Social Security Numbers, fingerprints, and background investigation records were compromised (referred to as background investigation records incident hereafter). Unlike other information, sensitive data such as the background investigation records, which include personal histories, relationships, and biometrics, reveal employees' personal lives are difficult to be re-issued. Typical protection such as a few months of credit monitoring may be insufficient in protecting victims from determined attackers. To date, little is known about how and why people decide and act in the aftermath of breaches involving their personal data. In particular, the role of data breach fatigue, manifested by insensitivity to data breaches and low estimate of fraud loss, in affecting people's decisions and actions is unknown. The existing research has also been silent on employees' decision making and reactions in response to data breaches. To fill this research gap, in this proposal, we plan to conduct a study that reveals the key decision factors, response actions, and the potential effect of data breach fatigue in the context of anxiety over the possible outcomes of the breach. Findings of the study will help in understanding employee reactions towards data breaches. New knowledge will help industry and policy makers develop intervention strategies that avert the effect of breach fatigueTechnical DescriptionThis proposal will explore the crucial issues that influence employees' responses in the context of the recent two OPM data breach incidents. This proposed research will compare these two different incidents and their impacts on different types of victims, employees who receive notification of the personnel records incident (now), employees who receive notification of both incidents (future), and employees who only receive notification of the background investigation records incident (future). We will also survey employees who have not received any notification, as a control group. In addition to self-reported data through surveys, we shall extend this study by capturing organic Twitter messages related to the two breach incidents in the respective time periods in 2015 to study how people coped with breach incidents. Utilizing natural language processing, we intend to (1) explore patterns of discourses associated with the data breach fatigue, (2) extract coping mechanisms from the discourses, and (3) compare coping mechanisms of employees, identified from the survey and those derived from the data mining.