RAPID: Collaborative Research: Employees' Response to OPM Data Breaches: Decision Making in the Context of Anxiety and Fatigue

非技术描述根据最近媒体的报道，人事管理办公室(OPM)在最近的两次网络攻击(OPM 2015)中受到了沉重打击。2015年4月，OPM发现420万现任和前任联邦政府雇员的个人数据(如社会安全号码、全名和出生日期)被盗(以下称为人事记录事件)。2015年6月晚些时候，OPM发现，大约2150万名员工-现任和前任联邦雇员和承包商-受到影响，因为他们的个人信息，如社会安全号码、指纹和背景调查记录被泄露(以下称为背景调查记录事件)。与其他信息不同的是，背景调查记录等敏感数据，包括个人历史、人际关系和生物特征识别，揭示了员工的个人生活很难重新发布。典型的保护措施，如几个月的信用监测，可能不足以保护受害者免受坚定的攻击者的攻击。到目前为止，人们对人们如何以及为什么在涉及他们的个人数据的入侵事件后做出决定和采取行动知之甚少。特别是，数据泄露疲劳在影响人们的决策和行动方面的作用是未知的，表现为对数据泄露不敏感和对欺诈损失的低估计。现有的研究也一直对员工在数据泄露后的决策和反应保持沉默。为了填补这一研究空白，在本提案中，我们计划进行一项研究，揭示在对数据泄露的可能结果感到焦虑的背景下，数据泄露疲劳的关键决策因素、响应行动和潜在影响。这项研究的结果将有助于了解员工对数据泄露的反应。新知识将帮助行业和政策制定者制定干预策略，以避免数据泄露疲劳的影响技术说明本提案将探讨在最近两起OPM数据泄露事件的背景下影响员工反应的关键问题。这项拟议的研究将比较这两种不同的事件及其对不同类型受害者的影响，这些受害者包括收到人事记录事件通知的员工(NOW)、收到这两个事件通知的员工(将来)以及只收到背景调查记录事件通知的员工(将来)。我们还将对没有收到任何通知的员工进行调查，作为对照组。除了通过调查自我报告的数据外，我们还将通过捕捉2015年各自时间段内与两起违规事件相关的有机Twitter消息来扩展这项研究，以研究人们如何应对违规事件。利用自然语言处理，我们打算(1)探索与数据泄露疲劳相关的语篇模式，(2)从语篇中提取应对机制，(3)比较调查确定的员工应对机制和数据挖掘得出的员工应对机制。

Nontechnical DescriptionAccording to recent reports in the press, the Office of Personnel Management (OPM) was hit hard in two recent cyber-attacks (OPM 2015). In April 2015, OPM discovered that personal data (e.g., Social Security Numbers, full name, and birth date) of 4.2 million current and former Federal government employees had been stolen (referred to as personnel records incident hereafter). Later in June 2015, OPM discovered that around 21.5 million employees - current and former Federal employees and contractors - were affected as their personal information such as Social Security Numbers, fingerprints, and background investigation records were compromised (referred to as background investigation records incident hereafter). Unlike other information, sensitive data such as the background investigation records, which include personal histories, relationships, and biometrics, reveal employees' personal lives are difficult to be re-issued. Typical protection such as a few months of credit monitoring may be insufficient in protecting victims from determined attackers. To date, little is known about how and why people decide and act in the aftermath of breaches involving their personal data. In particular, the role of data breach fatigue, manifested by insensitivity to data breaches and low estimate of fraud loss, in affecting people's decisions and actions is unknown. The existing research has also been silent on employees' decision making and reactions in response to data breaches. To fill this research gap, in this proposal, we plan to conduct a study that reveals the key decision factors, response actions, and the potential effect of data breach fatigue in the context of anxiety over the possible outcomes of the breach. Findings of the study will help in understanding employee reactions towards data breaches. New knowledge will help industry and policy makers develop intervention strategies that avert the effect of breach fatigueTechnical DescriptionThis proposal will explore the crucial issues that influence employees' responses in the context of the recent two OPM data breach incidents. This proposed research will compare these two different incidents and their impacts on different types of victims, employees who receive notification of the personnel records incident (now), employees who receive notification of both incidents (future), and employees who only receive notification of the background investigation records incident (future). We will also survey employees who have not received any notification, as a control group. In addition to self-reported data through surveys, we shall extend this study by capturing organic Twitter messages related to the two breach incidents in the respective time periods in 2015 to study how people coped with breach incidents. Utilizing natural language processing, we intend to (1) explore patterns of discourses associated with the data breach fatigue, (2) extract coping mechanisms from the discourses, and (3) compare coping mechanisms of employees, identified from the survey and those derived from the data mining.