Control and Trust as Moderating Mechanisms in addressing Vulnerability for the Design of Business and Economic Models (ConTriVE)

个人数据具有造福商业和社会的巨大潜力，但在制度层面，对数据访问、所有权、隐私和保密相关风险的担忧正在上升。这个项目的主要目的是调查这些机构的关切是否以及如何反映在个人用户的观念中。该提案将通过理解用户对网络安全的个人主观感知与组织和机构对网络安全的看法之间的关系，建立一个新的数字经济研究项目。通过获得这种理解，我们寻求开发新的商业模式，使企业能够最大限度地减少个人对隐私、安全和信任问题的脆弱性感知。我们认为，个人在网络安全问题上的主观脆弱性是影响商业模式和数字经济发展的重要因素。我们从三个角度来考虑脆弱性：1)个体对自身脆弱性的看法；2)个人在数字领域中与之互动的实体的视角（可以是另一个人，也可以是一家企业）；3)负责监管和保护系统内所有实体的机构（如国家、监管机构等）。这三个实体可能会以不同的方式评估个别脆弱性，并有一套针对风险的单独权衡方案。个人考虑使用服务的选择/自由与易受攻击的风险之间的权衡。另一方面，一个企业，接近个人的脆弱性，并对风险进行评估，这对其商业模式很重要，以便权衡收入和提供额外的服务，以减轻风险，以安抚用户和监管机构。最后，从状态的角度来看，大量用户的聚集形成了一个复杂的数据共享系统，它承担着系统性风险，可能导致难以量化和管理的个体漏洞。拟议项目将实施“野外”战略，以便：(i)使用不同的环境并考虑到个体异质性，衡量网络安全问题方面的个体脆弱性；（ii）使用这些与环境相关的措施，提出新的商业模式，以减轻对网络安全风险的认知；（iii）建议政策制定者和监管机构通过缩小用户主观脆弱性与企业和其他机构测量的客观脆弱性之间的差距，来降低网络安全风险。

Personal data holds great potential to benefit commerce and society, but, at the institutional level, concerns are rising over the risks associated with data access, ownership, privacy and confidentiality. The main purpose of this project is to investigate whether and how these institutional concerns are reflected in the perceptions of individual users. This proposal will establish a new programme of research in digital economy by understanding how individual subjective perceptions of users with regard to cybersecurity relate to organizational and institutional views on cybersecurity. By gaining this understanding we seek to develop new business models which would allow businesses to minimize individual perceptions of vulnerability with regard to issues of privacy, security, and trust.We propose that individual subjective vulnerability with regard to cybersecurity issues is an important factor which impact upon business models and the development of digital economy. We consider vulnerability from three perspectives:1) An individual's perspective of their own vulnerability; 2) The perspective of the entity the individual is interacting with in the digital domain (which could be another individual, or a business); and 3) The institution that is tasked to regulate and protect all entities within the system (e.g., the state, regulatory body, etc.). All three entities are likely to assess individual vulnerabilities in different ways and would have a separate sets of trade-offs against the risks. An individual considers the trade-off between the choice/freedom to use a service against the risk of being vulnerable. A business, on the other hand, approximates individual's vulnerability and makes an assessment of risk which is important for its business model in order to trade off revenues and provide additional service to mitigate that risk to the extent that it would pacify the user and the regulator. Finally, from a state point of view, the aggregation of a large numbers of users creates a complex system of data sharing which bears a systemic risk that may result in individual vulnerabilities which are hard to quantify and manage.Proposed project will implement "in-the-wild" strategy in order to:(i) Measure individual vulnerability with regard to cybersecurity issues using different contexts and taking into account individual heterogeneity;(ii) Using these context-dependent measure, propose new business models which would mitigate perceptions of cybersecurity risks;(iii) Suggest tools for policy makers and regulators to decrease cybersecurity risks via bridging the gap between subjective vulnerability of users and objective vulnerability measured by businesses and other institutions.