IEEE Technology and Society Magazine - March 2022 - 61

found that Japanese respondents expressed less
trust than New Zealanders in how organizations
managed their data, however, Cullen attributed this
to the negative experience with specific individuals
rather than an overall distrust in corporate entities.
These findings are important in that they might suggest
that while cultural norms might promote datafication
and information sharing, individuals might
remain concerned about the integrity of a system.
Discussion
Cybersecurity strategies can no longer afford to
focus on software and hardware. Rather, designers,
developers, and distributors must perceive cybersecurity
as a sociotechnical system defined by interaction
between human and nonhuman agents. The social
cognitive processes and representations that support
cyber hygiene behavior must be understood and
incorporated into design to promote the acceptance
of, and compliance with, cybersecurity practices.
This requires that we understand users' mental models
of privacy and security to determine the extent to
which they overlap, compliment, and conflict with
one another. Although not all these concerns can, or
should, be addressed in the design of cybersecurity
systems, a general understanding of privacy engineering
and privacy concerns can help create effective
cybersecurity practices that preserve users' privacy
and trust in these systems.
Challenges to privacy implementation
ICS professionals are at the frontlines of network
defense. The recognition that users resign themselves
to privacy policies [72], [73] suggests that
their perspectives are often neglected leading to
learned helplessness [74]. This learned helplessness
might in turn result in reduced compliance with
cyber hygiene practices. Cybersecurity professionals
must go beyond the technical affordances to
address these concerns. Understanding users' mental
representations represents a key starting point.
The philosophical and legal literatures on " privacy "
are vast and emphasize facets of privacy
such as self-determination, socially embedded
conceptions of dignity, and control over self-presentation
[18], [19]. Each of these facets will likely
vary in their degree of importance across cultures
based on the weighting of other values. Adding
further complexity, users might not themselves
have a clear understanding of their own mental
March 2022
models of security and privacy, and these models
are likely to develop over the course their interactions
with technology. Consequently, security and
privacy requirements must be equally adaptive and
dynamic, promoting both transparency within the
design of these systems as well as advocacy for the
users' best interest.
From a design perspective, accommodating user
beliefs and attitudes creates challenges for ICS professionals.
Making a more general point, Norman
[75] cautions about shifting from activity-centered
design to human-centered design. He notes that
human-centered design focuses on accommodating
individuals or groups and that this can create tradeoffs
that might disadvantage other individuals and
groups and overly complicate design, a sentiment
that has also been echoed in algorithmic design
[76]. Consequently, design frameworks must be
adopted that translate the goals of network security
into technical affordances [17].
National legislation and regulation represent
a starting point in that they can codify the norms
and conventions of a group. Despite the regulatory
weight that can be placed behind such systems,
the need to accommodate large groups of individuals
means that these norms will necessarily be
general. If privacy is ultimately about the individual
and their relationship with others, there will inevitably
be considerable variation from one individual
to the next in terms of what information should be
deemed private, which can be shared within an individual's
immediate social network, and which can
be more widely distributed. These demands go far
outside any general policy or legislation scope. Consequently,
ICS professionals are the best positioned
to ensure that software is both secure and that user
personal information is sufficiently obscured based
on their needs.
Beyond technical affordance and compliance
The plurality of definitions of privacy and security
might explain the concerns and doubts of ICS professionals
identified in studies of PEM [38], [40]. By
focusing on tangible goals (e.g., data integrity and
network security) and technical affordances, they
might fail to consider users' perception of privacy.
Compounding this issue, users' concepts of privacy
might be ill-defined, suggested that standards
other than privacy (e.g., obscurity) [54] should be
adopted. Here, an explainability framework should
61
IEEE Technology and Society Magazine - March 2022

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - March 2022
