Why security and privacy research lies at the centre of the information systems (IS) artefact: proposing a bold research agenda

Abstract

In this essay, we outline some important concerns in the hope of improving the effectiveness of security and privacy research. We discuss the need to reexamine our understanding of information technology (IT) and information system (IS) artefacts and to expand the range of the latter to include those artificial phenomena that are crucial to information security and privacy research. We then briefly discuss some prevalent limitations in theory, methodology, and contributions that generally weaken security/privacy studies and jeopardise their chances of publication in a top IS journal. More importantly, we suggest remedies for these weaknesses, identifying specific improvements that can be made and offering a couple of illustrations of such improvements. In particular, we address the notion of loose recontextualisation, using deterrence theory (DT) research as an example. We also provide an illustration of how the focus on intentions may have resulted in an underuse of powerful theories in security and privacy research, because such theories explain more than just intentions. We then outline three promising opportunities for IS research that should be particularly compelling to security and privacy researchers: online platforms, the Internet of things (IoT), and big data. All of these carry innate information security and privacy risks and vulnerabilities that can be addressed only by researching each link of the systems chain, that is, technologies-policies-processes-people-society-economy-legislature. We conclude by suggesting several specific opportunities for new research in these areas.

Privacy concerns in the smart home context

“…As mentioned by [61] in addition to the service offered by the technology itself, the interaction between provider and customer is necessary. Therefore, we address a substantial research investigation of privacy aspects in IoT, which is mentioned by [6] and [13] and whose relevance is particularly mentioned in the smart service context, e.g., by [61].…”

“…Nevertheless, a major obstacle to adoption is the nature of the technology that gives rise to new concerns about information privacy [6]. An editorial in the Information Systems Journal stated that "recent technological changes are generating additional privacy challenges beyond the existing landscape" [7, p. 575].…”

Information security policy noncompliance: An integrative social influence model

“…Studies have found important cross-domain implications from ethical work climate to service outcome (Myer, Thoroughgood, & Mohammed, 2016), from climate regarding employee relations, organizational support, and leader-F I G U R E 1 An integrative model of information security policy (ISP) noncompliance member exchange to workplace safety (Hofmann & Morgeson, 1999;Wallace, Popp, & Mondore, 2006) and to customer service outcome (Schneider, White, & Paul, 1998). Researchers have also highlighted the relevance of ethics in the security, privacy, and IS domain (Lowry, Dinev, & Willison, 2017;Mingers & Walsham, 2010). Personal ethics and ethical work climate have both been found to directly or indirectly impact ISP (non)compliance (Hovav & D'Arcy, 2012;Li et al, 2014;Myyry et al, 2009;Yazdanmehr & Wang, 2016).…”

Philosophy and information systems: where are we and where should we go?

“…As a result of these events, ethical rules as they apply to academicians are being re-examined (Editorials Nature, 2018). Despite over a decade of research in privacy and security of information in IS (Acquisti & Gross, 2006;Lowry, Dinev, & Willison, 2017;Posey, Raja, Crossler, & Burns, 2017), we cannot assume that the problem is solved. A new approach to privacy and security may be necessary to overcome these challenges.…”