Cyber Behavior Change: An Ethical Framework for Behavioral Interventions in Cybersecurity

The importance of changing behaviors is gradually being acknowledged in cybersecurity, and the reason is the realization that the majority of security incidents have a human-related component. Thus, enhancing behaviors at individual level, can bring a significant reduction in security breaches overall. Behavior change refers to any modification of human behavior through some type of intervention. Interventions from behavioral economics and psychology are being increasingly introduced in the field, however, the ethics surrounding such interventions are largely neglected. In this paper, we raise the potential ethical issues associated with behavioral intervention approaches. We draw on the traditionally more mature field of biomedical ethics and propose a six-principle ethical framework suitable for cyber behavior change. We conducted a survey (N=141) to identify individuals' perceptions on the proposed ethical principles and validate their perceived usefulness. We analyze an existing intervention in the light of this conceptual framework to showcase how it can be used as a practical apparatus. Our adapted ethical framework is aimed for cyber security professionals, policy makers, and behavioral intervention designers, and can serve as a starting point for best-practice development in cyber behavior change ethics.