The human factor in information systems is a large vulnerability when implementing cybersecurity, and many approaches, including technical and policy driven solutions, seek to mitigate this vulnerability. Decisions to apply technical or policy solutions must consider how an individual’s values and moral stance influence their responses to these implementations. Our research aims to evaluate how individuals prioritise different ethical principles when making cybersecurity sensitive decisions and how much perceived choice they have when doing so. Further, we sought to use participants’ (...) responses to cybersecurity scenarios to create profiles that describe their values and individual factors including personality. Participants (n = 193) in our study responded to five different ethically sensitive cybersecurity scenarios in random order, selecting their action in that scenario and rating and ranking of the ethical principles (i.e., Beneficence, Non-Maleficence, Justice, Autonomy, Explicability) behind that action. Using participants’ demographics, personality, values, and cyber hygiene practices, we created profiles using machine learning to predict participants’ choices and the principle of most importance to them across scenarios. Further, we found that, generalising, for our participants Autonomy was the most important ethical principle in our scenarios, followed by Justice. Our study also suggests that participants felt they had some agency in their decision making and they were able to weigh up different ethical principles. (shrink)

Over the past decade, the Five Eyes Intelligence community has argued cryptosystems with end-to-end encryption (E2EE) are disrupting the acquisition and analysis of digital evidence. They have labelled this phenomenon the ‘problem of going dark’. Consequently, several jurisdictions have passed ‘responsible encryption’ laws that limit access to E2EE. Based upon a rhetorical analysis (Cunningham in Understanding rhetoric: a guide to critical reading and argumentation, BrownWalker Press, Boca Raton, 2018) of official statements about ‘going dark’, it is argued there is a (...) need for a domain-specific principle of cryptographic justice to reorient the debate away from competing technocratic claims about the necessity, proportionality, and accountability of digital surveillance programs. This article therefore specifies a principle of cryptographic justice by adapting more general norms of information justice to decision-making about encryption law and policy. The resulting principle is that encryption laws and policies should be designed to empower the comparatively powerless to protect themselves from domination (i.e., morally arbitrary forms of surveillance). It is argued this principle can reorient decision-making about encryption law and policy towards consideration of how cryptography impacts systems-level power dynamics within information societies. (shrink)