Why users (fail to) read computer usage policies

Industrial Management & Data Systems

Volumn 108, Issue 6, 2008, Pages 701-712

  Bryan Foltz, C ^a   Schwager, Paul H ^b   Anderson, John E ^c  

^a UNIVERSITY OF TENNESSEE AT MARTIN   (United States)

^b EAST CAROLINA UNIVERSITY   (United States)

^c UTAH VALLEY UNIVERSITY   (United States)

Author keywords

Business policy; Computers; Crimes; Individual behaviour; Information systems

Indexed keywords

COMPUTER CRIME; SECURITY SYSTEMS; STUDENTS;

BEHAVIORAL INTENTION; COMPUTER SECURITY; COMPUTER USAGE; DESIGN/METHODOLOGY/APPROACH; INDIVIDUAL (PSS 544-7); ON-LINE SURVEY; POLICY STATEMENTS; PRACTICAL IMPLICATIONS;

COMPUTERS;

EID: 46749091723     PISSN: 02635577     EISSN: None     Source Type: Journal    
DOI: 10.1108/02635570810883969     Document Type: Article

References (40)

1. Ajzen, I. (1988), Attitudes, Personality, and Behavior, The Dorsey Press, Chicago, IL.
2. Ajzen, I. (1991), “The theory of planned behavior”, Organizational Behavior and Human Decision Processes, Vol. 50 No. 2, pp. 179-211.
3. Anthes, G.H. (1996), “Hack attack: cyberthieves siphon millions from US firms”, Computerworld, Vol. 30 No. 16, p. 81.
4. Assembly Committee on Criminal Procedure (State of California) (1975), “Public knowledge of criminal penalties”, in Ed. Henshel, R.L. and Ed. Silverman, R.A. (Eds), Perception in Criminology, Columbia University Press, New York, NY, pp. 74-90.
5. Backhouse, J. and Dhillon, G. (1995), “Managing computer crime: a research outlook”, Computers and Security, Vol. 14 No. 7, pp. 645-651.
6. Beck, L. and Ajzen, I. (1991), “Predicting dishonest actions using the theory of planned behavior”, Journal of Research in Personality, Vol. 25 No. 3, pp. 285-301.
7. Blumstein, A., Cohen, J. and Nagin, D. (Eds) (1978), Deterrence and Incapacitation: Estimating the Effects of Criminal Sanctions on Crime Rates, National Academy of Sciences, Washington, DC.
8. Breakey, P. (2007), “Delaware board sets computer-use policy”, Knight Ridder Tribune Business News, October 11, available at: www.thedailystar.com/archivesearch/local_story_ 284040041.html (accessed April 4, 2008).
9. Brodwater, T. (2007), “Firefighters put on suspension: technician finds sexual images on Timberlake district's computers”, Knight Ridder Tribune Business News, April 11, p. 1.
10. Buikhuisen, W. (1974), “General deterrence: research and theory”, Abstracts on Criminology and Penology, Vol. 14 No. 3, pp. 285-8.
11. Cook, K.S. (Ed.) (2001), Trust in Society, Russell Sage Foundation, New York, NY.
12. Doll, J. and Ajzen, I. (1992), “Accessibility and stability of predictors in the theory of planned behavior”, Journal of Personality and Social Psychology, Vol. 63 No. 5, pp. 754-764.
13. Earle, T. and Cvetkovich, G. (1995), Social Trust: Toward a Cosmopolitan Society, Praeger, Westport, CT.
14. Flickes, M. (2004), “Behind the numbers: the FBI cyber-crime survey results”, Government Security web site, http://govtsecurity.com/mag/behind_numbers_fbi/ (accessed August 1, 2004).
15. Foltz, C.B., Anderson, J.E. and Schwager, P.H. (2007), “Factors influencing awareness of computer usage policies”, Proceedings of the Southwest Decision Sciences Institute, San Diego, CA, pp. 243-252.
16. Foltz, C.B., Cronan, T.P. and Jones, T.W. (2004), “Student awareness of university computer usage policies: is a single exposure enough?”, Proceedings of the Southwest Decision Sciences Institute, Orlando, FL, pp. 293-9.
17. Fornell, C. and Larcker, D. (1981), “Evaluating structural equation models with unobservable variables and measurement error”, Journal of Marketing Research, Vol. 18, pp. 89-98.
18. Gordon, L.A., Loeb, M.P., Lucyshyn, W. and Richardson, R. (2006), “2006 CSI/FBI computer crime and security survey”, Computer Security Journal, Vol. 22 No. 3, pp. 1-21.
19. Heiser, J. (2002), “Go figure”, Information Security, April, p. 26.
20. Holmes, J. (2003), “Formulating an effective computer use policy”, Information Strategy: The Executive's Journal, Vol. 20 No. 1, pp. 26-33.
21. Klette, H. (1975), “Some minimum requirements for legal sanctioning systems with special emphasis on detection”, General Deterrence: A Conference on Current Research and Standpoints, National Swedish Council for Crime Prevention, Stockholm, pp. 12-59.
22. Krause, M. and Tipton, H.F. (Eds) (1998), Handbook of Information Security Management, Auerbach, Boca Raton, FL.
23. Lee, J. and Lee, Y. (2002), “A holistic model of computer abuse within organizations”, Information Management & Computer Security, Vol. 10 No. 2, pp. 57-63.
24. Leonard, L.N.K. and Cronan, T.P. (2005), “Attitude toward ethical behavior in computer use: a shifting model”, Industrial Management & Data Systems, Vol. 105 No. 9, pp. 1150-71.
25. Lindquist, C.D. (2008), “Commentary: use of employer's e-mail in attorney-client communication raises privilege concerns”, Daily Record, January 3, p. 1.
26. Madden, T.J., Ellen, P.S. and Ajzen, I. (1992), “A comparison of the theory of planned behavior and the theory of reasoned action”, Personality and Social Psychology Bulletin, Vol. 18 No. 1, pp. 3-9.
27. Nagin, D. (1978), “General deterrence: a review of the empirical evidence”, Deterrence and Incapacitation: Estimating the Effects of Criminal Sanctions on Crime Rates, National Academy of Sciences, Washington, DC, pp. 93-139.
28. Nunnally, J. (1978), Psychometric Theory, 2nd ed., McGraw-Hill, New York, NY.
29. Robert, P.H., Clairet, S., Benoit, M., Koutaich, J., Bertogliati, C., Tible, O., Caci, H., Borg, M., Brocker, P. and Bedoucha, P. (2002), “The apathy inventory: assessment of apathy and awareness in Alzheimer's disease, Parkinson's disease and mild cognitive impairment”, International Journal of Geriatric Psychiatry, Vol. 17 No. 12, pp. 1099-105.
30. Romney, M. (1995), “Computer fraud – what can be done about it?”, The CPA Journal, Vol. 65 No. 5, pp. 30-33.
31. Scott, T. and Voss, R. (1994), “Ethics and the 7 ‘P's’ of computer use policies”, Proceedings of the Conference on Ethics in the Computer Age, Gatlinburg, TN, pp. 61-67.
32. Siegrist, M. (2000), “The influence of trust and perceptions of risks and benefits on the acceptance of gene technology”, Risk Analysis, Vol. 20 No. 2, pp. 195-203.
33. Siegrist, M. and Cvetkovich, G. (2000), “Perception of hazards: the role of social trust and knowledge”, Risk Analysis, Vol. 20 No. 5, pp. 713-9.
34. Siegrist, M., Cvetkovich, G. and Roth, C. (2000), “Salient value similarity, social trust, and risk/benefit perception”, Risk Analysis, Vol. 20 No. 3, pp. 353-362.
35. Straub, D.W. (1986), “Deterring computer abuse: the effectiveness of deterrent countermeasures in the computer security environment”, dissertation, Graduate School of Business, Indiana University, Bloomington, IN.
36. Straub, D.W. (1987), “Controlling computer abuse: an empirical study of effective security countermeasures”, Proceedings of the International Conference on Information Systems, pp. 277-289.
37. Straub, D.W. and Nance, W.D. (1990), “Discovering and disciplining computer abuse in organizations: a field study”, MIS Quarterly, Vol. 14 No. 1, pp. 45-60.
38. Taylor, S. and Todd, P.A. (1995), “Understanding information technology usage: a test of competing models”, Information Systems Research, Vol. 6 No. 2, pp. 144-176.
39. Vankatesh, V., Morris, M., Davis, G. and Davis, F. (2003), “User acceptance of information technology: toward a unified view”, MIS Quarterly, Vol. 27 No. 3, pp. 425-478.
40. Haines, R. and Leonard, L.N.K. (2007), “Individual characteristics and ethical decision-making in an IT context”, Industrial Management & Data Systems, Vol. 107 No. 1, pp. 5-20.