The impact of ignorance and bias on information security protection motivation: a case of e-waste handling

Abstract

PurposeProtection motivation theory (PMT) explains that the intention to cope with information security risks is based on informed threat and coping appraisals. However, people cannot always make appropriate assessments due to possible ignorance and cognitive biases. This study proposes a research model that introduces four antecedent factors from ignorance and bias perspectives into the PMT model and empirically tests this model with data from a survey of electronic waste (e-waste) handling.Design/methodology/approachThe data collected from 356 Chinese samples are analyzed via structural equation modeling (SEM).FindingsThe results revealed that for threat appraisal, optimistic bias leads to a lower perception of risks. However, factual ignorance (lack of knowledge of risks) does not significantly affect the perceived threat. For coping appraisal, practical ignorance (lack of knowledge of coping with risks) leads to low response efficacy and self-efficacy and high perceptions of coping cost, but the illusion of control overestimates response efficacy and self-efficacy.Originality/valueFirst, this study addresses a new type of information security problem in e-waste handling. Second, this study extends the PMT model by exploring the roles of ignorance and bias as antecedents. Finally, the authors reinvestigate the basic constructs of PMT to identify how rational threat and coping assessments affect user intentions to cope with data security risks.

Appraising the Manifestation of Optimism Bias and Its Impact on Human Perception of Cyber Security: A Meta Analysis

“…Incorrect cyber risk perception leads to thinking that the individual has preventive measures, or the risk is low, not very serious and I will not be a target. Ament (2017) stated that optimism bias will lead to overconfidence on the skills of the individual as well as create a thinking that I will not be a target thus will not opt preventive measures due to that overconfidence and optimism bias [37] Cho et al, 2010 [38] and Chen & Yuan, 2022 [29]. Overconfidence and optimism bias will affect the decision making of the individual both in personal context as well as in organizational context [29] [38].…”

“…These results are consistent with the results of most of the individual studies of optimistic bias in the context of cyber security. Chen & Yuan, in a recent study found that due to optimistic bias, the decisions of the analysts will not be objective and will be biased and flawed [29].…”

“…The authors found that optimism bias led to lower perception of information security risks although the lack of knowledge of those risks does not significantly affect the perceived threat [29].…”

Investigating the Relationship Between Personality Traits and Information Security Awareness

“…2) Anonymity and Psychological Distance: The often anonymous nature of cyber threats can diminish the perceived immediacy and severity of these risks, affecting individual behavior in security practices [29]. 3) Cognitive Biases: Common cognitive biases, such as the illusion of invulnerability, can lead individuals to underestimate their likelihood of being targeted by cyberattacks [30]. 4) Adaptability to Changing Threats: The continual evolution of cyber threats necessitates that information security measures be flexible and responsive to new challenges [31].…”

“…Further contributing to this field, AlGhamdi, Win, and Vlahu-Gjorgievska [37] and Solomon et al [38] provided models to assess and enhance compliance with information security controls and contextual security awareness, respectively, focusing on culturally and contextually sensitive frameworks [37,38]. Chen and Yuan [30] and [26] explored how ignorance, cognitive biases, and intelligence integration with personality traits influence security behaviors and compliance with preventive measures [26,30]. Our study extends these discussions using a quantitative modeling approach through Spearman correlation analysis and logistic regression.…”