Hello all! We, Verena Zimmermann and Karen Renaud, welcome you to our presentation “The Nudge Puzzle". It is based on an article published in the TOCHI journal in January this year.
One essential quest in usable security research is to support users in making secure decisions.
Yet, there are different types of decisions, such as simple one dimensional A/B decisions
or decisions with multiple dimensions. A simple example is the choice between public WiFis that fulfil the same functionality.
More complex choices are influenced by various factors such as price, functionality and security features. For example, the choice of a cloud-service.
Then, some decisions are made relatively frequently, such as password choices, and others are made once or very rarely, such as deciding whether to encrypt your smartphone.
One approach to support “wise” and “secure” choices, is nudging.
The concept of nudging has been introduced by Thaler and Sunstein within the area of behavioural economics.
Nudges are small adaptions of the decision environment to facilitate the “wiser” choice by activating automatic cognitive processes such as heuristics and biases.
They do not limit choices nor do they enforce choice. Finally, they should always be intended for the good of the user.
Examples from the physical world include comparisons with the neighbours’ energy consumption to encourage energy saving
or the use of painted footsteps on the floor towards the stairs to encourage activity instead of taking the escalator.
In our study, we tested the efficacy of nudges in the digital domain and in the context of the four different security decisions.
It is still an open question whether nudges, which exert their influence by activating automatic cognitive processes, are still effective when combined with explanatory information.
Therefore, we analysed the influence of additional intervention types on users‘ security decisions,
that is: no intervention, mere information, a nudge, and the combination of a nudge with explanations, labelled a hybrid nudge.
Thus, we analysed four decisions with four different experimental conditions each.
Here you can see the study design and the procedure.
Each of the 450 participants made all four security decisions in a randomized order.
Each decision was presented once. The intervention type was randomized and presented once.
Thus, an exemplary order could look like the one presented on this slide.
After making the four decisions, the participants were asked to give reasons for their choices.
Two weeks later in a follow-up study the same participants were presented with the same four decision types, but all in the control condition.
This was to check whether any of the effects from the interventions transferred to future decisions in which the intervention was absent.
In terms of the results, any intervention was always more successful in encouraging secure decisions as compared to no intervention at all.
That in itself indicates the importance of purposefully designing choice architectures.
We found that hybrid nudges were always at least as and often more successful in encouraging secure choices as compared to its individual components, a nudge or information provision.
This indicates that the nudge combined with information does not necessarily reduce the nudge’s effectiveness. This is supported across all decisions and nudge types.
Apart from that, hybrid nudges are more ethical.
The combination of a nudge with information enhances its transparency so that users are aware of the existence and aims of the intervention.
Unfortunately, the follow-up study showed that nudge influence did not endure to influence the same decisions two weeks later in the absence of the intervention.
So, an assumed educational effect of information provision might be questionable.
The results overall are promising and offer multiple options for application in the field of digital security and privacy decisions.
Sunstein argues that nudges and education can, indeed, complement each other.
Future work should take a closer look at the repeated deployment of interventions.
That might be suitable for infrequent decisions.
Ways to reduce the need for the intervention should be explored.
For example, users might be provided with an option to make their initial selection a default setting for all future similar decisions.
We hope that this short presentation encouraged you to take a closer look at our paper and the study results
that you can quickly access via the link or QR code on the right-hand side.
Please feel free to contact us if you have any questions. Thank you! Bye!