Social Science Experiment Jan-Willem Bullee

2 Cyber-crime Science Background Effectiveness of authority on compliance We can get some of the answers from »Literature (Meta-analysis) »Attacker stories/interviews But the answers are inconclusive »Different context »Hard to measure human nature »Difficult to standardize behaviour.

3 Cyber-crime Science Principles of Persuasion Authority »More likely to listen to an police officer Conformity »Peer pressure Commitment »Say yes to something small first Reciprocity »Return the favour Liking »People like you and me Scarcity »Wanting the ungettable

5 Cyber-crime Science Literature on Authority Classical Milgram Shock Experiment »66% full compliance [Mil63] S. Milgram. Behavioral study of obedience. The Journal of Abnormal and Social Psychology, 67(4), 371–378.

5 Cyber-crime Science Introduction Key Experiment Get something from an employee Equal to password or PIN Intervention Impersonate

5 Cyber-crime Science Experimental Setup Design Intervention »Written memo »Key-chain »Poster R1R1 XO R2R2 O

5 Cyber-crime Science Hypotheses H 0 : Intervention and Control comply equally H 0 : Authority and Control comply equally H 0 : Effect of Authority on compliance

5 Cyber-crime Science Results 351 rooms targeted »N=118 (33,6%) populated Demographics Targets »Female: 24 (20%) Male: 94 (80%) »M age = 34, range (23-63) years Overall compliance distribution »52.5%/47.5%

5 Cyber-crime Science Results

5 Cyber-crime Science Results Intervention distribution »60%/40% H 0 : Intervention and Control comply equally »χ²-test »Hypothesis rejected

5 Cyber-crime Science Results Authority distribution »≈50/50 H 0 : Authority and Control comply equally »χ²-test »Hypothesis accepted

5 Cyber-crime Science Results Effect of authority »Logistic Regression »Employees that did not get the intervention are 2.84 times more likely to give their key away Intervention Give Key

5 Cyber-crime Science Results Effect of authority »Logistic Regression »Employees that did not get the intervention are 2.84 times more likely to give their key away »Authority: No effect Intervention Authority Give Key

5 Cyber-crime Science Results Comments: »“Great test!” “Cool Experiment” “Interesting study” »“I had doubts” “Having an keychain is important” »“Suspicious looking box” »“Guy in suit looked LESS trustworthy” »“Asked for my ID” »“Trusted me since I looked friendly” »“I feel stupid” »“I didn’t wanted to give the key, but did it anyway”

5 Cyber-crime Science Take Home Message Children, animals, people never react the way you want. Limited availability in July and August You are not important for others …unless you want to break the system 1/3 of employees works on a Wednesday in September 2.84 times higher odds to get key if no intervention

10 Cyber-crime Science Charging Mobile Phone

10 Cyber-crime Science Charging Mobile Phone What are the security considerations of the users of a public mobile phone charger? »What is the use rate of the device (per number of people at that location per hour), »Why do people use (or not) the system? »How do the safety perceptions of the current users differ between the former users and the non-users. You are the researchers!

10 Cyber-crime Science Crime Prevention CPTED Framework (Crime Prevention Through Environmental Design) Activity Support »Eyes on the street »Unfortunately: also provides opportunity »Overall crimes are reduced by increasing activity [Coz05] Cozens, P. M., Saville, G., & Hillier, D. (2005). Crime prevention through environmental design (CPTED): a review and modern bibliography. Property management, 23(5),

10 Cyber-crime Science Hypotheses H 0 : Cabinets in busy and quite areas are equally used. H 0 : Cabinets with surveillance (e.g. service desk) and with no surveillance are equally used. H 0 : Cabinets in lunch hours (e.g. lunch) and lecture hours are equally used.

11 Cyber-crime Science Our Design Researchers: You (Student) Target: Fellow Students and Employee Goal: Observe »Observe and interview people Interface: Face 2 Face Count people and short questionnaire

12 Cyber-crime Science Method : Our design 2 experimental conditions »Users of the system / non users of the system 6 locations »Experimental: Bastille, Hal-B, Horst and Spiegel »Control: ITC (city center), Ravelijn

13 Cyber-crime Science Method : Our procedure Subjects from the experimental building »Teams of 1 researcher »One minute count: the people that pass-by »Approach users of the system Subjects from the control building »Teams of 2 researchers »Interview people walking in the area More details on the course-site

15 Cyber-crime Science What to do Before Tuesday 9 September »Register in the Doodle On 10, 17 (and 24) September »09: :50 Briefing at ZI4047 »Travel to location »10: :45 Experiment »12: :30 Break and travel »13: :45 Experiment part 2

16 Cyber-crime Science What to do We have permission to do this only at »UT: Bastille, Hal-B, Horst, Ravelijn, Spiegel and ITC Enter your data in SPSS »Directly after the attack »Come to me ZI4047 Earn 0.5 (out of 10) bonus points

17 Cyber-crime Science Ethical issues Informed consent not possible Zero risk for the subjects Approved by facility management Consistent with data protection (PII form) Approved by ethical committee, see

18 Cyber-crime Science Conclusion Designing research involves: »Decide what data are needed »Decide how to collect the data »Use validated techniques where possible »Experimental Design, pilot, evaluate and improve »Training, data gathering

19 Cyber-crime Science Further Reading [Cia09] R. B. Cialdini. Influence: The Psychology of Persuasion. Harper Collins, [Gre96a] T. Greening. Ask and ye shall receive: a study in 'social engineering'. SIGSAC Rev., 14(2):8-14, Apr [Hof66] C. Hofling, E. Brotzman, S. Dalrymple, N. Graves, and C. Pierce. An experimental study in Nurse-Physician relationships. J. of Nervous & Mental Disease, 143(2): , Aug 1966.