Control and Trust as Moderating Mechanisms in addressing Vulnerability for the Design of Business and Economic Models (ConTriVE)

Personal data holds great potential to benefit commerce and society, but, at the institutional level, concerns are rising over the risks associated with data access, ownership, privacy and confidentiality. The main purpose of this project is to investigate whether and how these institutional concerns are reflected in the perceptions of individual users. This proposal will establish a new programme of research in digital economy by understanding how individual subjective perceptions of users with regard to cybersecurity relate to organizational and institutional views on cybersecurity. By gaining this understanding we seek to develop new business models which would allow businesses to minimize individual perceptions of vulnerability with regard to issues of privacy, security, and trust.

We propose that individual subjective vulnerability with regard to cybersecurity issues is an important factor which impact upon business models and the development of digital economy. We consider vulnerability from three perspectives:
1) An individual's perspective of their own vulnerability;
2) The perspective of the entity the individual is interacting with in the digital domain (which could be another individual, or a business); and
3) The institution that is tasked to regulate and protect all entities within the system (e.g., the state, regulatory body, etc.).
All three entities are likely to assess individual vulnerabilities in different ways and would have a separate sets of trade-offs against the risks. An individual considers the trade-off between the choice/freedom to use a service against the risk of being vulnerable. A business, on the other hand, approximates individual's vulnerability and makes an assessment of risk which is important for its business model in order to trade off revenues and provide additional service to mitigate that risk to the extent that it would pacify the user and the regulator. Finally, from a state point of view, the aggregation of a large numbers of users creates a complex system of data sharing which bears a systemic risk that may result in individual vulnerabilities which are hard to quantify and manage.
Proposed project will implement "in-the-wild" strategy in order to:
(i) Measure individual vulnerability with regard to cybersecurity issues using different contexts and taking into account individual heterogeneity;
(ii) Using these context-dependent measure, propose new business models which would mitigate perceptions of cybersecurity risks;
(iii) Suggest tools for policy makers and regulators to decrease cybersecurity risks via bridging the gap between subjective vulnerability of users and objective vulnerability measured by businesses and other institutions.

We will focus on: businesses, consumers, wider society and the academic community. Our "in-the-wild" strategy is of integrated nature and represents an extensive eco-system of which involves users and businesses. (1) Users: ConTriVE will suggest ways to improve technology used by individuals and households to incorporate user preferences into making demand predictions. This would allow users to make "better" (more optimal) use of technology and inform product and service consumption decisions which would increase their quality of life. In addition to users participating in our research directly, we will also provide educational feedback to the general public. (2) Private sector: Our project will provide a practical tool in the form of user preferences prediction models which would propose ways of anticipating future consumer needs/wants through behavioural and decision-theoretic modelling. Proposed models will be converted into a practical tool useful to businesses developing technology. Technology providers will be able to use this tool to decrease user feelings of vulnerability, increase user satisfaction, and thereby increase business profitability by offering better value for money. (3) Policy-makers: ConTriVE will offer new ways in which users will interact with ICT which will make useful policy recommendations as to how the interactions between consumers and their self-generated data could be regulated and supported by the public sector. ConTriVE will also extensively cover the problem of cybersecurity which will help create more effective data protection policies for the future. (4) Scientific community: ConTriVE will contribute to all disciplines involved in the project via new knowledge.

Our impact strategy includes: (a) Exploration: we will engage all stakeholders of personal data, particularly individuals and firms, for discovering emerging scenarios, usages and behaviours through live scenarios in real environments. We will explore the legal, technological and market framework around which data can be secured and protected and, more importantly, how the cybersecurity issues are being perceived by users and organizations. (b) Experimentation: the living lab will implement the HAT for individuals to experience live cybersecurity scenarios, live market exchanges with firms with permission from data donors (at both user and business level) which will be analysed in their context during the evaluation activity. Individuals will have the ability to decide what type of data, how the data is collected, what kind of device to be used in the data collection and the contexts for the data collection. The intention here is to help develop a new type of 'smart' and empowered consumers, aware of the new horizons for the use of metadata which are offered by the digital economy, and who understand how these opportunities can be turned into better well being and effective purchasing decisions through decreasing vulnerability to cybersecurity issues. This experimentation on data, human decisions and new business models will also provide both opportunities for emerging business models and research contributions to academia. (c) Evaluation: Through "in-the-wild" strategy, we will assess new ideas and innovative concepts emerging from the HAT technology in real life situations through various dimensions such as socio-ergonomic, socio-cognitive and socio-economic aspects; making observations on the potential for business transformations. ConTriVE will evaluate and assist firms in their transformation capability to move into the personal data and digital economy through an assessment and understanding of how their business models can be transformed to decrease vulnerability. (d) Co-creation: ConTriVE lab will bring together users and businesses who will be able to co-create in order to develop new products and services providing better individual sense of security bridging the gap between subjective and objective vulnerability.