IEEE Technology and Society Magazine - Spring 2013 - 75

health behaviors [18]. They found
that actions preventing threats were
seen as safe, while those that detect
threats were seen as risky. In their
study, safe behaviors were encouraged through a gain frame, while
risky behaviors were encouraged
though a loss frame. In the security
domain, patching prevents malware
from exploiting software vulnerabilities. Thus, end users should be
presented information regarding
patching as a gain. people can be
told that patching would keep their
computer running fast and the software cutting edge. Alternatively,
antivirus also detects malware.
Hence, presenting the information
in a loss avoidance frame arguably
encourages antivirus installation and
periodic scans. For example, end
users can be told that if that without
antivirus they are much more likely
to lose data.
Assimilation and Contrast
The wrong decision frame can
encourage decision making counter to the intended nature of the
communication [21]. Thus, inappropriately presented information
may encourage users to increase
risk-seeking behavior. When people act in valence with provided
risk communication, they demonstrate assimilation effects [8].
However, when they act counter to
the intended goal of the communication, they demonstrate contrast
effects [5]. In general, when information provided is used to evaluate
a category it leads to assimilation
effects. However, if it is used to
evaluate a specific member of the
group it leads to contrast effects.
For example, the example of a corrupt Congressional representative
may decrease the general opinion
of representatives, but might also
improve one's opinion of their local
representative. Thus, telling users
that clicking on online banner ads
might install malware on their systems may make them suspicious
of pop-ups in general; but might
increase trust in specific banner

In a complementary vein, we argue
that behavioral as well as rational
economic models can improve the
design of security technologies.
ads, such as fake AV as shown in
Fig. 1 [37].
Similarly, there are implications
for email based scams. Individuals
primed with moderate exemplars
and asked to judge ambiguous stimuli may demonstrate assimilation
effects [8]. Contrasts effects were
seen when unambiguous stimuli
were judged or when participants
were primed with extreme exemplars. Thus, when participants are
shown extreme exemplars of email
scams such as 419 scams, they may
become more trustworthy of less
extreme examples such as generic
phishing emails. In general, priming with a stereotype generates
assimilation [3], while priming with
an exemplar generates contrasts [5].
For example, priming with a professor stereotype led participants
to perform better on trivia, while
priming with Einstein degraded
performance. Thus, priming with

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

the general example of a security
guru might lead to safer behaviors
online, while priming with an
exemplar such as Bruce Schneier
might lead to increased risk taking. If we account for the decision
frame, a more effective analogy
may be explored. For example,
priming the user with a generic
unsafe end user might lead to more
unsafe behavior. However, priming
with an extremely unsafe user (e.g.,
Sarah palin's email) might lead to
much safer behaviors.
Representativeness
Stereotypes encouraging assimilation are an illustration of the general power of representativeness.
The comprehensive representativeness heuristic is based on the
conjunction fallacy [33]. One of
the foundational results of classic probability theory is that the
probability of a conjunction, i.e.,

Fig. 1. Typical malware pop-up pretending to be a malware remover.

SprING 2013

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - Spring 2013