IEEE Technology and Society Magazine - Spring 2013 - 78

positive affect complements
acceptability of risk reducing
choices. Identifying that there is
an increase in safety, and that the
individual is avoiding risk, is likely
to increase cognitive flexibility.
Fraudsters endeavor to increase
stress in victims, to encourage nonreflective cognitively constrained
action. Thus, risk communication
should address the positives of riskmitigating decisions rather than the
negatives of risk-taking behaviors.
physical risks are haptic and
thus allow humans to learn from
previous mistakes. Online, feedback to nonexperts is minimal,
often delayed, and thus lacks
context. However, this limitation can be alleviated by having
targeted and contextualized risk
communication. The technology
that enables this communication
should then share the burden of
learning from end-user interactions, which are modeled not as
failures of the cognitive process
but as systematic inputs. A site
that has been trusted some n times
would not be subject to another
query, as such interactions appear
to simply be training the person
to accept risk. This implies design
for constrained acceptance and
risk mitigation as opposed to the
all-or-nothing pop-up selections
currently dominant. Thus, security
settings too must be targeted. For
example, "accept all scripts," as
opposed to, "look once, and let me
know if there is trouble".

Limitations and Criticisms
Heuristics and biases have limitations. Frequentists argue against
the model stating "rationality is
identified with the internal consistency of subjective probabilities"
[7]. This notion of subjective probabilities as learned frequencies has
been argued against by several
investigations that note persistent
errors despite availability of relevant frequency data [34].
The model also does not explain
the underlying cognitive processes.
78

Thus, it is unclear which heuristics
dominate the decision-making process under what context. In general,
one can only provide a posthoc
explanation for an observed effect.
These limitations are addressed
by two emerging theories in
social psychology: 1) Decision
Field Theory (DFT) [4], and 2)
Quantum Information processing
Theory (QIpT)[16].
Decision Field Theory is a
stochastic dynamic theory of decision making under risk [4]. Both
expected utility theory and prospect theory qualify the preference
among outcomes. However, neither
measures the strength of those outcomes. Thus, they do not account
for deliberation time for preference
formation. When faced with a decision under uncertainty, a person
must retrieve and evaluate a complex set of alternatives. Not all
alternatives can be analyzed simultaneously, i.e., each potential choice
is individually retrieved and processed serially. Thus, the amount
of time available for deliberation
would impinge the preference
expressed as well as the strength of
expression. Deliberation processes
are important in security and privacy risk behaviors, as these are
usually orthogonal to the primary
goal of the end user.
Thus, strategies that mitigate
risk while simultaneously allowing task completion would be
harder to retrieve and therefore
evaluate and implement. Given
two strategies to encourage riskaverse behavior in end users, the
one more likely to succeed is
the one that requires less deliberation time. Arguably, security
designs for older adults should
then focus on episodic rather than
semantic memory to make context
retrieval easier. DFT allows security researchers to model security
decisions as alternatives that are
not simultaneously available and
thus are impinged by their ease of
initial coding and retention as well
as subsequent retrieval.

Quantum Information processing Theory, unlike most theories,
is situated in quantum probability
models instead those of classic
probability theory. In quantum
probability models, the probability of a conjunction can be greater
than that of its components. Classic
probability models such as Markov
models assume probabilities are
real, while quantum assumes that
probabilities are complex. Thus,
quantum probabilities appropriately model several systematic errors explained by prospect
theory. For example, representativeness heuristicas explained
with the example of Linda previously, can now be modeled using
QIpT, as the probability of Linda
being a historian and a mathematician can be greater than that of
her either being a librarian or a
mathematicians.
Classical theories assume that
measurement merely reveals a
preexisting property of a system,
while quantum theories argue
that it is the act of measurement
that creates the property being
measured. Thus, under classical
theory when faced with a pop-up
box, the user expresses their risk
posture by either accepting to
proceed or by rejecting the risk.
However, under quantum theory it
is the presentation of the pop-up
box that engenders the risk posture. Application of QIpT is currently limited by Hilbert Space,
generalized Euclidean Space, and
Hamiltonian, i.e., a function representing the total energy of the
system [16]. The identification of
an appropriate Hilbert Space and
the corresponding Hamiltonian is
a non-trivial endeavor.

Bounded Rationality
as Design Input
research in social psychology
observes and explains systematic
errors by decision makers. This
should, however, be an insight
that informs security designs to
encourage risk averse decision

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

SprING 2013

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - Spring 2013