A Systematic Literature Review of Empirical Methods and Risk Representation in Usable Privacy and Security Research

Usable privacy and security researchers have developed a variety of approaches to represent risk to research participants. To understand how these approaches are used and when each might be most appropriate, we conducted a systematic literature review of methods used in security and privacy studies with human participants. From a sample of 633 papers published at five top conferences between 2014 and 2018 that included keywords related to both security/privacy and usability, we systematically selected and analyzed 284 full-length papers that included human subjects studies. Our analysis focused on study methods; risk representation; the use of prototypes, scenarios, and educational intervention; the use of deception to simulate risk; and types of participants. We discuss benefits and shortcomings of the methods, and identify key methodological, ethical, and research challenges when representing and assessing security and privacy risk. We also provide guidelines for the reporting of user studies in security and privacy.

AN ERGODIC BSDE RISK REPRESENTATION IN A JUMP-DIFFUSION FRAMEWORK

We consider the representation of forward entropic risk measures using the theory of ergodic backward stochastic differential equations in a jump-diffusion framework. Our paper can be viewed as an extension of the work considered by Chong et al. (2019) in the diffusion case. We also study the behavior of a forward entropic risk measure under jumps when a financial position is held for a longer maturity.

Achieving Accuracy through Ambiguity: the Interactivity of Risk Communication in Severe Weather Events

Risks associated with natural hazards such as hurricanes are increasingly communicated on social media. For hurricane risk communication, visual information products—graphics—generated by meteorologists and scientists at weather agencies portray forecasts and atmospheric conditions and are offered to parsimoniously convey predictions of severe storms. This research considers risk interactivity by examining a particular hurricane graphic which has shown in previous research to have a distinctive diffusion signature: the ‘spaghetti plot’, which contains multiple discrete lines depicting a storm’s possible path. We first analyzed a large dataset of microblog interactions around spaghetti plots between members of the public and authoritative weather sources within the US during the 2017 Atlantic hurricane season. We then conducted interviews with a sample of the weather authorities after preliminary findings sketched the role that experts have in such communications. Findings describe how people make sense of risk dialogically over graphics, and show the presence of a fundamental tension in risk communication between accuracy and ambiguity. The interactive effort combats the unintended declarative quality of the graphical risk representation through communicative acts that maintain a hazard’s inherent ambiguity until risk can be foreclosed. We consider theoretical and practice-based implications of the limits and potentials of graphical risk representations and of widely diffused scientific communication, and offer reasons we need CSCW attention paid to the larger enterprise of risk communication.

Climate change as a corporate strategy issue

Purpose The purpose of this paper is to explore how energy companies discursively construct climate change when integrating it into their overall business strategy. Design/methodology/approach This linguistic study uses a quantitative/qualitative approach to investigate three instances of recent climate disclosure, climate strategy reports, by the energy majors Statoil (now Equinor), Suncor Energy and Total. The qualitative analysis focuses on how keywords and expressions function in their immediate linguistic context. The discussion takes the socio-political and business context of the companies into account. Findings The paper finds that the reports discursively construct climate change in different ways. Total presents climate change primarily as a responsibility the company is ready to take on; Suncor Energy presents it primarily as a business risk; and Statoil as a business opportunity. In the material as a whole, however, the risk representation is the most prevalent. Research limitations/implications The material is relatively modest; however, the three reports represent the first comprehensive accounts of how energy players fit climate considerations into their overall strategy. The analysis is based on three search terms (responsibility, risk and opportunity). Further studies should include a broader range of words that may be semantically related to each approach. Practical implications The study can inform corporate strategy discussions and indicate the rhetorical implications of discourse-related choices in climate disclosure. Originality/value The study deals with very recent corporate disclosure involving an emerging discourse, climate strategy reporting. As the reports represent responses to investor engagement, the findings should also be relevant for studies involving stakeholder perceptions.