One of the most important aspects of RISCS is its multidisciplinary nature. Adam Joinson studies human behaviour online. At the June 2017 RISCS meeting, he introduced the cSALSA project to study how the way people talk about security changes over their lifespan.
Joinson began researching the psychology of how people use the internet as early as the mid-1990s. His academic career has grown up alongside the web; his earliest days online, when he was starting his PhD on self-esteem at the University of Hertfordshire, were in the era of Gopher and FTP, early protocols for sharing information. His first study of human web behaviour began in 1995 when he wrote to the webmasters of some football teams and got them to examine their log files to compare patterns of access to the teams’ wins and losses.
Originally, Joinson had it in mind to be a journalist. He picked psychology as his one optional subject. Besides the fact that he enjoyed it, he could see the potential in crossing psychology and the material he was studying separately in economics. Behavioural economics was just beginning as a field, and Daniel Kahnemann and Amos Tversky were publishing their earliest work. During the final studies for his PhD thesis, he shared a lab with students in cognitive science and computer science, who introduced him to the early internet.
For a 1999 study, he set up a web-based survey with measures of socially desirable behaviour and studied the responses. The resulting paper Social Desirability, Anonymity and Internet-Based Questionnaires (PDF) compared anonymous and non-anonymous responses and found that anonymity did make some difference in that respondents who answered anonymously were more likely to report socially undesirable behaviour. However, the simple fact of the survey’s being conducted online had a unique effect on top of that. This early study showed that there is something significantly different about responding online, compared to offline surveys. The study has since been replicated many times, and even today the outcome is not much different.
The paper established two important principles. First, even though there are demographic issues about who gets online and who responds to online surveys – which still need to be taken into account when researchers use Amazon’s Mechanical Turk and do online polling – the paper demonstrated that it was possible to collect data in this way. Second, although most people at the time thought people didn’t present their real selves online, this paper showed the opposite: people actually became more candid. One result of this paper was the creation of online polling groups such as YouGov. “People came to ask how they could design their online system to get good, valid responses that would convince the customers,” he says.
This work led to a series of studies that compared the way people talk face-to-face with how they communicate online. In one study, Joinson manipulated self-awareness: some participants could see video of each other, some were watched by someone else, some were distracted by a cartoon playing in another window while chatting. The studies found that these various elements have a psychological impact that changes how people communicate. The resulting 2001 paper, Self-Disclosure in Computer-Mediated Communication: The Role of Self-Awareness and Visual Anonymity, found an association between high levels of spontaneous self-disclosure and the combination of heightened private self-awareness and reduced public self-awareness.
In 2008, Joinson’s interest began to shift from online anonymity to privacy as part of some of the first work studying how and why people were using Facebook. The resulting paper, “Looking at”, “Looking up” or “Keeping up with” People? Motives and Uses of Facebook (PDF), used a uses and gratifications framework to understand why people were using the social network and how those patterns of use related to what they were trying to get out of it. Joinson also found that people using it in order to meet new people had different approach to privacy settings than those using to reconnect with old friends. This paper kicked of a lot of work still being done about how patterns of use relate to privacy and security. A journalist using Twitter, for example, has specific motivations that determine how they relate to people and how open they are as opposed to someone using it to keep up with friends and family. The lesson, Joinson says, is that design decisions in this area have to match privacy and security settings to users’ goals.
A final bit of social media work in 2016, led by Joinson’s PhD student Ben Marder, focused on the chilling effect of having mixed audiences. This work was based on Michel Foucault’s idea, based on the Panopticon, that people who know they might be surveilled wind up censoring their own behaviour. The results they found, published as The extended ‘chilling’ effect of Facebook: The cold reality of ubiquitous social networking, had a twist: people, especially younger ones, manage the social anxiety of wanting their presentation to match observers’ expectations, by changing their offline lives. They are conscious that pictures will be taken, posted, and tagged – and therefore have no-camera or no-tagging rules at parties. The Internet of Things is likely to threaten this approach by taking away the opportunity to make our own rules.
Simultaneously, Joinson was developing his ideas about trust. The 2010 paper Privacy, Trust, and Self-Disclosure Online (PDF) examined the interplay between concerns about privacy, the apparent trustworthiness of sites, and the adoption of privacy-enhancing behaviour. The result was, Joinson says, “a really odd relationship with privacy and trust”: people think that sites that look trustworthy offer better privacy protection. Facebook poses a particular challenge, in that users are managing dual trust relationships – one with the people they’re connected and the other with the service itself. Yet, the service is often transparent to its users, who focus instead on deciding what to share with their connections based on how they think those connections will treat the disclosures.