Mobile App Installation: the Role of Precautions and Desensitization

ABSTRACT The purpose of this research is to investigate precautions that consumers take before installing mobile apps and consumer's potential desensitization to excessive app permission requests. Through a survey of 209 participants, a prediction model was created that attempts to predict whether respondents would download applications asking for excessive permissions. The model results indicate those that take more precautions are less likely to download apps requesting excessive permissions. However, the precautions taken by participants may be inadequate and may leave consumers with a false since of security. Another key finding with the support of Communication Theory and the C-HIP Model is that some consumers have become desensitized to excessive permission requests. These consumers knowingly install apps requesting excessive permissions for reasons such as nothing bad has happened to them before, they trust the market, or they really want the app. The security implications of permission desensitization and inadequate precautions are discussed. Keywords: Mobile APPs, installation of mobile APPs, consumer desensitization INTRODUCTION Smartphones and tablets have been rapidly increasing in worldwide sales over the last few years. Gartner predicts smartphones will account for 90% of all mobile phones by 2018 (Gartner, 2014) and tablet sales will surpass PC sales in 2016 (Gartner, 2015). As of fall 2015, Google's Android operating system was on 64% of the world's smartphones and tablets and Apple's iOS was on 23% (Statcounter, 2015). These two platforms lead the mobile market by a larger margin. The app markets associated with these two popular platforms are Google's Google Play market and Apple's App Store, with each containing over 1.5 million downloadable applications (Statista, 2015). A significant risk to consumers that download and install mobile applications is malware. McAfee (2015) reports that malware is on the rise, with over 1 million new mobile malware samples detected in early 2015. Also, 99% of all mobile malware is written for the Android operating system (Cisco, 2014). However, Apple applications are not without risk. In a report on poplar apps, iOS apps were found to be more risky than Android apps (Appthority, 2014). In addition, the report highlighted that 95% of the top free Android and iOS apps and 80% of paid apps exhibited at least one risky behavior. With the increase in smart devices, apps, and malware, consumers should take precautions before installing apps. According to research and government agencies, potential precautions consumers can take are to review the app developers (IC3, 2012), use only trusted app markets (FCC, 2014), and read app permissions (Harris et al., 2014). App permission requests are apps asking the consumer for permission to access data or services on the device, such as an app asking to know the consumer's location. Excessive permission requests are apps asking for access to data or services that are not necessary for the app to reasonably function, such as a card game requesting permission to send text messages. Consumers that choose to ignore excessive permission requests and install the app anyway may have become desensitized to excessive permission requests. Two potential reasons for desensitization are that the consumer trusts the market to protect them and nothing bad has happened to them before. Also used as a precaution, but not recommended by researchers, is reading app reviews and star ratings (Kelley et al., 2012) The purpose of this research is to investigate precautions that consumers take before installing mobile apps and consumer's potential desensitization to excessive app permission requests. Knowing what precautions consumers take before installing apps will be helpful in determining if consumers are taking the proper security precautions. Investigating desensitization to excessive permission requests will be helpful in determining the overall effectiveness of the permission request warning. …