<figure><img src="image_1.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Cyber Security Policies in Crisis Response: exploring the predicament of creating safe but workable systems

Joshua Stassen¹[0009-0009-3178-9132], Ali Pirannejad¹[0000-0003-4517-7259] and Kenny Meesters¹
[0000-0002-8324-956X]

¹ Tilburg University, Tilburg 5037 AB, The Netherlands
Joshuastassen@gmail.com

**Abstract.** As societies become more connected, the nature and response to crises are becoming increasingly complex as well. Crises can affect our societies in unpredictable ways and thus require different actors to bring information together to take appropriate actions. However, as the number and diversity of actors increases, so does the quality and variety of information systems. Especially considering the increased availability and accessibility of technologies available together, process and exchange information.

While these developments provide a high potential to improved information sharing, these options also present certain risks. Individual organizations may have measures, training, and policies in place for daily routines to mitigate these risks. During a crisis however, these measures can become a constraint, especially when sharing information in an inter-organizational and cross-boundary context. People in the crisis response team may not appreciate the risks, need to improvise, or even circumvent measures.

In this paper, we examine the increased cybersecurity risks associated with the increased use of information technologies used in and facilitating information management during a crisis response. Using a serious gaming research method we examine how, in the context of crisis response, these factors are exacerbated under the pressure of time, uncertainty and coordination challenges. From this we identify the need for increased awareness about the risks of information technologies and sharing in heterogenous stakeholder environments. Specifically, a cultural change and need for additional capacities to understand, assess, and mitigate risks involved as the number of actors, systems, and technological options keep increasing.

**Keywords:** Cybersecurity behavior, compliance, disaster information security management.

## 1 Introduction

With the world as connected as today, the increasing number of crises is becoming more complex. COVID-19 caused logistical disruptions and the war in Ukraine causes price surges around the world. What a crisis is, is not so clear anymore. Due to the larger group of actors involved, information is shared more frequently. Luckily, there are more tools available and there is better access towards these tools. The combination
of these two trends will translate to a cooperation landscape consisting of many differ-
ent actors bringing their equally different systems with them. This creates the perfect
storm for cybersecurity issues. The time pressure, heterogeneity of systems and the lack
of IT skills (mainly in IT risk management) that exists in crises creates an unsafe envi-
ronment. At the same time, large parts of our society have become dependent on tech-
nological possibilities, companies, communities, and individual citizens. This also ap-
plies to emergency response agencies which are increasingly embracing technology to
support their operations, decision-making and analysis activities. However, especially
in such vital sectors, this dependency not only carries the same risks but also an in-
creased possibility of errors because working under pressure. During the COVID-19
pandemic, attacks have been launched on governmental agencies or directly at users to
disrupt essential services, steal information or seek to spread fear during the pandemic
[1]. The biggest vulnerability of these systems primarily lies with the humans interact-
ing with those systems. Most of the time, human error is the root cause of the hack [3].
Humans pose a high risk, whether this is through malicious intent or human error. There
is a lack of cybersecurity understanding amongst responders. While responders are
thought to prioritize their own safety and have a great understanding of how their tools
function, this is not the case for IT. Especially amongst emergency responders coming
from different backgrounds. If emergency responders don't know how to use their ‘vir-
tual firehose’, how should these responders safely provide support during a crisis? And
more important, what is stopping us from translating the same physical response rea-
soning to the digital response environment?

To understand this problem, it is critical to understand how people act during a crisis. In short, disasters, systems and humans are dependent on each other. Humans interact with systems, which increases not only the risks from a technical and human perspective, but also from the increased pressure that the systems and humans operate under, and their vitality in critical operations. Disasters create pressure with a high cognitive load, which incentives problematic cybersecurity behavior by humans. These factors combined can potentially even create a disaster within a disaster. In the heat of a response saving lives could be deemed more important than compliance, jeopardizing valuable information or systems. Disasters create pressure, which incentives problematic cybersecurity behavior by humans. To solve this, systems can be made very strict, but this comes at a cost of flexibility during a disaster. This inflexibility can be problematic for the ability to deal with large multidisciplinary crises like COVID-19. Flexibility is needed for future uncertain and unknown situations.

This dilemma between compliance and pressure is the focus of this paper. The fol-
lowing research questions are answered by this study: ‘What are key characteristics of
disasters and how do these characteristics influence behavior?’, ‘When do people start
to show non-compliant behavior with their organizations cyber policy?’ and ‘What var-
iables contribute to this non-compliance behavior?’. By examining the influences on
compliance rates, cybersecurity in natural disasters can improve. The paper will focus
on human behavior, which will show what the actual cyber risks are and provide im-
portant mitigation starting points.
# 2 Theoretical background

## 2.1 Data security

To measure data security, information security practitioners turn to the CIA triad. The triad consists of the terms confidentiality, integrity and availability [2,4]. The definitions of the CIA triad are the following:

1. Unauthorized information release. An unauthorized person can read and take advantage of stored information. Unauthorized access also extends to the unauthorized usage of programs. This access to information has become the notion of confidentiality. Confidentiality refers to the preservation of authorized information access and disclosure restrictions, including means for protecting personal privacy and proprietary information.

2. Unauthorized information modification. An unauthorized person can make changes to the information that is stored. This improper information modification or destruction has become the notion of Integrity.

3. Unauthorized denial of use. An intruder can prevent a user from referring to or modifying information, becoming the notion of availability. Availability entails ensuring timely and reliable access to and the use of information.

The CIA triad provides a basic framework to establish insecure behavior. This means that in the context of the rest of the study, insecure behavior refers to a breach in confidentiality, integrity, or availability.

## 2.2 Compliance

But what have factors like timeliness, accessibility, load, and coordination have to do with compliance rates? In a cybersecurity context, employees tend to be influenced by the perceived costs of being compliant. These are 'costs', for example, in terms of investing extra time and effort. According to the Rational Choice Theory (RCT) employees who view compliant behavior as too costly tend to be non-compliance [5]. This is strengthened by an individual's reaction to threats. If threat appraisal by individual results in a low sense of severity and vulnerability, the individual will be inclined not to follow the policy. Weighing the perceived severity of non-compliant behavior against the 'ease of use', the Protection Motivation Theory (PMT) and Theory of Planned Behavior (TPB) state that if an employee perceives the ability to complete the security task, enjoys a positive attitude towards the security task and observes other people also actively performing the task, the employee will be likely to comply and thus can result in actual compliance [6,7]. What does this mean in a disaster context? There is little thought of cybersecurity measures, because of the costs in time or inflexibility. Think of databases in Excel that are sent to responders but can be uncontrollably forwarded to other people. Sharing information may be beneficial to the relief effort, but a possible breach of confidentiality or integrity may pose problems. Situations were cybersecurity
protocols dramatically decrease the usability through for example time costs, will trigger non-compliant behavior by the individuals interacting with the systems. The same protocols meant for security, could make an application through displayed behavior by individuals more insecure.

So, if these costs are too high, it will lead to shadow security. Shadow security can be seen as employees not complying with prescribed policies but create a more suitable alternative to the policies suggested by the organization's official security functions [8]. There are two ineffective scenarios of cyber security: 'It is impossible to comply with the set policy and get the work done' and 'current policies are irrelevant and burdensome' [9]. Both scenarios have these elements of burdensome security implementations. Perceptions of disproportionate impact upon the ability to proceed led employees to procure their own less demanding and disruptive solutions to support (in what the employees perceived as more proportionate) security behavior. There are four forms of security burdens [9]:

* Time. Time-related problems occurred in situations where employees followed the prescribed security behavior (which resulted in slower completion).

* Lack of adaptability. A lack of adaptability in IT systems to account for the changing organizational conditions. This lack of adaptability creates disruptive problems, for example, employees that did not have timely access to information necessary for their role.

* Increased cognitive load. Employees devised their own security mechanisms when the organization's password policy caused excessive cognitive load for the employees. Many felt the need to physically write down the passwords, especially for the system's accounts that rarely were used. There are five password management behaviors: (1) choosing a password for the first time, (2) changing a password, (3) letting someone else use your password, (4) taping passwords next to the computer and (5) sharing passwords with family, friends, or co-workers [10]. While the first two behaviors are neutral, the subsequent three are negative actions. One reason is that memorizing randomized and temporary passwords are problematic and inconvenient for employees [11]. The perceived inconvenience prompts workarounds like simpler passwords and writing passwords down.

* Disruption. Security restrictions could lead to situations wherein security mechanisms were blocking the tasks that needed to be done.

However, coordination can also cause disruption. As already seen in the previous section, natural disasters will involve multiple parties providing aid. Data sharing can be vital, but any organization that shares and manages the shared data must comply to one set of rules. To have every organization on the same page can be very difficult. When comparing EU, NATO, and national cybersecurity strategies, countries have different amounts of principles and there was not one single match between national policy and the EU or NATO cyber strategies [12]. This again can lead to shadow security. If co-operation between multiple parties is needed, clashes in policy can cause an impossibility for employees to comply. Employees will then make their 'own policy', caused
by a lack of adaptability or disruption [9]. Translating this to natural disasters, organi-
zations may not be allowed to share crucial information with each other or are going to
be non-compliant, sharing the information in an insecure manner anyway to provide
aid. Furthermore, poor intergroup coordination and communication can be problematic
as well. This happens when high-level managers and low-level employees do not un-
derstand how one's behavior may influence the other [13]. Think of systems that require
online connections, but the location where responders work doesn't have any internet
access. This understanding of influencing behavior may lead to high-level managers
not understanding the practical implications of specific policies, which can lead to
shadow security practices.

2.3 Crisis Management

As already stated, information is crucial to combat disasters effectively. Without accu-
rate and timely information, aid might be targeting the wrong areas, providing the
wrong items, and being delayed [14]. Therefore, systems have functional requirements
that describe their functions needed during natural disasters. These requirements consist
of the following [15]:

* Relevance: the degree to which information matches the actors' intended use

* Timeliness: the degree to which received information is up to date

* Accessibility: the degree to which information is provided so that it easily can be used by the actor (this includes interoperability)

* Reliability: the degree to which the actor justifies information

* Verifiability: the degree to which there are the means to verify the information by the actor

* Load: the degree of cognitive load associated with the information

These requirements overlap with the earlier mentioned security burdens. Time and cog-
nitive load are linked directly. Lack of adaptability and accessibility result in disruption,
therefore these can be considered as disruption.

The coordination of humanitarian organizations is characterized by fragmenta-
tion. The inter-organizational differences in systems or standards strengthen this dis-
connect, which can hamper coordination and planning [16]. These differences could
give way to the spontaneous and unstructured setup of coordination structures driven
by individual leadership rather than organizational mandates and norms [17]. Own set-
ups in a cyber context could lead to policy violations. This phenomenon has overlap
with poor intergroup coordination and communication [13]. The deviation from organ-
ization mandates and norms can point to high-level managers and low-level employees
do not understand how one's behavior may influence the other. There may not be an
understanding of the practical implications of specific policies, which can lead to
shadow security practices.

Furthermore, many different teams and parties are working together during dis-
asters [15,16]. It is highly likely that there are differences in policies and standards in
cybersecurity policy that can lead to shadow security.
# 3 Research method

This paper uses a qualitative methodology to explore what variables are relevant and what relationships do exist. The data should provide more information on the dilemma that is created due to the pressure. How do participants behave? What variables influence the decision-making of the participants? To apply this pressure a serious game was used. The serious game helps to mimic the environment of a natural disaster and aims to see when participants stop complying with the policy [18]. Decision-making in disaster risk management is not always a smooth or rational process but can be very dynamic and complex. Stakeholders have different interests, responsibilities, and opinions on managing the crisis. High-stress levels, uncertainty, time pressure, coordination and communication problems influence the decision-making process to make it even more complex [18]. The gamification in the serious game will enable the pressure, in the form of the earlier mentioned variables in the literature, on participants and help better understand the ‘performance’ of individuals’ behavior. Comparing this to surveys, interviews or focus groups, the unique characteristic of serious games is addressing the complexity between a technical and physical environment (f.e. interactions between systems and the results) and the social-political complexity (the interactions between the various stakeholders) [19]. The participants are able to interact with these different complexities. Within the game setting, participants can explore behavior without real-life consequences. These games or simulations offer rule-biding, which limits the options participants have and makes the game playable. An option can be created by the allocated time or specific allocated paths, making it easy for serious games and simulations to mirror critical characteristics of a specific disaster [20]. The serious game can mirror concepts like time, cognitive load, disruption, and coordination. The serious game is a viable method for cases where socially desirable answers are likely [21] and looking at people’s behavior.

## 3.1 Target audience

For the target audience, there are some specifics. One group will consist of people who experience high-stress levels in their jobs, to mimic actual responders. Think of firefighters, police, and ambulance personnel. The same study was conducted with ‘non-responders’ to see if professionals trained in these crises make different choices than regular non-trained people. People with an IT background were ruled out of the study because of their possible expertise with the subject. For people who work on IT subjects, their prior knowledge will likely influence daily. The game scenario is designed so that both groups find it recognizable. The responders were targeted by using both a judgement and snowball sampling method. The first group was chosen based on their experience. Afterwards, the responders were asked to share this with colleagues. Furthermore, the non-responders were targeted via convenience sampling.
## 3.2 Design

There are two versions of the same game: one with the variables time stress, high cognitive load, disruption, and coordination and one without these variables. The first version will mimic the manipulation of the variables. For this study, a between-subjects design was used. Participants were randomly assigned to either the control group or the treatment group. After the participants were done with the game, a questionnaire was prompted to ask the participants' reasons. The questions in the questionnaire will link back to the answer that participants provided.

Although the situations are fictional, all are based on real-life examples, the literature review or situations discussed in the expert interviews. Third parties are not mentioned by country or name to prevent biases towards the country or name from influencing the game's outcomes. The following will be a brief rundown of the game with the reasoning behind the situations. Before starting the game, participants will be asked if they frequently work with stressful situations, like emergencies. Every 'yes' response will be directed to the treatment group. Every 'no' response will then be randomly directed to either the treatment or control group. The software ensures an even distribution of 'non-stress' participants between the treatment and control groups. The game starts with a prompt that a giant tsunami has hit a fictional island and that it is the participant's task to alleviate the suffering and save lives. The experts during the interviews stated that awareness and preparation could be used to mitigate the effects of time pressure, cognitive load, and disruption. The control group will receive additional information to mimic an awareness training or to reduce the complexity of the dilemma due to the mimicked better preparation. Every scenario has two options resembling compliance and non-compliance. A potential breach of confidentiality, integrity or availability will be seen as non-compliant behavior. The order of these answers is also randomized.

### Dilemmas presented in the serious game

Dilemma one deals with the potential flooding of dikes, based on the Europe floods of July 2021 [22]. This situation deals with time and disruption (as well as coordination). A foreign officer offers to fortify the dykes and asks for access to the control systems. However, the control group is alerted to the fact that it is unknown if the officer can be trusted and if given access, there is a risk that the officer, in a later stage, floods the country by opening the dikes.

Dilemma two deals with a junior responder who wants to access information through the participants' accounts. The notion of sharing accounts is based on an expert story of sharing printer access through one account. The responder needs the data now, or she cannot operate. This scenario resembles the time pressure and disruptive effects. The control group will be told that account sharing could lead to hacks, data modification or theft under their name.

Dilemma three applies a cognitive load on the participant. The treatment group will be given a complex randomized password, while the control group will receive a passphrase, which is easier to remember. This scenario is based that people have cognitive difficulty remembering complex passwords. Furthermore, an expert stated that passphrases should be used to make passwords easier to remember.
Dilemma four resembles a disruptive effect through coordination. The experts were asked the same question. The lack of cyber policy in the humanitarian sector and security culture differences were discussed during the interviews. This information formed the basis for this scenario where participants had to decide if data would be shared with an NGO with a low cyber policy.

One of the experts mentioned sleeping, dining, bathroom problems, and fatigue in the interviews. The expert also talked about situations where data is quickly shared by email without thinking of repercussions in confidentiality. The fifth dilemma is created based on this cognitive load. The participant will be told that there are a lot of different data sources and that the participant is fatigued. A responder needs data and offers to help by just emailing it. The control group is notified that this will cause a confidentiality breach.

The last dilemma is based on operating in conflict territories, like Ukraine and working with ISIS. The local authorities want to have all information on a displaced minority. The control group will be told that the data contains incriminating information on the minority and that the local authority is against this minority.

## 3.3 Pre-test

The pre-test was conducted with six people. Each tester played the game multiple times. In total, the game was played 16 times. The test showed that the logical flow of the game was broken with some questions. For example, the participant received both behavioral questions of question 5, while they should only receive the one that belongs to the chosen answer. This logic error is fixed in the final build of the serious game. Furthermore, the behavioral questions in the pre-test only asked why a participant chose a specific answer. However, this resulted in answers unrelated to the variables used, like time pressure. The updated behavioral questions had two questions per answer: Why did a participant select a particular answer and did the treatment variables affect the decision? The testers also found some grammatical errors, which were corrected in the final version. The answers originally contained progression points, which resemble a specific number of saved lives by performing that specific action. The testers felt that there were real dilemmas in each scenario. The testers also reported a noticeable difference between the treatment and control scenarios, reporting that the control scenarios were easier to answer due to the training and preparation ques. The progression points made the decision-making harder for the participants. However, there was a fear that participants would select answers based on the higher amount of progression points. Therefore, the decision was made to remove the progression points within the answers.

## 3.4 Expert interview process

To validate the findings from the literature review and serious game, a panel of experts was interviewed. These interviews helped to understand if the literature findings were plausible in the context of natural disasters while also providing more context concerning the variables. The experts were selected based on their knowledge of cybersecurity, disaster management or both. Cybersecurity experts needed to be at least five years
active in cybersecurity, with links to societal projects. These include governmental, humanitarian, or military projects. The experts with a disaster management background should have been involved in two disaster responses (from 2010 onwards). IT professionals in the humanitarian field should have a clear link to cybersecurity (for example, writing papers on the topic). One recent or one current disaster response will be a minimum to qualify for the expert interviews of this study. Table 1 shows an overview of all the interviewed experts for this study.

<table><caption>**Table 1.** Overview interviewed experts</caption><thead><tr><td>Expert</td><td>Job function</td><td>Experience</td></tr></thead><tbody><tr><td>E1</td><td>Researcher and lecturer at a Dutch university</td><td>Cybersecurity lecturer with a background in IT audit (> 5 years in current role at this Dutch university) and conducted several studies on governmental IT-projects</td></tr><tr><td>E2</td><td>Digital Services, Information Management Branch at UN OCHA</td><td>Former Information Management Officer of UN OCHA. Former deployments to Haiti earthquake, Nepal earthquake of Philippines floods. Involved in the writing of papers dealing with cybersecurity in the humanitarian sector</td></tr><tr><td>E3</td><td>Disaster Management Consultant</td><td>Twenty-five years of experience in the development and humanitarian sector. Most of this time as a former UN staffer. Nowadays, predominantly working with UN agencies in evaluations, training, and capacity strengthening of national NGOs.</td></tr><tr><td>E4</td><td>COO at cybersecurity NGO for the humanitarian sector</td><td>Cybersecurity Department of the French government (cyber crisis simulations and bilateral relations). Cyber response activities for European cybersecurity agency and World Economic Forum.</td></tr><tr><td>E5</td><td>Head cybersecurity at NATO Support and Procurement Agency</td><td>Organization and security guidance for humanitarian or military flights. Former cybersecurity of Supreme Headquarters Allied Powers Europe (NATO)</td></tr></tbody></table>

The interview process was conducted five times. Because the qualitative methodology is used to explore variables and relationships, a semi-structured approach was used to ask the questions in a structured manner to validate the literature findings. In addition, the semi-structured approach enabled flexibility so that if statements were made, the expert could elaborate more on this statement. After each interview, the process was stopped, and the transcript was reviewed. If needed, the question sheet was altered to provide additional questions concerning the expert's expertise (f.e. additional questions concerning disaster responses or military behavior) or to switch the order of questions.
All questions dealing with conceptual model validation were asked in every interview. After the last interview, a saturation point was reached due to the similar answers by the experts. Furthermore, the literature suggests that five to fifteen interviews can reach saturation points [23]. Moreover, these types of cyber specialists in the humanitarian sector are hard to find. An explanation for this could be that cybersecurity is relatively novel in the humanitarian sector, as stated by one of the interviewees. The interviews were conducted either in person or via Zoom.

# 4 Results

There were 82 respondents in total for the game. It was decided to make three even groups of 20 respondents to compare all three groups with each other. Responses with missing or low-quality answers to the questions were deleted to get to 20 per group. However, close attention was paid to the differences between the groups to prevent influencing the results. The three groups are referred to as T1: No Stress (Treatment group 1 with no stressful jobs), T2: Stress (Treatment group 2 with stressful jobs) and C1: Control (the control group). Respondents found the game 'difficult to solve' since its participants had to make a choice that felt wrong (in terms of cybersecurity) but was necessary to save the lives. According to the respondents the game provided them with a real dilemma from time to time. All results can be found in table 2 on page 12.

**Dilemma one.** The participants received information about an officer of a foreign army who requested access to the control systems of the dykes to help fortify these dykes. The stress group (18) and no stress group (17) choose the non-compliance option and possibly breach integrity or availability notions. The most important reason for people to give the officer access to the system was that lives were hanging in the balance, so the response had to be quick, and the foreign army otherwise could not help. The participants confirmed that time and disruption greatly influenced the decision-making. As seen in table 2, the control group mostly opted for the option of non-compliance. The participants mentioned an important reason: Trust. Because an officer asks for the controls, the participants deem this officer trustworthy—more on this in chapter 5 discussion.

**Dilemma two.** A junior responder asked to borrow the participants' accounts to receive the data for the search and rescue grids. The no-stress group had an even split in non-compliance and compliance. The main reason for non-compliance was to save lives quickly because of the time pressure. Non-compliant behaviour resulted in a breach of confidentiality. Participants also noted that time pressure and disruption would be reasons to give the responder access. The stress group is with 14 answers more in favour of compliance. According to the participants, the responders' supervisor should resolve the authorisation problem. In the control group, 13 participants choose compliance. Although there is a compliance shift compared to the no-stress treatment group, this difference is insignificant (sig. = 0.400).
**Dilemma three.** Respondents were asked if they would remember the password or write it down. The treatment groups received complex randomized passwords, while the control group received a passphrase. The no stress and stress treatment group had 19 and 17 participants who selected non-compliance, causing confidentiality and integrity concerns. The main reason was that people found the password too tricky to remember. The control group, however, had 17 participants choosing the compliance option. The reasoning behind this choice was that the password was easy to remember. There is a significant (sig. < 0.001) difference between the groups.

**Dilemma 4.** Participants received the same question as the experts did. The participants belong to an organization with high cybersecurity standards, while the approaching NGO has low cybersecurity standards. Table 2 shows that no stress and stress have similar results. Of the participants, 14 choose to comply with the policy and not give the NGO access. *'The NGO is not suited to handle the data securely and is in conflict with the culture of the own organization'* was one of the primary reasons participants complied with the policy. Within the control group, 18 participants choose the option of compliance. After comparing these numbers and running the tests, the results were that these were not significant differences (sig. = 0.225).

**Dilemma five.** The participants were confronted with a high cognitive load due to simulated information overload and fatigue. Within the no stress group, seven participants were non-compliant, and 13 were compliant. This result is different from the stress group, where 16 participants were compliant and four non-compliant. The provided non-compliant participants stated that the time pressure of saving lives and the information load influenced the decision. The control group had similar results in comparison to the stress treatment group. In the compliance group, participants noted that when people are tired, the possibility for mistakes is higher. Also, participants assumed that the data was confidential.

**Dilemma six.** Participants were asked if the participants were inclined to share data about a minority group with the local authorities in order for the local authorities to speed up the process of returning the minority group to home. Table 2 shows that the no-stress treatment group mostly choose to share the data and be non-compliant. 16 of the 20 participants choose this option. The main reason for the participants was that otherwise, the local government was not able to help, and in this way, the process would go a lot faster. There was a little shift compared to the stress group, where 13 participants chose non-compliance. In the control group, 12 participants chose compliance and not to share any data with the local authorities. This difference between the treatment and control groups is significant (sig. = 0.032) and shows how different behavior can impact the confidentiality of data.
<table><caption>Table 2. Results serious game</caption><thead><tr><th></th><th>Non-compliance</th><th>Compliance</th><th>Non-compliance</th><th>Compliance</th><th>Non-compliance</th><th>Compliance</th><th>Non-compliance</th><th>Compliance</th><th>Non-compliance</th><th>Compliance</th><th>Non-compliance</th><th>Compliance</th><th>Non-compliance</th><th>Compliance</th></tr></thead><tbody><tr><td>T1</td><td>17</td><td>3</td><td>10</td><td>10</td><td>19</td><td>1</td><td>6</td><td>14</td><td>7</td><td>13</td><td>16</td><td>4</td></tr><tr><td>T2</td><td>18</td><td>2</td><td>6</td><td>14</td><td>17</td><td>3</td><td>6</td><td>14</td><td>4</td><td>16</td><td>13</td><td>7</td></tr><tr><td>C1</td><td>16</td><td>4</td><td>7</td><td>13</td><td>3</td><td>17</td><td>2</td><td>18</td><td>4</td><td>16</td><td>8</td><td>12</td></tr></tbody></table>
# 5 Discussion

## 5.1 Dilemmas

This study aimed to find the variables that influence compliance rates of cyber policies. It is important to understand what contributes to insecure cyber behavior to resolve it successfully. Throughout the game, it became apparent that people took shortcuts to save lives. When lives are at stake, people take shortcuts or use alternative approaches to save these lives. In the first question, participants were willing to give an officer of a foreign army access to the control systems of the dykes. The main reason for this was the immediate time pressure to save lives and the fact that the foreign army could not help otherwise. In other words, disruption. The same goes for the last question, where participants were asked to share data about a minority with local authorities. Under time pressure and disruption, the treatment group shared the data with the local authorities because of this time pressure or disruptive effects. This is in line with the conducted expert interviews, which all stated that time pressure and disruptive effects could have a negative impact on compliance rates. Cognitive load influenced respondents to write down passwords and experts stated that mental fatigue can be problematic for compliance.

## 5.2 Culture

With technology becoming so important, it is time to take cybersecurity seriously. Fire-fighters are trained to use their equipment safely. Medical personnel will operate with an eye for hygiene and safety for their own health. It is time to teach responders the right hygiene and safety protocols for the systems that help during disaster responses. Instead of considering humans as the biggest threat, it is necessary to make them our biggest resources. Responders should be educated, which enables them to operate on 'auto-pilot' and recognize risks. Cyber awareness training is not the silver bullet in cyber defense as sometimes thought. The game showed that the intent to save life can take priority over data security. Awareness is useful for understanding but will not solve all our problems. Furthermore, we should reconsider our way of designing systems. It is often implied that more security causes less efficiency, that there is a trade-off. Cybersecurity professionals should work together with responders to design systems in a way that a system is secure and efficient. Tight systems may increase security but will hinder crisis responses or incentivize shadow security which places cyber vulnerabilities in our blind spot. Solutions also must be flexible and adaptable. Preparing for multiple scenarios for information sharing could help in the operational context of a disaster which can be different by the day. Besides a changing crisis context, the world of IT changes as well. Over time new systems and tools arise. As well as cooperation with different partners, which means different systems and different policies. Removing the responsibility from individual responders will make systems less flexible. Individual decision-making helps in complex situations but may open the door the cyber threats if training is done incorrectly. Using technology as a tool in disaster responses should be
done responsibly with the right competences and skills for the users. In this way, user-
centric systems can be created with all the possible scenarios in mind.

5.3 Serious game

The serious game itself also helped the participants to understand more about the cy-
bersecurity problem at hand. Participants found the dilemmas ‘difficult to answer’ and
felt that they had ‘to do something of which you knew it was not right (in terms of
cybersecurity) but had to in order to save lives’. The participants started to think about
the dilemmas and their possible solutions to the problem. A serious game can be a great
starting point to create more awareness on the topic and help start a conservation about
it. As confirmed by the experts, running through these scenarios also will help recog-
nize problems in cyber policy and enable to find suitable solutions.

6 Conclusion

The serious game itself will function as a method for detecting behavioral problems concerning compliance. The serious game also helps create a discussion about the topic and scenarios at hand. We must be aware of the dependence on technology in our most vulnerable moments and be aware of our responsibilities to prevent it.

This study added cyber risks to the literature. Cyber risks are often looked at from a
technical point of view, but this study adds to the human side of cyber risks. It shows
what situations like natural disasters can do to compliance rates. Besides the influences
of time, cognitive load and disruption, the notion of coordination was reasonably unex-
plored. This study managed to bridge the gap and showed how these variables influence
data security through compliance. Besides the earlier-mentioned variables, the study
also managed to identify another interesting variable that can influence compliance:
Trust. This contribution can be a great starting point for further academic research into
this topic.

We see more technology possibilities emerge. Our organizations, societies and tech-
nologies become more intertwined and mutually dependent, and we see the emergence
of risks and vulnerabilities in our societies, it is an important subject to consider. Not
just for (formal) emergency responders, but for any organizations, community or
agency who may find themselves in a complex emergency situation (and we increas-
ingly see this: floods, COVID-19, Ukraine)

Above all, this study functions as a call to action. It makes clear that organizations
might have to rethink how their security protocols are designed. Current protocols could
lead to shadow security and be a burden to many responders in the field.

## 6.1 Limitations and future research

The study contains limitations because of the decision-making in the execution of
this study. The serious game contained a question concerning cognitive load. However,
it appears that cognitive load was not triggered correctly. There is a good reason for this. The question deals with sleep deprivation and information overload. However, participants could play the game from the comfort of their own homes. This comfort situation most likely did not prime the treatment of cognitive load enough for the participants to feel the pressure. Trust also influences participants' cost perception in the first question, neutralizing the 'awareness training' provided. Trust also was found in the last question. The lack of trust was the primary reason for compliance. Besides, cognitive load and trust, it is likely that there are more violations of cyber policy in real-life cases. People are not consciously thinking of compliance. People are thinking about the time pressure, disruption, the saving of lives and other things. A real-life test or real-life observation could help unveil more employee behaviors. Therefore, further research in a real-life setting should provide more information on cognitive load, trust, and other possible variables.

Another limitation of this study is the point of view of the experts. Mainly the cybersecurity point of view from a humanitarian organization. As seen in the study, there are more stakeholders. It could be interesting to explore that same problem from a policymaker's or citizens point of view. Policymakers have different objectives and spending money on possible futures can be hard to justify, while regular citizens deal differently with cybersecurity during disasters. Further research needs to be conducted to gain more information on different perspectives.

Lastly, future research could be conducted into the effectiveness of mentioned mitigation methods. For example, how much influence does awareness have when people are under time pressure? Or what kind of an effect does training have? One of the experts mentioned that lack of time for training was an issue. So further research could investigate the most effective ways of training.

# 7 References

1. Hakak, S., Khan, W., Imran, M., & Choo, K.: Have you been a victim of COVID-19-related cyber incidents? Survey, taxonomy and mitigation strategies. IEEE Access, 8, 124-134-124144 (2020).

2. Samonas, S., & Coss, D.: The CIA strikes back: Redefining confidentiality, integrity and availability in security. *Journal of Information System Security, 10*(3) (2014).

3. IBM.: *Cyber Security Intelligence Index*. Retrieved from IBM security services: https://i.crn.com/sites/default/files/ckfinderimages/userfiles/images/crn/custom/IBMSecurty Services2014.PDF (2014).

4. Anderson, J.: Computer security technology planning study (1972).

5. Khatib, R., & Barki, H.: How different rewards tend to influence employee non-compliance with information security policies. *Information & Computer Security* (2021).

6. Vance, A., Siponen, M., & Pahnila, S.: Motivating IS security compliance: insights from habit and protection motivation theory. *Information & Management, 49*(3-4), 190-198 (2012)
7. Pham, H., Brennan, L., & Richardson, J.: Review of behavioural theories in security com-
pliance and research challenge. *Informating Science and Information Technology Education Conference*, 65-76 (2017).

8. Ertan, A., Crossland, G., Health, C., Denny, D., & Jensen, R.: Everyday Cyber Security in Organisations (2020).

9. Kirlappos, I., Parkin, S., & Sasse, M.: Learning from "Shadow Security": Why understand-
ing non-compliance provides the basis for effective security (2014).

10. Tam, L., Glassman, M., & Vandenwauver, M.: The psychology of password management: a tradeoff between security and convenience. *Behaviour & Information Technology*, 29(3), pp. 233-244 (2010).

11. Tari, F., Ozok, A., & Holden, S.: A comparison of perceived and real shoulder-surfing risks between alphanumeric and graphical passwords. In *Proceedings of the second symposium on Usable privacy and security* (pp. 56-66). ACM (2006).

12. Stibilis, D., Pakutinskas, P., & Malinauskaitė, I.: EU and NATO cybersecurity strategies and national cyber security strategies: a comparative analysis. *Security Journal*, 30(4), 1151-1168 (2017).

13. Albrechtsen, E., & Hovden, J.: The information security digital divide between information security managers and users. *Computers & Security*, 28(6), pp. 476-490 (2009).

14. Van de Walle, B., & Turoff, M.: Emergency Response Information Systems: Emerging Trends and Technologies. *Communications of the ACM*, 50(3), 29-31 (2007).

15. Nespeca, V., Comes, T., Meesters, K., & Brazier, T.: Towards coordinated self-organization: An actor-centered framework for the design of disaster management information systems. *International Journal of Disaster Risk Reduction*, 51 (2020).

16. Comes, T., Van de Walle, B., & Van Wassenhove, L.: The Coordination-Information Bubble in Humanitarian Response: Theoretical Foundations and Empirical Investigations. *Production and Operations Management*, 29(11), 2484-2507 (2020).

17. Darcy, J., Stobaugh, H., Walker, P., & Maxwell, D.: The use of evidence in humanitarian decision making. *ACAPS Operational Learning Paper* (2013).

18. Solinska-Nowak, A., Magnuszewski, P., Curl, M., French, A., Keating, A., Mochizuki, J., . . . Jarzabek, L.: An overview of serious games for disaster risk management - prospects and limitations for informing actions to arrest increasing risk. *International Journal of Disaster Risk Reduction* (31), 1013-1029 (2018).

19. Mayer, I.: The gaming of policy and the politics of gaming: A review. *Simulation & Gaming*, 40(6), 825-862 (2009).

20. Meesters, K., Olthof, I., & Van de Walle, B.: Disaster in my Backyard: a serious game to improve community disaster resilience. *Proceedings of the European Conference on Games Based Learning*, 2, pp. 714-722 (2014).

21. Grimm, P.: Social desirability bias. Wiley international encyclopedia of marketing (2010).

22. United Nations.: 2021 floods: UN researchers aim to better prepare for climate risks. Retrieved from unric: https://unric.org/en/2021-floods-un-researchers-aim-to-better-prepare-for-climate-risks/ (2022)

23. Hennink, M., Kaiser, B., & Marconi, V.: Code saturation versus meaning saturation: how many interviews are enough? *Qualitative health research*, 27(4), 591-608 (2017).