# Get to Know Your Geek: Towards a Sociological Understanding of Incentives Developing Privacy-Friendly Free and Open Source Software

Oğuz Özgür Karadeniz, Stefan Schiffner

► To cite this version:

Oğuz Özgür Karadeniz, Stefan Schiffner. Get to Know Your Geek: Towards a Sociological Understanding of Incentives Developing Privacy-Friendly Free and Open Source Software. 14th IFIP International Summer School on Privacy and Identity Management (Privacy and Identity), Aug 2019, Windisch, Switzerland. pp.177-189, 10.1007/978-3-030-42504-3_12. hal-03378966

HAL Id: hal-03378966

https://inria.hal.science/hal-03378966

Submitted on 14 Oct 2021

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Get to Know Your Geek: Towards a Sociological Understanding of Incentives Developing Privacy-Friendly Free and Open Source Software

Oğuz Özgür Karadeniz<fnref n="1" /> and Stefan Schiffner<fnref n="2" />

**Abstract.** In this paper we sketch a road map towards a sociological understanding of software developers' motivations to implement privacy features. Although there are a number of studies concerning incentives for developers, these accounts make little contribution to a comprehensive sociological understanding, as they are either based on a simplistic view of FOSS development in terms of altruism vs. utilitarianism, or are focused on individual psychological factors, leaving room for research that takes into account the complex social context of FOSS development. To address this gap, we propose a mixed methods approach, incorporating the strengths of qualitative and quantitative techniques for a comprehensive understanding of FOSS development as a social field. We then sketch how we envision developing a game theoretic approach based on the gathered data to analyze the situation in the field with respect to privacy features and propose relevant changes in policy and best practices.

## 1 Introduction

*Motivation.* The GDPR [1], and the European Commission's Ethics Guidelines for Trustworthy AI [2] indicate the importance of data privacy in contemporary society. With GDPR, developers are now legally obliged to implement Privacy by Design (PbD), or in the lingua of the legal text, data protection by design, in their development process. However, privacy breaches continue to occur, despite policy initiatives and guidelines that legally incentivize or nudge developers towards privacy-friendly features. In fact, as pointed out by ENISA's threat landscape [3], threats continue to rise as the landscape becomes more and more complex.

Moreover, as pointed in the Ethics Guidelines for Trustworthy AI [2], legal compliance, e.g. with the GDPR, does not guarantee that a system meets any ethical standards. In order to meet privacy standards, software developers need to move beyond checklist compliance towards a continuous critical approach concerning the product/service and its social impact. Hence software developers need to continually prioritize and reassess the implementation of secure features, rather than a superficial compliance to law.

<footnote n="1">¹ KU Leuven, Leuven Belgium</footnote>

<footnote>oguzozgur.karadeniz@student.kuleuven.be</footnote>

<footnote n="2">² Université du Luxembourg, Esch sur Alzette, Luxembourg</footnote>

<footnote>Stefan.Schiffner@uni.lu</footnote>
In this paper, we seek to pave the way for a better sociological understanding of software developers' motivations when taking implementation decisions for privacy-friendly and secure software. In order to reduce direct monetary and other external motives, we focus on free and open source software development (FOSS). In the first part of the paper, we present a literature review indicating the lack and importance of a sociological understanding of this issue. Following this, we offer a methodological approach based on mixed methods, which is not only appropriate for gaining a better understanding of FOSS developers' motives, but also for bringing about positive social transformation.

*Background.* FOSS development represents an immense contribution to technology and, through this, to society. Open source software has often contributed to more secure and privacy-friendly software either as its main goal, such as the development of PGP<fnref n="3" /> for email encryption and Tor<fnref n="4" /> for anonymity protection, or by setting high standards, such as the Linux kernel<fnref n="5" />, and the Firefox web browser<fnref n="6" />. Some open source software has been developed and maintained for decades, and has thus become a practical alternative for commercial products. At other times the contribution has been more indirect, as in cases where the success of certain superior aspects of open source products led to improvements in the same direction in closed source competitors, such as end-to-end encryption for messenger apps.

Many open source licensing models allow commercial applications to make use of them. This is arguably a double-edged sword, since it adds a potential layer of vulnerability to every service that uses them. As code is open to the public in FOSS projects, it is easier to find vulnerabilities, but due to their dependence on voluntary contributions, maintenance is often more difficult, potentially exposing applications and services that use them. On the other hand, FOSS developers also have the potential to facilitate the development of privacy-friendly and secure software, such as programs to identify vulnerabilities and assess risks[4], or by setting high standards as mentioned above. Finally, open source software usually comes with ‘no warranty’ despite popular belief in their superiority in this respect, which can be erroneous at times [5, 6]. This puts FOSS in a very critical role in terms of privacy and security, since, although it represents a very important contribution and potential improvement, its perceived security can be misleading given the reluctance among developers [7, 8] to implement PbD.

*Our contribution.* In this paper, we argue that in order to bring about social transformation with regards to the production of privacy-friendly and secure software and services, a more formal model of the motivations of FOSS developers is necessary. We detail the steps towards a model that allows for a better sociological understanding of the issue, which can be used to render advice for

<footnote n="3">³ https://www.openpgp.org</footnote>

<footnote n="4">⁴ https://www.torproject.org</footnote>

<footnote n="5">⁵ https://www.kernel.org</footnote>

<footnote n="6">⁶ https://www.mozilla.org/</footnote>
policy changes. Firstly, we point to the areas where legal incentives fell short of preventing breaches or the development of needlessly privacy invasive services. Secondly, we present the literature on developer motivations to highlight the need for a sociological understanding of the motivations of FOSS developers. We will then offer our own methodological approach for a sociological inquiry into this problem based on mixed methods, combining the strengths of different quantitative and qualitative techniques for a more comprehensive view of the cultural context being investigated [9]. Following this, we describe how game theory can be used to construct a model that draws from the findings of a sociological research into this field. Finally, we offer a thought experiment that illustrates our approach.

## 2 Related Work

*FOSS Development and Developer Motivation.* In his seminal work “The Cathedral and the Bazaar”[10], Eric Raymond compares the FOSS development scene to a crowded bazaar where individuals with multiple underlying agendas interact. According to him, the gift culture that characterizes the motivations of FOSS developers is ultimately self-interested rather than altruistic. Despite competition and the self-interest of the participants, FOSS development culture results in a harmonious system and better and more secure software than commercial development [11, 10]. Raymond’s work can be considered as a step towards an understanding of FOSS as a social field with its own relatively autonomous dynamics, as it identifies motivations and goals in FOSS development other than altruism, such as recognition and gaining rank within the community. However, as Lin argues, Raymond’s account is a long way from capturing the diversity of the field that it acknowledges or addressing how individual efforts can work harmoniously to develop sophisticated software within this complexity [11].

Raymond’s work had a tremendous influence on academic and popular courses on FOSS. The work led to the popular belief that open source is in many ways superior to commercial, epitomized by the phrase “Given enough eyeballs, all bugs are shallow”, commonly attributed to Linus Torvalds [6]. Coining the term “vulgar Raymondism”, Nikolai Bzrukov severely criticizes this idealization for ignoring many problematic aspects of FOSS development ranging from developer burnout, hyper-inflated egos among developers and disagreements within the community [6, 12].

With the influence of Raymond’s work, many researchers in the field tried to situate motivations and incentives in the field in terms of self-interest and altruism. For example, Lerner and Tirole [13, 14] formulate motivations underlying contribution to open source in terms of career advancement and reputation. According to them, contribution to open source is connected with an expectation of delayed return in career and economic terms due to gain in reputation and an associated ego boost. Bonaccorsi and Cristina also mention a combination of altruistic or self-interested motives, but they also find that these motivations differ between firms and individuals. According to their survey, individual program-
mers have a tendency to have social and altruistic motives, such as contribution to the movement and belief in non-proprietary code [15]. Others such as Hars and Ou, and Roberts et al. differentiate between intrinsic and extrinsic motivations, as they associate intrinsic motivations with societal contribution and extrinsic motivations with economic and reputational gains [16–18].

While the research Raymond’s work inspired sought to shed more light on motivations to participate in open source, research focusing on motivations in implementations of PbD features is more sparse. More recent work by Spiekermann[8] and Bednar et al.[7] further indicate the need for research and intervention in the field by documenting the reluctance to implement PbD. Using both qualitative and quantitative data, their findings indicate organizational and individual components to the low motivation for ethical system development and implementing privacy features [7, 8].

*FOSS and Non-Monetary Incentives.* Yuwei Lin points out that the reductionist instrumentalist approach to developer motivations is inadequate, since FOSS development is not characterized by a universal activity: the actors in FOSS development assume different identities (e.g. leader, follower, developer, user, hacker) and competitive and cooperative strategies that change between different social circles [11]. Moreover, as Gabriella Coleman notes, individual motivations and ethical commitments do not remain constant, but change over the course of projects, adding another level of complexity to the mosaic of ethical and motivational parameters [5]. In addition, there are other actants in the field such as corporations, NGOs, legal administrative bodies and platforms such as GitHub<sup>7</sup> and SourceForge<sup>8</sup> which further complicate matters.

Following from these criticisms, it can be argued that an account of developer motivations needs to move beyond the assumption that monetary and legal incentives will work universally as sources of motivation, and take into account the diverse social contexts of FOSS developers and sources of motivation specific to them. In this regard, following Pierre Bourdieu [19], recognizing the non-monetary forms of capital in the field of FOSS development can be valuable in understanding motivations. For example, recognition and reputation, which are forms of symbolic capital, have been referred as an alternative to monetary capital by Roberts and other researchers following him [16–18]. This type of symbolic capital is not necessarily antagonistic to commercial interests in FOSS development<sup>9</sup>, since the reputation and experience gained in open source projects are reasonably aligned with developoers’ career progression goals. However, this brings the pitfall of adopting an overly reductionist approach which assumes that every decision in the field can be explained in terms of career goals and ignoring the rest of the cultural aspects of FOSS. As, e.g., Gabriella Coleman argues in Coding Freedom [5], participation in FOSS development and hacking has important ethical and political aspects. Similarly, Linus Torvalds’s

<footnote n="7">⁷ https://github.com</footnote>

<footnote n="8">⁸ https://sourceforge.net</footnote>

<footnote n="9">⁹ Unlike, for example, *avant-garde* art. See Bourdieu (1996) [20]</footnote>
autobiography ‘Just for Fun’ [21] can be seen as a narrative on how ‘fun’ can be considered a source of motivation in FOSS. Bednar et al. [7] find that developers describe implementation of privacy features using terms such as ‘inconvenient’, ‘not pleasing’, ‘challenging’, ‘nightmare’, or ‘interesting’, ‘exciting’ and ‘satisfying’ respectively. As these findings show, the forms of capital and sources of motivation in software development involve diverse elements, including symbolic capital (reputation, recognition), politics, ethics, excitement, convenience and fun.

# 3 Research Agenda

As stated in the previous sections, the field of FOSS development has many types of non-monetary rewards, incentives, values and goals related to developers’ motivation. Due to this diversity and dependence on social context, an inquiry into motivations in this field needs to address these diverse and field-specific parameters. The research we propose hopes to bring about a social change towards the adoption of PbD principles in open source developer communities, based on a theoretical framework combining game theory and field theory. Our work examines FOSS development as a relatively autonomous field, with its specific rules, goals, values, and forms of capital, in order to understand the motivations of FOSS developers in implementing software features, and to effectively model objective functions based on them to bring about change towards a more favorable equilibrium.

## 3.1 Model Assumptions

Game theory assumes an individual that develops rational strategies consisting of actions oriented towards a goal [22]. In sociology, the notion of rational individual is used not as an accurate and realistic representation, but as a simplification that allows for accounting for complex mechanisms [23]. Despite this acknowledgment, this assumption is criticized for being too narrow, and rarely coinciding with social reality, ultimately defeating its purpose [23].

Goldthorpe (1998) [24] (as cited in Glaesser 2013 [25]), who favors rational action theory over the concept of habitus for large-scale data, acknowledges that actors do not act purely on rational terms in individual cases. He puts forth a notion of subjective rationality based on the idea that

[...] actors may hold beliefs, and in turn pursue courses of action, for which they have ‘good reasons’ in the circumstances in which they find themselves, even though they may fall short of the standard of rationality that utility theory would presuppose. [25]

This view contextualizes actors’ courses of action in terms of their social circumstances, which also includes the information available to them. As actors do not necessarily have the resources or disposition to access the ‘best information
imaginable', they usually act on the available information [25]. They may be
aware or unaware of their lack of information or the costs of accessing additional
information and thus act on incomplete information [25].

The assumption of rational choice is similarly criticized within game the-
ory since rational action is sometimes dependent on extra-game circumstances
including ‘history of past interactions, existing customs and practices, or con-
tingently salient features of the particular instantiation of the game’ [22]. This
echoes the criticisms from sociology, as it implies that a simplified and univer-
salized model of an individual acting optimally on the best information ignores
the diversity of individual and social contexts.

The complex social circumstances of FOSS development culture warrants taking these views into account. On one hand, the field of FOSS development is diverse, with various developer agents and other actants having a large spectrum of backgrounds and motivations. Secondly, as previous research on the issue attests, goals, norms and practices in the field are varied and contextual [11]. To factor this complexity, brought about by the diversity of individual cognitive structures and social contexts in FOSS development, we make an assumption based on Pierre Bourdieu's concepts of field and habitus [26, 27]. Our assumption is that actors in the field are limited in their capacity of making rational and optimal choices by their *habitus* and *specific rules and goals of the subfield*.

*Habitus.* Bourdieu defines habitus as “systems of durable, transposable dispo-
sitions, [...] principles which generate and organize practices and representa-
tions” [26]. Habitus is a system of cognitive and motivating structures associ-
ated with past individual and class experience. Although Habitus can result in
mastery in actions towards goals without conscious motivation, it also includes
strategic thinking involving “an estimation of chances presupposing transfor-
mation of the past effect into an expected objective” in the light of present
“objective potentialities” [26].

As Bourdieu's concept of habitus does not exclude rational choice but con-
textualizes it within past experience and present conditions, it has the potential
to make up for the shortcomings of a purely rational model of individual in
studying goal-oriented choices and motivation. One example is a study on ed-
ucation choices in Germany and England by Glasser and Cooper (2013), who
find that young individuals make their educational choices rationally and ori-
ented towards goals, yet these choices are also informed by their class and the
culture of their educational institute, confirming habitus as a factor that affects
the decision space and actions available to individuals [25].

To summarize, despite the tendency to represent habitus and rational choice
as polar opposites or mutually exclusive concepts, habitus is inclusive of rational
choice, although based on limited information or class/individual experience.
Consequently, we take both habitus and rational choice as important components
of the cultures that we chose to study, informing and conditioning each other.

*Specific rules and goals of the subfield.* According to Pierre Bourdieu, the social world is composed of semi-autonomous systems called fields, which are not com-
completely independent but rather have their own laws and forms of capital [27]. It
follows that a field, such as literature, can have its own, non-monetary forms of
capital such as recognition, prestige and autonomy [20]. Fields have their own
specific logic by which individuals can take positions within them or forms of
capital such as monetary capital that can be converted into other forms and
vice-versa [20, 27].

The goals, forms of capital, the logic of their accumulation and conversion,
and the rules of a field do not necessarily coincide with other fields and society
as a whole. This difference affects the capacity of the agents to take rational
actions in it, as well as complicating our means of interpreting these actions in
purely rational psychological terms. Therefore, our second assumption is that
the specific conditions, rules and goals of the field leading to courses of action
do not necessarily coincide with rational choice.

Thus, our ability to analyze developer motivations in FOSS development
as actions oriented towards goals, and formulate them as objective functions
require taking into account the specific cognitive structures of these agents and
the rules specific to the field. This context-specific information cannot be derived
from macro-sociological accounts or overly-general assumptions about individual
cognition. Our research addresses this issue by integrating a qualitative field
study aimed towards understanding the habituses of the developers in this field,
and the rules specific to the field. This insight into the contextualized motivations
enabls us to use field-specific variables in our objective functions, rather than
generalized notions of utilitarian or altruistic choices.

## 3.2 Data Collection

The research we propose uses mixed methods, i.e., combining qualitative and
quantitative techniques. Due to their suitability for research projects that aspire
to practical application and social transformation, mixed methods have been
associated in social sciences with pragmatism [9, 28, 29]. The qualitative phase
of the research is an exploration of FOSS development communities as a social
field. A field consists of a structured set of positions; these positions differ from
spatial positions in that they include alignments based on interpersonal relations
and common goals [30, 31]. This first phase is intended to gather insight into the
values, goals and forms of capital specific to the field of FOSS development, as
well as the agents that take positions within it. This will be achieved through a
combination of in-depth and focus-group interviews and participant observation
in developer meet-up events such as conferences. While interviews will be useful
in understanding individual and group motivations and shared goals, observa-
tions in developer conferences will supplement this knowledge to shed more light
no interactions. The results of the first phase will facilitate selection of relevant
parameters to be measured and thus will shape the quantitative inquiries that
follow.

The second part of the research consists of developing questionnaires guided
by feature vectors built according to the findings of the previous stage. At this
stage, the individual data collected from developers will be used to examine the
field using local network regression [32, 33], and to visualize it with dimensional-
ity reduction techniques. After mapping the field as clusters based on individual
features, we will be able to determine different subfields with their respective
motivating goals, capital forms and habituses. This would enable us to distill
objective functions to model a two-player game (developers and users) in order
to change the equilibria of the subfields to a state favorable to PbD. Our aim
at this stage is to be able to address the diversity of the subfields, avoiding the
pitfalls of previous research and legal incentives, while keeping the model as sim-
ple and elegant as possible. After the dissemination of tools based on our game
model, the final quantitative stage of the research is an assessment of the impact
of our intervention, and proposal of strategies that encourage PbD based on our
findings.

*Sample.* Our proposed study focuses on European FOSS mobile game develop-
ers. Mobile software is significant for the issue of privacy and security as it is a
platform that is very susceptible to exploitation. As mobile games are easily in-
stalled, and are used almost ubiquitously by people of all ages and backgrounds,
they represent an important risk with respect to privacy and security. For our
field study, we strive for maximum variation in our sample of FOSS develop-
ers in terms of age, career stage, educational background and project size. This
variation will facilitate exploration of a wide variety of subfields that include
developers from diverse social backgrounds.

3.3 Engineer the Game: Mechanism Design

The modeling of the FOSS field is intended to describe and understand the
current situation. A mere understanding, as detailed as it might be, does not
bring about change. However, the aim of our research is to produce actionable
advice for policy makers. To do this, we use an approach based on mechanism
design. Here we will introduce the basic notions of mechanism design and present
a thought experiment how to analyse the resulting games.

Mechanism design originated in economic theory or, more precisely, in game
theory. It takes an engineering approach to design mechanisms, i.e. incentives,
toward desired objectives. By informing this approach with the qualitative and
quantitative results of our field research, as sketched in Fig. 1, we acknowledge
the general critique of game theory, i.e. unrealistic assumptions about the ratio-
nality of agents and over-simplification [23].

*Games: Objective Functions and Equilibria – two examples.* For our thought experiment, let’s assume that we find in the analyses of our initial interviews and observations that our participants have different occupational statuses and organizational roles (e.g. junior, senior, student), and have different roles in the decision-making processes of their FOSS projects. They also have various motives for participating in FOSS (e.g. to build reputation for themselves or their organization, to have a project to show in job applications, to gain skills and knowledge, to contribute to society). They formulate the impact of their
<figure><img src="image_2.png" /><figcaption>Fig. 1. Our Experimental Setup</figcaption></figure>

project in terms of their individual careers, contribution to the FOSS world, and society in general. Finally, let us say that we find that all of our participants think PbD features are important, but all are reluctant to implement them for differing reasons: Some state that PbD features take too much time and hinder the project, some think their skills are not sufficient for their implementation and are concerned that it will harm their reputation if they fail, and some do not want the ethical responsibility of implementing them correctly in case they fail.

Looking at these preliminary results, we develop our questionnaires. Our data can be roughly organized under habitus and forms of capital (education and skills, career, role in project or organization, reputation, money), values and goals (e.g. reputation, skills, contribution), strategies and positions (e.g. organizational and project hierarchy, career plans), and motivational factors (e.g. importance placed on PbD, time and resources or lack thereof, fear of losing reputation, wishing to contribute to society vs. fear of doing damage by developing insecure software). With the collected data and using local network regression[32] we will be able to cluster individuals and observe subfields formed on the basis of these features. This will help us develop a game model addressing the diversity of these clusters while remaining simple and elegant. Based on this model, we can develop tools to shift the equilibrium towards a more sensible state, followed by our assessment of impact.

<table><caption>**Table 1.** Payoff matrix of our example game: the privacy battle.</caption><thead><tr><th></th><th>c = pet</th><th>c = pet&#773;</th></tr></thead><tbody><tr><td>p = pet</td><td>2,1</td><td>0</td></tr><tr><td>p = pet&#773;</td><td>0</td><td>1,2</td></tr></tbody></table>

To illustrate the type of conclusions we envision from this process, we briefly sketch a game that reflects a very rough view on the situation that we set out in
our introduction, then discuss the expected equilibria. The most basic game has
two players, both of which can play two strategies: producer $p$, which can opt
to provide a privacy-friendly product or a product without privacy protection
but with equal functionality otherwise. Moreover, the consumer $c$ might chose
to buy a privacy-aware or non-privacy-aware product. In Table 1, we illustrate
this game. It describes the following situations:

**The producer implements a privacy-enhanced service ($p = pet$).** In doing so, the service becomes more expensive, which might have a negative impact on the profit margin.

**If the consumer requires privacy ($c = pet$),** the producer will reach some satisfaction, but at higher implementation costs, while the consumer will be fully satisfied. Hence the consumer payoffs are relatively higher.

**If the consumer is willing to give up privacy ($c = \overline{pet}$) for a lower priced product,** both consumer and producer might be unsatisfied, because the consumer might not be willing to pay the higher price of the privacy-enhanced product.

**The producer implements a service without privacy ($p = \overline{pet}$).** By doing this, the service becomes less expensive, which might have a positive impact on the profit margin.

**If the consumer requires privacy ($c = pet$),** both consumer and producer might be unsatisfied, because the consumer might not be willing to give up privacy.

**If the consumer is willing to give up privacy ($c = \overline{pet}$) for a lower-priced product,** the producer will be fully satisfied but the consumer will need to surrender some of their revenue in the form of privacy.

From today's market observation, we expect a payoff matrix similar to that described above. That is, if both players opt for the more privacy-aware option $c$, they will get their highest payoff and $p$ some payoff lower than that. If, on the other hand, both opt for a less privacy-friendly option, $p$ will get their highest payoff and $c$ some lower payoff. In the remaining cases, no player will get any payoff since either the consumer is not willing to pay the higher price or is not willing to give up their privacy. Further research is needed to determine more precise figures. Note in the fundamental game theory literature, games of this form are often introduced as "battle of the sexes games".

From everyday observation, which indicates a lack of privacy-friendly ser-
vices, we venture to construct the following hypothetical analysis of the game:
we know that “battle of the sexes” type of games have three Nash equilibria
namely two pure, where both players opt for the same privacy preference, and
one mixed. While the pure strategies are utility optimal, i.e. both ensure that the
sum of all revenues is maximized, both are unfair: one party will always receive
the higher revenue. On the other hand, the mixed strategy is highly inefficient.
From the above, we conclude that consumers settle for a lower overall revenue
due to the lack of better options.

While this simple game may broadly approximate the current situation, we
do not assume that such a simple game will be sufficient to describe the current
motives of FOSS developers. Hence we need to collect data to come up with a
somewhat more complex game.

4 Conclusion

In this paper, we have attempted to provide a road map for research on FOSS
developer motivations, with the aim of bringing about social change towards
privacy-friendly features, while taking into account and learning from the short-
comings of previous research. We argued that the problems in previous research
on this topic stem from the fact that it is mostly based on assumptions about
developers that do not reflect the specific conditions of the FOSS development
scene. More specifically, the research we see in the literature typically assumes
that the developers are hedonistic rational individuals that make self-interested
choices, or assumes that they take part in FOSS development due to altruistic
motives. Neither of these models successfully explains the reluctance to imple-
ment privacy features or the failure of legal incentives obliging the implementa-
tion of PbD. More recent research, such as Spiekermann (2019) [8] and Bednar
et al. (2019) [7], go beyond such limited explanations and point to organiza-
tional and individual reasons underlying this reluctance, indicating the necessity
for research that takes into account the specific individual and social contexts
surrounding developer motivations.

To address this, we have proposed an approach combining field theory and
game theory into a mixed methods research endeavour with the aim of gaining
deeper insight into FOSS communities and of suggesting relevant policy changes.
From field theory, we take the concept of field and habitus in order to replace the
general/universal models of individual with a historically and socially contextu-
alized understanding of FOSS developers. This approach enables us to explore
the field of FOSS development and the developer motivations with respect to
field specific rules, goals, forms of capital and the collective past experience of the
individuals therein. The findings will be used to develop games based on social
context rather than dehistoricized assumptions about developers. The insights
from the field study and game model will then be used to develop guidelines,
tools and policy suggestions aimed at social change towards privacy-friendly
software.

References

1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 april 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing directive 95/46/EC (General Data Protection Regulation). O.J., L 119/1.

2. AI High Level Expert Group. High Level Expert Group on AI: Ethics Guidelines for Trustworthy AI, 2019.

3. ENISA. ENISA threat landscape report 2018 — 15 top cyberthreats and trends, 2018.

4. Jaclyn Kilani. Will the GDPR affect open source projects?, 2018.
5. E. Gabriella Coleman. *Coding Freedom: The Ethics and Aesthetics of Hacking*. Princeton University Press, 2012.

6. Nikolai Bezroukov. A second look at the cathedral and the bazaar. *First Monday*, 4(12), Dec 1999.

7. Kathrin Bednar, Sarah Spiekermann, and Marc Langheinrich. Engineering privacy by design: Are engineers ready to live up to the challenge? *The Information Society*, 35(3):122–142, Mar 2019.

8. Sarah Spiekermann, Jana Korunovska, and Marc Langheinrich. Inside the organization: Why privacy and security engineering is a challenge for engineers. *Proceedings of the IEEE*, 107(3):600–615, Mar 2019.

9. John W Creswell and J David Creswell. *Research design: Qualitative, quantitative, and mixed methods approaches*. Sage publications, 2017.

10. Eric Raymond. The cathedral and the bazaar. *Knowledge, Technology & Policy*, 12(3):23–49, 1999.

11. Yuwei Lin. The future of sociology of FLOSS. *First Monday*, Special Issue 2, 2005.

12. Nikolai Bezroukov. Open source software development as a special type of academic research: Critique of vulgar Raymondism. *First Monday*, 4(10), Oct 1999.

13. Josh Lerner and Jean Tirole. Some simple economics of open source. *The journal of industrial economics*, 50(2):197–234, 2002.

14. Josh Lerner and Jean Tirole. The open source movement: Key research questions. *European economic review*, 45(4-6):819–826, 2001.

15. Andrea Bonaccorsi and Cristina Rossi. Altruistic individuals, selfish firms? the structure of motivation in open source software. *First Monday*, 9(1), Jan 2004.

16. Jeffrey A. Roberts, Il-Horn Hann, and Sandra A. Slaughter. Understanding the motivations, participation, and performance of open source software developers: A longitudinal study of the Apache projects. *Management Science*, 52(7):984–999, Jul 2006.

17. Shaosong Ou, Alexander Hars. Working for free? motivations for participating in open-source projects. *International Journal of Electronic Commerce*, 6(3):25–39, Apr 2002.

18. Hind Benbya and Nassim Belbaly. Understanding developers' motives in open source projects: A multi-theoretical framework. *Communications of the Association for Information Systems*, 27, 2010.

19. Pierre Bourdieu. The forms of capital. In *Readings in Economic Sociology*, pages 280–291. Blackwell Publishers Ltd, 2002.

20. Pierre Bourdieu. *The Rules of Art: Genesis and Structure of the Literary Field*. Stanford University Press, 1996.

21. David Diamond Linus Torvalds. *Just for Fun: The Story of an Accidental Revolutionary*. HarperCollins, 2002.

22. Julius Sensat. Game theory and rational decision. *Erkenntnis* (1975-), 47(3):379–410, 1997.

23. Julia Adams. The unknown James Coleman. *Contemporary Sociology: A Journal of Reviews*, 39(3):253–258, May 2010.

24. John H. Goldthorpe. Rational action theory for sociology. *The British Journal of Sociology*, 49(2):167, Jun 1998.

25. Judith Glaesser and Barry Cooper. Using rational action theory and Bourdieu's habitus theory together to account for educational decision-making in England and Germany. *Sociology*, 48(3):463–481, Jul 2013.

26. Pierre Bourdieu. *The Logic of Practice*. Stanford University Press, 1990.

27. Pierre Bourdieu. *Distinction: A Social Critique of the Judgement of Taste*. Harvard University Press, 1984.
28. Peggy Shannon-Baker. Making paradigms meaningful in mixed methods research. *Journal of mixed methods research*, 10(4):319-334, 2016.

29. David L Morgan. Paradigms lost and pragmatism regained: Methodological im-
plications of combining qualitative and quantitative methods. *Journal of mixed
methods research*, 1(1):48-76, 2007.

30. Pierre Bourdieu. *Sociology in Question*. Sage Publications UK, 1993.

31. John Levi Martin. *The Explanation of Social Action*. Oxford University Press, Aug 2011.

32. Peter McMahan, Adam Slez, and John Levi Martin. Local network regressions. *Socius: Sociological Research for a Dynamic World*, 5:237802311984575, Jan 2019.

33. John Levi Martin, Adam Slez, and Chad Borkenhagen. Some provisional tech-
niques for quantifying the degree of field effect in social data. *Socius: Sociological
Research for a Dynamic World*, 2:237802311663565, Mar 2016.