Ethical Hacking for a Good Cause: Finding Missing People using Crowdsourcing and Open-Source Intelligence (OSINT) Tools

2023 | Communications of the Association for Information Systems | Citations: 0

Authors: Dincelli, Ersin; Slyke, Craig Van; Yayla, Alper

Abstract: Over 600,000 people go missing every year in the US alone. Despite the extensiv ... Expand

Abstract: Over 600,000 people go missing every year in the US alone. Despite the extensive resources allocated to investigating these cases, the high volume of missing person cases constitutes one of the biggest challenges for law enforcement agencies. One approach to tackle this challenge is using crowdsourcing. That is, volunteers use freely available tools and techniques to aid the existing efforts to investigate missing person cases. Open-Source Intelligence (OSINT) refers to gathering information from publicly available sources and analyzing it through a comprehensive set of open-source tools to produce meaningful and actionable intelligence. OSINT has been applied to address various societal challenges and crimes, including environmental abuse, human rights violations, child exploitation, domestic violence, disasters, and locating missing people. Building on this premise, this case examines a crowdsourced initiative called Trace Labs that aims to assist law enforcement agencies in solving missing person cases using OSINT tools. The case emphasizes socio-technical aspects of cybersecurity, highlighting both the bright and dark sides of technology. It demonstrates the potential of information systems to serve the public good by examining topics such as open-source software, crowdsourcing, and intelligence gathering, while acknowledging that the very same underlying technology can be used for malicious purposes. concerns the behavioral aspects of information security and human-computer interaction (HCI). In particular, he studies individuals' decision-making processes and behaviors in the context of information security and privacy, social engineering attacks, privacy-invasive technologies (e.g., social media and wearable devices), designing innovative security education, training, and awareness (SETA) programs, and HCI design for emerging technologies (e.g., AI, blockchain, and virtual reality). Dr. Dincelli has published in academic journals, such as the Collapse

Topics: IT security ease of learning crowdsourcing anonymity open source

Methods: survey personal interview survey design mixed method

SITUATIONAL ROADMAP DEVELOPMENT FOR BUSINESS PROCESS IMPROVEMENT VIA A MODELING TOOL

2023 | European Conference On Information Systems | Citations: 0

Authors: Johannsen, Florian

Abstract: The integration of new technologies as well as the need to increase customer sa ... Expand

Abstract: The integration of new technologies as well as the need to increase customer satisfaction and reduce costs require companies to continuously analyze and improve their business processes. Hence, Business Process Improvement (BPI) ranks high on the agenda of many companies. However, existing methods like Six Sigma are often perceived as overly complex for projects with a limited scope. Therefore, more and more companies focus on the application of a few selected BPI techniques only, which are logically arranged in the form of "roadmaps" to tackle process weaknesses. Against this backdrop, the concept of "tool-supported situational roadmap development for BPI" along with a corresponding prototype are introduced. The approach builds on conceptual modeling and is technically realized by means of a metamodeling platform. Accordingly, the research offers practitioners a solution to systematically create project-specific roadmaps for BPI to improve process performance. Collapse

Topics: evaluation criteria ease of learning systems development

Methods: design science design artifact metamodel conceptual modelling

IT Knowledge Spillovers, Absorptive Capacity, and Productivity: Evidence from Enterprise Software

2022 | Information Systems Research | Citations: 0

Authors: Huang, Peng; Ceccagnoli, Marco; Forman, Chris; Wu, D.j.

Abstract: We examine the productivity implications of external knowledge flows obtained th ... Expand

Abstract: We examine the productivity implications of external knowledge flows obtained through an internet-mediated discussion forum in which IT professionals help one another solve problems related to the implementation and use of enterprise software. We extend elements of the absorptive capacity (ACAP) framework that have not previously been studied in the information systems (IS) literature to a new context. Consistent with prior results from the IS literature, we first show that IT spillovers—acquired through employees’ participation in this forum—only accrue to firms with prior related investments in enterprise software. We then demonstrate boundary conditions for ACAP based on characteristics of external knowledge affecting the ease of learning. Our results show that IT spillovers are not “free”; the ability to derive the value of IT spillovers through informal channels—such as online communities—critically depends on both prior related IT investments by the recipient firm and the novelty of external knowledge. Less intuitively, when knowledge originates from relatively novel or emergent domains, the role of prior related knowledge in absorbing spillovers becomes more important. Collapse

Topics: enterprise information system productivity absorptive capacity human resource management IT skill

Methods: Compustat statistical hypothesis test instrumental variables estimation longitudinal research descriptive statistic

Theories: absorptive capacity theory

From Acceptance to Adaptive Acceptance of Social Media Policy Change: a Set-Theoretic Analysis of B2B SMEs

2021 | Information Systems Frontiers | Citations: 0

Authors: Iannacci, Federico; Fearon, Colm; Pole, Kristine

Abstract: Drawing on theories of mindfulness, this paper aims to introduce the concept of ... Expand

Abstract: Drawing on theories of mindfulness, this paper aims to introduce the concept of adaptive acceptance of social media policy change in the context of Business-to-Business (B2B) Small-and-Medium Enterprises (SMEs) based in the South East of England. The paper adopts a quasi-experimental design based on the analysis of multiple cases with each case replicating prior findings either literally or theoretically. The study uses a mix of survey, interview, and electronic data informed by an innovative, set-theoretic approach to distill commonalities within positive cases and differences between positive and negative cases. It shows that attracting new customers and raising the company’s profile are necessary pre-requisites for adaptive acceptance of social media policy changes. In addition, these two conditions combined with learning to use social media effortlessly are jointly sufficient for adaptive acceptance. Theoretical, practical, and methodological implications are discussed. Collapse

Topics: social media business-to-business ease of learning perceived usefulness technology adoption

Methods: qualitative interview survey robustness check survey design qualitative comparative analysis

Theories: technology acceptance model theory of reasoned action

The Effect of Risk Representation Using Colors and Symbols in Business Process Models on Operational Risk Management Performance

2021 | Journal of the Association for Information Systems | Citations: 3

Authors: Kummer, Tyge-F.; Mendling, Jan

Abstract: The operational management of risk and internal controls (RIC) makes increasing ... Expand

Abstract: The operational management of risk and internal controls (RIC) makes increasing use of visual representations to support tasks such as risk assessment and control activity definition. The strengths and weaknesses of different representations are typically assessed by cognitive theories that assume an analytical and an intuitive mode of information processing. Previous research has focused mainly on the analytical risk assessment while intuitive information processing has largely been neglected. We develop a theoretical argument based on dual-process theory, which explains why RIC representational alternatives influence different levels of information processing. We test our hypotheses with the help of an online experiment using accountants and operation managers recruited via MTurk (N = 166). Our results suggest that highlighting risk and controls in business process modeling and notation (BPMN) by using color improves risk understanding, control understanding, and the identification of control improvements, which help reduce the risk in a given process. Furthermore, we do not find evidence that the inclusion of color leads to perception biases. This has implications for information systems research, which has primarily addressed the analytical processing of conceptual models. Our findings extend cognitive research on such models by adding an intuitive processing path that can improve the user's risk management performance. For practitioners, our findings are particularly relevant because colors can be easily added as a secondary notation element without disguising the factual risk situation in processes. 684Note: Again, participants completed three true-false questions. These focused on the general process and were not related to specific risk and internal control aspects. This gave the participants time to familiarize themselves with the process. The timer began once the participant had answered the three questions.The process model depicts an insurance claim process. Please read the process model carefully and answer the following questions:Each claim is registered. (Yes/No) P.2 At the end of the process, the claim is archived. (Yes/No) P.3 A claim can be rejected at multiple stages in the process. (Yes/No) Part 2.2In the following, you will be given questions related to the depicted business process. Please answer these questions to the best of your knowledge within the given time limit (5 minutes). CPI: Cost Per Incident, TED: Total Expected DamageNote: The following five questions were used to determine risk understanding.R.1 How many risks are described in the process? ____________ R.2 The risk of fraud in relation to overcharging within the process is ____%.R.3 The risk of missing documents can cause a total damage of $______.R.4 What is the highest total expected damage in the process? $___________ R.5 What is the cost per incident incurred when an assessment error is made? $____________ Note:The following five questions were used to determine control understanding.C.1 How many controls are described in the process? ____________ C.2 The controls for missing documents cost $___ per claim.C.3 The risk of assessment errors can be reduced by ________% through a second assessment.C.4 The internal controls reduce the anticipated cost of assessment errors by $________.C.5 What is the remaining total expected damage when the control to double-check the obtained documentation is in place? $________. Note:The following question was used to determine control improvement. The timer was reset and counted down 180 seconds (3 min). Journal of the Association for Information Systems 689Note: Again, participants completed three true-false questions. These focused on the general process and were not related to specific risk and internal control aspects. This gave the participants time to familiarize themselves with the process. The timer began once the participant had answered the three questions.The process model depicts a goods receipt process. Please read the process model carefully and answer the following questions:The process can only end by placing goods in stock. (Yes/No) P.2 Goods are received by trucks. (Yes/No) P.3 The booking clerk is contacted when the delivery does not match a purchase order. (Yes/No) Part 2.3In the following, you will be given questions related to the depicted business process. Please answer these questions to the best of your knowledge within the given time limit (5 minutes). CPI: Cost Per Incident, TED: Total Expected DamageNote: The following five questions were used to determine risk understanding R.1 How many risks are described in the process? ____________ R.2 The risk that the booking clerk makes a wrong acceptance decision is ____%.R.3 The risk to accept goods with poor quality causes damage of $______ per incident.R.4 What is the highest total expected damage in the process? $___________ R.5 Errors in the vendor selection cause a total damage of $___________. Note:The following five questions were used to determine control understanding C.1 How many controls are described in the process?_____________ C.2 The controls to validate the vendor selection cost $___ per order.C.3 The risk to accept goods with poor quality can be reduced by ____% by inspections.C.4 The internal controls reduce the anticipated cost for making a wrong decision upon acceptance by $________.C.5 The remaining risk that a cheaper vendor exists despite the validation of the vendor selection causes the total damage of $__________. Note:The following question was used to determine control improvement. The timer was reset and counted down 180 seconds (3 min). Collapse

Topics: risk management accounting business process management decision making electronic commerce

Methods: business process modeling experiment modeling language business process model and notation hierarchical linear modeling

Theories: dual-system theory cognitive theory

Choose your own training adventure: designing a gamified SETA artefact for improving information security and privacy through interactive storytelling

2020 | European Journal of Information Systems | Citations: 0

Authors: Dincelli, Ersin; Chengalur-Smith, InduShobha

Abstract: Online self-disclosure (OSD) on social networking sites can leave individuals an ... Expand

Abstract: Online self-disclosure (OSD) on social networking sites can leave individuals and organisations vulnerable to security threats. Following a design science research (DSR) method, we created a gamified, “choose your own adventure” style security education, training, and awareness (SETA) artefact using two formats: text and visual. Both artefacts were designed to identify the security threats that trainees are most susceptible to, debrief them about the threat and its potential consequences, and facilitate behaviour change by letting trainees re-evaluate their decisions. Using a longitudinal randomised controlled experiment, we compared these two artefacts to no intervention and traditional security warning emails by assessing both instrumental (changes in attitudes, intentions, and OSD behaviour) and experiential (memorability and user experience) outcomes. Our survey of 1,718 employees showed that the text-based artefact was better at improving instrumental outcomes, and the visual-based artefact was better at improving experiential outcomes. This study provides a more granular understanding of the linkages between technology artefacts and human experiences through the application of design science thinking. The findings contribute to DSR by developing design principles, testable propositions, and realistic performance evaluation metrics for gamified SETA artefacts, and present practical recommendations for regulating employees’ information security and privacy behaviours inside and outside the workplace. Collapse

Topics: electronic mail user experience privacy gamification Facebook

Methods: survey experiment longitudinal research design principle design science

Boundary Resources for IIoT Platforms – a Complementor Satisfaction Study

2020 | International Conference on Information Systems | Citations: 0

Authors: Petrik, Dimitri; Herzwurm, Georg

Abstract: Platform providers can use Boundary Resources (BR) to enable complementors to ut ... Expand

Abstract: Platform providers can use Boundary Resources (BR) to enable complementors to utilize the platform to create value, simultaneously controlling the complementary output. Despite their significance, not much is currently known about the quality of BRs and their impact on the complementor satisfaction. This paper presents the results of the complementor satisfaction study in the Industrial Internet of Things (IIoT) domain through the application of the critical incident technique (CIT). Applying the Kano model, the first result sheds light on how the platform providers affect complementor satisfaction through various BRs. The second result discovers satisfaction-relevant quality dimensions (QD) for each evaluated BR. Our findings show which BRs are suitable to leverage the satisfaction-driven complementor engagement in platform-based IIoT ecosystems, establishing a link between the decisions on BR quality and the platformbased innovation dynamics, if satisfaction is incorporated in the design of BRs. Collapse

Topics: customer satisfaction application programming interface usability cloud computing devops

Methods: survey design principle case study single case study critical incident technique

Theories: two-factor theory

External Learning Strategies and Technological Search Output: Spinout Strategy and Corporate Invention Quality

2019 | Organization Science | Citations: 2

Authors: Cirillo, Bruno

Abstract: The strategic management of knowledge spillovers to employee ventures may provid ... Expand

Abstract: The strategic management of knowledge spillovers to employee ventures may provide firms with knowledge spill-ins or the potential to learn from the ventures that they have spun out. However, the mechanisms underlying knowledge spill-ins and their importance for external learning in uncertain technology environments have not been examined in detail. This article compares corporate venturing (CV) spinouts that are supported by parent firms with independent employee spinouts as well as other strategies for external learning, such as investments and alliances. An analysis of the patenting activities of leading corporations operating in the information and communication technology industry reveals that, ceteris paribus, when firms recombine unfamiliar knowledge components developed by their CV spinouts, their inventions are associated with higher quality than comparable firms’ inventions that recombine knowledge from the firm’s corporate venture capital portfolio ventures, allies, or employee spinouts. This effect is especially pronounced when CV spinout inventors hold parent-specific technological expertise. The results are robust across several econometric specifications that account for selection and intrinsic differences in external learning strategies. Furthermore, the results indicate that CV spinouts benefit their parent firms by reducing uncertainty relative to other strategic formats for external learning in unfamiliar technological areas. The detailed theoretical and practical implications derived from this research reflect perspectives on technology strategy and corporate renewal. Collapse

Topics: research and development innovation management information systems strategy database system human resource management

Methods: descriptive statistic robustness check econometric modeling statistical hypothesis test ordinary least square

Theories: lemon market theory

Optimizing Usability Testing in the Context of a Large-scale Software Service for Digital Textbooks

2017 | HICSS | Citations: 0

Authors: Kastner, Margit; Simon, Bernd

Abstract: The adoption of digital textbooks in education has steadily increased. This pape ... Expand

Abstract: The adoption of digital textbooks in education has steadily increased. This paper reports on the initiative Digi4School aiming to provide a large-scale software service for digital textbooks. Since the usability of this service is of particular concern, it is the subject of a design science research project with the goal to investigate two artifacts: (1) an optimized method for usability testing and (2) a fully-functional software service for delivering digital textbooks to users with heterogeneous IT background. We conclude that a combination of usability tests and the use of a questionnaire including closed and open-ended questions is recommended. Furthermore, both novice and expert users should evaluate a system’s usability with iterations until the usability measures reach a satisfactory level for all users. This was achieved for Digi4School. Such an approach has the potential to identify and eliminate flaws that prevent users from adopting the system. Collapse

Topics: usability software as a service web application ease of learning usage intention

Methods: survey cognitive walkthrough design science usability testing parametric test

LEARNING ABOUT AMBIGUOUS TECHNOLOGIES: CONCEPTUALIZATION AND RESEARCH AGENDA

2017 | European Conference On Information Systems | Citations: 0

Authors: Pillet, Jean-Charles; Pigni, Federico; Vitari, Claudio

Abstract: Information Technologies (IT) have gradually transformed into complex digital ar ... Expand

Abstract: Information Technologies (IT) have gradually transformed into complex digital artefacts with blurred and constantly changing functional boundaries. While this shift offers promising venues that unfold in front of our eyes every day, it also challenges the deeply entrenched knowledge structures on which ordinary users rely to learn about unfamiliar technologies. We propose to take a step back in order to theorize the ambiguous nature of modern IT and to speculate on how users learn to use them. This paper revisits a wide array of management (BYOD, Gamification) and IS design trends (generativity, everyday computing, incompleteness) through the lens of the categorization framework. Our review of the literature on ambiguous products suggests that users exposed to ambiguous technologies may experience a categorization difficulty that disrupts the process of learning how to use them. This difficulty stems from a user’s belief that there are multiple or inconsistent interpretations of why and how to use an IT, as well as a perception that a given IT has some attributes in common with one or several seemingly unrelated ITs. We build on this theorization to propose a research agenda and discuss the expected practical implications of this path of research. Collapse

Topics: marketing management consumer behavior innovation management technology adoption bring your own device

Methods: design artifact theory development literature study literature sample