Published on in Vol 23, No 5 (2021): May

Preprints (earlier versions) of this paper are available at https://preprints.jmir.org/preprint/24879, first published .
Emotional Reactions to Cybersecurity Breach Situations: Scenario-Based Survey Study

Emotional Reactions to Cybersecurity Breach Situations: Scenario-Based Survey Study

Emotional Reactions to Cybersecurity Breach Situations: Scenario-Based Survey Study

Original Paper

1Department of Work, Organization and Society, Faculty of Psychology and Educational Sciences, Ghent University, Ghent, Belgium

2Department for Psychotherapy and Biopsychosocial Health, Faculty of Health and Medicine, Danube University Krems, Krems an der Donau, Austria

3Eindhoven University of Technology, Eindhoven, Netherlands

4University of Greenwich, London, United Kingdom

5Centre for Integrative Neuroscience and Neurodynamics, School of Psychology and Clinical Language Sciences, University of Reading, Reading, United Kingdom

Corresponding Author:

Sanja Budimir, PhD

Department of Work, Organization and Society

Faculty of Psychology and Educational Sciences

Ghent University

Henri Dunantlaan 2

Ghent

Belgium

Phone: 32 09 264 64 56

Email: sanja.budimir@ugent.be


Background: With the ever-expanding interconnectedness of the internet and especially with the recent development of the Internet of Things, people are increasingly at risk for cybersecurity breaches that can have far-reaching consequences for their personal and professional lives, with psychological and mental health ramifications.

Objective: We aimed to identify the dimensional structure of emotion processes triggered by one of the most emblematic scenarios of cybersecurity breach, the hacking of one’s smart security camera, and explore which personality characteristics systematically relate to these emotion dimensions.

Methods: A total of 902 participants from the United Kingdom and the Netherlands reported their emotion processes triggered by a cybersecurity breach scenario. Moreover, they reported on their Big Five personality traits, as well as on key indicators for resilient, overcontrolling (internalizing problems), and undercontrolling (aggression) personality types.

Results: Principal component analyses revealed a clear 3-dimensional structure of emotion processes: emotional intensity, proactive versus fight/flight reactions, and affective versus cognitive/motivational reactions. Regression analyses revealed that more internalizing problems (β=.33, P<.001), resilience (β=.22, P<.001), and agreeableness (β=.12, P<.001) and less emotional stability (β=–.25, P<.001) have significant predictive value for higher emotional intensity. More internalizing problems (β=.26, P<.001), aggression (β=.25, P<.001), and extraversion (β=.07, P=.01) and less resilience (β=–.19, P<.001), agreeableness (β=–.34, P<.001), consciousness (β=–.19, P<.001), and openness (β=–.22, P<.001) have significant predictive value for comparatively more fight/flight than proactive reactions. Less internalizing problems (β=–.32, P<.001) and more emotional stability (β=.14, P<.001) and aggression (β=.13, P<.001) have significant predictive value for a comparatively higher salience for cognitive/motivational than affective reactions.

Conclusions: To adequately describe the emotion processes triggered by a cybersecurity breach, two more dimensions are needed over and above the general negative affectivity dimension. This multidimensional structure is further supported by the differential relationships of the emotion dimensions with personality characteristics. The discovered emotion structure could be used for consistent predictions about who is at risk to develop long-term mental well-being issues due to a cybersecurity breach experience.

J Med Internet Res 2021;23(5):e24879

doi:10.2196/24879

Keywords



Background

The increasing number of Internet of Things devices (IoT) and their diverse application in private and work lives offer unlimited possibilities for a connected life. However, this has also extended the scope of security breaches and cybercriminal behavior [1]. As cyberattacks became more and more focused on specific companies and individual users [2,3], they increasingly create technological, economic, social, and psychological challenges. Because of the deep penetration of IoT in personal lives, cybersecurity breaches on such devices can have far-reaching personal consequences. Work and livelihood can be disturbed, personal and social spheres can be altered, and these changes can sometimes be irrevocable. The most direct psychological effects of such events, which are intrinsically relevant to the personal goals of the user, are the emotional responses they elicit [4,5]. A leading security company reported that negative emotions including anger, annoyance, frustration, upset, and a feeling of being cheated are the common reactions to being a victim of cybercrime [6]. These emotional experiences could develop into long-term, far-reaching psychological turmoil [7-10]. Despite their central role in psychological well-being, very little is known about emotional reactions in the context of cybersecurity breaches. In this study, we (1) explore victims’ emotion processes by employing a scenario study with a cybersecurity breach on a smart security camera, which is one of the most telling examples of invasion of privacy by unauthorized entrance in the private sphere [11,12], (2) explore which personality characteristics predict interindividual differences in emotional reactions to this cybersecurity breach; and (3) designed the explorative research in such a way to generate replicable findings.

Emotion Processes

In emotion research, participants are often asked to report on their own emotions by evaluating emotion and affect terms (eg, the frequently used Positive and Negative Affect Schedule [PANAS] [13]). While this type of research can generate very interesting findings, it does not allow researchers to unearth the emotion processes these affect terms refer to. To get a comprehensive view of the emotion processes that can be elicited by cybersecurity breaches, emotions are currently studied on the basis of the componential emotion approach [14]. This approach has emerged as an overarching conceptual framework within the scientific field of emotion research. According to this approach, emotions are conceptualized as processes that are elicited by goal-relevant events and consist of an interplay between 5 major components: appraisals, action tendencies, bodily responses, expressions, and subjective feelings [5]. Each component has a function. Appraisals are the evaluation of the eliciting event against one’s goals, needs, and values. Action tendencies refer to the preparation and direction of adaptive action. Bodily responses refer to physiological changes that prepare the body for actual action. Expressions are the facial, vocal, and gestural reactions through which the ongoing emotion process is communicated. Through subjective feelings, the individual becomes aware of the ongoing emotion process. These feelings are often communicated with the use of emotion and affect terms. Moreover, emotion processes are evolutionary-shaped processes that have evolved from reflex-like reactions to dynamic processes open to regulation [5,14]. All aspects of the emotion process can be regulated, from the impulsive reactions to the cognitive evaluations. Having flexible emotion processes allows us to better adapt to our environment [15].

This componential emotion approach is especially promising for studying emotional experiences, as it has been demonstrated across cultural and linguistic groups that the 5 components, as well as regulation are encoded in daily language. First in 3 samples from the United Kingdom, Switzerland, and Belgium [16] and later in 31 additional samples from 24 countries and representing 20 languages (such as Chinese and Japanese) [14], it was demonstrated that 142 emotion features representing the 5 emotion components and regulation systematically constitute the meaning of 24 frequently used emotion terms [14]. The componential emotion approach forms not only a comprehensive theoretical framework but also represents how people naturally think and talk about their emotions.

Thus, to fully understand emotion dynamics, it is important to go beyond feeling and emotion terms and study all emotion components and regulation processes. In this study, the dimensions that structure the emotion processes elicited by a cybersecurity breach of a smart security camera are exploratively identified by taking all emotion components as well as regulation into account.

Person Characteristics and Emotional Reactions

To better understand the emotion dimensions involved in this scenario, we evaluate whether and how characteristics of personality are related to the reported emotional experience. To this end, we have worked with 2 broad personality models that have been shown in the past to relate to emotional functioning: the Big Five personality model [17] and the resilient/overcontrolled/undercontrolled personality type model [18,19].

Big Five Personality Model

In the first model, personality is described by the Big Five broad personality traits: extraversion, emotional stability, conscientiousness, agreeableness, and openness [17]. These traits have been shown to relate to the duration of emotional states and frequency of specific emotional experiences [20]. A very common finding is that extraversion is positively associated with positive affect and emotional stability negatively with negative affect [21]. Additionally, associations of personality traits with emotion regulation were demonstrated in several studies [22-24]. For instance, extraversion, conscientiousness, and openness were predictive for problem solving and cognitive restructuring, while agreeableness was predictive for social support and cognitive restructuring [22-24].

Resilient/Overcontrolled/Undercontrolled Personality Type Model

The second personality model classifies people into 3 broad personality types [18,19]. Resilient people are characterized by a tendency to effectively adapt to changes and have the ability to recover well from stress and negative emotional arousal. Overcontrolled people are introverted and emotionally sensitive but also dependable. They are more likely to experience sadness and fear and are at risk of developing internalizing complaints such as depression and anxiety. Undercontrolled people are low on agreeableness and conscientiousness and high on aggressiveness and delinquency. They are more likely to experience anger and are at risk to develop externalizing problems.

Gender and Age

Next to these personality predictors, we have also looked at the relationships with gender and age. Overall gender differences in emotional reactions have been observed, with females having more intense emotional reactions compared with males [25-28]. Regarding age, a general decrease of negative affective experiences [29] and increase of healthier emotion regulation strategies [30-32] have been observed throughout the life span.

Replicability

In light of the replicability crisis in psychology [33] and because of the explorative nature of this research with the innovation to root the study of emotional experiences in the componential emotion approach, the study was executed in two samples from different countries (United Kingdom and the Netherlands) speaking different languages (English and Dutch). Moreover, participants in each country received at random one of two versions of the cybersecurity breach scenario. In one version, the smart security camera showed obvious signs of a cybersecurity breach (nonambiguous condition), and in the other version, it showed unclear signs (the ambiguous condition) that could also potentially be caused by other factors (eg, a bug in the software). By adding the latter scenario, the ecological validity of the research was increased, as in daily life it is also often unclear whether or not a dysfunction of internet-connected devices is due to a cybersecurity breach.


Sample

A total of 1045 participants were recruited through Qualtrics panel, 524 participants from the United Kingdom and 521 participants from the Netherlands. Before the data analyses, participants showing signs of not properly answering questions were removed. One of the strongest indicators that the validity of responses is at stake is nondifferentiation of the responses [34]. All participants who gave the same response on at least 75% of the GRID items and on 70% of the International Personality Item Pool 50 (IPIP-50) questionnaire items deviated from most participants in scale use and were removed (n=143 deleted cases). This left 902 participants for the analyses. Sample characteristics are presented in Table 1.

Table 1. Study sample characteristics (n=902).
CharacteristicsCountry of residence, n (%)Total, n (%)

United Kingdom (n=435)Netherlands (n=467)
Gender

Female221 (50.8)231 (49.5)452 (50.1)

Male214 (49.2)236 (50.5)450 (49.9)
Condition

Ambiguous217 (49.9)241 (51.6)458 (50.8)

Nonambiguous218 (50.1)226 (48.4)444 (49.2)

Procedure

The Qualtrics project team organized and coordinated data collection. They recruited samples from both countries based on their Qualtrics panel of participants. Quotas for samples were predefined and balanced by country of residence, gender, and scenario with age range limited from 18 to 65 years. An online questionnaire, located on the Qualtrics survey platform, was presented to participants remotely by sending them a survey link. Each participant electronically signed an online informed consent form prior to completing the questionnaire. Participants had the opportunity to complete the questionnaire within a 1-week period. The average duration of questionnaire completion was 15 minutes. Each participant was presented with an introduction explaining what IoT devices are and specifically what a smart security camera is. This was followed by the presentation of one of the two scenarios (ambiguous or nonambiguous, see complete instructions in Multimedia Appendix 1). Each participant thus evaluated only randomly assigned one scenario.

Measures

Emotion Assessment

Participants were asked to imagine they experienced one out of two cybersecurity breach scenarios. Scenario 1, which represented the ambiguous condition, was formulated as follows: “Imagine that you bought a smart security camera for your home. After some time, you notice that the shutter on your smart security camera starts opening and closing without your instruction, several times for a few minutes, then it stops for a minute and starts again opening and closing several times and then it stops.” In the nonambiguous condition (scenario 2), the formulation was “Imagine that you bought a smart security camera for your home. After some time, you notice that the shutter on your smart security camera opens without your instruction and the camera rotates toward you and then starts following your movement.”

Participants were subsequently asked to report the emotional reactions they would have in the situation presented using the Cybersecurity GRID questionnaire (Multimedia Appendix 2). This is an adjusted version of the GRID instrument that was used to study the meaning of emotion words across cultural and linguistic groups [14] and is based on the componential emotion approach [5] including the assessment of the 5 emotion components and emotion regulation. In order to determine and operationalize relevant features of the emotion processes in the specific context of cybersecurity breaches, we executed a preliminary qualitative survey. In this survey, 130 participants reported on their real or expected emotional reactions in cybersecurity breach situations (either from first-hand experience or based on a third-party experience). Participants’ reports included a brief description of the cybersecurity breach situation and the emotional reactions they had or would have had in that situation (referring to each of the 5 emotion components and regulation). The new Cybersecurity GRID questionnaire was based on those emotion features that were reported by at least 15% of the participants. The Cybersecurity GRID contains 76 items (19 appraisals, 16 action tendencies, 11 bodily reactions, 8 expressions, 14 subjective feelings, and 8 emotion regulation strategies). Each emotion feature was evaluated on the 7-point Likert scale commonly used in survey research ranging from 1 (strongly disagree) to 7 (strongly agree) [35].

IPIP-50

IPIP-50 [17] is a validated instrument that measures the Big Five personality factors. Participants rated how accurately each statement described them on a 5-point Likert scale ranging from 1 (very inaccurate) to 5 (very accurate). Person mean-centered scores were calculated for IPIP items and reversed according to instructions. Each factor showed good to very good internal consistency (Cronbach alpha): extraversion: α=.85, agreeableness: α=.83, conscientiousness: α=.79, emotional stability: α=.83, and for openness: α=.72.

Depression, Anxiety, and Stress Scale–21 Item

The Depression, Anxiety, and Stress Scale–21 Item (DASS-21) assesses internalizing problems, which is a key feature of the overcontrolled personality type. It is a shortened 21-item version of the Depression, Anxiety, and Stress Scale [36]. Items are rated on a 4-point scale ranging from 0 (does not apply at all) to 3 (applies very much). The total DASS-21 sum scores showed high internal consistency, α=.96.

Short-Form Buss-Perry Aggression Questionnaire

The Short-Form Buss-Perry Aggression Questionnaire [37-39] assesses aggression, which a key feature of the undercontrolled personality type. It is a short version of the Buss-Perry Aggression Questionnaire [40] and consists of 21 items rated on a 5-point scale ranging from 1 (extremely uncharacteristic of me) to 5 (extremely characteristic of me). The scale showed a high internal consistency, α=.92.

Ego Resilience Scale

The Ego Resilience Scale [41,42] is a short, revised version of the Ego-Resiliency Scale [43], measuring self-reported resilience on 10 items on a 4-point scale ranging from 1 (does not apply at all) to 4 (applies very strongly). The Cronbach alpha of the total score was .78.

Ethical Approval

Ethical approval was obtained from the ethical committee of Ghent University, Faculty of Psychology and Educational Sciences in 2017 (number 2016/67).


Internal Structure of Emotional Reactions

Principal component analyses were applied to identify the major dimensions of variability among 76 emotion features. To avoid confusion between emotion components from a substantive point of view and principal components obtained from analysis, the latter will be referred to as dimensions in the remainder of the text.

To identify the number of dimensions, 3 criteria were used: (1) the scree plot based on the Eigenvalues (Multimedia Appendix 1), (2) interpretability, and (3) replicability for each language, scenario, and gender (Multimedia Appendix 1). The theoretically best interpretable rotation was selected. A highly stable and well-interpretable 3-dimensional structure was identified that accounted for 48% of the total variance (see Table 2 for the highest loading features on each dimension and Multimedia Appendix 1 for the full loading matrix).

On the first dimension, accounting for 31% of variance, all emotion features have a positive loading, with the subjective experiences loading highest (eg, I would feel panic, I would feel upset). The higher participants score on this dimension, the more intense negative emotion processes are elicited by the scenario. Therefore, this dimension is named emotional intensity.

The second dimension, accounting for 12% of variance, is a bipolar dimension. One pole is defined by proactive action tendencies to deal with the cybersecurity breach (eg, I would want to regain control over the device/account, I would want to find a solution and fix the problem). The other pole is defined by fight/flight action tendencies (eg, I would want to take revenge, I would want to isolate myself physically) and features from other components that indicate distress (eg, I would have pain in the chest). Therefore, this dimension is labeled proactive versus fight/flight.

Table 2. Results from principal component analysis of the Cybersecurity GRID questionnaire (n=920)a.
GRID itemsDimension loading

123
Dimension 1: Emotional intensity

SF5. I would feel panic..73.20–.30

SF4. I would feel afraid..72.09–.26

SF7. I would feel worried..70–.15–.21

SF6. I would feel upset..70.04–.27

SF14. I would feel uncomfortable..67–.14–.12

SF11. I would feel angry..67.01–.15
Dimension 2: Proactive versus fight/flight

AT14. I would want to destroy whatever was close..32.65.10

AT15. I would want to take revenge..36.63.16

BR4. I would have pain in the chest..49.61–.22

AT1. I would want to stop what was happening..43–.62.16

AT9. I would want to find a solution and fix the problem..34–.64.12

AT2. I would want to regain control over the device/account..44–.68.14
Dimension 3: Affective versus cognitive/motivational

A19. I would think “It is not safe that this device is connected to the internet.”.58–.07.43

A7. I would think “My trust is betrayed.”.58.13.42

A12. I would think “It is happening because someone is trying to hack and take control over my count.”.56–.10.41

E8. I would be walking around nervously..60.32–.34

E7. I would be restless (touching face, hair, biting nails, nervously kicking with legs)..58.34–.35

ER3. I would try to calm myself down (eg, by breathing deeply)..59–.09–.37

aThe 6 highest loadings are presented, and the full loading matrix can be found in Multimedia Appendix 1.

The third dimension, accounting for 5% of the variance, is also bipolar. All appraisal and action tendency features (eg, I would think “It is not safe that this device is connected to the Internet”) have a nonnegative loading, while all subjective experience, bodily reaction, expression, and regulation features (eg, I would try to calm myself down) have a nonpositive loading on this dimension. This dimension is labeled affective versus cognitive/motivational.

Predictors of Emotional Reactions

The scores on each of the 3 identified emotion dimensions were regressed on the personality characteristics. As the Big Five indicators and the resilience, overcontrolled, and undercontrolled indicators show both theoretical and empirical overlap (and the differences and similarities between personality models do not form the focus of this research), their predictive value was investigated separately. Hierarchical linear regression analyses were performed. In the baseline model (model 1), the predictors are country of residence, scenario, gender, and age (with United Kingdom, ambiguous situation, and women being the reference categories). In the second model the personality characteristics were added as predictors: the Big Five personality traits in model 2a and the indicators for resilience, overcontrolled, and undercontrolled personality types in model 2b.

Emotional Intensity

In model 1 (Table 3), it was observed that United Kingdom (βTheNetherlands=–.20, P<.001), women (βman=–.14, P<.001), and those imagining the unambiguous scenario (βunambiguous=.12, P<.001) reported the highest emotional intensity. Model 1 accounted for 8% of the variance (F4,901=18.28; P<.001). In model 2a (Table 3), it was observed that less emotionally stable (β=–.25, P<.001) and more agreeable (β=.12, P<.001) participants reported a higher emotional intensity. Model 2a additionally accounted for an additional 5% of the variance (F9,901=14.64; P<.001). Model 2b (Table 3) showed that those reporting more internalizing problems (β=.33, P<.001) and more resilient participants (β=.22, P<.001) reported a higher emotional intensity. Model 2b additionally accounted for 17% of the variance (F7,901=66.32; P<.001).

Table 3. Results of hierarchical regression analyses showing amount of variance in the emotional intensity dimension accounted for by country of residence, condition, gender, age, Big Five personality traits, DASS-21, aggression, and resilience.
ModelBaSEβbtP value FcRR2ΔR2d
1

(Constant)0.36.11e3.22<.00118.28.28.08.08

Countryf–0.40.06–.20–6.14<.001

Conditiong0.23.06.123.60<.001

Genderh–0.28.06–.14–4.34<.001

Age00–.05–1.39.16
2a

(Constant)0.21.111.89.0614.64.36.13.05

Countryf–0.35.06–.18–5.54<.001

Conditiong0.21.06.113.36<.001

Genderh–0.17.07–.08–2.52.01

Age00–.02–.540.59

Extraversion0.04.05.030.78.44

Agreeableness0.19.06.123.05<.001

Conscientiousness0.08.06.051.20.23

Emotional stability–0.37.06–.25–6.59<.001

Openness–0.03.07–.01–.390.69
2b

(Constant)–2.41.24–10.27<.00166.32.49.24.17

Countryf–0.29.06–.14–4.85<.001

Conditiong0.18.06.093.01.003

Genderh–0.32.06–.16–5.42<.001

Age0.010.144.21<.001

Depression, anxiety, stress0.44.06.337.26<.001

Aggression0.09.05.081.80.07

Resilience0.04.01.227.40<.001

aB: unstandardized coefficient.

bβ: beta standardized coefficient.

cF: F ratio.

dΔR2: R2 change.

eNot applicable.

fReference category: United Kingdom.

gReference category: ambiguous situation.

hReference category: women.

Proactive Versus Fight/Flight

More fight/flight reactions were reported by younger participants (βage=–.26, P<.001), by men (βman=.16, P<.001), and by participants responding to the unambiguous scenario (βunambiguous=.09, P=.006). Model 1 (Table 4) accounted for 9% of the variance (F4,901=22.59; P<.001). In model 2a (Table 4), it was observed that less agreeable (β=–.34, P<.001), less conscientious (β=–.19, P<.001), and less open (β=–.22, P<.001) but more extraverted (β=.07, P=.02) participants showed more fight/flight reactions. Model 2a accounted for an additional 32% of the variance (F9,901=68.57; P<.001). In model 2b (Table 4), it was observed that less resilient participants (β=–.19, P<.001) and participants with more internalizing problems (βDASS=.26, P<.001) and more aggression (β=.25, P<.001) reported more fight/flight reactions. Model 2b accounted for an additional 24% of the variance (F7,901=62.82; P<.001).

Table 4. Results of hierarchical regression analyses showing amount of variance in the proactive versus fight/flight reactions dimension accounted for by country of residence, condition, gender, age, Big Five personality traits, DASS-21, aggression, and resilience.
ModelBaSEβbtP value FcRR2ΔR2d
1

(Constant)0.48.11e4.43<.00122.59.30.09.09

Countryf0.0600>.99

Conditiong0.17.06.092.73.01

Genderh0.31.06.164.85<.001

Age–0.020–.26–8.10<.001
2a

(Constant)0.08.090.81.4268.57.64.41.32

Countryf0.07.05.041.37.17

Conditiong0.17.05.083.23<.001

Genderh0.07.05.031.21.23

Age–0.010–.08–2.92<.001

Extraversion0.10.04.072.44.02

Agreeableness–0.51.05–.34–10.26<.001

Conscientiousness–0.31.05–.19–6.080

Emotional stability–0.05.05–.03–0.99.32

Openness–0.41.06–.22–7.29<.001
2b

(Constant)–0.33.22–1.51.1362.82.57.33.24

Countryf0.12.06.062.17.03

Conditiong0.14.06.072.26.01

Genderh0.20.06.103.58<.001

Age–0.010–.07–2.44.02

Depression, anxiety, stress0.34.06.266.04<.001

Aggression0.27.05.255.96<.001

Resilience–0.04.01–.19–7.02<.001

aB: unstandardized coefficient.

bβ: beta standardized coefficient.

cF: F ratio.

dΔR2: R2 change.

eNot applicable.

fReference category: United Kingdom.

gReference category: ambiguous situation.

hReference category: women.

Affective Versus Cognitive/Motivational

Model 1 (Table 5) showed that for older participants (βage=.21, P<.001), men (βman=.13, P<.001), and Dutch participants (βTheNetherlands=.08, P=.01), the cognitive/motivational reactions were more salient. The model accounted for 7% of the variance (F4,901=18.02; P<.001). Only emotional stability was a significant predictor of the salience of cognitive motivational reactions in model 2a (β=.14, P<.001). Model 2a (Table 5) accounted for an additional 2% of the variance (F9,901=10.57; P<.001). In model 2b, it was observed that more aggression (β=.13, P=.01) and less internalizing problems (β=–.32, P<.001) related to a comparatively higher salience of cognitive/motivational than affective reactions. Model 2b (Table 5) accounted for an additional 5% of the variance (F7,901=18.06; P<.001).

Table 5. Results of hierarchical regression analyses showing amount of variance in the affective versus cognitive/motivational dimension accounted for by country of residence, condition, gender, age, Big Five personality traits, DASS-21, aggression, and resilience.
ModelBaSEβbtPFcRR2ΔR2d
1

(Constant)–0.86.11e–7.81<.00118.02.27.07.07

Countryf0.16.06.082.52.01

Conditiong0.12.06.061.79.07

Genderh0.25.06.133.95<.001

Age0.020.216.59<.001
2a

(Constant)–0.75.12–6.52<.00110.57.31.10.02

Countryf0.11.06.061.76.08

Conditiong0.13.06.072.06.04

Genderh0.23.07.113.38<.001

Age0.010.185.33<.001

Extraversion0.06.05.041.21.23

Agreeableness–0.04.06–.03–0.66.51

Conscientiousness–0.04.06–.02–0.58.56

Emotional stability0.20.06.143.54<.001

Openness0.04.07.020.51.61
2b

(Constant)–0.04.25–0.18.8618.06.35.12.05

Countryf0.13.06.072.03.42

Conditiong0.13.06.062.04.41

Genderh0.26.06.134.08<.001

Age0.010.133.63<.001

Depression, anxiety, stress–0.42.07–.32–6.50<.001

Aggression0.14.05.132.65.01

Resilience0.01–.010.32.75

aB: unstandardized coefficient.

bβ: beta standardized coefficient.

cF: F ratio.

dΔR2: R2 change.

eNot applicable.

fReference category: United Kingdom.

gReference category: ambiguous situation.

hReference category: women.


Internal Structure

The first and foremost goal of this study was to investigate the structure of emotional reactions in one of the most emblematic situations of cybersecurity breaches of the upcoming IoT devices—the hacking of one’s smart security camera—by looking at the full emotion process that can be elicited by this situation. Not a 1-dimensional but a 3-dimensional structure clearly emerges.

On the first dimension, all emotional reactions are loading positively. With the subjective experience items loading the highest on this dimension, this general intensity dimension can be best interpreted as a negative affectivity dimension, comparable to, for instance, the frequently used negative affectivity scale of the PANAS [13].

The second dimension represents the relative salience of proactive versus fight/flight action tendencies. This second dimension underlines the central status of action tendencies for the concept of emotion [44,45]. From an evolutionary perspective, emotion processes are phylogenetically shaped processes that quickly prepare the organism for action. However, depending on the concrete situation, these elicited action tendencies can be more or less constructive. In the new internet environment where we interact from a distance, acting aggressively or withdrawing are not adaptive reactions. One often does not know who is responsible and one’s life depends more and more on participating in this interconnected online world. Only the proactive tendencies to stop what is happening and to better protect oneself can be considered adaptive and lead to constructive results.

The third dimension describes the relative salience of cognitive/motivational versus affective (expression, bodily reactions, regulation, and feelings) features. Possibly, this finding can be linked to the different levels of consciousness with which appraisals can occur [46]. When the appraisals are made consciously, one can focus more on what one feels inclined to do and should do. When the appraisals are made unconsciously, the way the emotion is felt and expressed becomes more salient rather than what has elicited the emotion.

When the second and third dimensions are combined, a distinction emerges that has been referred to in the stress and coping literature as problem-focused versus emotion-focused coping [47] (Figure 1). The proactive tendencies in the upper-left quadrant correspond with problem-focused coping. The bodily reactions, subjective feelings, and expressions in the lower-left quadrant indicate that one is overwhelmed and regulation is required.

This 3-dimensional structure is highly replicable: exactly the same structure was found across the two versions of the security breach scenario, across the two countries with their respective languages, and across the two genders (Multimedia Appendix 1).

Figure 1. Plot of the loadings of the emotional reactions on the second and third dimension as a function of the emotion component to which they belong. A: appraisal; AT: action tendency; BR: bodily reaction; E: expression; SF: subjective feeling; ER: emotion regulation.
View this figure

Predictors of Emotion Dimensions

The second goal was to explore whether personality characteristics predict the empirically identified emotion dimensions, and, if that is the case, which ones (Tables 3-5). The general finding is that the broad personality characteristics from both personality models relate differentially to the 3 emotion dimensions, which confirms that these emotion dimensions are indeed each capturing valid aspects of the emotion processes.

Big Five Personality Model

The two most predictive personality traits are emotional stability and agreeableness. In line with the well-documented negative relationship between emotional stability and negative affectivity [22-24], we observed that emotionally stable participants scored lower on the general emotion dimension and reported a higher salience of the affective components. Agreeable participants showed more proactive action tendencies and tended also to score a bit higher on the general emotion dimension. It is possible that agreeable people, who value warm interpersonal relationships, appraise negatively intended actions by others, like hacking, as more relevant while at the same time are less inclined to react aggressively, which frees more energy to deal constructively with the situation. Moreover, agreeable people are more likely to use cognitive restructuring and problem-solving approaches [22-24]. Conscientiousness and openness only predicted proactive tendencies. Being diligent, efficient, and orderly, which are characteristics of conscientious people, might help to focus on the action tendencies that can provide support in effectively dealing with the situation. The relationship with the personality trait openness was a bit less self-evident. As IoT is a recent and fast-developing field, people who are more curious and open are possibly more likely to understand the full implications of cybersecurity breaches and act accordingly. Extraversion, which has been found in the literature to be predictive of positive but not negative affectivity [22-24], was virtually unrelated to the emotion dimensions (with the exception of a very small although statistically significant relationship with fight/flight tendencies, probably due to the fact that extravert people tend to express their emotions more) [48].

Resilient/Overcontrolled/Undercontrolled Personality Type Model

Internalization problems, which are important characteristics of an overcontrolled personality type, predicted a higher general emotional intensity, more fight/flight tendencies, and a comparatively higher salience of the affective components. This finding indicates that people who are already vulnerable do not succeed in adequately dealing with the emotional experience. Interestingly, resilience, a characteristic of well-functioning people [43], not only predicts more proactive tendencies but also a higher general intensity of emotional reactions and a higher salience of the affective components. Possibly because resilient people can cope better with stressors, they are less defensive and more willing to appraise the seriousness of the situation and accept their own emotional reactions. Finally, aggression, as an indicator of an undercontrolled personality type, is especially predictive of fight/flight action tendencies and relates to a slightly higher salience of the cognitive/motivational components. People who are high on aggression are more willing to blame others and are primed on aggressive reactions [49,50].

Gender and Age

In addition to the personality predictors, we also found that gender and age played a role. Women had a tendency to have more emotionally intense and affective reactions, while men were more likely to show fight/flight reactions. This is in line with earlier findings that females generally have more intense emotional reactions [25-28], experience more emotions in situations of cyberbullying [51], and have more anxiety in situations of hacking [52] and that males tend to react more aggressively [53].

We also found that older individuals were more prone to have proactive and cognitive/motivational reactions, which fits the observation that older individuals have less negative affective experiences and healthier emotion regulation strategies [29-32]. Additionally, intra-individual differences in emotional reactions to cybersecurity breaches are organized and structured in exactly the same way for males and females (Multimedia Appendix 1).

Ambiguous/Nonambiguous Conditions

While the two cybersecurity scenarios showed exactly the same 3-dimensional structure of emotional reactions, quantitative differences were observed, with the nonambiguous situation eliciting more intense and more fight/flight emotional reactions. The nonambiguous situation is possibly experienced more as though one is confronted with a natural person in real life. The situation becomes more relevant for one’s goals and elicits more fight/flight action tendencies rather than the more adaptive proactive reactions.

Country

Finally, while the emotion structure is the same in the two countries, we observed less intense reactions and a higher salience of cognitive/motivational reactions in the Dutch as compared with the UK sample. A speculative explanation could be that the emblematic example of the hacking of a smart security camera has received more media coverage in the United Kingdom [54-57] than in the Netherlands, which has made these scenarios more emotionally salient in the United Kingdom.

Principal Findings

In this study, only the direct emotional reactions to a cybersecurity breach scenario have been studied. A question for future research is whether and to what extent these immediate emotional reactions set the stage for further mental health problems. Being exposed to hacking has been linked to psychopathology [58-61] in the literature and even to suicide in the media [9]. Based on the discovered emotion structure, very different dynamics can be predicted with respect to the role that a hacking situation will play in a person’s life in the longer run.

Those with intense emotional reactions, fight/flight action tendencies, and salient affective components are probably more likely to stay confronted with the situation and its negative ramifications. They experience the situation as emotionally highly relevant, but they tend to react in a way that does not resolve the challenges created by the problem. Moreover, they are additionally confronted with affective reactions that need to be regulated and thus require extra energy. This combination can be considered the psychologically least adaptive reaction, which sets the stage for further mental health complaints.

Those who have no or little negative emotional reactions can only be partially considered better off. They do not have to deal with the negative emotional reactions themselves but also lack the inherent pressure created in the emotion process to take action. Emotions are relevance detectors [5]. Appraising the situation as threatening with its ensuing negative emotional reactions can motivate appropriate action and can therefore be considered adaptive. This interpretation is also supported by the finding that resilient people score higher on the general intensity dimension.

The most adaptive emotional reaction can be considered to be a negative emotional reaction in which the proactive and constructive action tendencies and cognitive-motivational components are the most salient. Such a reaction pattern implies that the seriousness of the situation is adequately appraised and thus that the emotions play their role as relevance detectors. At the same time, actions are prepared that maximize an effective resolution of the situation without the person being overwhelmed by the affective reactions.

Limitations

One of the limitations of this study is that the causal conclusions about the long-term mental health consequences of a cybersecurity breach cannot be investigated with a scenario methodology based on anticipated emotional experiences. However, as experimental research of real emotional experiences is impossible or at least highly limited in this area due to ethical considerations (it is unethical to actually invade the privacy of people by hacking their security camera), scenarios offer an ethically viable and direct way to study the structure of emotional reactions in this uncharted domain. As this study was conducted in Western Europe, further cultural generalizability is yet to be demonstrated. Future research can also study the ecological validity, generalizability, and long-term mental health implications of these findings. Another limitation is the use of self-assessment instruments. While some emotion components can only be studied through self-assessment (like subjective feelings and cognitive appraisals), other components can be studied by objective data (like psychophysiological and expressive changes). In future research, it would be interesting to complement self-reported data with such objective data.

Conclusion

With the increasing interconnections through the internet and especially the recent development of IoT, people are much more at risk of experiencing cybersecurity breaches. Becoming a victim of cybersecurity breaches, with possibly far-reaching consequences for one’s personal and professional life, is becoming more and more likely. When all components of the emotion processes elicited by such cybersecurity breaches are investigated, a replicable 3-dimensional structure emerges that goes beyond the well-known negative affectivity dimension. These dimensions relate differentially to broad personality characteristics, which further validates the need for a multidimensional representation. Depending on the position of the emotional reaction on these three dimensions, very different predictions can be made about the long-term mental health implications of hacking experiences. With this study, a key process that links the occurrence of a cybersecurity breach situation with possible long-term mental health effects has been mapped out.

Acknowledgments

This study is part of a larger research project, Emotion Psychology Meets Cyber Security in IoT Smart Homes (Cocoon), funded by EU FP7 CHIST-ERA funding scheme (European Coordinated Research on Long-term Challenges in Information and Communication Sciences & Technologies ERA-NET) corresponding to grants FWO project G0H6416N-FWOOPR2016009701 and EPSRC EP/P016448/1 and NWO project no.651.002.002. Many thanks to native speaker Arpine Hovasapian, PhD, for proofreading the paper. We thank her for her valuable contribution to the manuscript.

Authors' Contributions

SB and JRJF substantially contributed to analyses and interpretation of data, drafted the article, and gave final approval of the version to be published. SB, JRJF, NMAH, AH, GL, and EBR substantially contributed to conception of the study and design and acquisition of data, critically revised the manuscript for important intellectual content, and gave final approval of the version to be published.

Conflicts of Interest

None declared.

Multimedia Appendix 1

Supplement.

PDF File (Adobe PDF File), 205 KB

Multimedia Appendix 2

Cybersecurity GRID.

PDF File (Adobe PDF File), 83 KB

  1. Security Breach. 2019.   URL: https://www.techopedia.com/definition/29060/security-breach [accessed 2021-03-30]
  2. Threat Report: Protecting people—a quarterly analysis of highly targeted attacks. Proofpoint. 2018.   URL: https://www.proofpoint.com/au/resources/threat-reports/cybersecurity-analysis-report [accessed 2021-03-30]
  3. The most telling cyber security statistics in 2019. Techjury.   URL: https://techjury.net/stats-about/cyber-security/ [accessed 2021-04-26]
  4. Frijda NH. The Emotions. Cambridge: Cambridge University Press; 1986.
  5. Scherer KR. Appraisal considered as a process of multilevel sequential checking. In: Appraisal Processes in Emotion: Theory, Methods, Research. New York: Oxford University Press; 2001.
  6. The Norton Online Family Report. Symantec. 2010.   URL: https://www.broadcom.com/404-symantec [accessed 2018-03-30]
  7. Beaton A, Cook M, Kavanagh M, Herrington C. The psychological impact of burglary. Psychol Crime Law 2008 Jan 04;6(1):33-43. [CrossRef]
  8. Chung MC, Stedmon J, Hall R, Marks Z, Thornhill K, Mehrshahi R. Posttraumatic stress reactions following burglary: the role of coping and personality. Traumatol Int J 2014 Jun;20(2):65-74. [CrossRef]
  9. Baraniuk C. Ashley Madison ˝suicides˝ over website hack. BBC News. 2015 Aug 24.   URL: https://www.bbc.com/news/technology-34044506 [accessed 2019-12-10]
  10. Gaps in European cyber education and professional training: education, training, awareness, cyber ranges. European Cyber Security Organisation. 2017.   URL: https://ecs-org.eu/documents/publications/5fdb282a4dcbd.pdf [accessed 2021-03-30]
  11. Vigdor N. Somebody's watching: hackers breach ring home security cameras. The New York Times. 2019 Dec 15.   URL: https://www.nytimes.com/2019/12/15/us/Hacked-ring-home-security-cameras.html [accessed 2021-03-30]
  12. Buntz B. 5 Cybersecurity lessons related to IP security cameras. IoT World Today. 2019 Aug 31.   URL: https://www.iotworldtoday.com/2019/08/31/5-cybersecurity-lessons-related-to-ip-security-cameras/ [accessed 2021-03-30]
  13. Watson D, Clark LA, Tellegen A. Development and validation of brief measures of positive and negative affect: the PANAS scales. J Personality Soc Psychol 1988;54(6):1063-1070. [CrossRef]
  14. Fontaine JRJ, Scherer KR, Soriano C. Components of Emotional Meaning: A Sourcebook. Oxford: Oxford University Press; 2013.
  15. Frijda NH. Impulsive action and motivation. Biol Psychol 2010 Jul;84(3):570-579. [CrossRef] [Medline]
  16. Fontaine JRJ, Scherer KR, Roesch EB, Ellsworth PC. The world of emotions is not two-dimensional. Psychol Sci 2007 Dec;18(12):1050-1057. [CrossRef] [Medline]
  17. Goldberg LR. The development of markers for the Big Five factor structure. Psychol Assess 1992;4(1):26-42. [CrossRef]
  18. Robins RW, John OP, Caspi A, Moffitt TE, Stouthamer-Loeber M. Resilient, overcontrolled, and undercontrolled boys: three replicable personality types. J Pers Soc Psychol 1996 Jan;70(1):157-171. [CrossRef] [Medline]
  19. Donnellan MB, Robins RW. Resilient, overcontrolled, and undercontrolled personality types: issues and controversies. Soc Personality Psychol Compass 2010;4(11):1070-1083. [CrossRef]
  20. Schindler S, Querengässer J. Coping with sadness—how personality and emotion regulation strategies differentially predict the experience of induced emotions. Personality Indiv Diff 2019 Jan;136:90-95. [CrossRef]
  21. Sander D, Scherer KR. The Oxford Companion to Emotion and the Affective Sciences. Oxford: Oxford University Press; 2009.
  22. Carver CS, Connor-Smith J. Personality and coping. Annu Rev Psychol 2010;61:679-704. [CrossRef] [Medline]
  23. Connor-Smith JK, Flachsbart C. Relations between personality and coping: a meta-analysis. J Pers Soc Psychol 2007 Dec;93(6):1080-1107. [CrossRef] [Medline]
  24. Hughes DJ, Kratsiotis IK, Niven K, Holman D. Personality traits and emotion regulation: a targeted review and recommendations. Emotion 2020 Feb;20(1):63-67. [CrossRef] [Medline]
  25. Bradley MM, Codispoti M, Sabatinelli D, Lang PJ. Emotion and motivation II: sex differences in picture processing. Emotion 2001;1(3):300-319. [CrossRef]
  26. Brebner J. Gender and emotions. Personality Indiv Diff 2003 Feb;34(3):387-394. [CrossRef]
  27. Deng Y, Chang L, Yang M, Huo M, Zhou R. Gender differences in emotional response: inconsistency between experience and expressivity. PLoS One 2016 Jun 30;11(6):e0158666 [FREE Full text] [CrossRef] [Medline]
  28. Fischer AH, Rodriguez Mosquera PM, van Vianen AEM, Manstead ASR. Gender and culture differences in emotion. Emotion 2004 Mar;4(1):87-94. [CrossRef] [Medline]
  29. Mroczek DK. Age and emotion in adulthood. Curr Dir Psychol Sci 2016 Jun 24;10(3):87-90. [CrossRef]
  30. John OP, Gross JJ. Healthy and unhealthy emotion regulation: personality processes, individual differences, and life span development. J Pers 2004 Dec;72(6):1301-1333. [CrossRef] [Medline]
  31. Johnson SJ, Machowski S, Holdsworth L, Kern M, Zapf D. Age, emotion regulation strategies, burnout, and engagement in the service sector: advantages of older workers. Rev Trabajo y las Organizaciones 2017;33(3):205-216. [CrossRef]
  32. Hay EL, Diehl M. Emotion complexity and emotion regulation across adulthood. Eur J Ageing 2011 Sep 17;8(3):157-168 [FREE Full text] [CrossRef] [Medline]
  33. Świątkowski W, Dompnier B. Replicability crisis in social psychology: looking at the past to find new pathways for the future. Int Rev Soc Psychol 2017 May 02;30(1):111. [CrossRef]
  34. Roberts C, Gilbert E, Allum N, Eisner L. Research synthesis. Public Opin Q 2019 Nov 12;83(3):598-626. [CrossRef]
  35. Likert R. A technique for the measurement of attitudes. Arch Psychol 1932;140:1-55.
  36. Lovibond PF, Lovibond SH. The structure of negative emotional states: comparison of the Depression Anxiety Stress Scales (DASS) with the Beck Depression and Anxiety Inventories. Behav Res Ther 1995 Mar;33(3):335-343. [CrossRef]
  37. Bryant FB, Smith BD. Refining the architecture of aggression: a measurement model for the Buss-Perry Aggression Questionnaire. J Res Personality 2001 Jun;35(2):138-167. [CrossRef]
  38. Diamond PM, Wang EW, Buffington-Vollum J. Factor structure of the Buss-Perry Aggression Questionnaire (BPAQ) with mentally ill male prisoners. Crim Justice Behav 2016 Jun 30;32(5):546-564. [CrossRef]
  39. Diamond PM, Magaletta PR. The short-form Buss-Perry Aggression Questionnaire (BPAQ-SF): a validation study with federal offenders. Assessment 2006 Sep 26;13(3):227-240. [CrossRef] [Medline]
  40. Buss AH, Perry M. The Aggression Questionnaire. J Personality Soc Psychol 1992 Sep;63(3):452-459. [CrossRef]
  41. Alessandri G, Vecchione M, Caprara G, Letzring TD. The Ego Resiliency Scale Revised. Eur J Psychol Assess 2012 Nov;28(2):139-146. [CrossRef]
  42. Vecchione M, Alessandri G, Barbaranelli C, Gerbino M. Stability and change of ego resiliency from late adolescence to young adulthood: a multiperspective study using the ER89-R Scale. J Pers Assess 2010 May 19;92(3):212-221. [CrossRef] [Medline]
  43. Block J, Kremen AM. IQ and ego-resiliency: conceptual and empirical connections and separateness. J Personality Soc Psychol 1996;70(2):349-361. [CrossRef]
  44. Frijda NH, Kuipers P, ter Schure E. Relations among emotion, appraisal, and emotional action readiness. J Personality Soc Psychol 1989;57(2):212-228. [CrossRef]
  45. Frijda NH. Emotion experience. Cogn Emotion 2005 Jun;19(4):473-497. [CrossRef]
  46. Leventhal H, Scherer KR. The relationship of emotion to cognition: a functional approach to a semantic controversy. Cogn Emotion 1987 Mar;1(1):3-28. [CrossRef]
  47. Lazarus RS, Folkman S. Stress, Appraisal, and Coping. New York: Springer Publishing Company; 1984.
  48. Riggio HR, Riggio RE. Emotional expressiveness, extraversion, and neuroticism: a meta-analysis. J Nonverbal Behav 2002;26(4):195-218. [CrossRef]
  49. Elison J, Garofalo C, Velotti P. Shame and aggression: theoretical considerations. Aggress Violent Behav 2014 Jul;19(4):447-453. [CrossRef]
  50. Zimmer-Gembeck MJ, Nesdale D, Webb HJ, Khatibi M, Downey G. A longitudinal rejection sensitivity model of depression and aggression: unique roles of anxiety, anger, blame, withdrawal and retribution. J Abnorm Child Psychol 2016 Oct 27;44(7):1291-1307. [CrossRef] [Medline]
  51. Balakrishnan V. Actions, emotional reactions and cyberbullying—from the lens of bullies, victims, bully-victims and bystanders among Malaysian young adults. Telematics Informat 2018 Aug;35(5):1190-1200. [CrossRef]
  52. Elhai JD, Chai S, Amialchuk A, Hall BJ. Cross-cultural and gender associations with anxiety about electronic data hacking. Comput Human Behav 2017 May;70:161-167. [CrossRef]
  53. Bettencourt BA, Miller N. Gender differences in aggression as a function of provocation: a meta-analysis. Psychol Bull 1996 May;119(3):422-447. [CrossRef] [Medline]
  54. Gibbs S. The Guardian. 2014 Nov 20.   URL: http://www.theguardian.com/technology/2014/nov/20/webcam-russians [accessed 2020-10-09]
  55. Noor P. Ring hackers are reportedly watching and talking to strangers via in-home cameras. The Guardian. 2019 Dec 13.   URL: http:/​/www.​theguardian.com/​technology/​2019/​dec/​13/​ring-hackers-reportedly-watching-talking-strangers- in-home-cameras [accessed 2020-10-09]
  56. Paul K. Ring sued by man who claims camera was hacked and used to harass his kids. The Guardian. 2019 Dec 27.   URL: http://www.theguardian.com/technology/2019/dec/27/ring-camera-lawsuit-hackers-alabama [accessed 2020-10-09]
  57. Weaver M. UK moves to shut down Russian hackers streaming live British webcam footage. The Guardian. 2014 Nov 20.   URL: http://www.theguardian.com/technology/2014/nov/20/webcam-hackers-watching-you-watchdog-warns [accessed 2020-10-09]
  58. Kopecký K, Szotkowski R. Cyberbullying, cyber aggression and their impact on the victim—the teacher. Telematics Informat 2017 May;34(2):506-517. [CrossRef]
  59. Gross ML, Canetti D, Vashdi DR. The psychological effects of cyber terrorism. Bull At Sci 2016 Aug 04;72(5):284-291 [FREE Full text] [CrossRef] [Medline]
  60. Gross ML, Canetti D, Vashdi DR. Cyberterrorism: its effects on psychological well-being, public confidence and political attitudes. J Cybersecurity 2017;3(1):49-58. [CrossRef]
  61. Canetti D, Gross M, Waismel-Manor I, Levanon A, Cohen H. How cyberattacks terrorize: cortisol and personal insecurity jump in the wake of cyberattacks. Cyberpsychol Behav Soc Netw 2017 Feb;20(2):72-77. [CrossRef] [Medline]


DASS-21: Depression, Anxiety and Stress Scale–21 Item
IoT: Internet of Things
IPIP-50: International Personality Item Pool 50
PANAS: positive and negative affect schedule


Edited by R Kukafka; submitted 09.10.20; peer-reviewed by A Teles, V Franzoni; comments to author 14.12.20; revised version received 05.02.21; accepted 16.03.21; published 12.05.21

Copyright

©Sanja Budimir, Johnny R J Fontaine, Nicole M A Huijts, Antal Haans, George Loukas, Etienne B Roesch. Originally published in the Journal of Medical Internet Research (https://www.jmir.org), 12.05.2021.

This is an open-access article distributed under the terms of the Creative Commons Attribution License (https://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work, first published in the Journal of Medical Internet Research, is properly cited. The complete bibliographic information, a link to the original publication on https://www.jmir.org/, as well as this copyright and license information must be included.