Employees' noncompliance with information security policy and rules is a serious impediment to the effectiveness of security programs in organizations. The extant information security studies have used General Deterrence Theory (GDT) to investigate noncompliant information security behavior, yet most of the findings have not been effective in practice due to a lack of strong theoretical underpinning. Neglecting criminal propensity of the potential perpetrator has been identified to be one of the theoretical weaknesses of GDT-based studies. Any attempt to explain noncompliant information security behavior in organizational context, demands a well grounded framework to explain why employees transgress information security policies and rules. The purpose of this study was to empirically investigate the link between self-control (criminal propensity), deterrence perceptions, and noncompliant information security behavior. Criminal propensity was operationalized using the three perspectives of self-control: personality trait, social bond, and self-generated inhibitions. This study then examined the influence of the three self-control variables on deterrence perceptions (certainty, severity, and celerity). Further, the study investigated the impact of deterrence perceptions on noncompliant information security behavior. Data collected from 421 employees in a Southern USA-based company was used to test the relationships between research model constructs using SPSS's Amos structural equation modeling software package. Results indicated that employees' perceptions on all three dimensions of deterrents were positively impacted by self-control based on self-generated inhibitions. The results also showed that only employees' perceptions on certainty of apprehension and celerity of punishment were positively impacted by social bond self-control. No significant relationships were established between deterrence perceptions and personality trait self-control. Further, employees' perceptions on certainty of apprehension and celerity of punishment were negatively associated with noncompliant information security behavior. The results also indicated that severity of punishment was not a significant predictor of noncompliant information security behavior. The uniqueness of this study provided evidence on the importance of incorporating criminal propensity in GDT-based studies. The current study also highlighted the importance of celerity of punishment dimension, which is highly neglected by GDT-based information security studies.

The purpose of this research is to identify the forces that impact the intention of employees to misuse the Internet at the workplace, called cyberloafing. Although cyberloafing literature has suggested several antecedents that predict cyberloafing such as job attitudes, organizational characteristics, work stressors, locus of control (Blanchard & Henle, 2008; Henle & Blanchard, 2008; Liberman, Seidman, McKenna, & Buffardi, 2011), this research adopted attitude, subjective norm, perceived behavioral control, and organizational citizenship behavior to predict the intention to cyberloaf. Additionally, this research adopted organizational justice and the mechanisms of general deterrence theory as moderating variables to better understand the relationship between attitude, subjective norm, perceived behavioral control, organizational citizenship behavior, and the intention to cyberloaf. We believe it is essential to investigate the antecedents of cyberloafing to help predict its existence and occurrence. The existing research, which examined employees' abuse of the Internet, remains greatly atheoretical; thus, it supplies limited insights to researchers as to why cyberloafing continues to take place (Lim, 2002). It is important to recognize what motivates employees to engage in cyberloafing for organizations to implement specific polices and intervention programs to limit or deter its occurrence. This is necessary, as employees' abuse of the Internet can negatively affect an organization through decreased profitability, reduced productivity levels, and exposure to a diverse range of legal liabilities (Liberman et al., 2011). The results of the study showed that an employee's attitude and subjective norm can significantly predict his or her intention to engage in cyberloafing. Both of the dimensions of general deterrence theory (punishment severity and certainty) significantly moderated the relationship between attitude, subjective norm, and the intention to cyberloaf. Additionally, punishment severity significantly moderated the relationship between perceived behavioral control and the intention to cyberloaf. From this study, we concluded that cyberloafing is a social phenomenon that needs to be studied further to fully comprehend the organizational contexts, motivational factors, and consequences. Our study should be analyzed as a positive step toward learning the key components that can influence employees' intentions to abuse the Internet in the workplace.

This study attempted to identify ways to improve voluntary compliance and minimize taxpayer burden, but also tries to understand the behavior of taxpayers’ compliance given the compliance regimen. Most explicitly, it attempted to identify ways to improve payment compliance using regimens already utilized in other parts of the tax code. The research question was whether different tax regimes, such as safe harbor, can change the behavior of employment tax payment for small business or self-employed taxpayers. The idea was to determine if a safe harbor provision can reduce the proclivity of authorized individuals to implement a payroll tax dilemma strategy and whether or regimen can reduce payment noncompliance in time of economic distress. To answer the research question, an online experiment was employed. The experimental design was an impact study. The population of interest in this study was all authorized individuals from small and self-employed firms. The sample size totaled 205, and it was based on the a-priori sample size calculation. Analysis of variance (ANOVA) was chosen as the data analysis technique, but other nonparametric test and logistic regression models were used to further analyze the data. This study showed that for subjects who did not subscribed to safe harbor provision but experienced an increased probability of apprehension increased their payment compliance. Also, the availability of a safe harbor provision lead to a large numbers to a safe harbor provision subscription in order to avoid enforcement. This study was able to show that individuals were willing to improve their payment compliance rate when enforcement was increased. The General Deterrence Theory explains that increased deterrence will lead to higher compliance. The study showed a 10 percent improvement in payment compliance when safe harbor was implemented. The results from this study also suggest that provisions such as a safe harbor can be a method of reducing filing costs and audit costs and ultimately taxpayer burden. On the other hand, the results of this study were inconclusive in determining if such provisions can improve payment compliance. Nevertheless, the outcome of this study can improve timing and accuracy of employment taxes payments and it may improve the accuracy of employment tax payment.

Denna uppsats undersöker intentionen att använda smarta enheter i tjänst hos personal i Försvarsmakten, som är en organisation med högt behov av verksamhetssäkerhet. Verksamhetens säkerhet är direkt beroende av hur personal inom verksamheten agerar utifrån ett säkerhetsperspektiv. Syftet är att belysa hur Försvarsmakten förmedlar informationssäkerheten kring smarta enheter och hur personalen påverkas utifrån det. Det empiriska materialet har samlats in genom en kvalitativ fallstudie i form av semistrukturerade intervjuer med två olika grupper. Resultatet analyseras med hjälp av ett teoretiskt ramverk bestående av Protection Motivation Theory (PMT) och General Deterrence Theory (GDT) i syfte att belysa vad det är som avgör personalens beteende. Teorierna utgår från att beteendet påverkas av rädsla för sanktioner eller för hot mot verksamhet och individ. Resultatet visar att aspekter från de båda teorierna är närvarande hos personalen och att det som påverkar den enskildes agerande beror på vilken information organisationen delgett och individernas personliga uppfattningar. Personalen är medveten om de risker som följer av användningen av smarta enheter, men enheterna används ändå i stor utsträckning. Faktorer som spelar in i intentionen är kunskapsnivån, befattningen individen besitteroch arbetsområdet individen verkar inom. / This paper examines the intention to use smart devices by staff in the Swedish Armed Forces,which is an organization with a high need for operational security. The security of the business isdependent on how staff within the business behave, in a security perspective. The purpose is toelucidate how the Swedish Armed Forces conveys information security regarding smart devicesand how their staff are affected. The empirical material has been collected through a qualitativecase study in the form of semi-structured interviews with two different groups. The results areanalyzed using a theoretical framework consisting of Protection Motivation Theory (PMT) andGeneral Deterrence Theory (GDT) in order to elucidate what determines the behavior of the staff.The theories are based on the fact that behavior is affected by fear of sanctions or threats to thebusiness and individuals. The result shows that aspects in both theories are present in the staffbehavior. What influences the individual's actions depends on what information the organizationhas shared and the personal perceptions of the individuals. Factors that play into the intention arethe level of knowledge, the position the individual possesses and the area of work the individualoperates within.

Information har idag kommit att bli så viktigt att det av många aktörer kallas för den nya digitala oljan, och med anledning av just detta är information idag en av de främsta tillgångar en organisation kan besitta. För att skydda informationen lägger organisationer massiva summor pengar på tekniska och fysiska åtgärder. Tillsammans med dessa åtgärder utfärdas även interna bestämmelser och riktlinjer för hur IT-system och information får eller inte får hanteras. Trots detta sker både intrång och andra säkerhetsrelaterade incidenter som kan härledas till mänskligt felaktigt beteende, eller den så kallade mänsklig faktorn. I den här uppsatsen har därför författaren gjort en djupdykning i ämnet för att studera vilka samband som kan finnas mellan beteendevetenskapliga teorier och efterlevnad av informationssäkerhet. Med kvalitativa metoder har bland annat litteraturstudier genomförts för att ta reda på vilka teorier som är mest relevanta i sammanhanget. Intervjuer har sedan nyttjats för att bredda författarens uppfattning om vilka faktorer som kan påverka mänskligt beteende. De personer som intervjuats har bland varit yrkesverksamma som säkerhetschefer, säkerhetskyddshandläggare och ledande forskare inom det specifika området.

The present study examines General Deterrence Theory (GDT) and its "parent," Rational Choice Theory (RCT), in an information security setting, assessing the behavioral intent to violate organizational policy under varying levels of certainty, severity and celerity of negative sanction. Also assessed is the individual computer user's time orientation, as measured by the Consideration of Future Consequences (CFC) instrument (Strathman et. al, 1994). How does rational consideration of violation rewards influence the impact of sanctions on individuals? How does time orientation impact intent to violate security policy? How do these operate in an IS context? These questions are examined by assessing the responses of university students (N = 443) to experimental manipulations of sanctions and rewards. Answering vignettes with the factorial survey method, intent to violate is assessed in a setting of Internet piracy of electronic textbooks while being monitored by computer security systems. Findings show that, although traditional GDT variables and reward impact intent to violate, CFC does not cause the hypothesized moderating effect on these variables. However, post-hoc analysis reveals a direct effect of time orientation on behavioral intent, as well as a weak moderating effect opposite of the hypotheses, indicating increased time orientation positively moderates, rather than negatively moderates, the impact of reward on intent to violate. Implications for theory and practice, and future research directions, are discussed.