Assessing Ethical Severity of e-Learning Systems Security Attacks

Assessing Ethical Severity of e-Learning Systems Security Attacks

YAIR LEVY

Graduate School of Computer and Information Sciences Nova Southeastern University

Ft. Lauderdale, FL 33314, USA Tel: 954-262-2006 Fax: 954-262-3915 E-mail: levyy@nova.edu

MICHELLE M. RAMIM

Huizenga School of Business and Entrepreneurship Nova Southeastern University

Ft. Lauderdale, FL 33314, USA Tel: 954-262-5000 E-mail: ramim@nova.edu

RAYMOND A. HACKNEY

Business School Brunel University Uxbridge, UB8 3PH, UK Tel: +44 (0)1895 265428 E-mail: Ray.Hackney@brunel.ac.uk

ABSTRACT

Security and ethical issues with information systems (IS) are important concerns for most organizations.

However, limited attention has been given to unethical behaviors and severity of cyber-security attacks, while these instances appear to be critically important. Although managers have been embracing e-learning systems for training and virtual-team collaborations, little is known about motivations for cyber-security attacks on such systems.

Our research includes quantitative and qualitative study of 519 end-users who rated the ethical severity of five common cyber-security attacks. This study investigated five types of security attacks for differences in perceived severity according to gender, academic level, and age. Our findings reveal that the majority of users (90%) reported their sense of severity as unethical across all five cyber-security attacks, while only a small minority of users (3.24%) reported these cyber-security attacks to be ethical. This study also presents a further grounded analysis through follow-up interviews.

Keywords: perceived ethical severity, ethics of cyber-security attacks, unauthorized Internet activities, severity

of unethical behaviors

Assessing Ethical Severity of e-Learning Systems Security Attacks

Yair Levy ¹ , Michelle M. Ramim ² , and Raymond A. Hackney ³

1 Graduate School of Computer and Information Sciences, Nova Southeastern University, Ft. Lauderdale, FL, USA

2 Huizenga School of Business and Entrepreneurship, Nova Southeastern University, Ft. Lauderdale, FL, USA

3 Business School, Brunel University, Uxbridge, UK

ABSTRACT

Security and ethical issues with information systems (IS) are important concerns for most organizations.

However, limited attention has been given to unethical behaviors and severity of cyber-security attacks, while these instances appear to be critically important. Although managers have been embracing e-learning systems for training and virtual-team collaborations, little is known about motivations for cyber-security attacks on such systems.

Our research includes quantitative and qualitative study of 519 end-users who rated the ethical severity of five common cyber-security attacks. This study investigated five types of security attacks for differences in perceived severity according to gender, academic level, and age. Our findings reveal that the majority of users (90%) reported their sense of severity as unethical across all five cyber-security attacks, while only a small minority of users (3.24%) reported these cyber-security attacks to be ethical. This study also presents a further grounded analysis through follow-up interviews.

Keywords: perceived ethical severity, ethics of cyber-security attacks, unauthorized Internet activities, severity of unethical behaviors

“A man's ethical behavior should be based effectually on sympathy, education, and social ties.”

- Albert Einstein (1879-1955)

INTRODUCTION

The seriousness of unethical behavior in today’s society is overwhelmingly documented, especially with regard to IS management and security [1]. Moreover, rapid technological developments have generated much attention in the news and other media outlets. Reports of unethical behaviors, such as identity theft and cyber-attacks, are highly sensationalized. In the U.S. alone the Federal Bureau of Investigation (FBI) reported, from a survey of 2066 organizations in 2005, that cyber-attacks cost businesses some $67.2 billion annually in security expenditures [2]

and in the UK, Telewest reported that individuals spend over $3 billion annually on cyber-security [3] – the enormous impact of these IS breaches is well documented. As a consequence, these emerging unethical behaviors need to be investigated and contained. Himma [4] argued that cyber-security attacks are totally unjustified on ethical grounds and perpetrators must be identified and appropriate sanctions be imposed. An earlier study attempts to achive goes some way towards achieving this objective through a consideration of how recipients of information may behave with regard to their ethics, supervisory level, and legal requirements [5]. However, it appears that very limited attention has been given to investigating the ethical severity of cyber-security attacks and emerging employees’ unethical behaviors within the context of growing organizational Web-based systems.

Given the news media hype about the global economic downturn, some employees face intense pressure to meet

expectations from their organizations and various stakeholders [6]. Additionally, corporate social responsibility

appears to be a façade rather than a sincere practice in most business organizations [7]. A surge in incidents of

unethical behavior has been reported in the U.S. news media, for example, the Bernie Madoff Ponzi scheme, the

2008 Singapore Grand Prix crash, and the ACORN scandal. Legal investigations of these incidents revealed that

employees were pressured to act unethically and illegally in order to reap personal gains. Despite the public

attention paid to these scandals, it appears that unethical behavior still occurs in significant circumstances.

Nowadays, user misconduct is more likely to involve the use of IS resources. Furthermore, some individuals believe that IS misuse is acceptable. Rogers [8], Cronan, Foltz, and Jones [9], and Harris [10] found that individuals are using advanced information technology (IT) tools to engage in unethical behavior. Unethical behavior is defined as any behavior that “violates social norms, whether or not such behavior also violates the law” [11]. While measuring unethical behavior appears to be a daunting task, measuring individuals’ perceptions about the severity of various unethical behavior can provide indication about their ethical decision making. Furthermore, Rogers [8] and Harris [10] indicated that future managers are learning about specific technology breaching techniques in some IT courses (i.e. hacking skills, approaches for installing sniffing software and for the identification of passwords, developing denial-of-service (DoS) attacks, and learning how to manipulate weaknesses with Web connections).

The number of cyber-security incidents has climbed sharply over the past two decades, though only a small percentage of such attacks is reported to the public [10]. It was reported that the majority of computer hackers are below the age of 30, pointing to the need to investigate users in that age group and their perceptions about unethical behaviors, specifically security attacks [10].

The motivation of future managers to engage in unethical behavior might be fueled by the temptation to graduate quickly in order to obtain a high-paying managerial position [12], availability of convenient IT tools [13], a sense of entitlement without consequences, and peer pressure, as well as a lack of understanding of the severity of their actions [14]. Research has shown that business students engaging in misconduct in their academic career are more likely to engage in unethical behavior during their professional managerial career [12]. Thus, the focus of this work was to investigate future managers’ perceptions about the severity level of key IS attacks in the context of e- learning systems, and to increase awareness for e-learning security issues, as well as their severity among IS managers and researchers. Following the philosophy set by Leonard, Cronan, and Kreie [15] on investigating IS related ethics, the nucleus idea behind our investigation posits that if individuals perceive the severity of key IS security attacks to be low, then they might be more likely to engage in or seek help to engage in such unethical behaviors.

E-learning systems originated from computer communication applications that were developed in the early 1980s. Such systems have shown tremendous growth over the past three decades, starting mainly in higher education and quickly moving into corporate organizations and government agencies. In 2010, more than 5.6 million U.S. students enrolled in at least one online course [16]. E-learning enrollment in higher education has proliferated steadily by about 13% annually or 758,000 students annually over the past few years [17]. Additionally, e-learning has captured about 32% of the adult education market [18]. However, e-learning systems have not just been the learning platform for educational institutions. E-learning has furthermore expanded significantly into delivery of various training modules for medical, corporate, and even military training units. In the medical field, physicians and nurses are taking refresher courses and certificate trainings via e-learning systems, while many businesses are offering their human resources (HR) training sessions via e-learning systems [19]. Within the corporate and the service sector, e-learning systems are used by most marketing, sales, and research and development units to train managers and employees yearly. In like manner, for over a decade the U.S. Government has been running an internal e-learning system to deliver learning modules and develop skills of its employees (www.usalearning.gov).

In light of the fact that substantial evidence affirms the trend of e-learning system as a critical ingredient of the business model, organizations are faced with the challenge of providing a secure and accountable e-learning environment for their employees. Although there is a limited body of research on security attack prevention strategies for Web-based systems, cyber-security does pose a real concern [20, 21], so much so that the U.S.

government has appointed a czar to help coordinate strategic efforts to reduce cyber-security threats (i.e. malware, spoofing, phishing, and botnets, to name a few) [22]. Cyber-security attacks were also found to have a profound crippling impact on the e-learning systems of higher educational institutions, while their implications for corporate organizations are vastly unknown [23]. Many scholars have demonstrated the significance of investigating cyber- security attacks on e-learning systems and the need to better understand their nature and ethical severity from the perspective of impostors [24, 25].

According to Shaw [26], “ethics deals with individual characters and moral rules that govern and limit our

conduct”. He added that ethics “investigates questions of right and wrong, fairness and unfairness, good and bad,

duties and obligation, justice and injustice, as well as responsibility and the value that should guide us” [26]. Cronan

et al. [9], Leonard et al. [15], and Dorantes, Hewitt, and Goles [27] noted that ethical behavior is gender dependent,

indicating significant differences between males and females in both their ethical perceptions and behaviors. They

indicated that in general, males appear to be less ethically driven, whereas females appear to be more ethically

driven. Moreover, age and academic level were also found to show differences related to perceptions about ethical

behaviors. Kreie and Cronan [28] noted that “a person’s characteristics, such as gender, age, and education, may

also affect one’s view of what is ethical” [28]. Although such investigations appear to indicate gender, age, and

academic level differences with ethical perceptions, not much is known about such differences within the context of cyber-security attacks, especially in popular Web-based systems such as e-learning systems.

The aim of this study was to investigate individuals’ sense of ethical severity of e-learning security attacks and unauthorized activities. Although there are several specific techniques of cyber-attacks, as noted, the focus of this work is about the general sense of ethical severity of engaging in such an attack, rather than a specific cyber-attack technique. The three key objectives of this study were:

a) To assess the extent that individuals perceive the severity of attacking an e-learning server and unauthorized activities as ethical

b) To assess the demographics of those who perceive the severity of attacking an e-learning server and unauthorized activities as ethical and as unethical

c) To assess if there are any significant differences on such ethical perceptions based on gender, age, and academic level

The significance of this research is substantial for institutions and businesses as it provides evidence on how individuals perceive the severity of attacking an e-learning server and unauthorized activities.

BACKGROUND Ethical Severity of Attacks and Unauthorized Activities

A substantial rise has been observed in cyber-attacks over the years [29]. However, the required level of sophisticated technological skills to unleash such cyber-attacks appears to have fallen over time. Saydjari [30]

reported that cyber-attacks are mainly attributed to the ease of committing such attacks, due to newly available toolkits that are freely downloadable over the Internet. Ramim and Levy [23] documented a case of a devastating cyber-attack that crippled an institution’s e-learning operations and caused substantial damage to their reputation.

Such an incident implies that businesses and organizations must be aware of the threats to their e-learning systems from cyber-attacks in order to avoid damages, loss of confidence, and legal liability. As such, the first e-learning security attack selected for this study was a general ‘attack on the server,’ and the aim was to assess individuals’

sense of ethical severity about such an attack.

The second unauthorized activity in this study deals with the interception of e-mails. Although e-mail interception is a general issue, most e-learning systems have internal e-mail systems to enable specific communication between the individual learner and the module or course instructor. The focus of this investigation was the interception of such internal e-mails. Intercepting e-mails is defined as reading, altering, blocking, and/or deleting e-mails sent to someone else. E-mail interception has also been easier than ever, due to rising surveillance applications provided to businesses seeking to intercept employee communications, and others seeking to intercept domestic communications of their spouses or partners [31]. We must emphasize that for some e-learning modules, such as training on proprietary product development or new corporate innovations, intercepting internal e-learning systems e-mails may provide additional knowledge or solutions that are not known otherwise, or be an exercise in corporate espionage. This study targeted the individuals’ sense of ethical severity associated with e-mail interception within e-learning systems.

The third unauthorized activity in this study deals with unauthorized file sharing. There has been substantial work on unauthorized file sharing, where the vast majority of such research investigates the distribution of music files over the Internet via peer-to-peer applications [32]. Unauthorized file sharing can be done by individuals during various e-learning activities. However, unauthorized file sharing during exams appears to be one of the most common unethical violations during e-learning exams [33]. We must emphasize that file sharing during exams may provide personal gains for employees who are required to complete e-learning exams for the purpose of certifications or other corporate requirements. For example, employees who are taking HR training exams for certifications or medical professionals taking refresher exams may be tempted to request and share files. As such, the focus of this investigation was on assessing individuals’ sense of ethical severity related to unauthorized file sharing during e-learning exams.

Unauthorized access was the fourth unethical activity this study investigated. According to Stallings [34], one

of the key intruder-based attacks is the “acquisition of privileges or performance of actions beyond those that have

been authorized” (p. 306). User access permission and general system authentication have been a great challenge,

while newly released technologies such as biometrics and multi-biometrics systems appear promising. Unauthorized

access by learners of e-learning systems or e-learning materials has also been a challenge [24, 35, 36]. Likewise, we

must emphasize here that given the significant increase in e-learning systems use in corporate organizations, the use

of such systems for housing of corporate proprietary training information has increased as well. Thus, the aim of this

work was also to study individuals’ sense of ethical severity related to unauthorized access to e-learning systems.

According to the 2009 report of the Internet Crime Complaint Center ( www.ic3.gov) [37], spoofing attacks were among the top reported Internet crimes. A spoofing attack is defined as a situation where an individual impersonates someone else to commit an unethical act. One spoofing example within the context of e-learning can occur when an individual posts a flaming message to a discussion board, and impersonates another individual by signing with that other individual’s name (A simple example of this can be done on discussion boards that allow anonymous posting). According to Dinev [38], a spoofing attack is a very serious Internet fraud. He also noted that such attacks can “cause significant business, personal, and social damage” (p. 82). Existing literature has documented the ease with which spoofing attacks can be carried out with very limited technical knowhow [39].

Although to our knowledge no specific research has been done on spoofing attacks in e-learning systems, protecting against such attacks within such environments have been documented [24], while instances of such attacks on e- learning systems have been observed. This study also included spoofing as one of the e-learning security attacks investigated.

To summarize, the five common components of security attacks and unauthorized activities that this study investigated are attacks on the server, e-mail interception, unauthorized file sharing, unauthorized access, and spoofing attacks. As this study is defined by e-learning security, descriptions of the five security attacks and unauthorized activities were communicated to the study participants. The five e-learning security attacks and unauthorized activities are noted in Table I. The descriptions were provided to participants in the introduction section of the survey. The scale used to assess the participants’ sense of ethical severity was a 5-point Likert-type scale with the following format: 1= ‘ethical’, 2 = ‘somewhat ethical’, 3=‘slightly unethical’, 4=‘unethical’, and 5=‘very unethical’.

TABLE 1. Five E-learning Security Attacks and Unauthorized Activities Investigated Attack or Unauthorized

Activity Name

Description

1. Attacks on the Server Initiating a cyber-attack on the e-learning server via the Internet and rendering it unavailable

2. E-mail Interception Reading, altering, blocking, and/or deleting e-mails sent to someone else in e-learning systems

3. Unauthorized File Sharing Unauthorized file sharing during e-learning exams 4. Unauthorized Access Unauthorized access to e-learning systems

5. Spoofing Attacks Attacks by individuals who impersonate their peers to falsify data

METHODOLOGY, DATA ANALYSIS, AND RESULTS

We sampled 1,100 students attending online courses at the undergraduate and graduate level during the six terms prior to Fall 2011. The target survey participants consisted of business students attending three higher educational institutions in the southeastern region of the US including two public institutions (a state university & a state community college) and a private university. The reason for selecting the three educational institutions was to diversify the sample to further generalize the results. A total of 519 responses were received, which represents about 47% of the response rate. Responses came from 268 females (51.6%) and 251 males (48.4%). The academic level based on undergraduate and graduate level was about half, with 261 participants (50.3%) undergraduate and 258 (49.7%) graduate students. The majority of the students, 434 (83.6%), were under the age of 34. In terms of the institutional distribution, about 17% of our study participants were from the state community college, about 36%

from the private university and the rest, about 47%, attended the state university. Figure 1 illustrates a summary of

the demographic distribution of the study participants

FIGURE 1. Demographic Distribution of Study Participants (N=519) Quantitative Results

The central aim of this study was to assess individuals’ perceived ethical severity across the five types of e- learning security attacks. We started by conducting an overall frequency assessment across all five security attacks and unauthorized activities. To simplify our discussion of the results, we defined an ‘ethical individual’ as one who reported either ‘4’ (unethical) or ‘5’ (very unethical), when asked to rate the ethical severity of the security attacks and unauthorized activities. Similarly, we defined an ‘unethical individual’ as one who reported either ‘1’ (ethical) or ‘2’ (somewhat ethical) when asked to rate such unethical activities. It is important to note that the severity of attacking the e-learning server is equivalent to the severity of an attempt to shut down the organization’s e-learning program. To put this in perspective, an attempt to attack an e-learning server is comparable to activating the fire alarm at the university campus, so that classes will be cancelled, exams will not be conducted, assignments will not be collected, etc. Hence, the importance of assessing the ethical severity of the attacks and unauthorized activities appears to be highly warranted in the context of our ever-growing digital dependability.

Contrary to prior literature about substantial numbers of individuals who are unethically driven, we found that a

large majority of our study participants appear to self-report their perceptions as ethically driven across all five e-

learning security attacks. Specifically, we found that the overall percentage of ethical individuals was very high

(‘Attacks on the Server’: 452 or 87.1%; ‘E-mail Interception’: 492 or 94.8%; ‘Unauthorized File Sharing’: 439 or

84.5%; ‘Unauthorized Access’: 465 or 89.6%; ‘Spoofing Attacks’: 490 or 94.4%). These results indicate that the

majority of our study participants (an average of 90.1%) appears to understand the severity of these e-learning

security attacks, while a small minority of the individuals (an average of 3.24%) appears to be unethical. To better

understand the age, gender, and academic level distribution among the two extreme groups, ethical versus unethical,

Figure 2 provides an additional distribution breakdown of the majority of individuals who indicated that the actions

are ethical, and the breakdown of the small minority of individuals who indicated the opposite. It is important to

note that although we assessed academic level in this study, one can make the analogy between this measure and the

amount of years that an employee works for a corporate or a government organization, from the point of view of

familiarity with various organizational IS.

Figure 2. Distribution of Ethically and Unethically Driven Students (N=519)

We tested for observable gender differences linked to the perceived ethical severity of e-learning security attacks. We conducted a nonparametric test using the Mann-Whitney U Test on the five security attacks and unauthorized activities based on gender. The reason for using a nonparametric test is due to the ordinal data used in the rankings of the individuals’ perceptions of ethical severity. Results of the gender analysis are presented in Table II. We found that although gender differences exist on all five activities, a statistically significant gender difference exists only for ‘Unauthorized File Sharing’ (at p<0.005), where females reported the severity of such activities less ethical, indicating that they are significantly more ethically driven. Our results also indicated that across all five activities, females rate the ethical severity of these e-learning security attacks and unauthorized activities as more severe, also indicating that in general, they are more ethically driven, which is consistent with prior literature.

TABLE 2. Gender Analysis using the Mann-Whitney U Test (N=519)

e-Learning Males

(n=251) Females

(n=268) Non-parametric (Mann-

Whitney U Test) Security Attacks

& Unauthorized Activities M SD M SD Z Sig. (2-t)

Attacks on the Server 4.51 0.83 4.46 0.82 -1.050 0.294

E-mail Interception 4.66 0.67 4.62 0.66 -1.064 0.287

Unauthorized File Sharing 4.15 1.03 4.44 0.78 -2.986 ** 0.003

Unauthorized Access 4.36 0.86 4.51 0.75 -1.947 0.052

Spoofing Attacks 4.59 0.72 4.62 0.66 -0.449 0.653

* - p < 0.05; ** - p < 0.01

The data was also assessed for differences between academic level (undergraduate & graduate) on their perceived ethical severity of e-learning security attacks, as we hypothesized that individuals who spend more time in the system may find the severity of engaging in such attacks less ethical due to their prolonged exposure to an academic setting. We conducted a similar analysis using the Mann-Whitney U Test based on academic level. Table III depicts the results of the academic level analysis. We found that significant academic level differences exist only for ‘Attacks on the Server’ (p<0.001), where graduates (i.e. individuals who have longer exposure to the organizational ISs) were found to be more ethically driven. It is important to note that the higher the score, the more unethical the individual perceived an activity to be, which indicates they are more ethical – i.e. an inverse relationship. Overall, across all five activities, our results indicated that more graduates than undergraduates report these e-learning security attacks, indicating that graduates are generally more ethical.

TABLE 3. Academic Level (Undergraduate/Graduate) Analysis using Mann-Whitney U Test

e-Learning Males

(n=251) Females

(n=268) Non-parametric (Mann-

Whitney U Test) Security Attacks

& Unauthorized Activities M SD M SD Z Sig. (2-t)

e-Learning Undergraduate

(n=261) Graduate

(n=258) Non-parametric

(Mann-Whitney U Test) Security Attacks

M SD M SD

Z Sig. (2-t)

& Unauthorized Activities

Attacks on the Server 4.36 0.91 4.62 0.71 -3.504 ** 0.000

E-mail Interception 4.62 0.65 4.66 0.68 -1.066 0.286

Unauthorized File Sharing 4.23 0.97 4.37 0.87 -1.515 0.130

Unauthorized Access 4.38 0.84 4.49 0.77 -1.482 0.138

Spoofing Attacks 4.55 0.74 4.66 0.62 -1.730 0.084

* - p < 0.05; ** - p < 0.01

We undertook a further analysis for differences between participants’ age groups. Similarly, another non- parametric test using the Kruskal-Wallis H Test of multiple groups based on age groups was conducted. The results of the age-group analysis are presented in Table IV. We found that there were significant differences based on age level for all items with ‘Attacks on the Server’, ‘Unauthorized File Sharing’, ‘Spoofing Attacks’ (p<0.001), ‘E-mail Interception’ (p<0.01), and ‘Unauthorized Access’ (p=0.001). Across all five activities there was an increasing trend, a pattern indicating that the older the individual is, the more severe he/she ranks the attacks. This suggests that with age, individuals become more ethical with regard to the measured unethical activities. Additionally, we found no significant differences among the three institutions based on the variables tested, which led us to believe that these differences are not institutional dependent.

TABLE 4. Age Analysis using the Kruskal-Wallis H Test (N=519) e-Learning

Security Attacks Non-parametric

(Mann-Whitney U Test)

& Unauthorized Activities Z Sig. (2-t)

Attacks on the Server 33.037 ** 0.000

E-mail interception 20.353 ** 0.009

Unauthorized File Sharing 30.261 ** 0.000

Unauthorized Access 25.569 ** 0.001

Spoofing Attacks 29.751 ** 0.000

* - p < 0.05; ** - p < 0.01

Following the statistical results on the 519 quantitative records, a qualitative assessment was undertaken to elicit the

‘soft complexity’ behind the survey results.

Qualitative Analysis

The qualitative investigation attempted to elicit rich ‘thoughtful behavior’ of the individuals to uncover reasons behind the quantitative results. The technique is common to social science research and aims to gain an in-depth understanding of human action and beliefs. The ‘why’ questions within our analysis are considered critical to the validity of the findings and the resultant authoritative insights for policy suggestions. Consequently, further research was based on semi-structured interviews through a solicitation e-mail asking the same 519 anonymous participants to volunteer to partake in the follow-up investigation. The qualitative research technique was adopted through a grounded theory to identify the ‘why’ behind the findings and based upon conceptual ideas [40], originally proposed by Glaser and Straus [41]. The main aim is to discover respondents’ main beliefs about possible reasons for the

‘why’ behind our empirical findings. We received 14 anonymous volunteers from all three institutions, which appears to be adequate for qualitative analysis, given the labor-intensive nature of the qualitative data collection.

Participant distribution included eight from a state university, six from a private university, and three from the state community college, while no identifying information was collected.

Our first question was a general one prior to showing our quantitative results. We asked if e-learners were generally ethical or unethical through their engagement with the online resources. As we anticipated, there was no obvious distinctive view and a broad split of opinions suggesting individuals were both ethical and unethical in relation to their behavior. One interviewee noted:

“I believe there is a mixture of both. Although there are individuals who conduct themselves ethically during on line exams, unfortunately there are others who may choose to access online resources or engage in other unauthorized activities during online exams”

Another noted:

“I think about 75% ethical and 25% unethical”

Some individuals do feel their peers act unethically, as they perceive that ‘there is no form of monitoring’ in e-

learning. This was further substantiated by the responses, suggesting it is unlikely that unethical behavior can be

mediated or changed. While the general perceptions appear to indicate there is a split among individuals between

their ethical and unethical behaviors, it might very well be that extensive media coverage on unethical engagements

and the publicizing of engagements in unethical activities by some individuals hype the phenomena. As we

discovered, there may only be a ‘few bad apples’ responsible for unethical activities, while the vast majority are

ethical individuals seeking candid learning experiences.

The participants were again provided with the list of the five items under investigation and were asked if the activities could be perceived in an ethical way. They indicated that for individuals who are taking e-learning courses, these are very clear unethical behaviors. Some responses included:

“I don't think so. There is no grey area with the activities described”

“Removal of the words ‘unauthorized’ and ‘attack’ from the questions would not change the survey taker's perception of them”

At that point in the interview, the results, including the figures and tables above, were given to the interviewees.

They were asked if they felt that these represented a ‘good measure’ of ethical severity. The individuals generally felt that our quantitative analysis was a good measure of the ethical severity of e-learning server attacks. One representative reply was that:

“Although there are a host of other unauthorized activities within e-learning these questions should provide a good measure of individuals’ ethical severity of attacks in general”

One overarching interview question asked ‘why individuals thought the way they did.’ Most individuals were surprised and ‘unsure’ why their peers ‘thought the way they did’. On one hand, there were those who noted that they expected such results:

“Because most individuals are honest. We do have that small percent that will try anything”

and

“Most people believe that others will do the right thing”

while on the other hand, there were those who still believed that more people are fundamentally unethical:

“I can't say why, I expected opposite results”

Another question posed during the interviews was about the gender-based differences based on an ethical stance, who was viewed as more ethical, and why our results indicated that females were more ethical. The respondents generally indicated that males behaved unethically and were more likely to be ‘risk affine’ in their attitudes and reactions to formal procedures. One statement provided sums up the responses as:

“Slightly females. The reason being males in real life are risk takers and at times look for short cuts”

Responses related to the behavior of ‘younger’ or ‘older’ individuals produced an unclear view and the category appeared to be insignificant. This question was then extended to ‘graduate’ and ‘undergraduate’ differences, which again produced no clear distinction by the interviewees between the two.

”I would think in this case that it would be equal to both groups. They both have knowledge of how to manipulate computers if needed”

The statistical analysis showed that 3.24% of e-learners perceived the five e-learning security attacks (Table I) as ethical, indicating that they are unethical. We asked interviewees ‘why’ they thought those who responded this way did so. Subsequent interview responses demonstrated a further distancing from this behavior. The alienation of the small percentage of individuals who behave this way is predictable. One explanation for these ‘bad apples’ suggests a plausible reason:

“Perhaps the new generation perceived the use of technologies differently and not really for the purpose of learning.”

It is evident that the adoption of online systems certainly presents more opportunities for unethical behavior. The final two interview questions solicited suggestions on the regulations and/or sanctions that a university should impose to reduce (or eliminate) unethical behavior. The responses were consistent and forthright about the need for

‘severe punishment’ to be imposed on culprits, with some responses even recommending expulsion from the program, i.e.;

‘If the person is found guilty of unethical behavior in a free and fair hearing the penalties should include, for example, paying for lost time and damaged equipment and for especially severe crimes, expulsion and referral to the police….’

In general, the qualitative evidence strongly backs our initial quantitative findings. It also provides useful insights into the perceived ethical behavior of individuals and proposed sanctions for offending culprits that may inform policy decisions.

DISCUSSION

Most interestingly, this study reports that the majority (91%) of the participants viewed the investigated e-

learning security attacks as unethical or very unethical, while a small number (~3.3%) found such attacks to be

ethical or somewhat ethical. This indicates that the large majority of individuals appear to be ethically driven, while

there is a very small group of people who seem to be unethical. As file sharing is less technically challenging than

the other types of security attacks we analyzed, our results show that individuals perceive unauthorized file sharing

during e-learning exams as more acceptable. One possible approach to managing the potentially unethical group of individuals is to develop explicit policies about file sharing practices, and to add these policies to official business communications, corporate employee manuals, and code of conduct documents. To enable individuals’ awareness and familiarity with policy, instructors should discuss it in the first class session (online, on-campus, or training facility), preferably during a chat at the beginning of the term or business training module. Another approach is to discuss, or point individuals to, scenarios of unauthorized file sharing in the workplace, along with associated consequences, so that they understand unethical behavior. Finally, corporate executives should counter incidents of unauthorized file sharing with severe penalties.

Our results indicated that across all five e-learning security attacks under investigation, males found these security attacks to be less severe than females, indicating that gender may be correlated to a varying sense of severity about unethical security attacks. Subsequently, a sense of severity about unethical security attacks may influence the path for decision making, which appears to be consistent with prior literature [42, 43]. Additionally, it appears that males are more likely to be risk takers, while females tended to be the risk-averse gender. Research suggests that pursuing a goal, such as an academic degree or attaining a professional certification via e-learning systems, increases risk taking behavior [44]. Furthermore, prior research also appears to connect gender, personality type, and age as indicators of risk-taking behavior [45]. Our results show that undergraduates, for the most part, appear to perceive these attacks as only slightly less severe than graduates. However, some of the undergraduates in our study were adult learners who were a bit older than average, and no direct correlation to age distribution was established. Most critically, our results indicated that in terms of age, there is an increasing trend where the older the individual is, the more severe he/she ranks the attacks. These results indicate that younger people, in particular young males, appear to find the e-learning security attacks significantly less ethically severe or not severe at all.

Although we speculated that during the academic experience they would become aware of the ethical severity of engaging in cyber attacks, our results revealed that for business majors, there is still a small group of mainly young individuals who have either not become aware of the severity, or who simply appear unethical in all of their endeavors.

In contrast to other ethics literature, we found that although our gender differences coincide with Kreie and Cronan [42, 43], the magnitude of the differences is significantly smaller than what has been reported. Specifically, Kreie and Cronan [42] indicated that “Men and women were distinctly, different in their assessment of what is ethical. Men were less likely to consider behavior as unethical. Moreover, their own judgment was most often influenced by their personal values and one environmental cue-whether the action was legal” (p. 74). In our study it is clear that all the security attacks indicated are illegal, but we still found significant differences across the gender comparison with a much smaller gap. Kreie and Cronan [43] found that there are notable differences between what was considered ethical and unethical by the individuals across their five scenario measures, as well as a considerable number of their participants (an average of 37%) perceiving unethical behaviors to be acceptable. Again, with these findings, we argue that the overall understanding of individuals about what is ethical and what is unethical may have changed over the years, whereas present-day individuals appear to better perceive right and wrong actions. Having said that, we still found that there is a small group who appears to view one or more of these unacceptable e-learning security attacks as ethical. Although this represented a small number of respondents, it is still a concern.

Specifically, we know that file sharing during e-learning sessions is less technically challenging than other security attacks such as spoofing. Therefore, it is troubling that a significant majority appears to perceive such an attack as more acceptable.

In relation to the policy that corporate executives, university administrators, and instructors or business trainers should adopt, there is an opportunity to build a positive ethical culture by advocating their expectations for proper behavior. In medical refresher courses, for example, clarification and reinforcement of unethical cyber attack practices should be discussed frequently in course introductions, learning materials, and official training documents (i.e. learners’ manual, code of conduct, and use of technology resources policies). The discussions and reminders of potential consequences should be done for all types of course delivery and not only for online courses, as a substantial number of courses nowadays use e-learning systems to supplement on-ground courses or training modules. Unethical behavior should be addressed from the perspective of multiple stakeholders rather than strictly from an individual’s viewpoint, indicating to the learner the ramifications of such attacks on the organizational IS and the integrity of their own degree or training certificate. Employees should also be taught early in their career about the ethical use of technology resources, and the social responsibility that they are held to as members of an organization (i.e. university, workplace, etc.), and as members of society.

There were three key objectives for this research. First, we wished to assess the extent that individuals perceive

the severity of attacking an e-learning server and engaging in unauthorized activities as ethical. In other words, do

individuals perceive the attacking of an e-learning server to be an ethical or unethical activity? Second, we wished to

determine the demographics of those who perceive the severity of attacking an e-learning server and unauthorized activities as ethical and as unethical. Are there any specific demographic indicators for unethical students? Knowing this, may help corporate executives, university administrators, and course instructors and business trainers to target additional awareness programs. We believe that additional awareness programs have the ability to inhibit unethical perceptions and reduce the likelihood of future attacks. Our third and last key objective was to assess whether there are any significant differences for ethical perceptions based on gender, age, and academic level (undergraduate/graduate).

Our sample included 519 individuals attending e-learning business courses in the U.S. The results of our investigation revealed that the majority of the participants appear to self-report their perceptions as ethically driven across all the five e-learning security attacks, which clearly indicates that they appear to understand the severity of these attacks. We found that a very small minority of the participants rates these attacks as ethical, indicating that they view these attacks as morally acceptable, and this is a cause for concern. In terms of the demographics indicators that may represent that specific group, it appears to be a small group of younger males, primarily in their 20s, who constitute the majority of the unethical individuals. Finally, our gender, age, and academic level analysis have indicated that in general, females are more ethical than males, individuals become more ethical with age, and graduates (i.e. more years of exposure to the organizational ISs) appear to be more ethical.

Further research could explore the process of seeking qualitative feedback on previously observed phenomena through so-called ‘thought experiments’. Maxwell reported that Albert Einstein used them quite extensively in his research after observing phenomena, seeking the help of others to come up with plausible explanations for his observations [46]. Einstein’s well known ‘thought experiment’, the ‘moving elevator’ (also known as ‘Einstein’s elevator’), seeks plausible explanations for the theory of relativity. This ‘scientific approach’ could arguably support social science applications, such as finding further explanations for ‘ethical’ behavior. It could usefully attempt to investigate actual individual engagements in these e-learning security attacks and study more about their nature and origins. An interesting comparison can be drawn between the results of our study and the results of a potential study that investigates the individuals’ perceived ethical severity and the relationship to their actual engagement in unethical behavior, such as initiating security attacks on an e-learning system. Also, future researchers could work with other majors (engineering, technology, and non-technology) to investigate these results and determine whether there are any differences among these individuals in their reported severity of unethical engagements, such as attacking an e-learning server. Future studies should also explore risk-taking behavior driven by goal-setting and should be carried out within the context of ethical use of technological resources.

CONCLUSION

The main goal of this study was to conduct an investigation on individuals’ perceptions of ethical severity related to five common information security attacks and unauthorized activities within the context of e-learning. It is evident that these issues represent a serious concern for corporate training, universities, and government agencies, and measures must be imposed to eliminate or reduce the motivations for such behavior. It is apparent from individuals’ perceptions about the severity of cyber-attacks that most people are ethical when it comes to these attacks. However, the general public may be naively unaware of the potential damages to organizational services should a cyber-attack be launched on an e-learning server. Moreover, we found that there is a small group of primarily young males in their 20s who find such cyber-attacks acceptable. These individuals should be coached early in their academic and corporate career about the severity of such attacks and the implications for their organization, as well as the consequences of engaging in the unethical activities we mentioned. As such, we believe that the findings of this study are somewhat positive, as most participants considered the five e-learning security attacks to be unethical or very unethical, with the exception of a small group of individuals.

A fundamental part of this conclusion addresses the issue of unethical individuals. Although a small group, they should be supervised or reformed to ensure total compliance with codes of conduct for the benefit of the community.

Our study has highlighted this approach through an applied context, research design, and policy formulation within

an e-learning environment. We specifically found that additional work related to individuals’ risk-taking behavior

driven by goal-setting may allow a better understanding of the consequences of their ethical decisions at a critical

time, such as for degree-seeking students nearing graduation or degree-seeking students who seek a better ‘start’ for

their grade point average (GPA) very early in their academic career. It will be useful and interesting to explore the

impact of peer pressure on these risk-taking behaviors. Our conclusions may also provide useful insights to the

policy makers who respond to the effects of individuals’ ethical behaviors in e-learning systems. Although in

regards to ethical severity, individuals in general perceive that a significant percentage of the population is unethical,

we think that our findings can provide starting evidence that only a ‘few bad apples’ exist, appear to shade adverse light on the vast majority of the people who are engaged in e-learning for the sake of true learning. Although a small number of individuals appeared unethical, we believe institutions should advertise very strong sanctions for those who are caught to ensure that the overall attitude towards e-learning remains highly credible. Based on our findings, we feel strongly that all corporate training units and institutions of higher education should develop a specific code of conduct, with clear definitions of unethical attacks. Moreover, executives should be aware that the vast majority of e-learners are indeed ethical and should be treated as such without imposing collateral actions that reduces the moral of those who strive to be ethical at all times.

ACKNOWLEDGMENTS

We would like to thank the users for participating in this study. Moreover, we would like to thank the JCIS editor-in-chief Dr. Alex Koohang and the anonymous JCIS referees for their careful review and valuable suggestions.

REFERENCES

[1] A. Matwyshyn, "CSR and the Corporate Cyborg: Ethical Corporate Information Security Practices,"

Journal of Business Ethics, vol. 88, pp. 579-594, 2009.

[2] J. Evers. (2006). Computer crime costs $67 billion, FBI says. Available: http://news.cnet.com/Computer- crime-costs-67-billion,-FBI-say/2100-7349_3-6028946.html

[3] I. Thomson. (2006, February 10). Viruses cost UK consumers £3BN a year. Available:

http://www.v3.co.uk/vnunet/news/2149507/viruses-cost-uk-billion

[4] K. Himma, "The Ethics of Tracing Hacker Attacks Through the Machines of Innocent Persons,"

International Journal of Information Ethics, vol. 2, pp. 1-13, 2004.

[5] T. C. Rindfleisch, "Information technology and healthcare," Communications of the ACM, vol. 40, pp. 92- 100, 1997.

[6] J. C. Sipior and B. T. Ward, "A Framework for Information Security Management Based on Guiding Standards: A United States Perspective," Issues in Informing Science and Information Technology, vol. 5, pp. 51-60, 2008.

[7] A. Geva, "Three Models of Corporate Social Responsibility: Interrelationships between Theory, Research, and Practice," Business and Society Review, vol. 113, pp. 1–41, 2006.

[8] C. F. Rogers, "Faculty perceptions about e-cheating during online testing," Journal of Computing Sciences in Colleges, vol. 22, pp. 206-212, 2006.

[9] T. P. Cronan, C. B. Foltz, and T. W. Jones, "Piracy, IS misuse at the university," Communication of the ACM, vol. 49, pp. 85-90, 2006.

[10] J. Harris, "Maintaining ethical standards for a computer security curriculum," in Proceedings of the 1st annual conference on Information security curriculum development, Kennesaw, Georgia, 2004, pp. 46-48.

[11] M. Siponen and A. Vance, "Neutralization: New insights into the problem of employee information systems security policy violations," MIS Quarterly, vol. 34, pp. 487-502, 2010.

[12] R. A. Lawson, "Is Classroom Cheating Related to Business Students' Propensity to Cheat in the Real World," Journal of Business Ethics, vol. 49, pp. 189-199, 2004.

[13] K. K. Molnar, M. G. Kletke, and J. Chongwatpol, "Ethics vs. IT ethics: Do undergraduate students perceive a difference?," Journal of Business Ethics, vol. 83, pp. 657-671, 2008.

[14] N. T. Nguyen and M. D. Biderman, "Studying Ethical Judgments and Behavioral Intentions Using Structural Equations: Evidence from the Multidimensional Ethics Scale," Journal of Business Ethics, vol.

83, 2008.

[15] L. N. K. Leonard, T. P. Cronan, and J. Kreie, "What influences IT ethical behavior intentions—planned behavior, reasoned action, perceived importance, or individual characteristics?," Information &

Management, vol. 42, pp. 143–158, 2004.

[16] I. E. Allen and J. Seaman, "Class Differences: Online Education in the United States, 2010," The Sloan Consortium2010.

[17] A. R. Johnson, "Distance learning in higher education," Review of higher education, vol. 32, pp. 542-545,

2009.

[18] B. Means, Y. Toyama, R. Murphy, M. Bakia, and K. Jones. (2009). Evaluation of evidence-based practices in online learning: A meta-analysis and review of online learning studies. Available:

http://www.ed.gov/rschstat/eval/tech/evidence-based-practices/finalrepott.pdf

[19] N. Geri and D. Gefen, "Is There a Value Paradox of E-learning in MBA Programs?," Issues in Informing Science and Information Technology, vol. 4, pp. 163-174, 2007.

[20] E. Kritzinger, "Information security in an e-learning environment," in International federation for information processing, education for the 21st Centiuy - Impact of ict and digital resources . vol. 210, T. D.

Kumar, Ed., ed Boston: Springer, 2006, pp. 345-349.

[21] J. D'Arcy and A. Hovav, "Does One Size Fit All? Examining the Differential Effects of IS Security Countermeasures," Journal of Business Ethics, vol. 89, pp. 59-71, 2009.

[22] "Obama Calls for Cyber Czar," Information Management Journal, vol. 43, p. 16, 2009.

[23] M. Ramim and Y. Levy, "Securing e-learning systems: A case of insider cyber attacks and novice IT management in a small university.," Journal of Cases on Information Technology, vol. 8, pp. 24-34, 2006.

[24] K. El-Khatib, L. Korba, Y. Xu, and G. Yee, "Privacy and Security in E-Learning," Journal of Distance Education Technologies, vol. 1, pp. 1-19, 2003.

[25] S. Furnell, "Cybercrime in society.," in Connected Minds, Emerging Cultures: Cybercultures in Online Learning, S. Wheeler, Ed., ed Charlotte, NC: Information Age Publishing, 2008.

[26] W. H. Show, Business Ethics, 6th ed. Belmont: Thompson-Wadsworth, 2008.

[27] C. A. Dorantes, B. Hewitt, and T. Goles, "Ethical decision-making in an IT context: The roles of personal moral philosophies and moral intensity," in Hawaii International Conference on System Sciences, Big Island, HI, 2006, pp. 1-10.

[28] J. Kreie and T. P. Cronan, "How men and women view ethics," Association for Computing Machinery.

Communications of the ACM, vol. 41, pp. 70-78, 1998.

[29] N. Ye, J. Giordano, and J. Feldman, "A process control approach to cyber attack detection,"

Communications of the ACM, vol. 44, pp. 76-82, 2001.

[30] O. S. Saydjari, "Cyber defense: art to science," Communications of the ACM, vol. 47, pp. 52-57, 2004.

[31] G. D. Nord, T. F. McCubbins, and J. H. Nord, "E-monitoring in the workplace: privacy, legislation, and surveillance software," Communication of the ACM, vol. 49, pp. 72-77, 2006.

[32] F. v. Lohmann, "Voluntary collective licensing for music file sharing," Communications of the ACM, vol.

47, pp. 21-24, 2004.

[33] N. T. Tippins, J. Beaty, F. Drasgow, W. M. Gibson, K. Pearlman, D. O. Segall, and W. Shepherd,

"Unproctored Internet Testing In Employment Settings," Personnel Psychology, vol. 59, pp. 189-255, 2006.

[34] W. Stallings, Network security essentials: Applications and standards, 4th ed. Upper Saddle River, NJ:

Prentice Hall, 2011.

[35] Y. Levy and M. Ramim, "Initial development of a learners’ ratified acceptance of multi-biometrics intentions model (RAMIM)." Interdisciplinary Journal of E-Learning and Learning Objects, vol. 5, pp.

379-397, 2009.

[36] M. Bruhn, M. Gettes, and A. West, "Identity and access management and security in higher education,"

EDUCAUSE Quarterly, vol. 26, pp. 12–16, 2003.

[37] "2009 Internet Crime Report - Internet Crime Complaint Center," ed, 2009.

[38] T. Dinev, "Why spoofing is serious internet fraud," Communications of the ACM, vol. 49, pp. 76-82, 2006.

[39] T. N. Jagatic, N. A. Johnson, M. Jakobsson, and F. Menczer, "Social phishing," Communications of the ACM, vol. 50, pp. 94-100, 2007.

[40] G. Mey and K. Mruck, Eds., Grounded Theory Reader (HSR-Supplement 19). Cologne: ZHSF, 2007, p.^pp. Pages.

[41] B. G. Glaser and A. L. Strauss, Discovery of Grounded Theory. Strategies for Qualitative Research.

Chicago: Aldine Publishing Company, 1967.

[42] J. Kreie and T. P. Cronan, "How Men and Women View Ethics," Communication of the ACM, vol. 41, pp.

70-76, 1998.

[43] J. Kreie and T. P. Cronan, "Making Ethical Decisions," Communication of the ACM, vol. 43, pp. 66-71, 2000.

[44] S. A. Jeffrey, S. Onay, and R. P. Larrick, "Goal attainment as a resource: The cushion effect in risky choice

above a goal," Journal of Behavioral Decision Making, vol. 23, pp. 191–202, 2010.

[45] R. Pat-Horenczyk, O. Peled, T. Miron, D. Brom, Y. Villa, and C. M. Chemtob, "Risk-Taking Behaviors Among Israeli Adolescents Exposed to Recurrent Terrorism: Provoking Danger Under Continuous Threat?," The American Journal of Psychiatry, vol. 164, pp. 66-72, 2007.

[46] J. A. Maxwell, Qualitative Research Design: An Interactive Approach, 2nd ed. Thousand Oaks, CA: Sage

Publications, 2005.