International Ethical Attitudes and Behaviors

Organizational information security policy must incorporate organizational, societal, and individual level factors. For organizations that operate across national borders, cultural differences in these factors, particularly the ethical attitudes and behaviors of individuals, will impact the effectiveness of these policies. This research looks at the differences in attitudes and behaviors that exist among five different countries and the implications of similarities and differences in these attitudes for organizations formulating information security policies. Building on existing ethical frameworks, we developed a set of ethics scenarios concerning data access, data manipulation, software use, programming abuse, and hardware use. Using survey results from 599 students in five countries, results show that cultural factors are indicative of the differences we expected, but that the similarities and differences among cultures that should be taken into account are complex. We conclude with implications for how organizational policy makers should account for these effects with some specific examples based on our results.