* Study shows image of eyes encourages compliance
A recurring problem in information assurance (IA) is the paradox of success: the better our security, the less immediate evidence there is to ordinary users that our precautions are actually worth anything. Put another way, the longer our security insures peaceful, safe computing, the more likely it is that our users will begin to skip necessary steps in information protection.
Information assurance awareness, training and education (ATE) are all important parts of maintaining compliance with IA procedures. Recently, I ran across an article by Mary Beckman in ScienceNOW that might provide an easy contribution to maintaining high compliance with our reasonable rules.
It seems that biologists Melissa Bateman, Daniel Nettle and Gilbert Rogers “examined the effect of an image of a pair of eyes on contributions to an honesty box used to collect money for drinks in a university coffee room. People paid nearly three times as much for their drinks when eyes were displayed rather than a control image. This finding provides the first evidence from a naturalistic setting of the importance of cues of being watched, and hence reputational concerns, on human cooperative behaviour.”
The article was published in the _Biology Letters_ of the Royal Society (abstract free; full text $30).
Mary Beckman added:
“Every week for ten weeks, they put up a different picture above the donation instructions: either of eyes or flowers… [R]esult [varied] according to the eyes: A judgmental male pair, for example, elicited more donations than a flirtatious female sideward glance.”
The idea that pictures with eyes might influence compliance, obedience and conformity is not new. In George Orwell’s prescient novel _1984_ (published in 1949), the opening paragraphs include this chilling description: “[T]he poster with the enormous face gazed from the wall. It was one of those pictures which are so contrived that the eyes follow you about when you move. BIG BROTHER IS WATCHING YOU, the caption beneath it ran.”
It seems to me that cheerful friendly pictures of employees might serve a more wholesome role than grim propaganda posters in raising compliance with security rules. It would be a fascinating and valuable experiment to put portraits of employees showing their eyes looking out at viewers in some offices in an organization and a similar number of pictures of, say, flowers in other comparable offices. Then one could compare appropriate metrics such as frequency of Post-It notes with passwords stuck in obvious places as a measure of compliance with security rules.
I’d be interested in hearing from readers who try this experiment.
