FACTORS AFFECTING PRIVACY INTRUSION ON SOCIAL NETWORKING SITES Sanghui Kim, Department of Information Security Management, Chungbuk National University, Cheongju, Republic of Korea, [email protected] DongBack Seo (Corresponding author), Department of Management Information Systems, Chungbuk National University, Cheongju, Republic of Korea, [email protected]

Abstract The usage of SNS (Social Networking sites) has been increased and universalized across the world. People value sharing information and communicating with each other through SNS. At the same time, strangers can easily collect one’s personal information through SNS. Although a lot of SNS users concern about their privacies, some people have witnessed that their personal information has been distributed over SNS without their permissions. Any of SNS users can be a potential victim of a privacy intrusion. Simultaneously, any of them can be a potential intruder of someone’s personal information on SNS. This study focuses on intruders of SNS privacy. There are two types of intruders: a benign intruder who simply collects one’s personal information and a malicious intruder who distributes that. Through surveying 167 people, it is found that the two types of SNS privacy intruders (collector and distributors) were affected by different factors. For the intention to collect someone’s private information, curiosity, response cost, and self-efficacy affect. For the intention to distribute someone’s private information, the past experience of intruding others’ privacies, enjoyment, and low ethical consciousness affect. There is also a relationship between the intentions of collecting and distributing someone’s personal information on SNS. Keywords: Privacy Intrusion, SNS Privacy, Personal Information, Cyberbullying

1

INTRODUCTION

According to Statista (2015), an US market research agency, approximately 2.13 billion people are using SNS in 2016. Since the number of SNS users has increased every year, it is expected that SNS users will reach 2.29 billion people in 2017 and 2.44 billion in 2018, which will be over 30% of the world population. 70% of Internet users use social networking sites (GlobalWebIndex 2015a). SNS users daily spend 1.61 hours on average in 2012 and 1.77 hours in 2015 (GlobalWebIndex 2015b). As information technologies including mobile devices have been developed further, people can easily access and use SNS anytime and anywhere. Consequently, more people start to use SNS and they spend more time on using SNS (David 2015). In SNS environments, people tend to reveal personal information such as name, gender, ethnicity, schools they attended, a place of work, contact, and photos when they interact with other users. SNS users also write and share their daily events, interests, and hobbies with other users. Users are able to access to friends’ and sometimes strangers’ profiles and posts (writings, photos, and videos) while building and maintaining social relationships on SNS. These characteristics of SNS, revealing and sharing personal information, are used to easily build and maintain social relationships, meanwhile these characteristics paradoxically bring side effects. For instance, Gross and Acquisti (2005) showed that social security numbers of 4,000 Carnegie Mellon University students could be identified through collecting and analyzing personal information on their Facebook profiles and pages. Moreover, a person can easily steal someone's identity, which can lead to various types of cybercrimes (i.e. phishing, spamming, and cyber-bullying). In USA and UK, a burglar who googled “comfortably leaving the house” posted on SNS to identify and to burglarize target houses were caught. As private information posted SNS can endanger users, more than half of SNS users in U.S.A. and Canada have privacy concerns (WP engine 2014; The Office of the Privacy Commissioner of Canada 2011). According to the survey by SK Communication in 2013, 85% of SNS users in South Korea felt frustration and fatigue due to the fear of losing their personal information on SNS. 99.6% of SNS users tried to protect their personal information through various possible ways they could do on SNS (Korea Internet and Security Agency 2014). On the other hand, 61.9% of SNS users said that they experienced searching other users’ personal information on SNS (Korea Communications Commission & Korea Internet and Security Agency 2009). It means that people are aware of SNS environments as tempting stages to collect other users’ personal information. As shown in the survey above, while people concern their privacies, many of them also intrude other users’ privacies. Then, what are factors that affect people to intrude other people’s privacies on SNS? Is collecting someone’s personal information same as distributing the collected information? The objectives of this study are first identifying two types of SNS privacy intruders (collectors and distributors). A collector of someone’s personal information is clarified a benign intruder, while a distributor of that is clarified a malicious intruder. Second, we investigate what factors differently affect the intentions of these two types of intruders. This research will open an avenue to study SNS privacy from an intruder’s perspective, which can also be used to design SNS applications as well as to develop privacy policies that can minimize influencing factors on one’s intention to intrude someone’s SNS privacy.

2

THEORITICAL BACKGROUND

2.1

Concept of Privacy and Privacy Intrusion

The definition of privacy began from ‘a right to be let alone’ which secures individual freedom in a private space (Warren & Brandeis 1890). This conventional meaning of privacy has been changed as Internet and SNS have emerged and developed, because a personal space has virtually extended. The boundary of a personal space in a cyber world is not as clear as one in a physical space. Privacy on

personal information is a right to control the distribution of that information (Westin 1967). In the cyber world, individuals should be able to control access and exposure of their personal information (Noh & Choung 2010; Oh & Yu 2011). Although users can control the access and exposure of their personal information on SNS in a certain level, SNS providers usually encourage users to provide their personal information. For instance, Facebook often asks to update where users are; what schools they have been; etc. Therefore, Social Networking Sites become stages for people to disclose their personal information as well as to intrude others’ personal information. Personal information posted on SNS can be easily out of control from its owner, which is losing the control of privacy. A cybercrime related to privacy is about an act of undermining or damaging one’s honor or dignity by using writings, photos, and videos in a cyber space (Kim & Seo 2009; Korea Communications Standards Commission 2012; Son 2013). According to the definition of privacy in the cyber space, collecting someone’s personal information without having her/his permission is intruding her/his privacy. However, it cannot be considered as a cybercrime. On the other hand, distributing someone’s personal information without the permission of an owner can turn into a cybercrime, because it tends to undermine and damage the honor or dignity of the owner. For this reason, a collector of someone’s personal information on SNS is considered as a benign intruder and a distributor of that is regarded as a malicious intruder in this research (Lyndon et al. 2011). 2.2

Motivation

“Motivation is an inner state which energizes and sustains human behavior to achieve goals” (Pizam et al. 1979: p. 195). Broussard and Garrison (2004) define motivation as “the attribute that moves us to do or not to do something” (p. 106). Researchers have classified motivation as intrinsic motivation and extrinsic motivation (Deci 1975; Deci & Ryan 1985; Lepper & Green 1978). Intrinsic motivation is about gaining pleasure and satisfaction from conducting an activity itself without any external compensation (Deci & Ryan 1985; Gottfried 1990). Self-efficacy, enjoyment, and curiosity are parts of intrinsic motivation. Self-efficacy is “concerned with judgments of how well one can execute courses of action required to deal with prospective situations” (Bandura 1982). As self-efficacy is about one’s confidence in her/his ability, it acts as a role of motivation factor in forming positive attitude (Hsu and Chiu 2004). One’s interest arisen from her/his interactions with environment regulates her/his actions (Hidi & Renninger 2006; Krapp 2002; Schiefele 1999). People recognize a same object differently because their interests toward the object are different. There are two types of interest: individual interest and situational interest (Hidi 1990). Individual interest refers to one’s consistent preference on any area or activity. Individual interest is gradually developed and it influences on one’s attitude. Therefore, enjoyment and curiosity as parts of individual interests influence on one’s attitude (Ainley & Ainley 2011; Schiefele 1999; Turner & Silvia 2006). Situational interest refers to a response triggered by a particular stimulus or situation (Renninger et al. 2014). A situational cue can generate people’s interests (Schiefele 1991). SNS users can easily witness and experience privacy intrusion on SNS (Lee & An 2013). For instance, a person, who has experienced being cyberbullied, is likely to cyberbully someone according to the research of Sung et al. (2006). In this case, the experience of being cyberbullied as a situational cue triggers a victim’s interest on cyberbullying. Therefore, any experience of SNS privacy as a victim or an intruder can be a situational cue to generate a person’s interest. Extrinsic motivation is an external drive for people to act (Byeon 2005; Deci & Ryan 2000; Ryan & Deci 2000). For example, reward, social recognition, avoidance of punishment, and work condition can be parts of extrinsic motivation. Extrinsic motivation is known to be influential on regulating intrinsic motivation. Response cost as extrinsic motivation is influential for a person to regulate her/his intrinsic motivation. Although a person has high intrinsic motivation, (s)he cannot act easily upon

her/his intrinsic motivation if the cost of an action is too high. Based on the motivational theory, we develop a research model.

3

RESEARCH MODEL AND HYPOTHESIS

3.1

Research Model

Based on the theoretical background, the factors of enjoyment, curiosity, self-efficacy, low ethical consciousness, and experience are developed based on intrinsic motivation. The factor of response cost is identified based on extrinsic motivation. Dependent variables are intensions to collect someone’s personal information and to distribute that as shown Figure 1.

Figure 1.

The research model.

3.2

Research Hypothesis

3.2.1

Enjoyment

Enjoyment as one of intrinsic motivation affects an attitude to act (Childers et al. 2001). A person can simply like threating others because of psychological pleasure called enjoyment (Blackwell 2009). In the context of SNS privacy intrusion, a person simply likes to collect or distribute someone’s personal information. Therefore, H1a and H1b are developed as below. H1a: Enjoyment is positively related to the intention to collect personal information of someone. H1b: Enjoyment is positively related to the intention to distribute personal information of someone.

3.2.2

Curiosity

Curiosity is a need for achieving new information or knowledge and sensory experience that motivate a person to explore new things in order to narrow a gap between wanting to know and knowing (Litman & Spielberger 2003; Loewenstein 1994). Furthermore, curiosity affects human activities to recognize and navigate new information (Koo & Ju 2010). In the context of SNS privacy intrusion, curiosity therefore affects a person’s intention to collect someone’s personal information on SNS. H2: Curiosity is positively related to the intention to collect personal information of someone. 3.2.3

Self-efficacy

Self-efficacy means one’s confidence and belief to perform a certain task (Bandura 1977, 1986). Selfefficacy affects people’s attitudes to adopt and use information systems (Compeau & Higgins 1995). In the SNS privacy intrusion context, people who have high self-efficacy are more likely to collect or distribute personal information of someone. H3a: Self-efficacy is positively related to the intention to collect personal information of someone. H3b: Self-efficacy is positively related to the intention to distribute personal information of someone. 3.2.4

Response Cost

Response cost refers to time and efforts that a person perceives to perform a certain task (Rogers 1983; Ifinedo 2012). Perceived response cost affects a person’s intention to do a task (Milne, Sheeran & Orbell 2000). If a person perceives high response cost to do a certain task and (s)he perceives low benefit from the outcome of the task, (s)he will be discouraged to do the task. In the SNS privacy intrusion context, response cost therefore affects a person’s intention to collect or distribute someone’s personal information. H4a: Response cost is negatively related to the intention to collect personal information of someone. H4b: Response cost is negatively related to the intention to distribute personal information of someone. 3.2.5

Low Ethical Consciousness

Unethical behavior between SNS users is violation of privacy rights. The privacy rights are about that a person can decide on when, how and to what extent her/his information can be disclosed. According to Korea Communications Standards Commission (2012), undermining and damaging the rights to privacy or honor of others by using writing, photos and videos is violation of privacy rights. Ethical behavior is expressed through personal recognition of ethical situation and ethical decision making (Hunt & Vitell 1986). Therefore, people who have low ethical consciousness develop intentions to behave following this low ethical consciousness. In the SNS privacy intrusion, people who have low ethical consciousness may feel less guilty about collecting or distributing someone’s personal information than those who have high ethical consciousness. H5a: Low ethical consciousness is positively related to the intention to collect personal information of someone. H5b: Low ethical consciousness is positively related to the intention to distribute personal information of someone. 3.2.6

Experience

Experience is used as a key variable to predict behavioral intention (Bentler & Speckart 1979; Ouellette & Wood 1998). Social learning theory has been used to explain crime, wrongdoing, and deviant behavior (Akers 1985). Thus, an individual will perform acts of violence by social or environmental factors. Sung et al. (2006) describes that a person, who experiences of seeing

cyberbullying or of being cyberbullied, tends to rationalize her/his intention to cyberbully others. Accordingly, H6a and H6b are developed as below. H6a: Experience of privacy being intruded by others is positively related to the intention to collect personal information of someone. H6b: Experience of privacy being intruded by others is positively related to the intention to distribute personal information of someone. People have a tendency to show a positive attitude toward what they have adopted repeatedly (Zajonc 1968). It means that people are likely to do same things based on their successful experiences. For example, the attendance of a student in the past is the strongest factor affecting the student’s future attendance (Ajzen & Madden 1986). In the SNS intrusion context, one’s past experience of intruding someone’s privacy on SNS tends to affect her/his future intention to intrude. H7a: Experience of intruding others’ privacy is positively related to the intention to collect personal information of someone. H7b: Experience of intruding others’ privacy is positively related to the intention to distribute personal information of someone. 3.2.7

Involvement

Involvement is a virtual concept used to identify a relationship between an individual and a specific topic (or object) based on Situational Theory (Bloch 1981). A level of one’s involvement in a topic changes as her/his situation changes, because it is about one’s interest and engagement on the topic. High involvement means that the degree of one’s interest and relevance on a topic (or object) is high (Sherif & Cantril 1947; Antil 1984). Since involvement affects people in processing given information, for example in processing product-related information whether to purchase it or not, it has been widely studied in marketing and consumer behavior research. As involvement changes, person’s low involvement in a topic (or object) can develop into high involvement when (s)he learns more about the topic. We consider the intention to collect someone’s personal information on SNS as a low involvement of intrusion, meanwhile the intention to distribute that on SNS as a high involvement of intrusion. Therefore, this low involvement of intrusion affects the high involve of intrusion. H8: The intention to collect someone’s personal information is positively related to the intention to distribute it.

4

METHODOLOGY

4.1

Data Collection

We tried to survey people in their 20s in order to identify different factors affecting intension of collecting versus distributing someone’s personal information on SNS. According to KISA (Korea Internet and Security Agency)’s survey of SNS users in 2014, SNS usage rate in their 20s was about 87%, which was the highest usage rate among all age groups. The second highest was about 75 % in their 30s. Moreover, 72% of SNS users in their 20s said that they experienced intruding someone’s privacy on SNS according to KISA’s survey in 2011. Therefore, people in their 20s were selected as a target sample group. We conducted a pilot study with 20 university students to test whether survey questions appropriately measured constructs. After analyzing the result of the pilot study, inappropriate survey questions have been modified or deleted, which left 48 survey questions. The online survey of Google Docs was distributed by soliciting SNS users through emails and SNS in November 6, 2015. At the same time, 130 paper copies of the questionnaire were distributed to SNS users in their 20s. Of the 130 copies, 124 copies were returned. Finally, 117 copies were selected except incomplete or improper 7 copies.

From the online survey, 50 copies were valid, which made 167 samples in total. Table 1 shows the demographic information of the samples. Characteristics Gender Age

Education

Number of the SNS accounts

Table 1. 4.2

Options Male Female Below 20 20~29 30 and above High school or below Associate's or bachelor's degree Master's degree or higher 1 2 3 4 >5

Case 69 98 1 164 2 3 127 37 93 45 24 2 3

Percent (%) 41.30% 58.70% 0.60% 98.20% 1.20% 1.80% 76.00% 22.20% 55.70% 26.90% 14.40% 1.20% 1.80%

Demographic information of the research sample. Measurement

Measurements were adopted and reformulated to fit this research context. For example, measurement items of response cost for collecting personal information were adopted from Rogers (1983) and Jee et al (2011). Response cost was reformulated as follows: finding personal information about someone on SNS needs a lot of time and effort; and finding personal information about someone on SNS cumbersome. Table 2 shows the definitions of constructs with sources for the measurements. For all measurement items except demographic information, a five-point Likert scale was adopted. Variable Self-efficacy Response Cost Curiosity Enjoyment Low Ethical Consciousness Experience

Intention

Table 2.

Definition Capacity and confidence in oneself which can make possible a privacy intrusion in SNS Time and efforts spent for a hypothetical privacy intrusion in SNS Curiosity about other people's personal information or private life on SNS Enjoyment acquired as violating the privacy of others in SNS Permissive attitude to a privacy intrusion in SNS (e.g. I think it is somewhat allowable to search someone’s personal information in SNS, I think it is somewhat allowable to write articles/comments about someone in SNS)

Experience violated privacy of others in SNS / experience of the violation of privacy by others Intention to intrude the privacy of others in SNS

Definition of Variables.

Reference Bandura (1977, 1986); Ifinedo (2014) Rogers (1983); Jee et al. (2011) Agarwal and Karahanna (2000); Ahn et al. (2014) Van der Heijden (2004); Ahn et al. (2014) Cho (2013) Bandura (1986); Korea Internet and Security Agency (2011) Ajzen (2002); Ifinedo (2014); Ahn et al. (2014); Son (2013)

5

EMPIRICAL ANALYSIS

The partial least square (PLS) procedure was adopted to validate the proposed model using Smart PLS (Partial Square Least). PLS is a research method applicable to an early development phase of a theory which is not completely tested (Teo et al. 2003). Internal consistency, convergent validity, and discriminant validity were tested to validate the measurement model. 5.1

Measurement Model Test

The convergent validity of measurement items was verified with factor loading and T-value on constructs using the bootstrap method of PLS. Table 3 shows the result of this analysis. The loading of each item exceeded 0.7, which was considered valid (Fornell & Larcker 1981). T-values for all the items exceeded 1.96 suggested by Gefen and Straub (2005). The composite reliabilities of all constructs exceeded 0.7, indicating a baseline suggested by Thompson et al. (1995). AVE (Averaged Variance Extracted) of each construct exceeded 0.5, a baseline suggested by Fornell and Larcker (1981) and Chin (1988). Cronbach α widely used for reliability verification appeared to be more than 0.7, a baseline suggested by Nunnally (1987). Therefore, the internal consistency of this model was identified as appropriate. Construct

Curiosity Low Ethical Consciousness in Collecting Information Low Ethical Consciousness in Distributing Information Intention of Collecting Personal Information Intention of Distributing Personal Information Enjoyment in Collecting Information

Enjoyment in Distributing Information

Response Cost

Self-efficacy in Collecting Information

Items

Loadings

T-Value

CU1 CU2 CU3 CU4 LEC1 LEC2 LED1 LED2 LED3 ITC1 ITC2 ITC3 ITC4 ITD1 ITD2 ITD3 NJC1 NJC2 NJC3 NJC4 NJD1 NJD2 NJD3 NJD4 NJD5 NJD6 RC1 RC2 RC3 RC4 SEC1 SEC2 SEC3

0.852 0.897 0.915 0.920 0.926 0.918 0.889 0.921 0.881 0.833 0.859 0.868 0.838 0.909 0.944 0.932 0.876 0.862 0.904 0.864 0.791 0.900 0.893 0.887 0.912 0.920 0.874 0.855 0.900 0.856 0.845 0.807 0.768

59.709 96.609 119.175 120.841 96.059 89.039 70.355 99.951 103.070 43.448 62.336 74.321 73.830 90.759 185.716 173.701 39.784 40.454 121.319 64.157 39.682 91.331 101.583 78.236 127.396 140.864 60.145 54.652 113.684 55.899 52.765 43.372 36.905

AVE

Composite Reliability

Cronbach’s Alpha

0.803

0.942

0.918

0.85

0.919

0.824

0.805

0.925

0.881

0.722

0.912

0.873

0.862

0.949

0.92

0.768

0.93

0.901

0.783

0.956

0.944

0.759

0.927

0.896

0.705

0.935

0.916

Self-efficacy in Distributing Information

Experience of Intrusion

Experience of being Intruded

Table 3.

SEC4 SEC5 SEC6 SED1 SED2 XPI1 XPI2 XPI3 XPI4 XPI5 XPB1 XPB2 XPB3 XPB4 XPB5

0.852 0.891 0.868 0.935 0.863 0.838 0.874 0.879 0.911 0.876 0.855 0.830 0.819 0.900 0.854

55.947 55.534 65.420 19.556 12.572 48.978 64.874 95.616 132.901 77.319 52.606 36.978 39.796 84.591 65.897

0.641

0.837

0.737

0.767

0.943

0.924

0.726

0.93

0.906

Convergent validity & Internal consistency.

The inter-construct correlation matrix (Table 4) shows the comparison by inter-correlations among latent variables and corresponding square toots of AVEs. Each square root of AVE is greater than its correlation with any of the other constructs (Fornell & Larcker 1981). Thus, convergent and discriminant validities hold for each latent construct. Construct CU LEC LED ITC ITD NJC NJD RC SEC SED XPI XPB

CU

LEC

LED

ITC

ITD

NJC

NJD

RC

SEC

SED

XPI

XPB

0.896 0.520 0.200 0.503 -0.022 0.645 0.289 0.165 0.070 0.064 0.131 0.079

0.922 0.376 0.496 0.073 0.592 0.293 0.212 0.084 0.065 0.073 0.073

0.897 0.226 0.533 0.396 0.610 0.348 -0.049 -0.093 0.400 0.170

0.849 0.304 0.450 0.153 -0.048 0.222 0.087 0.247 0.222

0.928 0.105 0.485 0.280 -0.074 -0.131 0.527 0.287

0.877 0.473 0.258 -0.017 -0.023 0.113 0.028

0.885 0.381 -0.183 -0.183 0.351 0.197

0.871 -0.114 -0.015 0.043 0.043

0.839 0.693 -0.046 -0.015

0.800 -0.147 -0.075

0.876 0.649

0.852

CU = Curiosity; LEC = Low Ethical Consciousness in Collecting Information; LED = Low Ethical Consciousness in Distributing Information; ITC = Intention of Collecting Personal Information; ITD = Intention of Distributing Personal Information; NJC = Enjoyment in Collecting Information; NJD = Enjoyment in Distributing Information; RC = Response Cost; SEC = Self-efficacy in Collecting Information; SED = Selfefficacy in Distributing Information; XPI = Experience of Intrusion; XPB = Experience of being Intruded

Table 4.

5.2

Discriminant validity.

Structural Model Test

In PLS, we are able to evaluate a goodness of model with R2 value. If R2 value is more than 0.1, it is likely to have explanatory power more than 10% (Falk & Miller 1992). This study shows that R2 value for intention to collect someone’s personal information on SNS is 0.436 and R2 value for intention to distribute someone’s personal information on SNS is 0.56. Thus, the explanatory powers are 43.6% for intention to collect someone’s personal information on SNS and 56% for intention to distribute that on SNS.

5.3

Hypothesis Tests

Intention to collect someone’s personal information on SNS is affected by low ethical consciousness (β = 0.281, ρ < 0.001), curiosity (β = 0.251, ρ < 0.001), response cost (β = -0.180, ρ < 0.001), selfefficacy (β = 0.170, ρ < 0.001), enjoyment (β = 0.155, ρ < 0.001), experience of intruding others’ privacies (β = 0.119, ρ < 0.01), and experience of privacy being intruded (β = 0.111. ρ < 0.05). Intention to distribute someone’s personal information on SNS is influenced by experience of intruding others’ privacies (β = 0.388, ρ < 0.001), intention to collect someone’s personal information ((β = 0.358, ρ < 0.001), enjoyment (β = 0.239, ρ < 0.001), and low ethical consciousness (β = 0.173, ρ < 0.001). Self-efficacy has a significant effect on intention to collect personal information on SNS, but no significant effect on intention to distribute personal information on SNS. The higher the response cost is the lower the intention to collect personal information on SNS is. However, the intention to distribute personal information on SNS becomes higher. Different from the research of Sung et al. (2006), the past experience of privacy being intruded is negatively related to intention to distribute someone’s personal information on SNS, even though it is positively related to intention to collect someone’ personal information on SNS. Figure 2 shows the test result of hypotheses.

Figure 2.

Model testing results.

6

CONCLUSION AND DISSCUSSION

This study examined factors affecting the intention to intrude someone’s privacy on SNS. As a result, we identified different factors affecting two different types of SNS privacy intruders: a collector of someone’s personal information and a distributor of someone’s personal information. In the case of collectors, these intruders are benign. They are curious about someone and like to collect his/her personal information, because they believe they can collect the information and they do not think that it is ethically wrong. It seems that these collectors are rather naïve about what they intend to do, because if they perceive that response cost is high, they are discouraged to collect someone’s personal information on SNS. On the other hand, the distributors of someone’s personal information on SNS enjoy writing and spreading words related to others’ privacies on SNS. They tend to have low ethical consciousness and their past experiences of intruding others’ privacies reinforce their wrongdoings. Although they need to put time and efforts, they are willing to distribute someone’s personal information on SNS. For these reasons, their intentions of distributing someone’s personal information on SNS are malicious and tend to be harmful to the information owner. Therefore, a person, who has experienced intruding others’ privacies with enjoyment, tends to be a recidivist of a malicious SNS privacy intrusion. One thing we need to pay attention is that intention to collect someone’s personal information on SNS is positively related to intention to distribute someone’s personal information on SNS (β = 0.358, ρ < 0.001). This result can be interpreted in two different directions. One is that an intruder needs to collect someone’s personal information on SNS to distribute it. The other is that a benign intruder can turn further into a malicious intruder. Therefore, this is one direction for future research to identify the relationship between the two intensions. It is also interesting that not supported three hypothesis are all related to a distributor of someone’s personal information. First, self-efficacy does not affect the intention to distribute personal information of someone. For the intention of a malicious intruder, self-efficacy does not matter for her/his intention to do a wrongdoing. Second, response cost is positively related to the intention to distribute personal information of someone. It means that a malicious intruder is willing to distribute someone’s personal information even though (s)he perceives a high cost to do so. For a case of high involvement, people tend to put more cognitive effort (Sherif & Cantril 1947; Antil 1984). The distribution of someone’s personal information is a kind of high involvement comparing to the collection of someone’s personal information. We speculate that this is why we have an opposite result for this hypothesis. Third, one’s experience of privacy being intruded by others is negatively related to the intention to distribute personal information of someone. It refers that a victim of privacy intrusion is less likely to become a malicious intruder. This unpleasant experience makes a person to be a benign intruder, but work against for the person to become a malicious intruder. These three not supported hypotheses again reveal that collectors and distributors of someone’s personal information are distinguishable. These are remarkable results that we need to investigate further. The contributions of this research are as follows. First of all, this study identifies two types of SNS privacy intruders: collectors and distributors of someone’s personal information on SNS. This provides a potential way to observe and develop privacy policies and management regulations for each type. Second, it opens up the perspective of a SNS privacy intruder, while many studies have focused on the perspective of a SNS privacy victim. Third, by identifying and differentiating factors affecting two different types of SNS privacy intrusions, practitioners can use our findings to design SNS more effectively to protect SNS users’ privacies. This study also has limitations. First, the survey subjects were mainly SNS users in their 20s. Therefore, future study needs to include broader age groups. Second, it applied a prism of individual factors rather than a wide prism of social factors to study SNS privacy intrusions. Nonetheless, this research as an explorative study brings interesting results and opens the perspective of an intruder in researching SNS privacy.

Acknowledgement This research was supported by the MSIP (Ministry of Science, ICT & Future Planning), Korea, under the “Employment Contract based Master's Degree Program for Information Security”, which is supervised by the KISA (Korea Internet Security Agency) (H2101-14-1001).

References Agarwal, R. and Karahanna, E. (2000). Time flies when you're having fun: Cognitive absorption and beliefs about information technology usage. MIS quarterly, 24 (4), 665-694. Ahn, S.M., Jang, J.Y., Kim, J.D. and Kim, B.S. (2014). Factors Affecting the Intention to Invade Privacy on Social Network Service. Information Systems Review, 16 (2), 1-23 (in Korean). Ainley, M. and Ainley, J. (2011). Student engagement with science in early adolescence: The contribution of enjoyment to students’ continuing interest in learning about science. Contemporary Educational Psychology, 36 (1), 4-12. Ajzen, I. and Madden, T.J. (1986). Prediction of goal-directed behavior: Attitudes, intentions, and perceived behavior control. Journal of Experimental Social Psychology, 22 (5), 453-474. Ajzen, I. (2002). Constructing a TPB questionnaire: Conceptual and methodological considerations. Retrieved from http://www.unibielefeld.de/ikg/zick/ajzen%20construction%20a%20tpb%20questionnaire.pdf Akers, R. L. (1977). Deviant behavior: A social learning approach. 2nd Edition. Wadsworth, California. Antil, J.H. (1984). Conceptualization and operationalization of involvement. Advances in consumer research, 11 (1), 203-209. Bandura, A. (1977). Self-efficacy: toward a unifying theory of behavioral change. Psychological review, 84 (2), 191-215. Bandura, A. (1982). Self-efficacy mechanism in human agency. American psychologist, 37(2), 122147. Bandura, A. (1986). Social foundations of thought and action: A social cognitive theory. Prentice-Hall, New Jersey. Bentler, P.M. and Speckart, G. (1979). Models of attitude–behavior relations. Psychological review, 86 (5), 452. Blackwell, C. (2009). A security architecture to protect against the insider threat from damage, fraud and theft. In Proceedings of the 5th Annual Workshop on Cyber Security and Information Intelligence Research: Cyber Security and Information Intelligence Challenges and Strategies, p. 45, ACM. Bloch, P.H. (1981). AN EXPLORATION INTO THE SCALING OF CONSUMER'S INVOLVEMENT WITH A PRODUCT CLASS. Advances in consumer research, 8 (1), 61-65. Broussard, S.C. and Garrison, M.E.B. (2004). The relationship between classroom motivation and academic achievement in elementary school-aged children. Family and Consumer Sciences Research Journal, 33 (2), 106-120. Byeon, Y.G. (2005). Consideration of teaching and learning theories. 2nd Edition. Hakjisa, Seoul (in Korean). Childers, T.L., Carr, C.L., Peck, J. and Carson, S. (2002). Hedonic and utilitarian motivations for online retail shopping behavior. Journal of retailing, 77 (4), 511-535. Chin, W.W. (1998). The partial least squares approach to structural equation modeling. Modern methods for business research, 295 (2), 295-336. Cho, K.I. (2013). Track 4: The research for the Leveles and Moral of Teenagers in Cyber Space lncluding the Development of Evalutation Methods for them. Korean Association of Computer Education, 17 (2), 151-156 (in Korean). Compeau, D.R. and Higgins, C.A. (1995). Computer self-efficacy: Development of a measure and initial test. MIS quarterly, 189-211.

David, B. (2015). Smartphones Are Now The Dominant Driver Of Social Media. Retrieved from http://arc.applause.com/2015/07/16/social-media-consumption-on-smartphones-2015/ Deci, E.L. (1975). Intrinsic motivation. Plenum Press, New York. Deci, E.L. and Ryan, R.M. (1985). The general causality orientations scale: Self-determination in personality. Journal of research in personality, 19 (2), 109-134. Deci, E.L. and Ryan, R.M. (2000). The" what" and" why" of goal pursuits: Human needs and the selfdetermination of behavior. Psychological inquiry, 11 (4), 227-268. Falk, R.F. and Miller, N.B. (1992). A primer for soft modeling. University of Akron Press, Ohio. Fornell, C. and Larcker, D.F. (1981). Evaluating structural equation models with unobservable variables and measurement error. Journal of Marketing Research, 18 (1), 39-50. Gefen, D. and Straub, D. (2005). A practical guide to factorial validity using PLS-Graph: Tutorial and annotated example. Communications of the Association for Information systems, 16 (1), 91-109. GlobalWebIndex. (2015a). Social Media Engagement Summary. Retrieved from http://insight.globalwebindex.net/hs-fs/hub/304927/file-2615393475 GlobalWebIndex. (2015b). GWI SOCIAL SUMMARY. Retrieved from http://www.globalwebindex.net/hubfs/Reports/GWI_Social_Report_-_Q3_2015_Summary.pdf Gottfried, A.E. (1990). Academic intrinsic motivation in young elementary school children. Journal of Educational psychology, 82 (3), 525-538. Gross, R. and Acquisti, A. (2005). Information revelation and privacy in online social networks. In Proceedings of the 2005 ACM workshop on Privacy in the electronic society, 71-80, Virginia, USA. Hidi, S. (1990). Interest and its contribution as a mental resource for learning. Review of Educational Research, 60 (4), 549-571. Hidi, S. and Renninger, K.A. (2006). The four-phase model of interest development. Educational psychologist, 41 (2), 111-127. Hsu, M.H. and Chiu, C.M. (2004). Internet self-efficacy and electronic service acceptance. Decision support systems, 38(3), 369-381. Hunt, S.D. and Vitell, S. (1986). A general theory of marketing ethics. Journal of macromarketing, 6 (1), 5-16. Ifinedo, P. (2012). Understanding information systems security policy compliance: An integration of the theory of planned behavior and the protection motivation theory. Computers & Security, 31 (1), 83-95. Ifinedo, P. (2014). Information systems security policy compliance: An empirical study of the effects of socialisation, influence, and cognition. Information & Management, 51 (1), 69-79. Jee, B.S., Fan, L., Lee, S.C. and Suh, Y.H. (2011). Personal Information Protection Behavior for Information Quality: Health Psychology Theory Perspectives. Journal of the Korean society for quality management, 39(3), 432-443 (in Korean). Korea Communications Commission & Korea Internet and Security Agency. (2009). Survey on the SNS Usage. Retrieved from http://isis.kisa.or.kr/board/?pageId=060300&bbsId=10&itemId=309&pageIndex=7 (in Korean). Korea Communications Standards Commission. (2012). Manuals on Violation of Rights in the Cyberspace. Retrieved from https://www.kocsc.or.kr/02_infoCenter/Edu_View.php?ko_board=edu&ba_id=5958 (in Korean). Korea Internet and Security Agency. (2011). Survey Report on Internet Ethical Culture. Retrieved from http://isis.kisa.or.kr/board/?pageId=060100&bbsId=7&itemId=786&pageIndex=3 (in Korean). Korea Internet and Security Agency. (2014). Survey on Information Security (Individual). Retrieved from http://isis.kisa.or.kr/board/?pageId=060200&bbsId=15&itemId=49&pageIndex=1 (in Korean). Kim, K.Y. and Seo, J.W. (2009). Exploring Typology of Cybercrime. Korean Public Management Review, 23 (4), 95-118 (in Korean). Koo, D.M. and Ju, S.H. (2010). The interactional effects of atmospherics and perceptual curiosity on emotions and online shopping intention. Computers in Human Behavior, 26 (3), 377-388. Krapp, A. (2002). Structural and dynamic aspects of interest development: Theoretical considerations from an ontogenetic perspective. Learning and instruction, 12 (4), 383-409.

Lee, J.H. and An, S.C. (2013). A Comparative Study on the Legal System of Cyberbullying. Dispute Resolution Studies Review, 11 (1), 133-157 (in Korean). Lepper, M.R. and Green, D. (1978). The hidden costs of reward: New perspectives on the psychology of human behavior. Erlbaum, New York. Litman, J.A. and Spielberger, C.D. (2003). Measuring epistemic curiosity and its diversive and specific components. Journal of personality assessment, 80 (1), 75-86. Loewenstein, G. (1994). The psychology of curiosity: A review and reinterpretation. Psychological bulletin, 116 (1), 75. Lyndon, A., Bonds-Raacke, J. and Cratty, A.D. (2011). College students' Facebook stalking of expartners. Cyberpsychology, Behavior, and Social Networking, 14 (12), 711-716. Milne, S., Sheeran, P. and Orbell, S. (2000). Prediction and intervention in health-related behavior: A meta-analytic review of protection motivation theory. Journal of Applied Social Psychology, 30 (1), 106-143. Noh, D.I. and Choung, W. (2010). Changing Concept of Privacy in Cyberspace and the Legal Response Thereto. Kyung Hee Law Journal, 45 (4), 181-218 (in Korean). Nunnally, J.C. (1987). Psychometric Theory, 2nd Edition. McGraw-Hill, New York. Oh, T.W. and Yu, J.Y. (2011). Changing concept of privacy in social networking service environment. Information and Communications Policy, 23 (4), 26-42 (in Korean). Ouellette, J.A. and Wood, W. (1998). Habit and intention in everyday life: the multiple processes by which past behavior predicts future behavior. Psychological bulletin, 124 (1), 54. Pizam, A., Neumann, Y. and Reichel, A. (1979). Tourist satisfaction: Uses and misuses. Annals of Tourism research, 6 (2), 195-197. Renninger, A., Hidi, S. and Krapp, A. (2014). The role of interest in learning and development. Psychology Press, New York. Rogers, R.W. (1983). Cognitive and Physiological Processes in Fear-based Attitude Change: A Revised Theory of Protection Motivation. Social Psychophysiology: A sourcebook, 153-176. Ryan, R.M. and Deci, E.L. (2000). Intrinsic and extrinsic motivations: Classic definitions and new directions. Contemporary educational psychology, 25 (1), 54-67. Schiefele, U. (1991). Interest, learning, and motivation. Educational psychologist, 26 (3-4), 299-323. Schiefele, U. (1999). Interest and learning from text. Scientific studies of reading, 3 (3), 257-279. Sherif, M. and Cantril, H. (1947). The psychology of ego-involvements: Social attitudes and identifications. Wiley, New York. SK communications. (2013). the reason why people feel fatigue on SNS is “Concerns about privacy exposure” Retrieved from http://corp.skcomms.co.kr/NewsServlet?nate_cmd=detail&seq=9071 (in Korean). Son. M.J. (2013). Current state of cyberbullying and Countermeasures in Korea. Internet & Security Focus, 3, 6-22 (in Korean). Statista. (2015). Statistics and facts about Social Networks. Retrieved from http://www.statista.com/topics/1164/social-networks/ Sung, D.K., Kim, D.H., Lee, Y.S. and Lim, S.W. (2006). A Study on the Cyber-Violence Induction Factors of Teenagers: Focused on individual inclination, cyber violence damage experience, and moral consciousness. Journal of Cybercommunication Academic Society, 19, 79-129 (in Korean). Teo, H.H., Wei, K.K. and Benbasat, I. (2003). Predicting intention to adopt interorganizational linkages: An institutional perspective. MIS quarterly, 27 (1), 19-49. The Office of the Privacy Commissioner of Canada. (2011). 2011 Canadians and Privacy Survey. Retrieved from https://www.priv.gc.ca/information/por-rop/2011/por_2011_01_e.asp Thompson, R., Barclay, D.W. and Higgins, C.A. (1995). The partial least squares (PLS) approach to causal modeling: Personal computer adoption and use as an illustration. Technology Studies, 2 (2), 284-324. Turner Jr, S.A. and Silvia, P.J. (2006). Must interesting things be pleasant? A test of competing appraisal structures. Emotion, 6 (4), 670-674. Van der Heijden, H. (2004). User acceptance of hedonic information systems. MIS quarterly, 695-704. Warren, S.D. and Brandeis, L.D. (1890). The right to privacy. Harvard law review, 4 (5), 193-220.

Westin, A.F. (1967). Privacy and Freedom. Atheneum, New York. WP engine. (2014). 71% of Americans Care Deeply about their Online Privacy Amid Recent Privacy Concerns. Retrieved from http://www.businesswire.com/news/home/20140729006077/en/71Americans-Care-Deeply-Online-Privacy-Privacy Zajonc, R.B. (1968). Attitudinal effects of mere exposure. Journal of personality and social psychology, 9 (2 Pt. 2), 1-27.