ITL - User Perceptions of Online Privacy and Security - Phase II

INTERVIEW PROTOCOL: MIDDLE LEVEL (2)

Project Name: User Perceptions of Online Privacy and Security—Phase 2

Reference Code¹:

Interviewer:

Date and Time of Interview:

Location of Interview:

Facilitator Script for non-NIST employees:

Hello, my name is _____________ and I am a researcher at (or for) the National Institute of Standards and Technology in the Information and Technology Laboratory.

We are interested in finding out your experiences with and perceptions of online privacy and security. Before we begin, I would like you to take a few minutes to fill out this demographic questionnaire which will give us some information about you and help us as we analyze the data. Then in the interview, I will ask you questions about your experiences with and perceptions about online privacy and security.

Please feel free to interrupt me at any time to ask a question or ask for clarification, or let me know if there is something you don’t understand.

As soon as you are done with the Questionnaire I will begin recording the session.

Facilitator Script of NIST employees:

Hello, my name is __________ and I am a researcher here at NIST in the Information Technology Laboratory.

We are interested in finding out your experiences with and perceptions of cybersecurity and privacy. Before we begin, I would like you to take a few minutes to fill out this demographic questionnaire which will give us some information about you and help us as we analyze the data. Then in the interview, I will ask you questions about your experiences with and perceptions about cybersecurity and privacy.

Please feel free to interrupt me at any time to ask a question or ask for clarification, or let me know if there is something you don’t understand.

As soon as you are done with the Questionnaire I will begin recording the session.

Demographic Questionnaire 2

1. Gender: M ☐ F ☐

3. Age: under 20 ☐ 21—29 ☐ 30—39 ☐ 40—49 ☐ 50—59 ☐ 60+ ☐

4. What is your highest level of education?

1. High School ☐

2. Some College ☐

3. BA/BS ☐

4. Masters ☐

5. PhD ☐

5. If you have a degree beyond high school, what discipline is your degree in?

6. How many hours per day—outside of work—do you spend online?

7. List the top 5 online activities you engage in outside of work (banking, shopping, social media, etc.).

5. How many hours per day—at work—do you spend on a computer?

6. List the top 5 computer activities you engage in while at work.

10. Please rate your knowledge of online and computer privacy and security from very little knowledge to expert knowledge by checking the box below that represents your knowledge.

1. Very little knowledge ☐

2. Little knowledge ☐

3. Moderate knowledge ☐

4. High Level of knowledge ☐

5. Expert knowledge ☐

INTERVIEW QUESTIONS: 2

1. The internet is something we all seem to use on a daily basis, for work and in our everyday lives. Given your work, I imagine you use it a lot. If you were describing your relationship to the internet to someone, how would you describe it?

1. If there is a pause: For example, is it something you depend on like a good friend, to keep you updated, or is it just a tool, or…?

2. Given your work, you have access to a lot of information about other people, information that is often stored and sent to others on computers. What does privacy mean in a setting like this?

1. If they pause: For example, we used to lock up forms and papers in cabinets, but we can’t do that anymore, so how do we protect privacy in the online setting?

3. We also seem to be doing more and more things on the internet, like banking and shopping and gossiping. A lot of this involves giving information about ourselves to others, or to the internet. What do you think privacy means in that kind of an online setting?

4. What about security, what do you think computer or online security means?

5. What do you think is the difference between online privacy and security?

6. How would you explain online privacy to a someone just starting out in your field today?

1. What about computer security, how would you explain it to a novice?

7. Why do you think we need to worry about computer security and privacy, why do you think they matter?

8. Do you believe most people protect themselves and their online privacy adequately?

1. Why do you think this?

7. So, what kinds of issues or problems do you think individuals face when trying to stay safe online?

8. When you think about computer security and privacy, what kind of problems do you think we as a country might face?

7. When you think about online privacy and computer security, what kind of emotions do you feel?

8. Tell me about a time when you felt at risk in an online situation, not while at work but in your personal life.

1. Why or when is it that you feel at risk online?

2. What triggers alarm bells for you when you’re online?

7. Describe what makes you feel safe when you’re online.

1. What do you do to feel safe?

2. Are there some places where you feel safer than others when you’re online? Why is this?

7. Do you have kids or grandkids or nieces/nephews? If so, what do you tell them about being online?

1. What do you want them to think about when they’re on the computer or online?

7. Is there a particular experience you’ve had online that you think demonstrates some of the topics we’ve been talking about?

7. Is there anything we haven’t asked that you think would be important for us to know about computer security and online privacy?

This collection of information contains Paperwork Reduction Act (PRA) requirements approved by the Office of Management and Budget (OMB). Notwithstanding any other provisions of the law, no person is required to respond to, nor shall any person be subject to a penalty for failure to comply with, a collection of information subject to the requirements of the PRA unless that collection of information displays a currently valid OMB control number. Public reporting burden for this collection is estimated to be 60 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed and completing and reviewing the collection of information. Send comments regarding this burden estimate or any aspect of this collection of information, including suggestions for reducing this burden, to the National Institute of Standards and Technology, Attn: Mary Theofanos, maryt@nsit.gov , (301) 975-5889).

OMB Control No. 0693-0043

Expiration Date: 10-31-2016

1 Reference # = Your initials+Interview # for you+Gender+NIST or NN (So… Reference #: SSP-Int2-F-NN)