The ethical responses of students to university ICT codes of conduct

Governments, organisations, and universities implement cybersecurity laws, regulations, policies, and processes to reduce their cyber risks. In the context of universities, students sign, usually before commencement of enrolment, various agreements including Information and Communication Technology (ICT) codes of conduct. However, individuals can ignore, circumvent, or act contrary to these codes due to a lack of awareness of the possible consequences of such contraventions, but also due to a lack of sensitivity to the ethical principles underpinning such codes. Therefore, there is a need to understand why students and other users are not compliant with ICT codes of conduct and how to change the behaviour of students and other users so that they act ethically and in accordance with ICT codes. We designed a between-subjects experiment involving students’ responses to 5 scenario pairs (breach/no breach of ICT code of conduct) following awareness training of ethical principles, or awareness training of acceptable use of IT, or no awareness training (control) to understand the potential value of training. Furthermore, we profile students to capture their moral stance and measure their attitudes towards their university’s IT services and resources to understand individual differences that may affect their cybersecurity behaviour.