An empirical investigation of anti-spyware software adoption: A multitheoretical perspective

Transcription

1 Available online at Information & Management 45 (2008) An empirical investigation of anti-spyware software adoption: A multitheoretical perspective Younghwa Lee a, *, Kenneth A. Kozar b,1 a School of Business, University of Kansas, 1300 Sunnyside Avenue, Lawrence, KS , United States b Leeds School of Business, University of Colorado at Boulder, Boulder, CO 80309, United States Received 30 September 2006; received in revised form 8 August 2007; accepted 11 January 2008 Abstract We performed an empirical investigation of factors affecting an individual s decision to adopt anti-spyware software. Our results suggested that an individual s attitude, subjective norm, perceived behavioral control, and denial of responsibility significantly affected anti-spyware adoption intention. Also, relative advantage and compatibility showed a significant effect on attitude, visibility, and image on subjective norm, and trialability, self-efficacy, and computing capacity on perceived behavioral control. Interestingly, moral obligation, ease of use, and perceived cost were not as significant as was originally expected. # 2008 Elsevier B.V. All rights reserved. Keywords: Anti-spyware software; IT adoption; Innovation diffusion; IT ethics/morality; Partial least squares 1. Introduction Considerable effort is being expended to develop and implement systems to protect computer users from malicious actions [46]. However, adoption of these systems is low. Spyware has become a major security threat that monitors a user s activities, and reports them to a third party, creating serious privacy and security breaches and resulting in deterioration of system performance. More seriously, spyware can act as a denial of service intermediary as a weapon to attack other computers. According to the National Cyber Security Alliance survey, more than 78,000 spyware programs have been identified and 85% of all computers are, on average, infected by 28 spyware programs [16,29]. Spyware is also responsible for about 12% of all technical support calls and accounts for the biggest category of customer complaints [4]. A variety of countermeasures have The project was funded by the New Faculty General Research Grant at the University of Kansas. * Corresponding author. Tel.: ; fax: address: [email protected] (Y. Lee). 1 Tel.: ; fax: been developed, including law enforcement and legislation, anti-spyware software, and self-regulatory programs. Anti-spyware software with features that prevent, detect, and remedy the spyware problems is by far the most widely recommended solution. It monitors attacks, identifies the malicious spyware, and then removes it from the system. Studies have shown that more than 80% of current spyware problems could be identified and resolved by using antispyware software [25]. However, only 10% of the users have actually adopted anti-spyware software [20]. Also a Gartner survey found that only 10% of their respondents took sufficiently aggressive steps to minimize spyware infestations [33] and a Forrester survey reported that only 40% of the adopters routinely ran anti-spyware programs [27]. Considering that such software effectively shields users from spyware, the low adoption rate is strange. However, although several authors [4,33] have suggested reasons for low adoption rates, an empirical study to investigate this phenomenon has not been published. The fundamental question is: Why don t computer users adopt anti-spyware software in situations where strong and obvious spyware threats exist? /$ see front matter # 2008 Elsevier B.V. All rights reserved. doi: /j.im

2 110 Y. Lee, K.A. Kozar / Information & Management 45 (2008) We investigated the factors affecting computer users adoption of anti-spyware software based on the theory of planned behavior (TPB), but extending the original model to investigate how an individual s innovation diffusion perception, ethical/moral perceptions, and situation-specific perceived behavioral control factors affected anti-spyware software adoption. 2. Theoretical background 2.1. Innovation diffusion theory In recent years, researchers have investigated how users perceptions of an innovation influenced its adoption [10]. Innovation diffusion theory [35] addresses why and how an innovation spreads and describes the characteristics of the innovation that lead to widespread acceptance. The characteristics including relative advantage, compatibility, visibility, image, ease of use and trialability have successfully explained a number of IS adoption behaviors [23,45]. However, the theory has a weakness: it does not clearly explain how an attitude is formed, how it leads to adoption intention and to actual adoption, and how innovation diffusion characteristics fit into this process [23]. In addition, it has been criticized for providing inconsistent findings. For example, Cooper and Zmud [14] found a significant effect of compatibility and complexity on adoption of material requirements planning (MRP) practices. Premkumar et al. [34] found that technical compatibility and relative advantage significantly led to higher adoption rates of EDI in organizations. Meanwhile, Chau and Tam [9] found that innovation diffusion characteristics such as complexity and benefits (relative advantage) did not significantly affect open system adoption. To address such weakness, some researchers have integrated innovation diffusion theory with other theories allowing it to address the interaction between attitude, intention, and behavior. For example, Karahanna et al. [23] integrated innovation diffusion theory with TRA to address individuals pre- and post-adoption beliefs and attitudes toward Windows technology. Taylor and Todd [39] combined innovation diffusion theory with the TPB. They hypothesized that perceived usefulness (relative advantage), ease of use, and compatibility were determinants of attitude and found that perceived usefulness had a significant effect on attitude. Finally, Yi et al. [48] developed an integrated model by combining innovation diffusion theory with the TPB and TAM for predicting PDA adoption by healthcare professionals IT ethics and morality IT ethics and morality deal with questions of inappropriate, illegal, and unethical use of computers. If an individual s IT-related behavior is not criminal, the ethical or moral boundary can still be ambiguous; a person may be copying software, compromising privacy, sabotaging computers, or intentionally distributing viruses. Such situations impinge on the domain of IT ethics and morality. Studies have been initiated to understand the reason why people commit ITrelated unethical/immoral behavior and to learn ways to counteract them. Some reasons include the lack of a social definition of appropriate computer usage [19], unwillingness to admit responsibility for actions or a tendency to diffuse and depersonalize others in order to justify the consequences of a behavior [22], and being located in an unethical environment (e.g. ethical climate) [5]. Studies have recommended several countermeasures, such as including ethical subjects in the curriculum of IS majors, training programs [5], developing a code of ethics and conduct [22] and a strong ethical climate, and monitoring system implementation. However, as Conger and Loch [13] mentioned, little attention has been given to empirical studies on computer ethics and moral issues associated with IT. More work is needed to help explain and minimize ITrelated unethical behavior Theory of planned behavior The TPB is a widely applied expectancy-value model that has addressed the relationships between attitude and behavior [3,15]. TPB provides parsimonious explanations of informational and motivational influences on both volitional and non-volitional behavior. It posits that actual behavior is determined by intention to perform a behavior and perceived behavioral control. Intention is predicted by three factors: attitude toward the behavior, perception of social pressure to perform the behavior (subjective norms), and control over performance of the behavior (perceived behavioral control). This model has successfully predicted causal relationships in a variety of situations [8,18,28]. The applicability of TPB to unethical human behaviors has been investigated. For example, Beck and Ajzen [7] attempted to predict dishonest actions (such as cheating on a test, shoplifting, and lying to get out of assignments). They found that attitude, perceived behavioral control, and moral obligation were significantly related to cheating and shoplifting intention; similarly perceived behavioral control and moral obligation were significantly related to lying. TPB also has been applied to unethical behaviors related to computer use, although the number of studies on this subject is scant. For example, Leonard and Cronan [26] adopted TPB to investigate factors affecting the IT-related unethical behaviors such as reading unauthorized and found that two TPB variables, attitude and normative belief had significantly impact on ethical behavioral intention. 3. Research model and hypothesis development We developed a research model by integrating multiple theoretical models that seemed to be relevant in addressing

3 Y. Lee, K.A. Kozar / Information & Management 45 (2008) an individual s anti-spyware software adoption decision. The model included innovation diffusion theory, IT ethics and morality, and TPB. We hypothesized that: (1) when an individual has a favorable Attitude toward antispyware software, (2) when an individual perceives social pressure (i.e. Subjective Norm) to adopt or not to adopt an antispyware software, and (3) when an individual feels Perceived Behavioral Control to support his/her adoption, then he/she has more intention to adopt the software, triggering actual adoption Adoption intention/adoption Adoption intention describes a person s motivation to exert effort to adopt a system. Intention has been known as a mediator linking the motivational factors affecting adoption and the adoption itself. It is a surrogate measure explaining a large amount variances in the adoption [3]. We hypothesized that intention to adopt anti-spyware software positively influenced actual adoption. H1. An individual s intention to adopt anti-spyware software is positively related to his/her actual adoption Original TPB variables The variables in the original TPB included Attitude, Subjective Norm, and Perceived Behavioral Control Attitude An attitude is the degree to which a person has a favorable or unfavorable feeling about a behavior. Previous studies [7,26] have found that attitude significantly influences the intention to behave. We posited that attitude positively influenced the intention to adopt anti-spyware software. H2. An individual s favorable attitude toward anti-spyware software is positively related to his/her adoption intention Subjective Norm This is defined as the social pressure to perform or not perform a behavior: it is determined by a person s inclination to comply with people important to him or her and by the person s normative belief. Based on Kelman s [24] theoretical propositions, Venkatesh and Davis [42] argued that the effect of subjective norm is realized through internalization (where an individual integrates others opinions as part of his/her belief structure) and identification (when an individual behaves in a similar manner to important referents). Subjective norm has been found to be important in explaining human intention in IT adoption [43], and computer-mediated communications [31]. Ajzen [3] found that 15 out of 19 TPB-based studies showed that subjective norm had significant effects on behavioral intention. We therefore posited that significant others attitude toward anti-spyware software and adoption would affect an individual s intention to adopt. H3. An individual s perception of significant others attitude toward anti-spyware software and adoption is positively related to his/her adoption intention Perceived Behavioral Control PBC is defined as the perceived ease or difficulty of performing the behavior [2, p. 286]. When an individual perceives that he/she has more resources and opportunities than expected obstacles, he/she perceives greater control, which triggers an intention to perform the behavior. It has been found to have significant influence on technology adoption [39,42]. We expected the same significant effect in the context of anti-spyware software adoption. Therefore, we hypothesized: H4a. An individual s assessment of perceived behavioral control factors is positively related to his/her intention to adopt anti-spyware software. The TPB model also proposed a direct effect of perceived behavioral control on behavior. For example, even though an individual could have a strong intention to adopt anti-spyware software, he or she could not adopt it because the computer did not have enough memory. To the extent that perceived behavioral control is present, it contributes to the prediction of the behavior in question. Therefore, we hypothesized: H4b. An individual s assessment of perceived behavioral control is positively related to his/her anti-spyware software adoption Extending the TPB model We extended the original TPB model by incorporating factors that contributed to increasing its explanatory power. First, six innovation diffusion variables were included as determinants of Attitude, Subjective Norm, and Perceived Behavioral Control. These included Relative Advantage, Compatibility, and Ease of Use as determinants of Attitude, Visibility and Image as determinants of Subjective Norm, and Trialability as Perceived Behavioral Control, as situationspecific factors of perceived behavioral control, Self-efficacy, Computer Capacity, and Perceived Cost were also identified Determinants of attitude Previous research has shown that relative advantage (the degree to which adopting the IT innovation is perceived as being better than using the practice it supersedes) [23], Compatibility (the degree to which an innovation is perceived as being consistent with the values, past experiences, and

4 112 Y. Lee, K.A. Kozar / Information & Management 45 (2008) needs of the potential adopter), and Ease of Use [1,40] have been considered as determinants of attitude. In the context of anti-spyware software adoption, people develop a positive attitude toward adopting anti-spyware software when they perceive it as an effective tool to enhance security and privacy of their systems. In addition, the more the adoption of antispyware software fits an individual s needs, values, and other protective methods, the more favorable the attitude he/she can develop toward anti-spyware software. Finally, when people perceive that anti-spyware software is easy to install, use, and update, they will have a positive attitude toward it. Therefore, we hypothesized: H5. An individual s perception of relative advantage (H5a), compatibility (H5b), and ease of use (H5c) to adopt antispyware software is positively related to his/her attitude toward it Determinants of Subjective Norm The subjective norm or social pressure felt by an individual is dependent on Visibility (the degree to which the innovation is visible to others) and Image (the degree to which adoption of the innovation is perceived to enhance an individual s status in the social system). Visibility in anti-spyware software adoption represents the degree to which adopting the software is seen as important to others, while image represents the degree to which the adoption of anti-spyware software enhances a person s image as a technically knowledgeable or an ethical person. Therefore, we hypothesized: H6. An individual s perception of visibility (H6a) and image (H6b) of adopting anti-spyware software is positively related to his/her subjective norm Determinants of Perceived Behavioral Control Previous studies [2,7] have pointed out the importance of identifying behavioral control factors for a behavioral context. For example, Taylor and Todd [39] noted the value of utilizing situation-specific variables in the TPB model, stating that by focusing on situation-specific belief, the model becomes more managerially relevant. Our study, through extensive interviews with 22 anti-spyware adopters, found that Trialability (trying out the software before adoption), Self-efficacy (confidence in one s ability to use the software), Computer Capacity (memory size, hard disk capacity, etc., and Perceived Cost (license fee or purchase cost) are situation-specific variables. Thus, we hypothesized: H7. Trialability (H7a), Self-efficacy (H7b) and Computing Capacity (H7c) positively influence an individual s assessment of perceived behavioral control, while perceived cost (H7d) negatively affects the assessment Further extensions ethical/moral factors Two IT ethics and moral variables were added: Moral Obligation (an individual s perception of the moral correctness of performing a behavior [15]) and Denial of Responsibility [19,22] (an individual s tendency to ascribe responsibility to him- or her-self or to diffuse and depersonalize it to others). Moral obligation represents an individual s perception of a responsibility to perform or refuse to perform a certain behavior, receiving much interest as a new relevant determinant of TPB in psychology and ethical studies [3,15]. Corner and Armitage [15] noted that it is one of the six determinants that should be considered significant in the TPB model. Ajzen [3] also pointed out that it should be included in the model, noting that such issues take on added salience with respect to behaviors of this kind and that a measure of perceived moral obligation could increase predictive power of the model. Presumably, then, an individual with a higher moral obligation would have high intention to adopt anti-spyware software. During interviews, a respondent indicated this by stating: My colleagues often download a variety of spyware. I know they would be quite attractive and beneficial to me. However, I do not want to download them because they might break others systems, and compromise their security and privacy. Instead, I purchased anti-spyware software at my own cost. I think I am right. We therefore hypothesized: H8a. An individual s high moral obligation is positively related to his/her intention to adopt anti-spyware software. Denial of Responsibility (DR), developed by Schwartz [36], is similar to rationalizing the consequences of one s behavior. The lower a person s DR, the more likely he or she is to accept personal responsibility as well as feel responsible for welfare of others [22]. Gattiker and Kelley [19] indicated that the behaviors related to DR are more salient in computer use due to computer use in the current workplace; thus it is hard, or even impossible, to identify the material and psychological consequences to other users (p. 236). Smith [37] also pointed out that computer users find it easier engage in antisocial and unethical behavior because their victims are invisible and cannot identify the attacker. We expected that the same effects of DR would occur when a person adopted anti-spyware software. Therefore, we hypothesized: H8b. An individuals high denial of responsibility toward anti-spyware software adoption is negatively related to his/ her adoption intention. 4. Research methodology To validate our research model, a questionnaire-based field survey was conducted with computer users who had heard about anti-spyware software. Subjects were recruited by advertising in local and student newspapers. Undergraduate students at a large Western US university also were recruited. Both online and paper-based questionnaires were developed. Data were collected from the sample via a two-

5 Y. Lee, K.A. Kozar / Information & Management 45 (2008) phased survey. In the first phase, the questionnaires were distributed to a total of 467 subjects; 373 responses were returned and 38 incomplete and invalid responses had to be removed and thus 335 usable responses resulted. In the second phase, conducted 6 months later, a questionnaire with an adoption measurement instrument and participant identification number was distributed to the 335 prior respondents. This was intended to prevent a common method bias caused by measuring both independent and dependent variables at the same time [32]. 305 responses were returned, and after removing 11 incomplete and invalid responses, the remaining 294 were included for data analysis. The overall response rate was 62.9%. The average age of respondent was 28.4-year-old with 71% being male and 59% industry professionals. Respondents were compensated by being entered into a sweepstake. Student participants also received class participation points. Instruments were developed using development processes of Straub [38]. The initial instrument items were developed from a literature review which covered material from the theory of planned behavior, innovation diffusion theory, and IT ethics/morality. Concurrently, interviews were conducted with 22 persons who had adopted antispyware software for at least 1 year to gain insight into their perceptions of anti-spyware software adoption. During these interviews, situation-specific variables for anti-spyware software adoption were identified. Four perceived behavioral control factors were found specific to the adoption of anti-spyware software. The instrument items for selfefficacy and trialability were developed from prior literature, and those for computer capacity and perceived cost were developed using Bearden et al. s [6] method. The instrument items were then reworked for the context of anti-spyware software adoption. Initial instrument items were pretested with eight experts familiar with TPB, innovation adoption, IT ethics, and instrument development. Through this process, the wording, order of items, content, and format of the questionnaire were revised. Their reviews of the instruments verified content validity. Finally, a pilot test was administered to 32 undergraduate students who had used anti-spyware software for at least 6 months. Appendix A shows the instrument items. 5. Results The research model was tested using partial least squares (PLS) analysis. It uses a least square estimation to obtain parameter estimates and places minimal demands on sample size, measurement scales, and residual distributions. PLS- Graph version 3.00 was used to analyze the data [11] Measurement model analysis Measurement model analysis was conducted to examine psychometric properties of the measures for latent constructs, examining internal consistency, convergent validity, and discriminant validity using the composite reliability, CR, index developed by Fornell and Larcker [17]. Composite reliabilities greater than 0.7 were considered adequate [21]. Table 1 shows the internal consistency of each construct. Convergent and discriminant validity was assessed by applying two criteria: the square root of the average variance extracted (AVE) by a construct from its indicators was at least (i.e. AVE > 0.5) and should be greater than the variance shared between the construct and others in the model, and standardized item loadings should be at least with no measurement item loading more highly on other constructs than the construct it intends to measure. The validities were confirmed. In addition, the factor structure matrix (Table 2) shows that all indicators exhibited high loadings on their own constructs and no items loaded higher on those constructs which were not intended to measure. Table 1 Inter-construct correlations and AVE along the diagonal CR INT ATT SN PBC RA COM EOU VIS IMG CAP COST TRI SE OBL RD INT ATT SN PBC RA COMP EOU VIS IMG CAPA COST TRI SE OBL RD The diagonal elements shown in bold are the square root of the average variance extracted.

6 114 Y. Lee, K.A. Kozar / Information & Management 45 (2008) Table 2 Factor structure matrix of loadings and cross-loadings INT ATT SN PBC RA EOU COM VIS IMG TRY CAP SE COST OBL RD int int att att att att sn sn PBC PBC PBC ra ra ra ra eou eou eou eou COMP COMP COMP vis vis vis image image image tri tri capa capa self self self cost cost oblig oblig Rd Rd Structural model analysis Fig. 1 shows the result of the structural model analysis. The model and hypotheses were tested by examining the path coefficient. In a PLS structural model, paths can be interpreted as standardized betas, and hence the explained variance in the endogenous variables was assessed as an indication of the overall predictive strength of the model. Following Wold [44], a bootstrapping test was conducted to find estimates of standard errors to test the statistical significance of path coefficients using t-tests [47]. Because PLS provides higher estimates for indicator loadings in the measurement model at the expense of lower estimates for path coefficients in the structural model, a larger sample size is better (at least 10 times the largest number of instrument items of an exogenous variable affecting an endogenous variable). The sample size in our study (n = 294) compared to 4 (the being largest number of items) was not a problem here. As shown in Table 3, further analysis was conducted to examine whether the adoption decision is different across gender and age. It was found that most of the hypothesized relationships were confirmed, although some interesting differences from the original model were discovered. 6. Discussion Adopting anti-spyware software is critical in protecting an individual s computer systems and privacy from malicious attacks. We developed and validated a research model by integrating TPB, innovation diffusion theory, and IT ethics/morality to investigate the factors affecting anti-spyware software adoption. The model also included

7 Y. Lee, K.A. Kozar / Information & Management 45 (2008) Fig. 1. Results. situation-specific behavioral control factors in order to gain a better understanding of their effect on adoption. We found that the model successfully explained most of the variance. Of course, our study has limitations. First, selecting one commercial anti-spyware software as our target system might not represent all types of anti-spyware software. Second, our study was conducted with small, student, and self-selected samples, there were few females and thus the result could potentially cause a selection bias. Third, to gather a large amount of data, this study used both an online and offline questionnaire, which could have influenced user response. Despite these limitations, the analysis presents some interesting results Attitude and its determinants Attitude toward anti-spyware software affected its adoption. In particular, we found that both relative Table 3 Results by different gender and age Gender Age Female (n = 85) Male (n = 209) 30 and below 30 (n = 154) Above 30 (n = 140) Attitude 0.363*** 0.321*** 0.305*** 0.383*** Relative Advantage 0.258** 0.484*** 0.311*** 0.434*** Compatibility 0.499*** 0.321*** 0.278*** 0.545*** Ease of Use 0.101* SN 0.338*** 0.399*** 0.318*** 0.414*** Visibility 0.599*** 0.421*** 0.467*** 0.544*** Image *** 0.27** 0.164* PBC 0.394*** 0.254*** 0.288*** 0.360*** Trialability 0.602*** 0.364*** 0.398*** 0.567*** Self-efficacy 0.288*** 0.264** 0.244** 0.311*** Computing Capacity 0.203* 0.162* 0.156* 0.212* Perceived Cost * Moral Moral Obligation 0.102* * Denial of Responsibility 0.103* 0.140* 0.146* Statistically significant at *p < 0.05, **p < 0.01 and ***p < 0.001; DV = adoption intention.

8 116 Y. Lee, K.A. Kozar / Information & Management 45 (2008) advantage and compatibility were significant determinants of attitude, while ease of use was not. To increase an individual s usefulness perception, the inclusion of success stories showing empirical findings of benefits of adoption, customer interview scripts and reviews or survey reports into websites or advertisement materials is recommended. An effort to associate anti-spyware software with other effective protection systems is a way to maximize the compatibility perception related to anti-spyware software adoption. Recently, companies have introduced integrated protection systems which combine anti-virus and spamware with antispyware. The insignificance of ease of use indicates that people do not have difficulty in using the software Subjective Norm and its determinants The significant effect of subjective norm on adoption intention was a surprising finding, because norms have been found to have a relatively weak impact on intention. May be people did not have enough time to develop a clear preference toward the software if it was recently introduced, and, having little experience, were willing to rely on the opinions and behaviors of others. Visibility and image were both found to strongly influence subjective norm. The significant effect of visibility suggested that as people observe increased instances of adoption by their friends, family, and colleagues, they feel more social pressure to adopt it themselves. When people perceive the adoption as an opportunity to enhance their image as an ethical/moral and technical leader among their referents, they feel more social pressure to adopt Perceived Behavioral Control and its determinants Perceived behavioral control was found to have a strong effect on both adoption intention and actual adoption. This showed that when people perceived more benefits than obstacles associated with the adoption, they felt more in control, which positively influence their actual adoption. In particular, trialability, computing capacity, and self-efficacy were observed to be important determinants, while perceived cost was not Moral factors Moral obligation was not found to be a significant factor in anti-spyware software adoption. Developer and user groups should work toward promoting a social feeling of the maliciousness of spyware. Several forms of denial of responsibility were found during debriefing interviews. One person rationalized that his non-adoption of anti-spyware software was relatively safer than others behavior: People I know have downloaded many free computer games from unknown providers. This is dangerous. Instead, I only download file sharing freeware from the website of a highly trustful company. And file sharing is a good thing. These other users need to install anti-spyware software, not me. A more intensive effort to educate spyware users, especially those identified as having a strong denial of responsibility should be followed Gender and age differences Several interesting results were related to gender and age differences. The hypothesized relationships between constructs in the original model are all confirmed with male adopters. However, females were different: image was not found to be significant and the effect of visibility was much higher than that of men, indicating that they are more sensitive to others attitudes and adoption. Also, ease of use had a significant effect, indicating that women may have less experience with technology and hesitate in adopting new and difficult-to-use technology; moreover the effect of trialability was much stronger, suggesting that women were less willing to take a risk. To examine the effect of age difference, the original data is divided into two age groups: those below 30 (n = 154) and those above 30 (n = 140). Contrary to the findings of the original model, perceived cost was a significant factor for the younger group, whereas moral obligation was not. Apparently younger adopters did not seriously consider ethical/moral value, but were sensitive to price. For the older group, all the results are the same as with the original model except for the insignificance of denial of responsibility. 7. Implications and conclusion From a researcher s perspective, this study demonstrated that extension of the TPB explained a significant amount of the variance in anti-spyware software adoption. Postulating users as system protectors, not as potential abusers, we proposed and validated a theoretical model that identified factors affecting the adoption of anti-spyware software. We also contributed to the theoretical advancement of innovation diffusion theory by identifying the perceptual process between its variables and attitude intention behavior. Revealing a clear causal path between innovation diffusion variables and adoption contributes to the advancement of theory, providing a better understanding of an individual s acceptance of innovative technology. From a practitioner s perspective, this study provides several useful insights for managers who control the development and distribution of anti-spyware software. Our model can provide useful insights and countermeasures for management to successfully fight such problems. For example, the findings of this study provide useful information to create an effective marketing strategy, such as developing multiple versions to fit system configurations, providing more trial options, bundling multiple protection systems, and customizing advertisements.

9 Y. Lee, K.A. Kozar / Information & Management 45 (2008) In summary, spyware is a threat that betrays computer users trust, invades their privacy, and deteriorates their productivity. This problem is exacerbated by the increased number of people using personal computers and the increasing time they stay online. Without adequate defenses against spyware, confidence of computer and the internet users will be undermined. Anti-spyware software is a powerful weapon to counteract such problems. We have provided useful insights for preparing efforts to attract potential adopters build a more secure computing environment. Appendix A Constructs References Questionnaire items Attitude [41] Adopting anti-spyware software is Bad...good Negative...positive Harmful...beneficial Dislike...like Subjective Norm [42] The people who are important to me adopt anti-spyware software The people whose opinions I value adopt anti-spyware software Perceived Behavioral Control [39] I will be able to adopt anti-spyware software Adopting anti-spyware software is entirely within my control I have the resources, knowledge, and ability to adopt anti-spyware software Relative Advantage [30] Adopting anti-spyware software will improve the safety of my computer Adopting anti-spyware software will increase the security of my computer I find anti-spyware software will be useful because it can protect my computer Adopting anti-spyware software enhances the safety of my computer Ease of Use [30] Learning to use anti-spyware software will be easy for me I will find it is easy to use anti-spyware software It will be easy for me to be accustomed to use anti-spyware software I will find anti-spyware software ease to use Compatibility [39] Adopting anti-spyware software will fit well with the way I think about protecting the computer Adopting anti-spyware software will fit into my value of protecting the computer Adopting anti-spyware software will be compatible with my needs to protect the computer Visibility [30] I have seen what others do using anti-spyware software It is easy for me to observe others using anti-spyware software Anti-spyware software is very visible in my referent group Image [30] Adopting anti-spyware software will improve my image within my referent group People in my referent group who adopt anti-spyware software have high reputations People in my referent group who adopt anti-spyware software receive more favorable attention than those who do not Trialability [23] I will have had a great deal of opportunity to try anti-spyware software before adopting it I am able to properly try anti-spyware software out before adopting it Computing Capacity [30] My computer has powerful system resources (memory size, CPU and network speed) to operate anti-spyware software Installing anti-spyware software does not affect the performance of my computer Self-efficacy [12] I will feel comfortable adopting anti-spyware software on my own If I wanted to, I can easily operate anti-spyware software on my own Overall, adopting anti-spyware software is very well supported Perceived Cost [41] I cannot afford the cost of adopting anti-spyware software Adopting anti-spyware software is expensive Denial of Responsibility [36] Spyware problems are caused by people who download spyware more frequently than me Spyware problems are caused not be me but by people who download dangerous spyware from the unknown sites Moral Obligation [7] If a good friend of mine does not install anti-spyware software, it will be my duty to persuade them to adopt it I think I have to adopt anti-spyware software if spyware makes others computers vulnerable to attack Adoption Intention [42] I intend to adopt anti-spyware software I predict that I will adopt anti-spyware software Actual Adoption Adopt or not

10 118 Y. Lee, K.A. Kozar / Information & Management 45 (2008) References [1] D.A. Adams, R.R. Nelson, P.A. Todd, Perceived usefulness, ease of use, and usage of information technology: a replication, MIS Quarterly 16 (2), 1992, pp [2] I. Ajzen, From Intentions to Actions: A Theory of Planned Behavior, Springer-Verlag, Berlin, [3] I. Ajzen, The theory of planned behavior, Organizational Behavior and Human Decision Processes 50, 1991, pp [4] A. Asaravala, Sick of spam? Prepare for Adware, Wired News, [5] D. Banerjee, T.P. Cronan, T.W. Jones, Modeling IT ethics: a study of situational ethics, MIS Quarterly 22 (1), 1998, pp [6] W.O. Bearden, R.G. Netemeyer, J.E. Teel, Measurement of consumer susceptibility to interpersonal influence, Journal of Consumer Research 15, 1989, pp [7] L. Beck, I. Ajzen, Predicting dishonest actions using the theory of planned behavior, Journal of Research in Personality 25, 1991, pp [8] P.Y.K. Chau, P.J.-H. Hu, Investigating healthcare professionals decisions to accept telemedicine technology: an empirical test of competing theories, Information and Management 39 (4), 2002, pp [9] P.Y.K. Chau, K.Y. Tam, Factors affecting the adoption of open systems: an exploratory study, MIS Quarterly 21 (1), 1997, pp [10] L.-D. Chen, M.L. Gillenson, D.L. Sherrell, Enticing online consumers: an extended technology acceptance perspective, Information and Management 39 (8), 2002, pp [11] W.W. Chin, T. Frye, PLS-Graph, University of Calgary, Alberta, Canada, [12] D. Compeau, C. Higgins, Application of social cognitive theory to training for computer skills, Information Systems Research 6 (2), 1995, pp [13] S.A. Conger, K.D. Loch, Ethics and computer use, Communications of the ACM 38 (12), 1995, pp [14] R.B. Cooper, R.W. Zmud, Information technology implementation research: a technological diffusion approach, Management Science 36 (2), 1990, pp [15] M. Corner, C.J. Armitage, Extending the theory of planned behavior: a review and avenues for future research, Journal of Applied Social Psychology 28 (15), 1998, pp [16] R. Farrow, Is your desktop being wiretapped? Network Magazine 18 (8), 2003, p. 52. [17] C. Fornell, D.F. Larcker, Evaluating structural equations models with unobservable variables and measurement error, Journal of Marketing Research 18 (1), 1981, pp [18] J.-R. Fu, C.-K. Farn, W.-P. Chao, Acceptance of electronic tax filing: a study of taxpayer intentions, Information and Management 43 (1), 2006, pp [19] U.E. Gattiker, H. Kelley, Morality and computers: attitudes and differences in moral judgments, Information Systems Research 10 (3), 1999, pp [20] J. Girard, A field guide to spyware vibrations, ID#TU , Gartner Research, July 9, [21] J.F. Hair, R.E. Anderson, R.L. Tatham, W.C. Black, Multivariate Data Analysis, Prentice Hall, Englewood Cliffs, NJ, [22] S.J. Harrington, The effect of codes of ethics and personal denial of responsibility on computer abuse judgments and intentions, MIS Quarterly 20 (3), 1996, pp [23] E. Karahanna, D.W. Straub, N.L. Chervany, Information technology adoption across time: a cross-sectional comparison of pre-adoption and post-adoption beliefs, MIS Quarterly 23 (2), 1999, pp [24] H.C. Kelman, Compliance, identification, and internalization: three processes of attitude change, Journal of Conflict Resolution 2, 1958, pp [25] Y. Lee, K.A. Kozar, Investigating factors affecting the adoption of antispyware systems, Communications of the ACM 48 (3), 2005, pp [26] L.N.K. Leonard, T.P. Cronan, Illegal, inappropriate, and unethical behavior in an information technology context: a study to explain influences, Journal of the Association for Information Systems 1, [27] M.D. Lopez, C. Charron, Spyware threat goes unchecked, Forrester Research, April 1, [28] A.S.R. Manstead, D. Parker, Evaluating and Extending the Theory of Planned Behaviour, Wiley, Chichester, [29] C. Metz, J. Clyman, K. Karagiannis, S. Carroll, N. Rubenking, Spy Stoppers, PC Magazine 23 (4), 2004, pp [30] G.C. Moore, I. Benbasat, Development of an instrument to measure the perceptions of adopting an information technology innovation, Information Systems Research 2 (3), 1991, pp [31] O.K. Ngwenyama, A.S. Lee, Communication richness in electronic mail: critical social theory and the contextuality of meaning, MIS Quarterly 21 (2), 1997, pp [32] P.M. Podsakoff, S.B. MacKenzie, J. Lee, N.P. Podsakoff, Common method bias in behavioral research: a critical review of the literature and recommended remedies, Journal of Applied Psychology 88 (5), 2003, pp [33] R. Posten, T.F. Stafford, A. Hennington, Spyware: a view from the online street, Communications of the ACM 48 (3), 2005, pp [34] G. Premkumar, K. Ramamurthy, S. Nilakanta, Implementation of electronic data interchange: an innovation diffusion perspective, Journal of Management Information Systems 11 (2), 1994, pp [35] E.M. Rogers, The Diffusion of Innovations, Free Press, New York, [36] S.H. Schwartz, Normative explanations of helping behavior: a critique, proposal, and empirical test, Journal of Experimental Social Psychology 9, 1973, pp [37] M. Smith, Commonsense Computer Security, McGraw-Hill, Berkshire, England, [38] D.W. Straub, Validating instruments in MIS research, MIS Quarterly 13 (2), 1989, pp [39] S. Taylor, P. Todd, Understanding information technology usage: a test of competing models, Information Systems Research 6 (3), 1995, pp [40] V. Venkatesh, Determinants of perceived ease of use: integrating control, intrinsic motivation, and emotion into the technology acceptance model, Information Systems Research 11 (4), 2000, pp [41] V. Venkatesh, S.A. Brown, A longitudinal investigation of personal computers in homes: adoption determinants and emerging challenges, MIS Quarterly 25 (1), 2001, pp [42] V. Venkatesh, F.D. Davis, A theoretical extension of the technology acceptance model: four longitudinal field studies, Management Science 46 (2), 2000, pp [43] V. Venkatesh, M.G. Morris, Why do not men ever stop to ask for directions? Gender, social influence, and their role in technology acceptance and user behavior MIS Quarterly 24, 2000, pp [44] H. Wold, Soft modeling: The Basic Design and Some Extension, North-Holland, Amsterdam, [45] J.-H. Wu, S.-C. Wang, What drives mobile commerce? an empirical evaluation of the revised technology acceptance model Information and Management 42 (5), 2005, pp [46] Q.-J. Yeh, A.J.T. Chang, Threats and countermeasures for information system security: a cross-industry study, Information and Management 44 (5), 2007, pp [47] M.Y. Yi, F.D. Davis, Developing and validating an observational learning model of computer software training and skill acquisition, Information Systems Research 14 (2), 2003, pp [48] M.Y. Yi, J.D. Jackson, J.S. Park, J.C. Probst, Understanding information technology acceptance by individual professionals: toward an integrative view, Information and Management 43 (3), 2006, pp

11 Y. Lee, K.A. Kozar / Information & Management 45 (2008) Younghwa Lee is an Assistant Professor of Information Systems at the University of Kansas School of Business. He received his Ph.D. from University of Colorado/Boulder in His research interest is in website usability, technology acceptance, and IT ethics and security. He is an ICIS 2003 doctoral consortium fellow. He has published in Decision Support Systems, Communications of the ACM, Data Base, Journal of Organizational Computing and Electronic Commerce, among others. Kenneth A. Kozar is a Professor of Information Systems at the University of Colorado/Boulder Leeds School of Business. His interests lie in the area of human and organizational impacts of technology. He has published in a number of journals, served two terms as an associate editor of the MIS Quarterly, and was the chair of the Society for Information Management s International Paper Award Competition.