Security Update Labels: Establishing Economic Incentives for Security Patching of IoT Consumer Products

TL;DR

This paper proposes mandatory security update labels for IoT consumer products to incentivize manufacturers to provide sustainable security updates, supported by a user study showing labels significantly influence consumer choices based on security update guarantees.

Contribution

Introduction of security update labels for IoT devices that inform consumers and incentivize manufacturers to enhance security support, backed by empirical user study results.

Findings

Security update availability impacts consumer choice by up to 35%.

Provisioning time for security updates influences decisions by up to 25%.

Labels are easily understood and can motivate better security practices.

Abstract

With the expansion of the Internet of Things (IoT), the number of security incidents due to insecure and misconfigured IoT devices is increasing. Especially on the consumer market, manufacturers focus on new features and early releases at the expense of a comprehensive security strategy. Hence, experts have started calling for regulation of the IoT consumer market, while policymakers are seeking for suitable regulatory approaches. We investigate how manufacturers can be incentivized to increase sustainable security efforts for IoT products. We propose mandatory security update labels that inform consumers during buying decisions about the willingness of the manufacturer to provide security updates in the future. Mandatory means that the labels explicitly state when security updates are not guaranteed. We conducted a user study with more than 1,400 participants to assess the importance of security update labels for the consumer choice by means of a conjoint analysis. The results show that the availability of security updates (until which date the updates are guaranteed) accounts for 8% to 35% impact on overall consumers' choice, depending on the perceived security risk of the product category. For products with a high perceived security risk, this availability is twice as important as other high-ranked product attributes. Moreover, provisioning time for security updates (how quickly the product will be patched after a vulnerability is discovered) additionally accounts for 7% to 25% impact on consumers' choices. The proposed labels are intuitively understood by consumers, do not require product assessments by third parties before release, and have a potential to incentivize manufacturers to provide sustainable security support.

Tables

Table 1. TABLE I : Product categories with their respective attributes and attribute levels.

Category	Attribute		Levels
Smart home camera	1	Price	€100, €120, €140, €160
	2	Resolution	HD, Full-HD
	3	Field of vision	110°, 130°, 150°
	4	Frame rate	25fps, 30fps, 50fps
	5	Zoom function	yes, no
	6	Availability of security updates	none, until 12/2020 (2 years), until 12/2024 (6 years)
	7	Provisioning time for sec. updates	none, within 10 days, within 30 days
Smart weather station	1	Price	€100, €120, €140, €160
	2	Battery lifetime	1 year, 2 years, 3 years
	3	Precision	$\pm$0.2°C, $\pm$0.3°C, $\pm$0.5°C
	4	Rain/wind sensor	yes, no
	5	Expandability to multiple rooms	yes, no
	6	Availability of security updates	none, until 12/2020 (2 years), until 12/2024 (6 years)
	7	Provisioning time for sec. updates	none, within 10 days, within 30 days

Table 2. TABLE II : Demographic data of conjoint analysis sample compared with the German population.

		Sample		Population
All		1,466
Gender	female	640	44.0%	49.8%a
	male	805	55.3%	50.2%a
	3rd option	10	0.7%
Age (in years)	18-24	339	23.1%	12.9%a
	25-29	288	19.6%	9.6%a
	30-49	432	29.5%	18.8%a
	50-64	404	27.5%	58.7%a
Vocational qualification	none	156	10.6%	22.8%a
	vocational	582	39.7%	60.2%a
	academic	728	49.7%	17.0%a
Monthly net income (in €)	none	52	4.3%	17.9%b
	less than 900	288	23.5%	24.3%b
	900 to 1,500	296	24.2%	22.7%b
	1,500 to 2,600	377	30.8%	22.4%b
	more than 2,600	210	17.2%	10.2%b
Professional IT background	yes	249	17.6%
	no	1166	82.4%

Table 3. TABLE III : Relative importance of product attributes.

	Smart Home Camera (n=731)			Smart Weather Station (n=735)
Rank	Attribute	$\mu$ [%]	$\sigma$ [%]	Attribute	$\mu$ [%]	$\sigma$ [%]
1.	Availability1	30.57	9.82	Availability1	20.37	9.28
2.	Price	15.12	8.86	Price	16.64	11.03
3.	Provisioning time2	13.98	6.30	Rain/wind sensor	16.37	9.87
4.	Resolution	12.05	8.98	Provisioning time2	16.12	7.96
5.	Frame rate	10.71	6.06	Expandability	13.15	8.14
6.	Field of view	8.89	5.29	Battery lifetime	9.82	6.53
7.	Zoom function	8.68	6.72	Precision	7.53	4.84

Table 4. TABLE IV : Average utilities of selected product attributes.

Attribute	Level	Smart Home Camera	Smart Weather Station
Price	100€	33.64	44.13
	120€	19.46	21.08
	140€	-5.66	-9.33
	160€	-47.45	-55.88
Availability of sec. updates	none	-111.93	-77.52
	until 12/2020 (2 years)	14.32	21.91
	until 12/2024 (6 years)	97.61	55.61
Prov. time for sec. updates	none	-32.82	-61.10
	within 10 days	37.16	43.75
	within 30 days	-4.34	17.35

Table 5. TABLE V : Comparing the market estimation regarding shares of preferences of four pre-defined product configurations with real preferences in fixed holdout tasks.

	Smart Home Camera				Smart Weather Station
	Holdout Task 1		Holdout Task 2		Holdout Task 1		Holdout Task 2
	P1, P2, P3a, P4		P4, P3b, P2, P1		P1, P2, P3a, P4		P4, P3b, P2, P1
\pbox1.2cm Product Profile	Estimated	Real	Estimated	Real	Estimated	Real	Estimated	Real
P1	1.5%	2.7%	1.4%	2.9%	1.7%	3.3%	1.5%	2.7%
P2	4.8%	11.4%	2.4%	5.7%	22.1%	21.0%	15.8%	16.5%
P3	3.6%	6.6%	58.8%	53.4%	5.3%	9.5%	36.5%	32.7%
P4	84.4%	72.8%	34.6%	35.6%	61.1%	57.1%	39.0%	42.0%
None	5.7%	6.6%	2.8%	2.5%	9.7%	9.1%	7.1%	6.1%

Table 6. TABLE VI : Consumer segmentation via latent-class analysis.

		Smart Home Camera			Smart Weather Station
		Group 1	Group 2		Group 1	Group 2	Group 3
Total number of respondents $n$1		488	243	Group 1 vs Group 2	182	221	332	Group 1 vs Group 2 vs Group 32
Gender	female	42.6%	44.9%	${\chi }^2\left(1\right)=0.42,V=0.024$	43.4%	50.2%	40.1%	${\chi }^2\left(2\right)=4.40,V=0.08$
	male	55.9%	53.1%		53.8%	49.8%	58.7%
Age	$\mu$ [years]	33.0	33.9	$t\left(729\right)=-1.10,d=-0.09$	36.9	34.8	32.8	$F(2,732)=8.00\text{<sup>**</sup>},r=0.15$
Vocational qualification	none	9.2%	11.9%		8.2%	11.8%	12.3%
	vocational	38.7%	42.8%	${\chi }^2\left(2\right)=3.35,V=0.068$	37.9%	43.0%	37.7%	${\chi }^2\left(4\right)=68.31\text{<sup>**</sup>},V=0.22$
	academic	52.0%	45.3%		53.8%	45.2%	50.0%
Monthly net income3	$\mu$ [€]	1704	1706	$t\left(599\right)=-0.22,d=0.002$	1854	1707	1532	$F(2,619)=3.73\text{<sup>*</sup>},r=0.11$
Professional IT background	yes	18.5%	17.7%	${\chi }^2\left(1\right)=0.06,V=0.01$	13.7%	17.2%	17.8%	${\chi }^2\left(2\right)=0.37,V=0.02$
	no	81.5%	82.3%		81.3%	81.4%	80.4%
Privacy concerns		4.48	4.59	$t\left(729\right)=-0.98,d=-0.08$	4.54	4.57	4.26	$F(2,732)=3.86\text{<sup>*</sup>},r=0.10$
Security behavior intention		3.59	3.56	$t\left(729\right)=0.59,d=0.05$	3.70	3.67	3.47	$F(2,732)=16.74\text{<sup>**</sup>},r=0.17$
Perceived security risk		5.44	5.61	$t\left(729\right)=-2.13\text{<sup>*</sup>},d=-0.17$	3.88	3.96	3.32	$F(2,732)=10.31\text{<sup>**</sup>},r=0.21$

Table 7. TABLE VII : Product attribute importance of consumer groups.

	Smart Home Camera				Smart Weather Station
Rank	Group 1 (n = 488)		Group 2 (n = 243)		Group 1 (n = 182)		Group 2 (n = 221)		Group 3 (n = 332)
1.	Availability1	31.42%	Availability1	25.26%	Availability1	23.41%	Availability1	35.24%	Price	29.98%
2.	Resolution	16.47%	Provisioning time2	19.03%	Rain/wind sensor	23.14%	Provisioning time2	24.62%	Rain/wind sensor	20.55%
3.	Price	11.82%	Price	16.66%	Provisioning time2	19.38%	Expandability	12.95%	Battery Lifetime	13.46%
4.	Frame rate	10.68%	Field of view	11.64%	Expandability	15.90%	Battery Lifetime	8.12%	Expandability	12.88%
5.	Zoom function	10.48%	Frame rate	9.26%	Price	8.49%	Rain/wind sensor	7.11%	Precision	8.49%
6.	Provisioning time2	10.22%	Resolution	9.17%	Battery Lifetime	5.26%	Precision	6.19%	Availability1	8.01%
7.	Field of view	8.91%	Zoom function	8.98%	Precision	4.44%	Price	5.76%	Provisioning time2	6.64%

Table 8. TABLE VIII : Considered product attributes ( n = 29 𝑛 29 n=29 ) and their dual-questioning scores (higher score values indicate a higher perceived importance for this attribute)

Smart Home Camera
Rank	Product Attribute	$\mu$	$\sigma$
1.	Price	31.76	12.83
2.	Solar panel for energy generation	26.66	12.01
3.	Battery lifetime	26.31	11.33
4.	Precision level of measurements	23.72	10.98
5.	Rain and wind measurements	23.69	10.99
6.	Expandability for multiple rooms	23.48	13.06
7.	Max. wireless range	23.34	10.17
8.	Warning feature (e.g., storm)	22.66	10.59
9.	How many days of local weather forecast	22.14	8.80
10.	Measurement rate	19.14	10.15
11.	Brand/ manufacturer	18.28	10.12
12.	Alarm upon preset threshold exceedance	18.03	10.69
13.	Seal of technical approval	17.76	10.14
14.	Environmental label	17.14	12.23
15.	Material of casing	16.62	10.45
16.	Color of product	16.03	11.69
17.	Alexa compatible	12.34	9.93
18.	Accessibility label (fictive)	11.17	6.70
Smart Weather Station
Rank	Product Attribute	$\mu$	$\sigma$
1.	Price	30.59	12.69
2.	Video resolution	26.79	12.22
3.	Field of view	26.17	11.60
4.	Video frame rate	24.41	11.21
5.	Zoom function	23.10	11.85
6.	Energy consumption	22.59	10.53
7.	Face recognition	22.10	12.19
8.	Night vision mode	21.79	9.60
9.	Timing function for recordings	20.86	9.16
10.	Type of power supply	19.24	8.59
11.	Brand/ manufacturer	18.48	11.92
12.	Seal of technical approval	18.48	12.21
13.	Material of encasement	18.41	10.62
14.	Environmental label	17.38	11.68
15.	SD card slot	17.21	9.69
16.	Color of product	14.52	10.21
17.	Accessibility label (fictive)	14.14	8.73
18.	Alexa compatible	11.21	9.19

Table 9. TABLE IX : Mean μ 𝜇 \mu and standard deviation σ 𝜎 \sigma from Prestudy 1 ( n = 30 𝑛 30 n=30 ) sorted by perceived security risk.

Product Category		\pbox2.2cmPerceived Security Risk	Attitude	\pbox1.5cmConsumption Motive	\pbox1.4cmPurchase Intention	Involvement	Desirability
Smart Alarm System	$\mu$	5.76	4.77	1.74	3.37	4.26	3.90
	$\sigma$	1.33	1.17	1.01	1.57	1.13	1.47
Smart Door Lock	$\mu$	5.65	3.16	2.42	2.39	3.22	2.70
	$\sigma$	1.63	1.38	1.43	1.55	1.28	1.34
Smart Home Camera	$\mu$	5.49	3.86	3.44	3.02	3.56	3.57
	$\sigma$	1.41	1.82	1.73	1.60	1.41	1.59
Smart Smoke Detector	$\mu$	4.12	5.16	1.74	4.27	4.52	4.27
	$\sigma$	1.55	1.34	1.03	1.79	1.30	1.55
Smart Thermostat	$\mu$	3.67	5.24	1.72	4.52	4.52	4.67
	$\sigma$	1.61	1.38	0.97	1.69	1.20	1.27
Smart Light Bulb	$\mu$	3.40	3.90	4.39	3.24	3.31	3.33
	$\sigma$	1.45	1.48	1.63	1.61	1.41	1.56
Smart Vacuum Robot	$\mu$	3.10	4.76	2.30	4.08	4.12	3.97
	$\sigma$	1.67	1.84	1.38	2.09	1.54	1.87
Smart Weather Station	$\mu$	2.98	4.38	2.90	3.51	3.75	3.67
	$\sigma$	1.51	1.83	1.47	1.87	1.63	1.69

Table 10. TABLE X : Post-hoc tests (Tukey HSD) for segmentation.

Smart Weather Station
	Groups	MD1	$p$	95%-CI2	d
Age	1 vs 2	$2.14$	$0.14$	$[-0.51,4.80]$	$0.19$
	1 vs 3	$4.12$	$0.00$	$[1.68,6.57]$	$0.37$
	2 vs 3	$1.98$	$0.11$	$[-0.32,4.28]$	$0.17$
Monthly net income	1 vs 2	$146.95$	$0.50$	$[-158.63,452.53]$	$0.11$
	1 vs 3	$322.04$	$0.02$	$[37.85,606.49]$	$0.26$
	2 vs 3	$175.09$	$0.26$	$[-85.76,435.94]$	$0.15$
Privacy Concerns	1 vs 2	$-0.03$	$0.97$	$[-0.37,0.31]$	$0.02$
	1 vs 3	$0.28$	$0.09$	$[-0.03,0.59]$	$0.20$
	2 vs 3	$0.31$	$0.03$	$[0.02,0.60]$	$0.22$
Security behavior intentions	1 vs 2	$0.03$	$0.89$	$[-0.12,0.18]$	$0.06$
	1 vs 3	$0.23$	$0.00$	$[0.09,0.36]$	$0.39$
	2 vs 3	$0.20$	$0.00$	$[0.07,0.33]$	$0.47$
Perceived security risk	1 vs 2	$-0.08$	$0.84$	$[-0.41,0.25]$	$0.05$
	1 vs 3	$0.56$	$0.00$	$[0.25,0.86]$	$0.36$
	2 vs 3	$0.63$	$0.00$	$[0.35,0.92]$	$0.31$

Table 11. TABLE XI : Perceived security risk scale (translated to English) with quality criteria.

#	Risk Category from [69]	Item	Product Category PC1 \pbox3.7cm(4 factors, $n=731$)			Product Category PC2 \pbox3.6cm(3 factors, $n=735$)
		If a third party takes unauthorized control over [product], there is a high risk that…	Factor loading	Item to Total	Cronbach’s alpha	Factor loading	Item to Total	Cronbach’s alpha
1	General	…the consequences are severe.	.769	.715	.891	.784	.780	.938
2		…it leads to high potential of abuse.	.835	.790		.817	.812
3		…it is used for criminal purposes.	.750	.768		.792	.795
4		…a serious security threat exists.	.776	.783		.822	.816
5	Privacy	…this has a serious impact on privacy.	.583	.596		.787	.809
6		…they access personal information.	.840	.774	.826	.742	.800
7		…it steals private data.	.826	.710		.702	.761
8	Physical	…the health of its owners or other people is at risk.	.885	.716	.804	.881	.803	.876
9		…the safety of its owners or other people is at risk.	.464	.524		.608	.688
10		…it has harmful consequences to the physical integrity of its owner or other people.	.875	.733		.882	.802
11	Financial	…the owner suffers financial losses.	.808	.756		.848	.797
12		…it is misused for crimes involving financial loss.	.799	.737	.886	.716	.781	.906
13		…it leads to financial loss.	.854	.841		.846	.863

Table 12. TABLE XII : Statistical significance and effect sizes (Cohen’s d z subscript 𝑑 𝑧 d_{z} ) of central product attitudes, purchase intention, and security risk perception for pairs of product categories (Prestudy 1).

\pbox1.4cmProduct Category 1	\pbox1.4cmProduct Category 2	Attitude			Consumption Motive			Purchase Intention			Involvement			Desirability			Perceived Security Risk
		$t\left(29\right)$		$d_z$	$t\left(29\right)$		$d_z$	$t\left(29\right)$		$d_z$	$t\left(29\right)$		$d_z$	$t\left(29\right)$		$d_z$	$t\left(29\right)$		$d_z$
Door lock	Light bulb	-2.266	*	-0.414	-4.855	***	-0.886	-2.762	*	-0.504	-0.338		-0.062	-2.129	*	-0.389	5.894	***	1.076
Door lock	Home Camera	-2.371	*	-0.433	-4.237	***	-0.773	-2.828	**	-0.516	-1.970		-0.360	-3.496	**	-0.638	0.637		0.116
Door lock	Smoke detector	-7.062	***	-1.289	2.088	*	0.381	-5.130	***	-0.937	-4.224	***	-0.771	-4.419	***	-0.807	5.288	***	0.965
Door lock	Thermostat	-6.519	***	-1.190	2.327	*	0.425	-5.884	***	-1.074	-4.811	***	-0.878	-5.662	***	-1.034	5.788	***	1.057
Door lock	Vacuum robot	-4.636	***	-0.846	.388		0.071	-4.809	***	-0.878	-2.783	**	-0.508	-3.532	**	-0.645	6.462	***	1.180
Door lock	Weather station	-3.600	**	-0.657	-1.563		-0.285	-3.063	**	-0.559	-1.891		-0.345	-3.057	**	-0.558	7.298	***	1.332
Door lock	Alarm system	-8.148	***	-1.488	2.411	*	0.440	-4.463	***	-0.815	-5.442	***	-0.994	-4.966	***	-0.907	-0.928		-0.169
Light bulb	Home Camera	0.134		0.024	2.218	*	0.405	0.677		0.124	-0.829		-0.151	-0.646		-0.118	-7.024	***	-1.282
Light bulb	Smoke detector	-3.621	**	-0.661	6.662	***	1.216	-2.425	*	-0.443	-3.389	**	-0.619	-2.328	*	-0.425	-2.397	*	-0.438
Light bulb	Thermostat	-4.036	***	-0.737	7.515	***	1.372	-3.443	**	-0.629	-3.931	***	-0.718	-3.641	**	-0.665	-1.164		-0.213
Light bulb	Vacuum robot	-2.780	**	-0.508	5.917	***	1.080	-2.281	*	-0.416	-2.710	*	-0.495	-1.698		-0.310	1.339		0.244
Light bulb	Weather station	-1.677		-0.306	4.925	***	0.899	-0.958		-0.175	-1.637		-0.299	-1.095		-0.200	1.948		0.356
Light bulb	Alarm system	-2.991	**	-0.546	7.385	***	1.348	-0.432		-0.079	-3.372	**	-0.616	-1.876		-0.343	-7.225	***	-1.319
Home Camera	Smoke detector	-3.876	**	-0.708	4.765	***	0.870	-3.850	**	-0.703	-3.148	**	-0.575	-2.104	*	-0.384	4.348	***	0.794
Home Camera	Thermostat	-4.200	***	-0.767	5.208	***	0.951	-5.324	***	-0.972	-3.707	**	-0.677	-3.171	**	-0.579	5.799	***	1.059
Home Camera	Vacuum robot	-2.631	*	-0.480	3.301	**	0.603	-3.353	**	-0.612	-1.995		-0.364	-1.343		-0.245	6.658	***	1.216
Home Camera	Weather station	-1.354		-0.247	1.468		0.268	-1.313		-0.240	-0.606		-0.111	-0.262		-0.048	7.574	***	1.383
Home Camera	Alarm system	-2.667	*	-0.487	5.588	***	1.020	-1.429		-0.261	-2.779	**	-0.507	-1.109		-0.202	-1.481		-0.270
Smoke detector	Thermostat	-0.308		-0.056	0.125		0.023	-0.822		-0.150	0.021		0.004	-1.249		-0.228	2.088	*	0.381
Smoke detector	Vacuum robot	1.054		0.193	-2.009		-0.367	0.436		0.080	1.160		0.212	0.787		0.144	3.288	**	0.600
Smoke detector	Weather station	2.234	*	0.408	-3.504	**	-0.640	1.797		0.328	2.135	*	0.390	1.469		0.268	5.129	***	0.936
Smoke detector	Alarm system	1.325		0.242	0.000		0.000	3.005	**	0.549	0.923		0.169	0.983		0.180	-6.090	***	-1.112
Thermostat	Vacuum robot	1.498		0.274	-2.067	*	-0.377	1.081		0.197	1.347		0.246	2.062	*	0.376	2.418	*	0.441
Thermostat	Weather station	2.592	*	0.473	-4.089	***	-0.747	2.445	*	0.446	2.466	*	0.450	2.838	**	0.518	3.878	**	0.708
Thermostat	Alarm system	1.654		0.302	-0.121		-0.022	3.332	**	0.608	1.000		0.182	2.316	*	0.423	-6.361	***	-1.161
Vacuum robot	Weather station	1.020		0.186	-1.948		-0.356	1.286		0.235	1.025		0.187	0.712		0.130	0.664		0.121
Vacuum robot	Alarm system	-0.038		-0.007	2.184	*	0.399	2.117	*	0.387	-0.539		-0.098	0.205		0.037	-7.084	***	-1.293
Weather station	Alarm system	-1.282		-0.234	3.964	***	0.724	0.477		0.087	-1.829		-0.334	-0.851		-0.155	-8.227	***	-1.502

Full text

I Introduction

In 1999, Kevin Ashton coined the term ‘Internet of Things’ [1] as the headline of a marketing presentation that promoted an idea of utilizing radio-frequency identification (RFID) in supply chains. By now, Internet of Things evolved into a major technological paradigm: everyday items, household appliances, and mobile devices are interconnected via wireless networks and the Internet. Gartner [2] predicts that the majority of IoT devices, 12.9 billion units (63%), will be installed in the consumer sector by 2020, and thus, consumer products play a prominent role in the expansion of the IoT.

Recent academic and industrial user studies [3, 4, 5, 6] document various security concerns regarding the usage of IoT products. At least since the denial-of-service attacks against Internet infrastructure by the Mirai botnet [7] in 2016, security experts have started to demand regulatory interventions. “Our choice isn’t between government involvement and no government involvement”, says Bruce Schneier in his testimony before a committee of the U.S. House of Representatives [8], “Our choice is between smarter government involvement and stupider government involvement”. Current policy approaches in the U.S. include a bill for establishing guidelines for the acquisition of secure IoT products by governmental agencies [9] as well as a Californian bill [10] obligating manufacturers to equip IoT devices with reasonable security features. In the EU, baseline security recommendations for IoT were published by the European Union Agency for Network and Information Security (ENISA) [11]. A task force from academia, industry, and societal organizations proposed a policy for vulnerability disclosure in the EU that also concerns IoT products [12].

The deficient IoT security can be at least partly attributed to missing economic incentives for manufacturers. To be successful on the market, manufacturers have to attract consumers and complementers [13, 14]. Consumers reward an early market entry and new functional features, while complementers favor systems that allow easy compatibility with their products. These demands contradict the security design that usually adds complexity to systems. In addition, releasing an innovative product to the market requires many resources, and since resources are finite, they are withdrawn from non-functional features, such as comprehensive security mechanisms [15].

The missing incentives for securing IoT consumer products originate from the consumers’ inability to compare security properties of different products. The concept of an asymmetric information barrier between buyers and sellers, which also affects other properties, such as energy consumption and product quality, is known in the economic theory as ‘the market for lemons’ [16]. This theory states that consumers are not willing to pay a price premium for something they cannot measure. In fact, even manufacturers might not have the complete knowledge about the strength of their products’ security [14]. Reasons might be a lack of experience in designing Internet-connected technologies or the outsourcing of a product’s security development to original equipment manufacturers (OEMs).

Contributions

Firstly, we propose and examine mandatory security update labels, a novel idea for a regulatory framework that complements ongoing regulation efforts. We do not call for security testing and certification to keep “insecure” products off the market. Instead, we explore to which extent market forces can be utilized to elicit manufacturers to sustainably support their products’ software with security updates. Security update labels enable an informed choice regarding security properties of IoT consumer products. They transform the asymmetric information about the manufacturer’s willingness to provide security updates into two intuitively assessable and comparable product attributes: availability period, i.e., for how long the manufacturer guarantees to provide security updates (e.g., ‘until 12/2016’), as well as provisioning time, i.e., within which timeframe after a vulnerability notification a security patch is provided (e.g., ‘within 30 days’). These labels are inspired by established regulations, such as energy labels.

Secondly, we empirically examine the impact of security update labels on the consumers’ choice. Although security patching is discussed by experts as one of the most effective countermeasure against insecure IoT devices, the impact of guaranteeing security updates on the consumers’ decisions has not been empirically assessed so far. We conducted a user study with more than 1,400 participants that measured the relative importance of the availability period and provisioning time of security updates for buying decisions. To this end, we used conjoint analysis, a well-established method in marketing research [17, 18], which has also been used in courts to calculate damages of patent and copyright infringements [19]. In a nutshell, a number of fictitious product profiles, each described by a set of attributes, is shown to respondents in multiple iterations. They are asked which of the presented products they would prefer to buy (with the option to refuse buying any of the products). Based on these choice results, conjoint analysis determines a preference model that measures the relative importance and utility of each attribute.

Study Results

We found that the guarantee of providing security updates has a high impact on buying decisions. We examined two product categories, one with a high and one with a low perceived security risk. Among all assessed product attributes, the availability period of security updates was the most important one: For the product with the high perceived security risk, its relative importance on the overall consumers’ choice of 31% is at least twice as high as the importance of other attributes. For the product with the low perceived security risk, availability had a lower relative importance of 20% for the consumers’ choice. Additionally, consumers prefer a shorter provisioning time (10 days) over a longer provisioning time (30 days), and dislike longer provisioning times for products with a high perceived security risk. Demographic characteristics play a minor role, while the sensitivity for security risks has an impact on the consumers’ choice.

With this work, we address policymakers and security researchers that are seeking for promising directions to foster sustainable security efforts for IoT consumer products.

II Background and Related Work

We provide background and related work on product labeling and conjoint analysis in this section.

II-A Product Labeling

Product labeling is used in many countries to inform consumers about intangible features of products and to enable product comparison during buying decisions. The Federal Trade Commission (FTC) issues product labeling policies in the USA, while each member state of the EU runs its own institution that enforces regulations defined by the EU Commission. Prominent examples are energy labels. In the USA, energy labels were introduced in 2007 [20] by the FTC and show the energy consumption and the estimated annual operating costs. In 2010, The EU followed with a similar approach by introducing the Energy Efficiency Directive [21]. Prior research on the effectiveness of energy labeling [22, 23, 24] concluded that consumers are aware of these labels, understand them, and that energy labels influence consumers’ buying decisions.

In 2017, the German government [25] evaluated an idea of lifetime labels on electronic products. Their label design showed a color-gradient lifespan between 0 (red) and 20 (green) years. In a user study with a representative sample, discrete-choice experiments (but not conjoint analysis) simulated online shopping scenarios. The results showed that while the lifespan attribute was recognized by consumers, its impact on buying decisions was less than the impact of other product attributes, e.g., price and brand. Their label did not concern security features, but the functional lifespan of a product.

II-B Security & Privacy Labels and Regulatory Approaches

In the academic research, the adaption of product labels for privacy information was examined in user studies. Kelley et al. [26, 27] investigated whether food nutrition labels can be adapted to make privacy policies of websites more understandable. Tsai et al. [28] evaluated whether consumers would pay a higher price for a product offered by an online shop with a strict privacy policy as compared to a less privacy-protecting shop. Their results suggest that consumers are willing to pay a price premium for higher privacy if privacy information is salient and understandable.

Independently and concurrently to our work, Emami-Naeini et al. [6] developed a security and privacy label for IoT consumer products. In contrast to our proposal, their label includes ratings that require third-party product testing before release. They tested their label in an interview study with 24 users and a survey with 200 respondents. Emami-Naeini et al. did not conduct a conjoint analysis but directly asked the users to rate the importance of security and privacy on their buying decisions. They concluded that importance of security and privacy depends on the product category: whereas they are important when buying a home camera or a smart thermostat, they are not important when buying a smart toothbrush. We found a similar effect in our study. Our and their studies complement and validate each other’s results using different methods.

Mandatory security update labels represent a possible approach to regulate the IoT product market with regard to security. Chattopadhyay et al. [29] consider this economic problem in more depth and analyze the impact of various regulation strategies on consumers’ behavior.

II-C Conjoint Analysis

Conjoint analysis is one of the major methods to measure the impact of product attributes on the consumers’ buying decisions [30]. The basic idea of conjoint analysis is that respondents are asked to state their preference for buying fictitious products. The product profiles are described by a limited set of attributes, e.g., size, color, and price. All further attributes of the product are assumed to be constant.

There are different types of conjoint analysis. Among them, choice-based conjoint (CBC) is used in 79% of the conjoint surveys [31]. In CBC, which we use in this work as well, the respondents receive multiple (usually randomly generated) subsets of 3 to 5 product profiles (so-called choice sets), of which they select the most desirable product.

Considering the overall preference (i.e., combination of all buying decisions) as dependent variable and the attributes of the product as independent variables, a conjoint analysis assesses the relative importance of product’s attributes. For example, relative importance of the attribute ‘color’ for buying decisions can be assessed. Conjoint analysis also evaluates the importance of the different characteristics of a single attribute, e.g., whether the change of a product’s color would have positive or negative effects on the consumers’ choice.

In the past decades, conjoint analysis has been applied to numerous commercial projects [32] and is by far the most widely-used methodology in marketing research to analyze consumer trade-offs in buying decisions [17]. Conjoint analysis is also used in other areas, e.g., to assess the patients’ preferences in the healthcare sector [33]. Furthermore, it is a recognized methodology to calculate damages of patent and copyright infringement in court cases [19]. A famous example was Apple’s $2.5 billion law suit against Samsung, in which Apple estimated the financial damages of the alleged patent infringement based on conjoint analysis [34].

Conjoint analysis has also previously been used to investigate the effects of product labels [35, 36, 37] on the consumers’ choice. Sammer and Wüstenhagen [38] analyzed the impact of energy labels on the buying decisions concerning light bulbs and washing machines of Swiss consumers. However, we are the first to use conjoint analysis to assess the importance of a security-related label.

III Security Labels for Consumers

Inspired by the success of existing product labels, we propose a label that enables users to compare security properties during buying decisions. We present the idea of a regulatory framework that accompanies the label, and discuss concerns that finally motivate the user study.

III-A Security Scales for Labeling

Learning from the success of the energy labeling initiatives, we asked how we can use a similar approach for security. First of all, an appropriate scale to measure security properties is required. We need a security scale that

can be intuitively understood by consumers, even if they have no security expertise; 2. 2.

enables them to easily compare products, as comparison lays the foundation for the choice between products; 3. 3.

and finally, does not require third-party product testing for market release.

The last requirement is based on the following considerations: Third-party testing is a long and costly procedure that might considerably delay the release of a new product. This involves the danger that manufacturers would choose testing laboratories that perform a relaxed and fast evaluation [39, 40], which again could lead to a false sense of security.

In prior work, a number of security scales has been proposed that could be applied to IoT products. Many of them (e.g., [41, 42]) are based on the Common Vulnerability Scoring System (CVSS) [43] and used to categorize the seriousness and impact of existing security vulnerabilities. Although CVSS can serve as an indicator of future security properties, it cannot solely measure the current level of product security, as it is based on past vulnerability records.

The time-to-compromise (TTC) [44] scale originated from the concept of the working time required to break a physical safe. In terms of IoT consumer products, this metric could measure the time it takes to break the security mechanisms of a product. According to our criteria, TTC is not applicable as it requires a third party to assess the product’s security.

A security scale might also show levels of a security certification scheme. However, besides the need for a third party, security certification is not suitable to communicate security levels to consumers, as it might be misleading: Whereas consumers may assume that the whole product is certified, in reality only a subset of the components might be certified [39].

III-B Security Update Labels

We conclude that, to the best of our knowledge, there are no suitable approaches to communicate the security level of an IoT product to consumers. And even if manufacturers would implement comprehensive security measures, security flaws in IoT products cannot be fully prevented. Prior research [45, 46] concluded that well-engineered code has an average defect rate of around 2 defects per 1,000 lines of code. If we accept the possibility of security vulnerabilities even in well-designed systems, the best approach would be to continuously support the repair of such defects as soon as they are disclosed. We propose a regulatory framework that demands brand-giving manufacturers to define an update policy for each IoT consumer product with the following properties:

Availability period:

The availability of security updates determines the absolute timeframe in which the manufacturer ensures the patching of security vulnerabilities in the product’s software. In other words, it defines until which date (for example: ‘12/2024’) the manufacturer contractually warrants to provide security updates.

Provisioning time:

When a security vulnerability in the software of an IoT consumer product was reported, the manufacturer has to investigate this issue and patch the software if needed. The update policy defines the maximum timeframe (for example: ‘30 days’) within which the manufacturer guarantees to provide software security updates.

Both attributes must be printed as a security update label on each adequate product such that consumers can compare this information when making a buying decision. The label content does not need to be authorized by a third party before the market release, similarly to the mandatory energy labels. If a manufacturer refuses to guarantee security updates, the label should explicitly display ‘no security updates guaranteed’ or a similar phrase.

III-C An Idea for a Regulatory Framework

Following the example of the legislations for energy labeling [21, 47], market surveillance and consumer protection authorities should supervise the implementation of the security update labels, and conduct promotional and educational information campaigns in the introduction phase. We propose that each applicable product displays the label on the packaging, such that it can be considered and compared during buying decisions, and on the device itself to inform the consumer about the guaranteed availability of security updates after deployment. These labels should be mandatory for each consumer product that is able to directly or indirectly (e.g., over Bluetooth) connect to the Internet. The liability should be enforced only between the brand-giving company that is responsible for the definition of the update policy, and the buyer of the product. All further interactions between the brand-giving company and OEMs or other involved third parties should be regulated by the market.

The vulnerability disclosure can be implemented in many ways. An approach might be to set up a public vulnerability reporting platform. This platform could ensure the documentation of the reported vulnerabilities and would act as an information channel where the manufacturer announces the current state of the vulnerability handling to the affected consumers and policy-enforcing entities. The design of such a reporting platform could follow the proposal of the Centre for European Policy Studies [12, p.56] and is out of scope of this paper. Procedures could be implemented based on the established standards for responsible vulnerability disclosure, e.g., ISO/IEC 29147 [48], and vulnerability handling, e.g., ISO/IEC 30111 [49]. When a suspected security vulnerability is found, the reporting entity files a vulnerability report via this platform, which in turn informs the affected manufacturers. After receiving the vulnerability report, the time-to-patch clock starts and the manufacturer investigates whether the vulnerability can be reproduced. If the manufacturer concludes that the reported vulnerability is an actual security flaw, a security patch shall be developed and provided within the guaranteed provisioning time. We propose that consumers have a right to compensation in the following cases:

• •

The manufacturer does not provide a required security patch within the guaranteed provisioning time.

• •

The manufacturer provides a security patch, but the patch does not fix the bug, introduces other security problems, or has serious effects on the performance of the product.

For the cases of disputes about the effectiveness of provided updates or whether a bug requires a security patch, policymakers should establish an entity that enforces accountability, judges the claims of the consumers, protects vulnerability reporters, and has the power to sanction manufacturers, similarly to the sanctions imposed by the General Data Protection Regulations (GDPR) in the EU [50, Art.58].

III-D Concerns towards Security Update Labels

The proposal of security update labels might raise the following concerns.

III-D1 Ineffectiveness

Some security vulnerabilities cannot be patched with updates. For example, a security flaw in the specification of an interconnected system might demand changes in other components that are not maintained by the manufacturer, or the hardware platform of the affected product cannot support the patched software due to memory or computational power constraints. In this case, the proposed label strengthens consumer rights as the consumer is entitled to compensation.

III-D2 Misuse

Manufacturers might be motivated to spend even less resources on security of their products before releasing them. They might decide that they always can patch the product within a certain timeframe, which means that they simply could outsource the debugging of their products to the consumers. We believe that such behavior would damage the user acceptance and the brand image. Furthermore, this practice would lead to a high pressure on the manufacturers to deliver numerous security patches within limited time. In another scenario, manufacturers might try to transfer the liability regarding their products to offshore companies. These scenarios should be considered when defining the legislation.

III-D3 Low User Acceptance

The security update labels could fail as they might not have the expected effect on consumers’ buying decisions. Prior user studies [51, 52, 53, 54] outline that consumers tend to be reluctant towards the installation of updates. This behavior results from a lack of clarity about the usefulness of updates as well as from negative update experiences in the past, such as unwanted changes in user interfaces or in functionality. In consequence, the attitude towards security updates is affected as users typically do not differentiate between different types of updates. Therefore, security update labels could have a low user acceptance.

Potential moral hazard [55] could also lead to a low user acceptance. In our context, this means that users might not be willing to pay a price premium to protect against security vulnerabilities that will not affect them. An illustration are the attacks by the Mirai botnet [7], in which thousands of IoT consumer products deployed in Latin America attacked US-based Internet services. In this case, why would a Latin-American consumer pay a price premium for a security update guarantee that protects US businesses?

The concerns of ineffectiveness and potential misuse depend on the legislation and business decisions of particular manufacturers. We leave the investigation of these concerns to future work. In the following, we investigate the concern of low user acceptance by means of a user study.

IV Concept of User Study

If security update labels turn out to be important for consumers’ buying decisions, this would create economic incentives for manufacturers to guarantee the timely patching of security vulnerabilities in their IoT products. Therefore, we consider the following research questions:

RQ1

What is the relative importance of the availability period and provisioning time for security updates for buying decisions compared to other product attributes?

RQ2

Are there differences in the relative importance of the availability period and provisioning time for security updates between products with a high perceived security risk compared to products with a low perceived security risk?

RQ3

Are there differences in the relative importance of the availability and provisioning time for security updates according to demographic characteristics of the consumers?

RQ4

Are there differences in the relative importance of the availability and provisioning time for security updates depending on security behavior intentions, privacy concerns, and security risk perception of the consumers?

In the following, we investigate these research questions for German consumers by means of a user study. Germany has the largest consumer market within the EU, and the fourth largest consumer market worldwide after USA, China, and Japan [56].

Structure of the User Study

We utilize conjoint analysis, as this method is well suited for our objectives (cf. Section II-C): We aim to determine the influence of the availability period and provisioning time attributes on consumers’ choices. This includes whether these attributes are desired at all (i.e., do consumers care about the availability of security updates?), and which attribute levels are more attractive (i.e., do consumers favor short provisioning time or long availability periods?).

To answer the research questions, we needed to choose product categories that differ in the perceived security risk. We decided on two product categories as this number is sufficient to answer the research questions: one with a high perceived security risk as well as one with a low perceived security risk.

The user study followed a three-stage approach as shown in Figure 1: In the first stage (Prestudy 1), two suitable product categories were selected. In the second stage (Prestudy 2), we determined the most important product attributes and their levels for each of the two product categories. In the third stage (Conjoint Analysis), we assessed the consumers’ preferences (RQ1), comparing the attributes of the security update label with other important product attributes. Finally, we validated the preference model, compared the product categories (RQ2), and performed a segmentation analysis (RQ3, RQ4).

Ethics and Recruitment

The study design was approved by the data protection office of our university. All data was processed in accordance with the German data protection laws and all survey answers were pseudonymized. The online surveys were hosted on a web server that is provided by our university, and secured such that only authorized entities have access to the collected data. The respondents for the online surveys were recruited at an online crowdworker platform, as prior work showed that such samples are appropriate for security research [57]. We used the Clickworker.de platform [58], which claims to have the largest crowd of German-speaking workers. For all online surveys, we selected the respondents with following characteristics: all genders, age between 18 and 65, and Germany as country of residence. The crowdworkers were paid according to the German minimum wage of €8.84 per hour.

Translation of Psychometric Scales

As we run our surveys with German-speaking respondents, we translated all items of utilized English psychometric scales. These scales measure, e.g., privacy concerns [59] or security behavior intentions [60]. To ensure a reliable translation, we utilized a methodology proposed by Venkatesh et al. [61]. Three bilingual domain experts translated the English scales into German individually. Then, the experts discussed differences in their translations and agreed on a single final version. Finally, three other persons (an English native speaker, a professional translator, and a German who lived for several years in the UK) retranslated the German scales back into the original language. Through verifying that the original scales matched the retranslated scales semantically, the translation was considered successful.

Statistical Data Analysis

We denote by $\mu$ the mean value, and by $\sigma$ the standard deviation. To assess the practical meaning of the statistical results, we report effect sizes [62]: For unpaired $t$-tests, the absolute value of $d<0.5$ is considered small, $d$ between 0.5 and 0.8 medium, and $d>0.8$ large effect. For paired $t$-tests, effect size $d_{z}$ is interpreted identically to $d$. Cramer’s $V$ measures effect sizes for ${\chi}^{2}$ tests, and $r$ for ANOVA111$r$ denotes effect size for one-way independent ANOVA according to Field [63, p. 472] and is calculated as $\sqrt{\eta^{2}}$.. Values around 0.10 indicate a small, 0.30 a medium, and 0.50 a large effect [63].

V Preliminary Studies

V-A Prestudy 1: Selection of Product Categories

The objective of this prestudy is to identify two categories of IoT products according to the following criteria:

C1

Both categories should differ significantly in their perceived security risk.

C2

Both categories should be similar concerning other central product attitudes and their purchase intentions: Attitude towards product category (in terms of favor, likability, pleasure) [64], involvement with product category (in terms of, e.g., fascination, excitement) [65], consumption motive (hedonistic or utilitarian) [66], desirability to possess products of this product category [67], and purchase intention for products of this product category [68]. The items of these scales are reported in Section A-A.

Perceived Security Risk Scale

To distinguish between product categories with a high and low perceived security risk (criterion C1), we needed a scale that measures the perceived security risk associated with IoT consumer products. After an extensive literature review, we concluded that there is no scale that sufficiently fits our purpose. Declined candidates [69, 59, 70] comprised scales that measure security and privacy risks in e-commerce settings. However, because IoT products may have adverse effects on the physical world, their security risks are fundamentally different.

Thus, we developed a perceived security risk scale for IoT consumer products using a similar methodology as proposed by Davis [71]. In the first step, we defined the concept of the perceived security risk in IoT products. Perceived risk is defined as the customers’ perceptions of uncertainty and unfavorable consequences concerning a product or a service [72]. In the context of security, uncertainty means the probability of a security incident, while consequences are the loss caused by such an incident. We decided to measure only consequences with our scale. We think that it is very difficult for non-experts to determine the probability of a security incident associated with a particular IoT product category, because they would need to assess the quality of the product’s security measures as well as the attractiveness of the product for attackers. On the other hand, the assessment of consequences of a security incident requires knowledge about the deployment and utilization of the product. Usage scenarios are known to consumers, and therefore, they can imagine potential consequences. As a result, we defined that perceived security risk for an IoT product exists if security vulnerabilities in this product are perceived to lead to negative consequences for the user.

We further considered classical risk categories for product purchase by Jacoby and Kaplan [73], which have often been used to measure perceived risk in marketing research [74, 72]. Additionally, we adapt risk categories by Featherman and Pavlou [69], who already adapted Jacoby and Kaplan’s categories for e-commerce settings.

We split the perceived security risk in four risk categories: ‘general’222Jacoby and Kaplan [73] denote this risk category as ‘overall’. We renamed it to ‘general’ since ‘overall’ could be misunderstood as average score over all risk categories., ‘privacy’, ‘physical’, and ‘financial’. Jacoby and Kaplan [73] and Featherman and Pavlou [69] present further risk categories that we did not consider because they have low relevance for the security risk of IoT products: ‘performance’, ‘time’, ‘psychological’, and ‘social’. Although the performance of IoT products can be affected in a security incident, performance deficiencies that affect functionality in a dangerous way are already covered by physical risk. The risk of wasting time in case of a security incident exists for all product categories alike. We excluded psychological risk as its original definition relates to the consumer’s self-image or self-concept regarding a product [73]333Definition of psychologocal risk [73]: “the chances that an unfamiliar brand of [product] will not fit in well with your self-image or self-concept.”. Effects of IoT products on consumers’ psychological state (e.g., perception of surveillance, or privacy violations) are considered in our scale by items in the risk categories ‘privacy’ and ‘general’. Finally, we did not take social risk into account since privacy risk already covers effects on the status in one’s social groups.

Item candidates were generated and iteratively improved through expert reviews by 14 experts from the domains of cybersecurity, psychology and marketing research. The final scale is presented in Appendix, Table XI and consists of 13 items relating to risk categories ‘general’, ‘privacy’, ‘physical’, and ‘financial’. For the statistical comparison of the product categories, we averaged the scale to form a composite index.

Survey Structure and Data Collection

We selected eight candidate product categories through an overview of popular IoT consumer products on online shopping websites and expert judgment: smart alarm systems, smart door locks, smart light bulbs, smart home cameras, smart smoke detectors, smart thermostats, smart vacuum robots, and smart weather stations. In the surveys, the products were introduced in a randomized order. Each product category was introduced with an exemplary product picture and a short text that explained the products’ features and usage scenarios. We emphasized that all these products connect to the Internet.

To determine the sample size for this prestudy, we performed a power analysis [75] for paired $t$-tests. Assuming that large effects indicate practical relevance (Cohen’s $d_{z}$ = 0.8), and the desired power of 0.99, the power analysis determined 30 participants as sufficient.

We collected data with an online questionnaire using LimeSurvey [76]. The questionnaire was pretested by six experienced colleagues at our institutes. During the tests we realized that the amount of data that we wanted to collect would lead to a long and exhausting survey. Therefore, we decided to split the survey into two smaller questionnaires that should be answered by two independent groups of respondents. One group answered the perceived security risk (C1) for all eight product categories, while the other group evaluated the scales of C2 for all eight product categories. Each group consisted of 30 crowdworkers. Through test runs, we estimated the average time to answer the surveys to be 10 to 12 minutes. We paid each crowdworker €1.80 for 12 minutes.

Results

Sixty respondents (23 female, 37 male) aged between 19 and 62 years ($\mu$ = 38.5, $\sigma$ = 10.7) answered the surveys. We did not exclude any responses. The collected data was analyzed using IBM SPSS [63]. The perceived security risk scale (C1) showed good statistical properties, which are not presented here for brevity. However, in Section A-B, we present the statistical properties of the scale using the results of the main study (Section VI). For all scales of C2, Cronbach’s alpha, a measure that defines the inner consistency of a scale, was above the recommended threshold of .700 (>.858) [63].

According to our criteria, we found three candidate pairs of product categories that do not statistically significantly differ from each other in the factors of C2, but differ statistically significantly in the perceived security risk:

Smart home camera and smart weather station

($t(29)=7.57,p<0.001,d_{z}=1.383$) 2. 2.

Smart smoke detector and smart thermostat

($t(29)=2.09,p<0.05,d_{z}=0.381$) 3. 3.

Smart smoke detector and smart vacuum robot

($t(29)=3.29,p<0.01,d_{z}=0.600$)

We decided on the first pair as these product categories have the highest difference between their perceived security risk scores. More analysis details can be found in Appendix, Tables XII and IX.

V-B Prestudy 2: Definition of Product Attributes and Levels

After two product categories were chosen, the next step was to determine product attributes that will be used in the conjoint analysis. The number of attributes should be reasonable such that a respondent can process them cognitively [77]. Otherwise respondents might tend to use shortcut heuristics that ignore less important features [78]. We decided for 7 attributes per product category. Two attributes were reserved for the attributes of the security update label (availability period and provisioning time). The remaining five attributes comprised existing product attributes that depend on the product category. We paid attention to avoid correlation between attributes, which would lead to illogical profiles. In the literature on conjoint analysis, the specification of attributes lacks a golden standard [79] and is approached in various ways, such as focus groups, surveys, or expert judgements.

Method

We conducted an online survey to identify the most important attributes for each product category to use in conjoint analysis. For this, attribute candidates were collected from online shopping websites. We prepared an online questionnaire on LimeSurvey that listed these 18 individual attributes, which are given in Appendix, Table VIII. Respondents rated the importance of these attributes for their buying decision using the dual-questioning methodology by Alpert [80, 81]. The respondents rated following two items on 7-point Likert scales: “How important is each of these attributes in your buying decision?” and “How much difference do you feel, there is among products of the product category ‘[product]’ in each of these attributes?”. Both scores were multiplied to get an overall score for each product attribute. The higher the overall score, the more important is the attribute.

Data Collection

We recruited 30 crowdworkers for this preliminary survey who were each paid €0.75 (reward equivalent for 5 minutes). In the screening of the collected data, we found that one participant clicked the middle option for almost all attributes and was six times faster than the average participant. This person was excluded from the evaluation [82].

Results

The final set of participants consisted of 29 respondents (18 female, 11 male) in the age between 20 and 63 years ($\mu$ = 35.3, $\sigma$ = 11.5). The results are reported in Appendix, Table VIII. In summary, the product attributes that are perceived as most important for smart home cameras were price, resolution, field of vision, frame rate, and zoom function. For smart weather stations, the most important product attributes were price, battery lifetime, precision, rain and wind sensor, and expandability for multiple rooms. In Appendix, Table VIII, we listed ‘solar panel for energy generation’ as second most important product attribute for smart weather stations. However, in line with prior research [83], we refrained from this attribute because it correlates with ‘battery lifetime’, and the correlated attributes bear the risk of threatening the study’s validity. We decided to include ‘battery lifetime’ as nearly all smart weather stations use batteries, while solar panels are only a rare feature in this product category. In addition to these attributes, we added the availability and provisioning time of security updates introduced in Section III-B. The final list of attributes is shown in Table I.

Attribute Levels

For each attribute, a discrete number of levels had to be specified. The number of attribute levels should be as low as possible and does not need to cover the full feature range of the attribute. As recommended [84], we defined two to four levels to keep the complexity of the conjoint analysis low. Similarly to the specification of the attributes, there is no golden standard in defining the attribute levels. We decided to specify the levels with reasonable values that we acquired through the examination of the most popular products in both product categories available on Amazon as of October 2018. Thereby, we took care to avoid the specification of extreme values that are considered outliers.

We considered price levels in the realistic price ranges on the market. We found smart home cameras by 13 manufacturers with prices between €50 and €179 (around €110 on average), and smart weather stations by 10 manufacturers in the range between €54 and €176 (around €129 on average). To enhance the comparability, we defined the same price levels for both product categories. Furthermore, we decided not to use prices below €100 as the threshold between a two-figure price and a three-figure price might bias the importance of the price attribute considerably towards two-figure prices. Also, we consistently used 0-ending prices [85, 86] and finally chose four price levels with an equal spacing between €100 and €160. For all further product attributes, we chose two to three levels that reflect the attribute span of products on the market. All attribute levels are summarized in Table I.

Focus Group

As the attributes of the security update label are unknown to consumers, we run a focus group to gain an intuitive description of the security update label’s attributes and their levels. The focus group consisted of 8 participants (5 females and 3 males) in the age between 19 and 54 years ($\mu$ = 33.5, $\sigma$ = 12.9) without professional cybersecurity background. Two participants had a professional IT background. Thus, we paid attention that these two participants did not dominate the discussion. We rewarded each participant with €10 for a one hour session. We started the focus group by establishing the participants’ prior experience with IoT consumer products, their awareness of security problems in these products, as well as their experience with security updates in general. Then, we introduced the idea of the security update labels and asked the participants to write down how they would explain the attributes to family and friends. Each participant presented their explanations and we discussed them with the group.

Based on the focus group discussion, we presented the availability period in the conjoint analysis survey as ‘availability of security updates’ (German: ‘Verfügbarkeit von Sicherheitsupdates’) with a fixed end date, e.g., ‘until 12/2020’, and with the relative period of time until this date (e.g. ‘2 years’) to reduce the cognitive effort for the respondents. Although the relative period is not part of the proposed label, the reduction of cognitive load was important as the respondents will compare availability attributes in 10 choice tasks. The levels of the availability attribute were chosen to reflect realistic conditions: There is always a level of non-availability (i.e., manufacturer does not guarantee security updates), a level similar to the usual warranty period of this class of products (i.e., 2 years), and a third level that exceeds the usual warranty period and is more oriented on the realistic lifetime of the product (i.e., 6 years). The provisioning time attribute was defined to reflect non-availability, a rather fast (and ideal) period of 10 days, and a slower (and more realistic) period of 30 days. We denoted the provisioning time attribute in the survey as ‘provision time of security updates’ (German: ‘Bereitstellungszeit von Sicherheitsupdates’).

To exclude confusing profiles that occur from certain combinations of availability and provisioning time, e.g., the manufacturer does not provide security updates but offers a provisioning time of 30 days, we only allowed for meaningful combinations of both attributes.

VI Conjoint Analysis

We decided on a choice-based conjoint (CBC) analysis as this variant is the de-facto conjoint data collection standard in marketing research [87] (cf. Section II-C). Although CBC’s data collection is considered less efficient than other conjoint data collection methods, it provides a better predictor of real-world in-market behavior [88]. Furthermore, it allows a “no choice”-option that also contributes valuable information, i.e., that all options are unattractive.

VI-A Method

We used Lighthouse Studio by Sawtooth Software [87] for survey setup and data analysis. Lighthouse Studio is a well-established and validated tool for conjoint analysis [89, 90].

To avoid fatigue, each respondent evaluated only one of the two product categories, whereas the product category was assigned randomly to the respondents. Upon starting the survey, general information about the context, privacy of collected data, and the scope of the survey were presented. The respondents expected a survey about a smart home product. Then, the particular product category was introduced with a short explanation about its features and exemplary product pictures. We asked if the respondent is familiar with this product category and if she owns such a product.

In line with previous research [91, 92], we explained all attributes shown in Table I (except price) with a short description, to raise their comprehension and prevent misunderstandings. To validate the comprehension, the respondent answered a quiz that included a question for each attribute. For example, for the availability attribute, we asked “What does the availability of security updates specify?” with possible answers: (a) “for how long the manufacturer guarantees to provide security updates”, (b) “for how long the device is allowed to be used”, (c) “for how long the device guarantees to be protected against hacker attacks”. While the first answer was correct in this example, the order of possible answers was randomly permuted in the questionnaire. If the respondent chose a wrong answer, the correct answer was explained again. Also, the quiz did not follow the order of how the attributes were presented before to rule out learning effects.

After the respondent became familiar with the attributes, the choice tasks for the conjoint analysis were explained: The respondent is presented with four product profiles and has to decide for the most attractive option. All product profiles are described by an attribute level for each product attribute (including the security update label attributes) in plain text. In addition to the set of product alternatives, there is always a “no choice”-option that can be chosen in case none of the four profiles is desirable. An exemplary choice task is depicted in Appendix, Figure 2. Then, each respondent performed ten choice tasks including eight randomly-generated tasks, which were individual for each respondent, and two fixed holdout tasks, which were identical for all. The fixed holdout tasks were later used to validate the attribute preference model. This model is based on the eight randomly generated tasks and should be similar to the model based on the holdout tasks in order to ensure internal consistency of the conjoint analysis (Section VI-F). The respondents were not aware whether a choice task is randomly generated or fixed. Prior research [93] concluded that the order of the attributes affects the choice behavior. Therefore, we randomly permuted the order of all 7 attributes for each respondent but kept the same order for a particular respondent as it might be confusing otherwise.

After the respondents performed the choice tasks, we measured the perceived security risk for the particular product category by facilitating the perceived security risk scale from Section V-A. Finally, we used psychometric scales to measure the respondents’ privacy concerns with the Internet [59] as well as their security behavior intentions [60].

Next, we included control questions to assess whether the respondents had difficulties in understanding the survey, had been distracted, and if they took the choice tasks seriously. These questions were used to identify unmotivated respondents that we later excluded from the analysis. Finally, we collected demographic data: gender, year of birth, vocational qualification, professional IT background, and net income. This data was used to determine the representativeness of the sample as well as for the segmentation. To ensure that the respondents stayed focused, we included a number of motivational statements in the questionnaire.

VI-B Pilot Study

The questionnaire was developed in multiple iterative rounds. After completing the final draft, we collected feedback from seven experts from academic and market research institutes. We asked whether they understood the attributes and tasks, and if anything could be misleading. Using their feedback, we re-worded some instructions. Finally, we tested the questionnaire with 60 crowdworkers to check that the questionnaire is working as expected, and to calculate the average task completion time needed to determine the compensation.

VI-C Sample Size

The sample size, i.e., number of respondents for our questionnaire, was chosen as a trade-off between increasing costs and decreasing sampling errors. Sampling error arises if the samples of respondents do not represent the population. Practical guidelines [94] on CBC analyses recommend at least 300 respondents for studies without segmentation. If a segmentation analysis is desired, as is the case with our study, then a minimum of 200 respondents per subgroup is advised. Since we aimed for a comparison of up to three subgroups, which is a usual configuration in a segmentation analysis, we decided to recruit around 800 respondents for each product category, and thus, 1,600 respondents in total.

In the pilot study, the average time to answer the questionnaire was 8 minutes. Thus, we paid crowdworkers €1.20. We ensured that respondents of the prestudies could not participate in the main survey.

VI-D Sample Characteristics

We collected the data within a week in mid-December 2018. After a screening, we excluded 154 (9.5%) of the 1,620 collected data sets. We excluded 70 data sets due to low task completion times (within less than half of the pilot study’s average time), 48 data sets due to indications in the control questions, 19 data sets due to suspected multi-participation (same IP address and user agent), 16 data sets that answered more than two quiz questions wrong, and 3 data sets of respondents under 18 years. The final sample included 1466 data sets (640 female, 805 male) in the age between 18 and 65 years ($\mu$ = 33.8, $\sigma$ = 11.2). Details of the demographic data are presented in Table II. In comparison to the German population, the sample is biased towards males and high-educated persons. Furthermore, people in the age of 50 and above are underrepresented in this sample. However, the sample aligns to the target group of consumers interested in IoT consumer products, which is likewise biased towards males, age group 25-34, and higher incomes [97].

VI-E Results

In total, 731 respondents evaluated the product category ‘smart home camera’ and 735 respondents assessed the product category ‘smart weather station’. The high difference in the security risk perception between both product categories was confirmed: While the smart weather station achieved an average perceived security risk score of 3.65, the smart home camera achieved an average score of 5.50. This difference is highly statistically significant with the large effect size: $t(1464)=28.42,p<0.001,d=1.48$. Cronbach’s alpha for all psychometric scales was above the recommended threshold of .700 (>.837) [63].

For the analysis of the collected conjoint data from the randomly-generated choice tasks, we used hierarchical Bayes estimation with default settings as recommended [87]. Using this estimation method, we determined the average relative importance of each product attribute as well as the part-worth utility for each product level based on a total of 5,848 (home camera) and 5,880 (weather station) choice tasks. The relative importance of an attribute defines the relative impact (measured in percent) on the overall choice. The importances are ratio data meaning that an attribute with an importance of 20% is twice as much important as an attribute with an importance of 10% [98].

As listed in Table III, the availability of security updates (31%) is the most important attribute for smart home cameras. It is twice as important as price (15%) and provisioning time for security updates (14%). Other functional attributes are less important with relative importance between 8% and 12%. For the smart weather stations, the availability of security updates (20%) is also the most important attribute. However, the difference in importance to other product attributes is smaller than for the smart home cameras. The relative importance of price, rain and wind sensor, and provisioning time for security updates are at around 16%. All other attributes are ranked with relative importances between 7% and 13%.

In general, the relative importance of the attributes differ between both product categories. Good research practice, e.g., [86], strongly discourages quantitative comparison of preference measurements of different product categories to each other, as the importance of an attribute can only be interpreted as relative value within the particular product category. Therefore, we discuss the possible differences qualitatively. For the product with the high perceived security risk, especially the availability of security updates (twice as important as other attributes) seems to play a more crucial role in buying decisions than for the product with the low perceived security risk (only slightly more important than other attributes). Furthermore, the provisioning time for security updates is considered the third most important attribute for the product with the high perceived security risk and the fourth most important attribute for the product with the low perceived security risk. Thus, the provisioning time for security updates seems to have a similar importance than price and other highly-ranked technical attributes.

To summarize, the availability of security updates plays the most important role in the consumers’ choice in this study. The relative importance of the provisioning time for security updates is also high, although substantially lower than of the availability of security updates. For both product categories, the second most important attribute is the price. Functional features of both product categories are rated as less important than the attributes of the security update label and price, except the rain and wind sensor for smart weather stations.

Table IV shows the average utilities that consumers ascribe to the levels of product attributes [98]. Negative utilities represent unfavorable options compared to the other options, while positive utilities describe the favorable options. The utilities of all levels of a certain product attribute add up to zero. For the price attribute, lower prices have a higher utility for consumers. For both product categories, the non-availability of security updates is considered as especially unfavorable with the highest negative utility scores among all attributes. The availability of security updates for 6 years is more favorable than for 2 years. The utility for the provisioning time for security updates shows a preference for short time period (10 days) rather than a longer time period (30 days). A provisioning time of 30 days has a negative utility for the smart home camera, in contrast to the smart weather station. Thus, participants dislike long provisioning times for a product with high perceived security risk.

VI-F Validity

We tested the internal consistency of our results by comparing simulations based on the preference measurement results with choice data from holdout tasks (cf. Section VI-A). Furthermore, we validated the preference for long availability periods and short provisioning times. The results of the holdout tasks were not included into the calculation of the preference measurement results.

For the holdout tasks, we defined five product profiles – P1, P2, P3a, P3b, P4 – for each product category. Profiles P3a and P3b differ only in their security update label attributes: In P3a, there was no guarantee for the availability and provisioning time of security updates. In P3b, these two attributes were set to the objectively best levels: availability of security updates for 6 years with provisioning time of 10 days.

In the course of the survey, each respondent performed 10 choice tasks, of which 8 were randomly-generated tasks and 2 were fixed holdout tasks. The fixed holdout tasks were the same for all respondents of a product category and appeared as the 4th and 8th of the 10 choice tasks. Both holdout task consisted of the four product profiles that were presented in a different fixed order. In the first holdout task (i.e., the 4th choice task), the profiles (P1, P2, P3a, P4) were presented. In the second holdout task (i.e., the 8th choice task), the profiles (P4, P3b, P2, P1) were presented.

The results in Table V (‘Real’-columns) for smart home cameras show that in the first holdout task 6.6% decided for P3a without guarantee for security updates, while in the second holdout task 53.4% chose P3b with best guarantee for security updates. The same effect can be observed for the smart weather station: in the first choice task, 9.5% choose P3a, while 32.7% decided for P3b. This validates the results that we derived from the randomly-generated choice tasks: The (non-)availability of security updates is an important factor in buying decisions, while this effect seems to be higher for products with high perceived security risk.

We tested the consistency of the hierarchical Bayes estimation with the market simulator from Lighthouse Studio, which represents a standard procedure to assess the internal validity of CBC models [89]. This market simulator estimates the shares of preferences for the product profiles P1 to P4 based on the preference measurement results of the conjoint analysis. We compared the estimated market shares with the evidence gathered through the holdout tasks (see Table V). For example, in the first holdout task of the smart home camera, the market simulator estimated a market share of 84.4% for P4, while the evaluation of the real choices showed that 72.8% of the respondents decided for P4. Based on the comparison of estimated and real choices, we conclude that although the simulator does not exactly match the real choices, the preference measurement results are robust in estimating the order and magnitude of the overall preferences, which indicates a high consistency of the results.

VI-G Segmentation

We used the latent class segmentation module of Lighthouse Studio to assign respondents to groups that have similar preferences. The module implements latent class analysis, a classification technique to find groups in multi-dimensional data. First, we needed a measure to decide in how many reasonable segments we split the respondents. Following recommendations of Sawtooth Software [100], we used the consistent Akaike’s information criterion [101] as measure. Based on this criterion (see Section A-C), we decided to split the respondents of the product categories “smart home camera” and “smart weather station” into two and three segments, respectively. The consumer segmentation for both product categories is shown in Table VI. The differences in preferences between the segments are given in Table VII.

For the smart home camera, both segments differ statistically significantly only in the perceived security risk. For the first group with lower security risk perception towards smart home cameras, the availability of security updates (31%) is the most important product attribute and twice as important as resolution (16%) and price (12%). In comparison to the importance of technical features (9–11%) other than the resolution, the availability of security updates is even three times more important. For the second group with the higher security risk perception, the availability (25%) and provisioning time (19%) of security updates are the most important product attributes followed by price (17%). Compared to the importance of the technical features (9–12%), availability and provisioning time are (almost) twice as important.

For the smart weather station, the segments differ statistically significantly with regard to age, vocational qualification, income, privacy concerns, security behavior intentions, and perceived security risk. The first group exhibits the highest average age, high vocational qualifications, the highest income, high privacy concerns, the highest security behavior intentions, as well as a high security risk perception towards smart weather stations. For this group, the availability of security updates (23%) as well as the rain and wind sensor (23%) are the most important product attributes, followed by provisioning time (20%) and expandability (16%). These attributes are 2 to 3 times as important as the price (8%).

The second group is characterized by lower vocational qualification, the highest privacy concerns, and the highest perceived security risk. For this group, the attributes of the security update label dominate the choice decision and account for 60% of the overall importance. The availability (35%) and provisioning time (25%) is three and two times as important, respectively, than technical features. For this group, the price (6%) is the least important attribute for their choice.

The third group perceives the lowest risk for smart weather stations. This group is the youngest on average, has the lowest income, as well as the lowest privacy concerns and security behavior intentions. The most important product attribute is the price (30%), followed by technical features, such as rain and wind sensor (21%) and battery lifetime (13%). The availability (8%) and provisioning time (7%) are the least important attributes, i.e., the security update label plays only a minor role in the consumers’ choice of this segment.

VII Discussion

We discuss research questions formulated in Section IV, and consider economic and policy implications of our results.

RQ1: Relative importance of the availability period and provisioning time. The availability of security updates was the product attribute with the highest relative importance (up to twice as important as other high-ranked attributes) as well as with the widest span of average utility (Table III). Provisioning time for security updates was evaluated as less important than their availability, but seems to be more important than most technical features. Consumers also prefer short provisioning times, and even assign a negative utility (i.e., dislike) to the provisioning time of 30 days for the product with the high perceived security risk (Table IV). The high importance of the attributes of the security update label is surprising, as users are not familiar with these attributes. This might be due to the explicit mentioning of the non-availability of security updates that might have discouraged the users. This effect can be seen in Table IV where the negative utility of non-availability is greater (-111.93 for home cameras and -77.52 for weather stations) than the positive utility of availability of security updates for 6 years (97.61 and 55.61, respectively). This indicates that consumers want to avoid the non-availability of security updates, and therefore, the mandatory nature of the security update label is very important.

RQ2: Differences between products with a low and high perceived security risk. We observed differences in the relative importance of the security update attributes. For the product with the high perceived security risk, the importance of availability is at least twice as high as the importance of other attributes. In contrast, availability is only slightly more important than for other high-ranked attributes for the product with a low perceived security risk. Furthermore, for the product with the high perceived security risk, the results of the holdout tasks (cf. Table V, ‘Real’-columns) show an increase of preference for product profile P3a from 6.6% (without guaranteed security update) to 53.4% for profile P3b (with 6-year guarantee for security updates). For the product with the low perceived security risk, there is a comparatively smaller increase from 9.5% to 32.7% in the preference for the analogous product profiles. Also, if we sum up the importance of both label attributes, the security update label shows a relative importance of 45% for the consumers’ choice regarding the product with the high perceived security risk, compared to 36% for the product with the low perceived security risk.

This finding supports the concern of moral hazard (Section III-D): Users might consider security update labels primarily if they think that they could be personally affected by security incidents. In reality, however, products with seemingly low perceived security risk for the owner can be used for serious attacks. For example, Mirai utilized digital video recorders [7]. We conclude that the introduction of security update labels might need educational campaigns that explain non-personal security risks associated with IoT devices.

RQ3: Differences due to demographic characteristics of the consumers. The sample segmentation for the product with high perceived security risk did not show any differences in demographic factors (Table VI). For the product with low perceived security risk, the segmentation showed statistically significant differences in terms of age, vocational qualification, and income. The groups with higher age and higher income assigned a higher importance to the security update label attributes (Table VII). This could indicate that this type of consumers may invest more in sustainable security of their IoT devices. In contrast, the group with the youngest age and lowest income seems not to care much about security updates. We conclude that for products with a high perceived security risk, demographics may play a minor role, whereas for the products with lower perceived security risk, younger population with lower income may prefer cheaper products with lower security.

RQ4: Differences due to security behavior intentions, privacy concerns, and security risk perception of the consumers. While the segmentation of the product category with the high perceived security risk showed only minor differences between the groups, the groups for the product category with the low perceived security risk range from very low to very high importance of the security update label. There, the respondents with higher security behavior intentions and privacy concerns exhibit a higher preference for the attributes of the security update label. For both product categories, a higher security risk perception positively relates to the higher importance of the security update label’s attributes. This indicates that consumers with a higher sensitivity for security risks and privacy concerns may assign a higher importance to the security update labels.

Limitations and Future Work

The results of the user study have the usual limitations of conjoint analysis studies. For the comparison of products, we had to limit the number of product attributes and discretize attribute levels. Also, some product attributes, such as product design, were discarded due to impracticality of the specification of attribute levels. Although we specified product attributes and attribute levels based on best practices and empirical evidence, a product profile cannot fully represent all factors that may influence buying decisions, such as product presentation, packaging, advertisement campaigns, and consumer ratings. Usability aspects of update mechanisms might also influence the consumers’ choice. Another limitation might be due to the evaluation of stated preferences (i.e., hypothetical buying decisions). However, the assessment of real buying decisions was infeasible as there are no suitable products that guarantee security updates. Finally, as we ran the user study with German respondents, the results might not be valid for other markets. Thus, future work is required to investigate the impact of security update labels in other countries, and with different sets of participants, products, and attributes. As we focused on the consumers’ choice in this work, future work should also consider the positions of manufacturers and policy makers.

Economic Implications

Security update guarantees may create additional costs for the manufacturers that will be potentially passed on to the consumers [29]. Are consumers willing to bear these costs? CBC analyses are not appropriate to precisely estimate consumers’ willingness to pay for a certain attribute. However, attribute levels with a high importance for consumers’ choices also indicate a willingness to pay a higher price for products with this attribute level [90]. In addition, initial support for the willingness to pay a price premium is provided by studies that show that consumers perceive price increases as fair if they are caused by higher costs for a manufacturer [102, 103, 104]. Prior works [6, 105] also concluded that consumers accept additional costs for security depending on the product’s perceived security risk.

Policy Implications

Our results show that mandatory security update labels could indeed have a high influence on the consumers’ choices. The labels communicate attributes that enable non-experts to compare security properties of different IoT products intuitively during the purchase process, and thereby influence buying decisions. The introduction of security update labels might increase security of IoT consumer products through establishing economic incentives for manufacturers to guarantee a long and timely availability of security updates, or, from another perspective, creating competitive disadvantages for the non-availability of security updates. These labels could strengthen the state of IoT security in the long term, as unpatched IoT consumer products are a major reason behind today’s IoT security incidents.

VIII Conclusion

Security update labels benefit consumers, as they decrease the probability of becoming a victim to disclosed but unpatched vulnerabilities. They have the potential to motivate manufacturers to invest more resources in the provision of security updates, which might lead to positive security-related changes in their business strategies. Finally, national security will also profit from these labels, as they strengthen the security of the private IoT infrastructure, and therefore, reduce the attack surface for malicious domestic and foreign actors.

Acknowledgments

We thank Freya Gassmann and Andrea Schankin for consulting regarding the statistical evaluation of the user study. We further thank the anonymous reviewers for their thorough and valuable comments, as well as the shepherd of this paper, Nick Feamster, for his guidance. This work was supported by a software grant from Sawtooth Software.

Appendix A Further Material

A-A Marketing Research Scales of Prestudy 1

The scales below were used in Prestudy 1 to compare the perception of product categories.

• •

Attitude towards a product category adapted from Martin et al. [64]

• –

How favorable are [product]s?

(1 = ‘not at all favorable’ to 7 = ‘very favorable’)

• –

How likable are [product]s?

(1 = ‘not at all likable’ to 7 = ‘very likable’)

• –

How pleasing are [product]s?

(1 = ‘not at all pleasing’ to 7 = ‘very pleasing’)

• •

Involvement with a product category, Mathwick and Rigdon [65].

‘[Product]s…’

• –

1 = ‘Mean nothing to me’ to 7 = ‘mean a lot to me’

‘I find [product]s…’

• –

1 = ‘worthless’ to 7 = ‘valuable’

• –

1 = ‘boring’ to 7 = ‘interesting’

• –

1 = ‘exciting’ to 7 = ‘unexciting’

• –

1 = ‘fascinating’ to 7 = ‘mundane’

• –

1 = ‘involving’ to 7 = ‘uninvolving’

• •

Consumption motives, Wakefield and Inman [66]

‘[Product]s are used for …’

• –

1 = ‘Practical purposes’ to 7 = ‘Just for Fun’

• –

1 = ‘Purely functional’ to 7 = ‘Pure enjoyment’

• –

1 = ‘For a routine need’ to 7 = ‘For pleasure’

• •

Desirability to possess a product adapted from Lei et al. [67]

• –

[Product]s are… (1 = ‘not at all desirable’ to 7 = ‘very desirable’)

• •

Purchase intention adapted from MacKenzie et al.  [68] (1 = ‘very low’ to 7 = ‘very high’)

• –

If I were going to buy a [product], the probability of buying this model is…

• –

The probability that I would consider buying this [product] is…

• –

The likelihood that I would purchase this [product] is…

A-B Quality Analysis of Perceived Security Risk Scale

We assessed the quality criteria of the perceived security risk scale based on the results of the conjoint questionnaire, where the group of 731 respondents (denoted as PC1) evaluated a product category with a high perceived security risk, and the group of 735 respondents (denoted as PC2) evaluated a product category with a low perceived security risk.

First, we evaluated the convergent validity of the perceived security risk scale using a principal component analysis (PCA) with Varimax rotation, in order to prove the dimensionality. For the PCA, the Bartlett test indicated significant correlations, the Kaiser-Meyer-Olkin (KMO) measure verified the sampling adequacy with KMO = .898 for PC1 and KMO = .917 for PC2, and all measures of sampling adequacy (MSA) values for individual items were greater or equal than .803 for PC1 and .840 for PC2. Thus, KMO and MSA exceed the acceptable limit of .500 as proposed by Field [63]. Field also suggests an eigenvalue cutoff, if the sample size exceeds 250 and the average communality is greater than .6. As both conditions apply to our case, we used an eigenvalue cutoff of .7, as proposed by Jolliffe [106]. This procedure is similar to Rust et al. [107], and helps to provide the best trade-off between parsimony and interpretability concerning the scale.

The factors of PC1 and PC2 are shown in Table XI. For PC1, the PCA with Varimax rotation for the 13 perceived security items revealed four factors for perceived security (variance explained = 77.94%). For PC2, the PCA with Varimax rotation revealed three factors (variance explained = 77.14%). Factor loadings of PC1 and PC2 were greater or equal to .464 (should be >.400) [108]. For PC1, all items loaded the highest on the factor (i.e., ‘general’, ‘privacy’, ‘physical’, or ‘financial risk’) on which they were supposed to load, making all factors easy to interpret. Thus, the four factors aligned closely with the four perceived security dimensions that we derived from previous research. For PC2, the first seven items formed a composite factor (‘general/privacy risk’), while items 8 to 10 loads on ‘physical risk’, and items 11 to 13 loaded on ‘financial risk’. The reasons for the loading of the general and privacy risks to a single factor are not clear, such that the scale may require further refinement in the future.

Second, we evaluated the perceived security risk scale in terms of the Cronbach’s alpha, a measure that defines the inner consistency of a scale, and the item-to-total correlation for all dimensions. For all factors of PC1 and PC2, Cronbach’s alpha was above the recommended threshold of .700 (>.804) and item-to-total correlation higher than the threshold of .500 (>.524), indicating high reliability and internal consistency of the perceived security risk scale [63].

A-C Consistent Akaike Information Criterion

The consistent Akaike information criterion (CAIC) is recommended by Sawtooth Software as measure to decide on the number of reasonable segments [100] for latent-class analysis. Due to the sample size (cf. Section VI-C), we were interested in splitting the respondents into either 2 or 3 groups, for which the latent-class analysis provided the corresponding proposals. Each segmentation proposal has a CAIC score. Smaller values of CAIC are desired [100]. For the segmentation of the respondents that evaluated the smart home camera, the CAIC score was 14,162 for 2 groups and 14,307 for 3 groups. For the segmentation of the respondents that evaluated the smart weather station, the CAIC score was 14,471 for 2 groups and 14,260 for 3 groups. In summary, for the smart home cameras, the smaller CAIC score indicated 3 groups, while for smart weather, the smaller CAIC score indicated 2 groups.