Social norms, psychology and cybersecurity

Social norms, psychology and cybersecurity

A few weeks ago I was at the Houses of Parliament to attend ‘CyberCrime – The Next Threat’, organised by Parliament Street and featuring a debate by panelists Dr. Robert Nowill, Chairman of the Board of Directors at Cyber Security Challenge UK Ltd; Andy Settle, Cyber Security Analyst and Senior Cyber Security and Threat Intelligence Consultant with IBM and Yair Cohen – Founder, The Internet Law Centre and author of The Net is closing: birth of the e-police.

One recurrent theme from the debate was the need for a greater psychological understanding of cybersecurity. This applies to all the parties involved – those who are attacking the system, those who are defending the system and the every day users of the system. This discussion reflected a call made by myself and my colleagues in a recent Psychologist article in which we note the increasingly social nature of cybersecurity incidents(1). These factors go beyond social engineering, in which psychological techniques are used by a attackers to manipulate a target, and encompasses the wider social psychological processes that influence behaviour such as group dynamics, motivation and perceptions of risk. In our article we acknowledge that what may be deemed cybercrime by some parties may be considered a form of social protest, or hacktivism, by others. We suggest that one approach for psychologists working in this area is to promote informed decision making in which individuals are empowered to understand the risks and possible outcomes of their actions, without imposing any values on how they should behave.

To turn this discussion to the focus of this blog it could be expected that social norms may be especially important in cybersecurity. Protection of computer systems and online information relies heavily on the behaviour of the users of the system. For example, many of the recent high profile cybersecurity breaches that have been in the media were, at least in part, a result of individuals within a targeted company opening up links in phishing emails. How people respond in such situations will depend on what they think is the normal course of action – without an organisational norm of treating links within emails with suspicion phishing emails will continue to be successful. Similarly cybersecurity incidents appear to often be instigated by groups. Individuals in these groups may adhere to group norms and participate in attacks without a full understanding of the risks they are exposing themselves to. Finally cybersecurity practitioners themselves operate within teams and as part of larger profession. As such they will as a group inevitably determine their own norms of behaviour and attitudes, which may lead them to act differently as individuals than they would otherwise do.

Furthermore, all of the above groups will be susceptible to additional social psychological process such as group think and risky shift, which can lead to impaired decision making and group actions that may be harmful to the individual involved. The increasing acknowledgement of the importance of individuals in cybersecurity is a good step – but to fully understand the behaviour of individuals in complex socio-technical systems it is important that we do not overlook the fundamentally social nature of people.

Dr John McAlaney, Bournemouth University


(1)  McAlaney, J., H. Thackray, and J. Taylor, The social psychology of cybersecurity. Psychologist, 2016. 29(9): p. 686-689.


Social norms, youth and alcohol in Brazil

Social norms, youth and alcohol in Brazil

Earlier this week I spent several days in Sao Paulo, Brazil, to attend and speak at the  1st International Seminar on Perspectives on Youth and Alcohol Abuse. Other speakers included representatives from the Village Education Institute, UNESCO, IRI-USP and UNAS (Union Centers and Heliopolis neighborhood associations), along with the sponsor AmBev and the Lynx Agency. Members of several youth groups were also in attendance, to add their own voice to the discussion and to help demonstrate some of the group activities that can be used in alcohol education.

The event was very positive, with the issue of empowering young adults to make informed decisions being consistently raised by speakers as a key priority. The importance of developing socio-emotional skills and resilience in young people was another theme of the day, with discussion around how changes to alcohol use must be part of a more fundamental process in which young people are equipped navigate their social world. Overall there was a clear sense amongst speakers and attendees that the majority of young people behave in a socially responsible way, and that this must be acknowledged to dispel negative and unhelpful stereotypes. This of course fits very well with the social norms approach, in which we challenge misperceptions and highlight that the majority of the target population behave in a substantially more positive and socially responsible way than may be thought. As such it was very enjoyable to be able to talk to the attendees about my own work in this area, and to hear about social norms project taking place in Brazil. It also demonstrated how even with cultural differences the social norms approach can be applied across countries, with misperceptions of the norms appearing to be a reflection of fundamental psychological processes that are shared by all.



Aren’t you glad you didn’t turn on the light? Social norms, urban legends and social control


On the eve of Halloween it seems timely to consider the link between urban legends, social norms and social control. The excellent urban legend, folklore and myth internet reference site Snopes contains a number of stories which would seem to serve the function of enforcing social norms in society. In the eponymous urban legend for example a student stops by her shared dorm room to collect an item late at night, but hears noises coming from her roommate’s side of the room and, assuming that her roommate is in bed with her boyfriend, leaves quickly without switching on the room lights. She later returns to the dorm room to discover the grisly remains of her murdered roommate with the words ‘Aren’t you glad you didn’t turn on the light?’ written in blood on the wall. Generations of students have told and re-told this story, usually with the earnest assertion that the incident has happened recently somewhere nearby. Indeed, during my own first week at university in the late 1990s I was told this story multiple times, with the claim that it had happened in one of the student residences the previous year.

This example and many other urban legends share a common underlying theme; namely that deviating from a social norm (either an actual norm or a desired one) will result in a terrible consequence. As with the example above these social norms often seem to relate to sex and relationships, particularly in regards to young people[1]. Other examples include the ‘Hook on the Handle’ story, in which a young couple narrowly escape being murdered by an escaped criminal after parking in a secluded spot. By serving as cautionary tales these urban legends act as a form of social control that aims to reinforce societal norms – at least for the sections of society who wish the maintain the status quo. They are maintained by societies as they act as a form of heuristic that helps us understand our social world, and how we ‘should’ behave[2].

Stubbersfield[1] argues that urban legends may serve two particular purposes. Firstly, there is survival information, which relates to information that is important for people to survive. This is reflected in urban legends that revolve around people getting into danger when they go somewhere alone, or are overly trusting of a stranger, or fail to check a new environment for potential risks. Secondly there serve a social information function, through which they warn against the dangers of not behaving in a socially inappropriate way. There may naturally often be overlap between survival information urban legends and social information urban legends, since other people can act as one of the biggest threats to our survival.

Aside from the entertainment and movie story lines that urban legends provide they can also help us understand social norms, particularly those which are implicit within society. People do not like to be told how to behave or what to think – urban legends may be one way for societies to maintain social order through social norms in a way that is not evident to the targets of this attempted social control.

Dr John McAlaney, Bournemouth University


  1. Stubbersfield, J.M., J.J. Tehrani, and E.G. Flynn, Serial killers, spiders and cybersex: Social and survival information bias in the transmission of urban legends. British Journal of Psychology, 2015. 106(2): p. 288-307.
  2. Mar, R.A. and K. Oatley, The function of fiction is the abstraction and simulation of social experience. Perspectives on Psychological Science, 2008. 3(3): p. 173-192.

Does the social norm approach work? Reflections on the Cochrane review by Foxcroft et al.

In 2009 Moreira,  Smith and Foxcroft [1] published a review of the efficacy of the social norms approach, specifically the application of brief personalized normative feedback in reducing alcohol-related problems amongst University students. The review was based on 22 randomised control trials and concluded that feedback was probably effective in changing behaviour in the short term. The authors have recently produced an updated review, which includes an additional 44 studies [2].  The authors argue that statistically significant effects for web based social norms feedback and face to face feedback have effect sizes that are too low to be meaningful; the magnitude of effect sizes for comparable interventions is not discussed.  The authors draw attention to methodological limitations in the current evidence base including: poor reporting of study design; high attrition; lack of clarity of implementation of the social norms approach; and the diversity of measured outcomes.

The updated 2015 review makes an important contribution to the literature by investigating the current evidence base for the social norms approach which, as evident in the trebling of the number of eligible studies from the authors’ 2009 review,  is continuing to rise in popularity as a prevention and early-intervention strategy. The authors highlight the variability in methodological rigour between studies and highlight the heterogeneity of the application and evaluation of the approach. The review further illustrates the importance of high quality research that rigorously evaluates effectiveness and investigates causal mechanisms of change.

Foxcroft et al. provide a review of RCTs that investigate the effectiveness of social norms approach interventions. The RCT is not an efficient design for testing public health interventions delivered to populations, hence there are a paucity of studies evaluating population based social norms campaigns using the RCT design. The review includes three RCTs investigating the use of population based social marketing campaigns; these are a small proportion of the population based evaluations of the social norms approach. Case-control and cohort studies form an integral part of the evidence base for the social norms approach but these are not eligible for inclusion in a Cochrane review. A comprehensive understanding of the evidence landscape requires consideration of evidence from RCTs as well as studies that have employed designs better suited to investigating public health interventions.

Some studies opted for an active control group (n=11), active controls being controls that received more than a leaflet, list of resources, and/or assessment. The control intervention ranged from education (website or face-to-face session) and generic feedback to treatment as usual counselling. In some instances the trials appear to be equivalency rather than effectiveness trials. Equivalency trials are important in determining the relative effectiveness of an intervention, where interventions are equivalent in effectiveness other factors (such as cost, scalability, resource availability, acceptability) should be considered. The review includes trials investigating the equivalence of social norms feedback to group educational sessions, and the equivalence of social norms feedback to face-to-face motivational interviewing therapy sessions. The heterogeneity of control conditions highlights the need for the field to reach consensus over where on the prevention/intervention spectrum social norms interventions are best placed in order to position interventions at a time and place that meets the needs of intended recipients.

The social norms approach is a public health intervention intended to reduce consumption of low to moderate drinkers. Paradoxically, because they outnumber the smaller minority of heavy users, these drinkers are responsible for the majority of the harm caused by alcohol (i.e. the prevention paradox [3]). The majority of the studies in the Cochrane review focussed on heavy users or mandated student who are unlikely to be representative of the wider university student population. Heavy drinkers are likely to require more intensive intervention than the presentation of normative information. For example in a study of 98 university halls of residences in Sweden personalised normative messages were associated with significant reductions in AUDIT scores [4]. A sub-group analysis revealed greater reductions for high-risk drinkers who received personalised feedback combined with brief skills training.  As shown by studies included in the review interventions for mandated students and/or heavy drinkers are generally more complex, display wide variability in intervention content and include normative information as only one of the active ingredients.

The review highlights the breadth of interventions that have adopted elements of the social norms approach.  The social norms approach has been incorporated into Motivational Interviewing sessions, used in face-to-face group interventions, and alcohol education packages. The mode of delivery varies substantially with the majority of studies including electronic delivery of individual feedback (35 of the 66). Less prolific, but included are individual face-to-face feedback (n=18), individual mailed feedback (n=7), and feedback delivered in a group setting (n=4). Foxcroft et al.’s analysis shows that effects vary across delivery mode. The substantial variation in intervention content, focus given to the social norms approach, and mode of delivery highlights the need to consideration the heterogeneity of interventions incorporating the social norms approach. A nuanced investigation into the evidence would enable us to understand how intervention content and/or delivery might impact on effectiveness.

Students misperceive and overestimate the alcohol use of their peers. These misperceptions are associated with increased alcohol consumption and negative consequences.  The social norms approach seeks to challenge misperceptions. Foxcroft et al.’s review shows that the delivery of individual face-to-face social norms information can reduce alcohol-related problems at four plus months. In their review social norms interventions had a significant effect on binge drinking and quantity of alcohol consumed

Interested in effects beyond the immediate short term the review investigated effects four or more months after the intervention. This sub-analysis is commendable as there is a need to understand the longer term effects of intervening using the social norms approach. Advocates of the social norms approach argue that to bring about substantive population change requires sustained implementation of a social norms approach intervention, ideally the intervention should be sustained for several years. One such as in the case of work at the University of Virginia where the risk of students experiencing multiple alcohol related harms has halved following the implementation of a long term social norms campaign[5].

The authors of the review posit that, whist statistically significant, effect sizes are too small to make a social norms campaign worthwhile. In the absence of population based approaches that show more substantial changes the social norms approach remains an effective prevention and early intervention method.

Dr Bridgette Bewick, University of Leeds, Dr John McAlaney, Bournemouth University


  1. Moreira, M.T., L.A. Smith, and D. Foxcroft, Social norms interventions to reduce alcohol misuse in University or College students. 2009, The Cochrane Collaboration.
  2. Foxcroft, D.R., et al., Social norms information for alcohol misuse in university and college students. Cochrane Database of Systematic Reviews 2015, Issue 1, 2015(CD006748).
  3. Weitzman, E.R. and T.F. Nelson, College student binge drinking and the “prevention paradox” : Implications for prevention and harm reduction. Journal of Drug Education, 2004. 34(3): p. 247 – 265.
  4. Ståhlbrandt, H.e., K.O. Johnsson, and M. Berglund, Two-year outcome of alcohol interventions in Swedish university halls of residence: A cluster randomized trial of a brief skills training program, twelve-step-influenced intervention, and controls. Alcoholism: Clinical and Experimental Research, 2007. 31(3): p. 458-466.
  5. Turner, J., H.W. Perkins, and J. Bauerle, Declining negative consequences related to alcohol misuse among students exposed to a social norms marketing intervention on a college campus. Journal of American College Health, 2008. 57(1): p. 85-93.

Using social marketing to explicitly challenge individuals to change their perceptions: A viable alternative to social norms messages?

Moore et al [1] report on a novel application of social marketing messages to reduce alcohol consumption among 1st year university students in Wales. The novelty was in their using a setting not yet evaluated in a UK RCT – namely university halls of residences.

In planning their study the authors envisioned developing social norms messages. Development of social norms messages was problematic after their survey suggested the majority of Welsh students reported hazardous/harmful weekly and per occasion drinking. Consistent with the social norms approach, the authors concluded that “communicating absolute values of drinking would risk further normalizing hazardous drinking” (Moore et al., 2013: 3). In situations like this, where the social norm is not conducive to the creation of a positive message, it can be possible to identify a secondary behaviour or attitude (e.g. number of alcohol free days) to focus messages around.

Moore et al did not identify an alternative positive social norm, their social marketing message instead focussed on reducing student perceptions of the level of misperception. Messages explicitly challenged students to consider their own perception of the norm (e.g. “Most of us significantly overestimate the amount that others drink”; “How much do you think the average female first year student drinks? Halve it. It really is less than you think”). Explicitly asking individuals to consciously attend to their misperceptions had not been investigated as an alternative approach to social norms messages. Social norms messages make visible actual norms thereby creating space for individuals to reflect on how their perceptions match (or not) reality; the accuracy of the perceived norm is not generally made explicit. Moore et al. informed students that their perceptions were incorrect and gave some indication of the direction of the actual norm.  Moore et al’s (2013) findings suggest that explicitly challenging perceptions of perceptions is not effective in changing behaviour and is therefore not a viable alternative to the use of social norms messages.

Not all the messages included by Moore et al focussed on challenging perceptions of misperceptions. Their social marketing campaign included messages intended to change behaviour and attitudes, these messages were not consistent with the social norms approach in that they:

(1) focussed on negative outcomes (e.g. “Most students drink to feel confident, but 70% have embarrassed themselves when drunk”). A social norms approach message would focus on positive behavioural/attitudinal norms.

(2) did not provide data to back up assertions (e.g. “Time for a break? Many students limit their drinking by including soft drinks in the night”). A social norms approach message would normally include details on the proportion of students who engaged in the named activity/behaviour.

(3) Positioned drinking and ‘getting drunk’ as normal behaviour for university students (e.g. “86% of males have never damaged their halls of residence when drunk”).

Moore et al intended to test the effectiveness of social norms messages to reduce alcohol consumption among 1st year university students living in halls of residences in Wales. Moore et al have continued to label their intervention as a ‘social norms approach’; due to the actual norms collected they actually developed a social marketing campaign. Their social marketing campaign was unique in its focus on perceptions of perceptions – their findings suggest that explicitly challenging perceptions of perceptions is not a viable alternative to social norms messages.

Dr Bridgette Bewick, University of Leeds, and Dr John McAlaney, Bournemouth University


  1. Moore, G.F., et al., An exploratory cluster randomised trial of a university halls of residence based social norms marketing campaign to reduce alcohol consumption among 1st year students. Substance Abuse Treatment, Prevention, and Policy, 2013. 8.

Can Facebook be used to effectively deliver social norms interventions? A discussion of Ridout and Campbell (2014)

As the technology available to disseminate messages to a population has developed so have the ways social norms campaigns can be delivered. In the early days of the approach campaigns consisted primarily of mass media campaigns in the form of posters and leaflets. As internet technologies became more pervasive there was a move towards incorporating online systems that can provide individuals with personalised normative feedback, such as in the case of Unitcheck[1].
Digital technology continues to evolve, and social media has become ingrained in the daily lives of many individuals. Facebook alone reported that in the first quarter of 2015 it had 1.44 billion active monthly users, an increase of 13% from the previous year. As Ridout and Campbell[2] highlight that alcohol related posts on social network sites can contribute to the perceived drinking norms of university students[3].  Yet whilst there is strong evidence to suggest that social media is an important medium for the creation and communication of perceived norms there is a lack of research into how to use these platforms for the dissemination of social norms campaigns. This is the issue addressed by Ridout and Campbell[2], who explored the use of the Facebook messaging system to deliver a social norms intervention to reduce problem drinking at a university. As they note the Facebook messaging system has a number of advantages over personalised feedback delivered via email, including the fact that Facebook is used more often by students than email[4]. In contrast to many regular email systems the Facebook messaging system allows the sender to easily see if their message has been read by the recipient. This helps resolve one of the challenges in delivering a social norms campaign, which is evaluating how successful the campaign has actually been at reaching the target audience.

Ridout and Campbell[2] were able to demonstrate significant reductions in frequency and quantity of alcohol use in an intervention group as compared to a control group; reductions were maintained at 3 month follow-up. In keeping with the expectations of the social norms approach participants in the intervention group demonstrated a reduction in their degree of misperception of peer alcohol use norms. Ridout and Campbell[2] show how social norms approach interventions can  make use of Facebook and other social media platforms that are pervasive in the lives of the target population. The continued success of the social norms approach requires campaigns to consider communication mediums of relevance to the target population. Ridout and Campbell have shown how social norms researchers and practitioners can adapt as technology evolves.

Dr John McAlaney, Bournemouth University, and Dr Bridgette Bewick, University of Leeds


  1. Bewick, B.M., et al., The feasibility and effectiveness of a web-based personalised feedback and social norms alcohol intervention in UK university students: A randomised control trial. Addictive Behaviors, 2008. 33(9): p. 1192-1198.
  2. Ridout, B. and A. Campbell, Using Facebook to deliver a social norm intervention to reduce problem drinking at university. Drug & Alcohol Review, 2014. 33(6): p. 667-673.
  3. Fournier, A.K., et al., Alcohol and the social network: Online social networking sites and college students’ perceived drinking norms. Psychology of Popular Media Culture, 2013. 2(2): p. 86-95.
  4. Judd, T., Facebook versus email. British Journal of Educational Technology, 2010. 41: p. E101 – 103.