5. What do Decision-Makers „Fight“ About?

Decision-makers in Germany are in agreement on many points: data security and data protection are important issues for which no adequate solutions acceptable to all have been found or which constantly give rise to new challenges which must be mastered. This only makes the need for action all the more urgent. But what must be done – and, above all, who will do what?

The following section will examine the key questions related to trust and security on the Internet from the perspective of the various groups of decision-makers.

Who has the greatest influence on the Net? Who poses the greatest threats?

  • The risk from thoughtless users. Academics and researchers are joined by civil society in viewing users as the number one risk factor. Representatives from civil society and from academics and research view thoughtless users as a greater threat than professional hackers. In their viewpoint, shopping and socialising in the online world without a moment of concern or thought causes enormous harm on the Internet – usually to the users themselves. Clueless users are a threat to themselves. These two decision-maker groups see a tremendous inequality of opportunity on the Net: a few large players do and know a lot – and a lot of „small players“ know almost nothing.
  • The media criticise the users. Media representatives also focus overproportionately sharply on users – especially those users downloading illegal content. Media representatives certainly see themselves as victims who suffer harm from the actions of users. This specific viewpoint means that they are less convinced than other actors that users are unable to grasp what is happening on the Net. They suspect that users are deliberately utilising online services subject to charge without paying for them. They criticise the gradual spread of a mindset that expects everything to be free on the Net and emphasise that high-quality services come with a price.
  • Differentiation in the classification of companies as security threats. Decision-makers from politics, civil service, civil society, media, academics and research are in agreement that companies on the Internet represent a greater threat to security than perceived by the business representatives themselves. Decision-makers from politics and civil service regard the private Internet service providers in general to be a group which threatens security; academics, researchers, media, and civil society focus here above all on the large global corporations. 80 per cent of the decision-makers from academics and research view these corporations as a threat and also express the opinion (more frequently than the average) that the growing market concentration is a key challenge on the Internet (50 per cent versus 36 per cent). The picture business representatives have of themselves deviates sharply from these assessments: only 46 per cent consider private Internet service providers to be a risk on the Net.
  • Academics and researchers as well as media take a critical view of the role of political actors and the government. 35 per cent of academics and researchers (in contrast to 21 per cent as an average among decision-makers) regard political actors as a group, which is a source of risk. The media fear above all the threat of overregulation in this respect. But academics and researchers also see a threat to security in this context from the lack of opportunities for the political establishment to exercise influence; these decision-makers express their fears that political instruments are unable to keep up with the pace of developments on the Net with the consequence that government institutions are unable to ensure security.

Who should assume responsibility? And how?

  • Responsibility is the „buck“ everyone wants to pass when the question of security on the Internet comes up. Nobody wants to keep it and everyone passes it on to the next in line. Some hold on to it for a longer period, but others never accept it at all.
  • Decision-makers in the business sector are significantly more reserved in comparison with representatives of all of the other decision-maker groups when it comes to assign- ing responsibility for security on the Internet. Their viewpoint is that the capability of specific actors to steer the Internet is restricted and is not a „job“ which anyone will be able to conclude successfully. It is only logical that 74 per cent of the decision-makers from business are of the opinion that every individual is him-/herself responsible for data protection; this opinion is shared by 63 per cent from politics, but by only 52 per cent from academics and research.
  • Business representatives frequently assume that users are naive. Overall they are less inclined to believe that too much is expected of users – many see demands for protection as an excuse.
  • Politicians are more firmly convinced that users are unable to grasp much of what happens on the Internet and are in need of protection. This is the attitude of 67 per cent of the politicians in comparison with 54 per cent among decision-makers in business. Political decision-makers view as the greatest necessity the determination of the threshold beyond which users must be protected; like the other groups, they expect the general population to assume a high level of responsibility for their actions.

 How should responsibility be assumed?

  • Decision-makers see a number of different ways in which responsibility for security on the Internet can be successfully assumed: by checking online applications and exercising caution during their use (users), by providing liability (companies/providers, users) or by establishing regulatory measures (politics). Besides the „mature“ use of the Internet by educated citizens, the decision-makers in the qualitative preliminary study addressed above all the issue of regulation because there are obviously substantial differences among the actors in this respect. Business and politics in particular displayed conflicting, in some cases diametrically opposed viewpoints. For example, 40 per cent of the business representatives are convinced that the Internet is a free medium which should not be regimented under any circumstances; this opinion is shared by only 23 per cent of the decision-makers from politics.
  •  Decision-makers from business clearly advocate self-regulation ahead of government regulation (60 per cent). Half of the politicians (50 per cent) agree with this standpoint – evidence that the answer to this question is not simply a decision for the one or the other option. Politicians frequently regard government regulation as the „ultima ratio“. They do not per se consider self-regulation to be inadequate, but they tend to be less euphoric against the back- drop of the empirical reality of the concept: self-regulation sounds great, but it does not work.
  • In comparison with decision-makers from politics, business representatives are less concerned about the need for an active government role to ensure security (70 per cent versus 84 per cent). The qualitative study revealed that companies think primarily about the security of their own business models (e.g. security of online financial transactions, copyright/trademark violations, other instances of fraud etc.). Nevertheless, the majority of them assume that the government, in view of an Internet spanning the globe, will be unable to create any binding legal frameworks (53 per cent). Politicians are slightly less pessimistic in this case: „only“ 43 per cent believe that this will prove impossible.
  • Academics and researchers as well as civil society call for a legal framework from the government more insistently than the average. Despite all of the emphasis given to individual media literacy, representatives from academics and research (88 per cent versus 79 per cent of all decision-makers), for example, expect the government to assume major responsibility. Their view is that users can be expected to assume responsibility only if there is a constitutional framework in place.
  • Personal liability of users is differentiated according to circumstances. The overwhelming majority of all decision-makers – even those from business – say that anyone causing damage or loss should also be liable for the consequences. However, decision-makers disagree as to whether the users should also be personally liable if their computers are not adequately protected. While 46 per cent of business representatives express the opinion that users should be liable, other actors are significantly more reluctant to see things this way (politics 36 per cent, civil society 32 per cent, academics and researchers 25 per cent).

Who and what can you trust on the Net?

Decision-makers from civil society see strikingly fewer threats on the Internet than all other groups of decision-makers. In particular, they dismiss total transparency, mass e-mails or restricted access to one’s own data as posing virtually no risks on the Net.

Media, along with academics and research, emphasise especially the social and cultural risks. Academics and researchers observe above all a rising flood of information and market concentration while the media – as do the political decision-makers – count increasing dependency on online infrastructures and a problematic change in political culture among the threats.

Decision-makers recommend differing strategies for more security on the Internet:

Trust in institutions tends to be more pronounced among political decision-makers and in civil service – and, in part, in civil society – than among other decision-makers. The latter put more trust in independent institutions (civil society) and government agencies and in the German legal system. Politicians, more than other decision-makers, reject a trial-and- error principle as the basis for action on the Internet – experience and media competence are very important, but there is also a need for general conditions.

A look at the various Internet segments within the group of business representatives is of interest: the Digital Vanguard in particular has significantly less confidence in independent institutions, preferring to rely on education and own experience. The lack of trust in the German legal system is especially great (30 per cent versus 39 per cent).

Decision-makers from the media and from academics and research rely above all on knowledge based on experience supported by information from independent institutions, experts (especially in the view of academics and researchers), reputable commercial service providers and knowledgeable users or the advice of friends. This means that when a person’s own experience does not suffice, one should trust those who know more about the subject. Trust here means above all trust in people. Technical security measures or „the government“ are less significant. Representatives from academics and research and from the media are the actors pursuing a holistic, systematic concept of trust to which all Net actors (including users) make contributions and in turn profit from others.