Social Controls and Bonds of Public Information Consumer on Sustainable Utilization and Provision for Computing

Abstract

In public areas, employees are both consumers and producers in information. For sustainable usage of information, employees should be aware of information systems security (ISS). Information systems security (ISS) is critical in further developing public sector information systems, such as e-government. Most ISS breaches are committed by insiders rather than outsiders. This study investigates the applicability of adult social bond theory, which proposes social controls in the form of social bonds that provide deterrence based on the potential shame an employee would feel from committing an ISS breach. The proposed research model consists of four antecedents for adult social bonds: commitment, attachment, belief and job stability. Individual ISS compliance is set as the dependent variance and deterrence and shame are set as the mediators between social bonds and compliance. Analysis of 672 data points largely supports the research model, proving the applicability to ISS of social bonds and social control. Belief seems to have the strongest effect on individual compliance. Implications are discussed and further studies are proposed.

1. Introduction

The public sector has confronted service revolution since the mid-1980s. In the 1990s, the public sector’s service revolution has gathered momentum [1] and satisfactory service delivery for users and citizens with efficiency and effectiveness have led to e-government [2]. E-government, primarily facilitating communications between the government and its stakeholders including citizens, other governments, government agencies and employees via internet and web-enabled computer technologies, becomes a prevalent and useful public service tool for the public sector and an international phenomenon [3].

E-government has established new public governance on the premise of e-government’s economic, political and practical values including citizenry satisfaction, resource efficiency, democratic responsiveness, accountability and fluent communications between governments and their stakeholders [4]. Though increasing practical and research attention to e-government, e-government is a nascent research field, due to its relatively short history that begun in the middle of 1990s [5]. The e-government literature has focused on e-service, e-democracy, conceptual modeling [6] and the diffusion of e-government including influencing factors on e-government diffusion, organizational factors in the e-government diffusion, systems and applications for e-government and technology diffusion [7]. Joseph’s (2013) analysis of the e-government research trend suggests the importance of studies using primary data and the opportunities of diverse topics which can expand the e-government literature [4].

With the advent of information technologies such as e-government in public sectors, the information systems security (ISS) becomes one of the prevalent problems. This study analyzed the primary data collected from the Korean public sector concerning ISS. As ISS has been identified both as a success factor [8]) and a barrier to e-government, e-government should reduce ISS threats and continuously improve ISS. ISS issues in e-government include protecting citizens’ personal data, cyber-attacks and terrors [7], system security for cloud computing [9] and transaction security [8].

Although ISS violation harms private organizations in terms of financial loss and reputational damage [10], for the public sector it causes more serious reputational damage and a complex web of financial, political and economic loss. Although technology-based solutions have been applied as the main solution for information threats and attacks, they have been only modestly effective [11]. The heavy reliance on technology-based solutions stems from the limited understanding of the complicated characteristics intertwined with technical, institutional, sociocultural and organizational aspects of ISS [12]. Consequently, it is natural that the focus of ISS has shifted from technical approaches toward social-organizational approaches and individual employee behavior.

In fact, numerous studies (e.g., [10,13,14]) have identified insider threats (i.e., information violation by employees) as one of the most serious threats to ISS. Employees’ ISS compliance and behavior have been identified to be among key elements to successful ISS from a socio-organizational and behavioral perspective [15].

Therefore, employees’ ISS-compliant or ISS-noncompliant behavior in organizations has received growing attention in ISS literature [16]. Deterrence theory is the primary theoretical framework that has been used to understand and predict employees’ misuse and violation of information systems [17]. However, the inconclusive findings with regard to the effectiveness of formal deterrence systems suggest that each individual’s different level of perceived deterrence threat determines the effectiveness of ISS deterrence [18].

Therefore, this study investigates the factors that influence individuals’ perceptions of formal and informal deterrence threats by analyzing the ISS compliance intentions of employees working in the Korean public sector.

Although Korean government agencies have been implementing and imitating ISS systems for effective information security, problems including a lack of manpower and ill-defined roles that cause performance-assessment problems, poor information security documentation and information security monitoring and inspection (Hwang & Choi, 2017). Government employees are required active cooperation and ISS behaviors for effective ISS performance; however, ISS is not considered as their priority when ISS behaviors are not included in their individual performance evaluations in the Korean government. Thus, it is vital to understand what drives employees’ ISS compliance intentions [19].

Nye’s four types of social controls [20] are integrated with Hirschi’s social bonding theory [21], which provides useful insights for understanding employees’ motivations for ISS compliance or violation and their different levels of perceived deterrence threat. Moreover, public sector employees’ ISS compliance intentions are investigated in the presence of formal deterrence and shame as self-imposed punishment. An empirical study of this under-researched ISS topic can make a valuable contribution in the field of public administration and e-government and has several practical implications:

• ISS policies for e-government should embrace employees’ motivations for compliance or noncompliance and the individual differences of their responses to sanction-based approaches.
• Because employees in the public sector may respond to both formal and informal deterrence, e-government ISS guidelines and training should emphasize to employees the repercussions of committing ISS violations, highlighting not only the formal sanctions but also the emotional punishment (e.g., shame and guilt) based on peers’ criticism, individual reputational damage and alienation.
• Because adult social bond elements, such as job commitment and job stability, are positively associated with perceived deterrence threats, the design of the deterrence system should incorporate them.

2. Theoretical Framework and Research Model

2.1. Theoretical Background: Social Control and Social Bond

The importance of the human aspect and insider threats to the effectiveness of ISS has been highlighted in the literature [22]. The weakest link of ISS effectiveness and the most critical element of ISS success [22] is the human factor. ISS studies focusing on user behavior have mainly investigated the attributes of employees’ compliance or noncompliance with ISS policy and abuse of information [23]. In these studies, deterrence theory has been the primary theoretical approach used [17]. However, ISS researchers have doubted the effectiveness of a formal sanction-based approach [13,24].

Alaskar, Vodanovich and Shen conducted a systematic review of the literature that has empirically studied employee behavior with regard to ISS and found very few (8) such studies before 2009 but an exponential increase between 2009 and 2012 (23 studies) [25]. They also found that since 2009 studies have shifted their focus toward positive behavior, such as ISS compliance (e.g., [12,16]) and away from negative behavior, such as ISS violation (e.g., [18,26]).

Moreover, they identified three major theoretical frameworks in the ISS studies of employee behavior: deterrence theory (e.g., [24,27,28]), the theory of reasoned action (TRA) (e.g., [13,29] and protection motivation theory (PMT) (e.g., [16,27,30]). In their literature review of ISS compliance, Anderson and Agarwal also found the use of deterrence theory and PMT to be popular [31]. Alaskar, Vodanovich and Shen [25] and Ifinedo [16] argued that, although concrete and robust evidence can be found for the use of various theoretical frameworks, alternative perspectives or multiple theoretical approaches have not been sufficiently explored.

Moreover, criminology literature [32] has emphasized the importance of informal sanctions and the inconclusive results of formal sanction-based deterrence, based on differences in individual employees’ perceptions of the threats posed by ISS sanctions [18], have prompted us to explore alternative perspectives to find factors that can influence individual differences. Accordingly, Nye’s (1958) comprehensive social control theory that originally proposes the impact of familial factors on delinquency [20], which includes the following four types of social control, is applied:

• Direct control, focused on threats of punishment or benefits of reward to force compliance with conventional norms;
• Indirect control, based on affectional identification with or attachment to significant other people, such as parents and friends;
• Internalized control, focused on the creation of autonomous conformity or control located in each individual’s conscience, self-concept, or personality, for example, conscience plays in making decisions related to delinquent behaviors; and
• Control over opportunities for compliant or deviant activities whereby compliance results from limited alternatives.

The concepts of Hirschi’s (2002) social bonding theory (SBT) [21], which focuses on “binding ties or social bonding that individuals have with their group,” [16] overlap with those of Nye’s social control theory. Hirschi’s attachment and belief are similar to Nye’s indirect control and internalized control. Public sector employees’ ISS compliance is investigated in the framework of Nye’s social control theory integrated with Hirschi’s SBT. Nye’s four social controls are interpreted in this study as follows:

• Direct control as formal deterrence;
• Indirect control as Hirschi’s social bond elements (attachment, commitment);
• Internalized control as shame and Hirschi’s belief; and
• Control over opportunities for compliant activities as compliance intentions.

Hirschi identified the components of SBT as attachment to significant others, commitment to conventional actions, involvement in conventional activities and personal norms (i.e., accepting society’s moral and traditional norms) that facilitate conformity through socialization. However, in an effort to avoid confusion, Hirschi’s concept of involvement is excluded, because a temporal aspect of involvement may work as a gauge of a person’s commitment when the person cannot be committed to certain activities without investing substantial time and energy.

It is important to clarify that the specific meaning of each SBT component can vary across an employee’s life span, because the adult social bond may focus on adults’ dominant institutions, such as work, family and community, rather than parents, family, school and peer-group, which are the dominant institutions in childhood and adolescence [33]. Accordingly, this study focuses on Sampson and Laub’s adult social bonds [33], namely, job commitment, job stability and attachment to spouse or family. In SBT, individuals who have these bonds are less likely to be antisocial or delinquent [21].

According to Alaskar, Vodanovich and Shen [25], SBT has been used in only two studies of ISS: Ifinedo [16] and Cheng, Li, Li, Holm and Zhai [34]. By investigating ISS compliance intentions by use of Nye’s social control theory integrated with Hirschi’s SBT, which establishes both formal sanction and the informal sanction of shame as a self-imposed punishment, the current study is distinguished from those two ISS studies that relied on only Hirschi’s SBT. Ifinedo used three theoretical underpinnings, including SBT as a theoretical framework of antecedents that influence attitudes in TRA and TRA and social cognitive theory that affect compliance intention with regard to ISS policy [16]; Cheng, Li, Li, Holm and Zhai used deterrence, SBT and social pressures as antecedents that influence the intention to violate ISS policy [34]. In addition, Hsu, Shih, Hung and Lowry (2015) also used the four components of SBT that influence social control and are positively associated with extra-role and in-role behavior, but they separately tested whether the extra-role and in-role behavior are positively associated with ISS effectiveness [35]. Moreover, these three studies use SBT components without clarifying the specific meaning of each SBT component based on an employee’s life span, while the current study focuses on adult social bonds.

As Hirschi attempted to explain, SBT may be more applicable to ISS compliance (lack of delinquency) than to ISS violation [36]. Moreover, SBT has been recognized as more suitable for the characterization of societies that have traditional sociocultural backgrounds, collectivist counties and relatively conservative countries, such as China, Japan, India and Taiwan [36].

2.2. Adulthood Social Bond Theory (ASBT)

Since Hirschi’s study, social bond theory (SBT) has been applied in studies of delinquency and crimes. The basic premise of SBT is that human beings are naturally inclined to antisocial behavior. Further, as individuals pursue self-interest, in most cases these self-interests conflict with the interests of other people. Based on these premises, SBT explains that these natural antisocial tendencies can be ameliorated when individuals have strong social bonds. Antisocial behavior, such as committing a crime, may be deterred when the individual has strong social bonds. In SBT, bonds are generally identified by four measurable elements: attachment to other individuals, commitment to social institutions, involvement in typical social behaviors and belief in basic values [21,35] and these four components are considered critical to an individual forming social bonds [35].

Sampson and Laub further developed SBT into adulthood social bond theory (ASBT) [33], in which the institutions of social control for adults from those for children, because adults have experienced life events that create different types of social bond. Compared to the four elements of SBT, ASBT has three elements: job stability, commitment and attachment [33].

This study of ISS-compliant behavior adapts SBT and ASBT. From the perspective of social control of ISS breaches, antecedents related to social bonding are posited in this study to be associated with deterrence and shame; such association leads to ISS-compliant behavior by employees. ISS breaches are crimes and ISS breaches (antisocial behavior) may result when an individual’s bond to society is weak or broken. Therefore, changes that strengthen social bonds in adulthood will thus lead to fewer ISS breaches and more compliant intention and behavior and changes that weaken social bonds will lead to more breaches and less compliance.

In this regard, four constructs are selected as critically influencers of deterrence and shame related to ISS: commitment, belief, attachment and job stability. Commitment, belief and attachment are adapted from SBT, while job stability is adapted from ASBT. The involvement element is excluded from this study of SBT and ASBT, for the reason already explained, that it is closely related to commitment. These two are not orthogonal in terms of forming social bonds.

Commitment is an individual’s dedication to a role. It is a normative motivation different from instrumental motivation, such as expectancy and reinforcement. Commitment reflects internalized normative pressures, such as personal ethical standards. Therefore, commitment and desirable action are closely related to each other. Internalized pressure has longer-term influences on behavior than do external, short-term rewards and punishments. In this regard, high commitment from individuals dedicated to their work roles and identifying themselves with the organization may lead to greater compliance with ISS policies and practices. Association between commitment and ISS-compliant behavior has been empirically tested and validated [12] and studied in human resources literature [37]. Committed employees believe that following behavioral guidelines, such as ISS policies and practices, is important and even imperative. Therefore, the following hypotheses are posited:

Hypothesis 1 (H1).

Commitment is positively associated with deterrence.

Hypothesis 2 (H2).

Commitment is positively associated with shame.

Belief refers to the basic belief system of an individual and this belief system is formed by social interaction and bonding with other people and related social institutions. Individual belief reflects the extent to which an individual considers certain behaviors to be acceptable in the society. An employee’s attitude toward compliance influences his or her intention to comply with the ISS and TRA literature suggests that the employee’s attitude is related to beliefs about the possible consequences of an ISS breach. Because a society shares norms and values, individuals in the society are influenced to some extent by these norms and values. Individuals who have internalized these norms are motivated to behave in a way that conforms with these shared norms. In ISS research, the positive effect of belief on ISS-compliant behavior has been confirmed [12]. In short, employees who believe strongly in shared norms and organizational goals are more likely to be deterred from noncompliance with ISS policies and practices. Thus, the following hypotheses are proposed:

Belief refers to the basic belief system and this belief system is formed by social interaction and bonding with other people and related social institutions. Individual belief is an extent to which an individual think that certain behaviors are correct and acceptable in the society. While an employee’s attitude toward compliance influences intention to comply with the ISS, TRA literature suggests that attitude is related to beliefs about the possible consequences of ISS breach. As a society shares norms and values, individuals in the society are influenced by these norms and values. When these norms are internalized, people are motivated to behave in a way to conform to these shared norms. In ISS research, the positive effects of beliefs on ISS compliance behavior has been supported [12,27]. In short, employees with strong belief in shared norms and organizational goal are more likely to be deterred from non-compliance of ISS policies and practices. Thus,

Hypothesis 3 (H3).

Belief is positively associated with deterrence.

Hypothesis 4 (H4).

Belief is positively associated with shame.

Attachment refers to an individual’s associations with other individuals. Attachment is one of the antecedents for strengthening social control and social bonds, because individuals tend to avoid negative actions when they feel closely attached to other people, such as colleagues, spouses, family and friends. Although this theory of attachment has been applied mainly to close relationships such as family, it has also been found relevant to the workplace. Studies have linked strong attachment to such variables as workplace cohesion, satisfaction with work and low levels of work strain and burnout. Strong attachment to other people plays a role in coping with stress and dealing with problems. Thus, attachment works as an internal control. It is known to be negatively associated with delinquent behavior, because such behavior would disappoint the people to whom the individual feels attached [21]. When individuals feel strongly tied to other people who are important to them, they are sensitive to the judgments of those people and try to behave in a way of which they would approve.

Therefore, employees are less likely to commit ISS breaches when they feel attachment. Rather, they are more likely to comply with ISS policies and practices [28]. Thus, attachment increases deterrence and shame concerning ISS:

Hypothesis 5 (H5).

Attachment is positively associated with deterrence.

Hypothesis 6 (H6).

Attachment is positively associated with shame.

Based on the premise that, although deviant behavior can persist through the entire life of an individual, the social bonds of adulthood are different from those of childhood, Sampson and Laub developed ASBT [33]. They contended that social interaction with adult institutions, such as marriage and employment, has strong effects on deviant behavior. Some evidence has been presented that episodes of unemployment lead to higher crime rates [38]. In this regard, the main difference between ASBT and SBT is the inclusion of job stability as a critical variable supporting compliant behavior and suppressing deviant behavior. Employment by itself does not increase social control, but coupled with job quality and job stability employment deters deviant behavior [39]. Thus, the following hypotheses are proposed:

Hypothesis 7 (H7).

Job stability is positively associated with deterrence.

Hypothesis 8 (H8).

Job stability is positively associated with shame.

2.3. Deterrence

Loughran, Pogarsky, Piquero and Paternoster (2012) categorized deterrence into specific deterrence (i.e., inhibiting the future criminality of an individual by punishing him or her for committing a crime) and general deterrence (i.e., preventing individuals from committing crimes that they intend or plan) [40]. When a person perceives the potential punishment as certain, severe and swift and he or she considers that the reward from the crime provides less value than would be lost from the punishment, sanctions deter future crime [40]. Various deterrence models have been developed, from classical criminology and criminal decision-making process, to include informal sanctions and moral emotions, such as shame and guilt, the rational choice approach and Katz’s crime benefits theory [41]. Because studies that have applied deterrence models indicate that sanction threats provide inconsistent effects, individuals’ personality and psychosocial factors should be investigated to improve the effectiveness of deterrence methods [40].

In essence, ISS deterrence is a sanction intended to prevent ISS violations. ISS deterrence includes dissemination and sharing of information about ISS guidelines, ISS policies, penalties for ISS violations, organizational ISS efforts and determination of ISS sanctions. ISS literature shows inconsistent and sometimes contradictory findings regarding the effectiveness of ISS deterrence [18]. Many ISS studies (e.g., [18,28,42]) have shown positive effects of ISS deterrence on employees’ ISS compliance. In contrast, other studies (e.g., 7 [27]) have concluded that the effect of deterrence on employees’ ISS behavior is insignificant. In addition, some studies have focused on employees’ perception of the components of ISS deterrence, for example, the significant deterrence effect of perceived deterrence certainty on software piracy [42] or on employees’ ISS compliance or violation (e.g., [28]). In contrast, D’Arcy et al. concluded that only the perceived severity of the deterrence has an effect.

Hypothesis 9 (H9).

Deterrence is positively associated with ISS compliance intentions.

2.4. Shame as Self-Imposed Punishment

Although classical deterrence theory assumes that human beings are rational, contemporary deterrence theory has evolved to embrace conscience measures, such as shame, guilt and embarrassment [43]. These self-conscious emotions disapprove of one’s own deviant behavior and stigmatize oneself as a troublemaker, which inhibits antisocial or deviant behavior [43]. Compared to guilt, shame works as a more consistent self-stigma concept [28,32,44]. In Nye’s four types of social control, shame as conscience can be included as an internalized control based on autonomous patterns of conformity in the individual personality, conscience, or self-concept [20]. Shame is a significant self-conscious emotion and many criminology studies have found that shame can inhibit criminal behavior (e.g., [45]). Shame also plays a role as self-imposed punishment that, effectively, discourages employees from organizational criminal behavior.

Because shame has not been sufficiently investigated with regard to ISS, few ISS studies have examined shame as an informal deterrence. Higgins, Wilson and Fell found a role for shame in reducing software piracy [42]. Bulgurcu, Cavusoglu and Benbasat found that shame as an intrinsic cost is positively associated with the cost of noncompliance [12]. Hu, Xu, Dinev and Ling 2011 were unable to conclude that shame is a statistically significant causal factor for ISS violation but found that it was negatively associated with ISS violation [13].

Hypothesis 10 (H10).

Shame is positively associated with ISS compliance intentions.

2.5. ISS Compliance

Many studies (e.g., [17,18]) have examined the factors that affect employee compliance with organizations’ ISS policies. ISS compliance can be defined as the extent to which employees follow ISS policies in performing their jobs. According to Galletta and Hufnagel, ISS policies are the rules, guidelines, standards and procedures that restrict users’ IT usage choices. Brown, Massey, Montoya-Weiss and Burkman argued that the intention of usage is not a meaningful dependent variable in a mandatory IT usage environment [46]. This study focuses on ISS compliance, because compliance is the main problem in mandatory IT contexts. Compliance encompasses both the concept of usage and the concept of elements specified by ISS policies.

ISS compliance is mandatory in the sense that its intent is not to bring about thought processes or creativity. Compliance is an expected employee behavior, in which employees should internalize and automatically obey any ISS rules within their abilities. Effective compliance with ISS policies requires employees to overcome technical and social barriers and adapt to changing organizational realities.

According to deterrence theory, one would expect the perceived certainty of punishment and shame will reduce the incidence of employees committing ISS violations. Punishment is a form of social control that helps to establish group norms that specify acceptable and unacceptable behavior.

This study used four demographic controlled variables: gender, age, education and job duration. Previous studies have indicated that gender and age make differences in security policy compliance [28,47].

3. Methodology

3.1. Measurement of Constructs

This study uses the research model presented in Figure 1. All of the variables are measured based on previously validated items and then further modified as needed. All variables are measured on a five-point Likert scale, in which 1 denotes “strongly disagree” and 5 denotes “strongly agree.”

The five variables that measure attachment are drawn from Berscheid, Snyder and Omoto [48] and Feeny [49]. The two variables that measure belief are taken from Hwang and Akers [50] and Hovav and D’Arcy [47]. The four items of commitment are based on Sampson and Laub [33] and D’Arcy, Hovav and Galletta [18] and then modified for information security. To measure job stability, three variables from Hwang and Akers [50] and Sampson and Laub [33] are used. Four variables from Nagin and Paternoster (1993) are used as measures of deterrence [51]. The six variables that measure shame are drawn from Siponen and Vance [27] and Nagin and Paternoster [51] and then modified to reflect the overall characteristics of information security. The three variables that measure security compliance are taken from Siponen, Mahmood and Pahnila [52]. Figure 1 shows the research model.

3.2. Data Collection

The questionnaire (see Appendix A) was presented as an opinion survey about information security. It included all constructs and information required for the research and that each individual respondent would be able to answer.

Paper copies of the questionnaire were distributed to Korean central and local government employees via information security managers at public institutions. Of the 700 paper questionnaires sent, 670 were completed and returned. Of those 670, 18 questionnaires that contained imperfect or unreliable answers were excluded, leaving 652 questionnaires with valid responses. The valid response rate was 93%.

The resulting demographics of the 652 respondents are reported in

Table 1. The characteristics of demography.

Item	Variable	Frequency	Percentage (%)
Gender	Male	439	67.3
	Female	213	32.7
Age	Under 20 years	8	1.2
	21–30 years	190	29.1
	31–40 years	297	45.6
	41–50 years	140	21.5
	Above 51 years	17	2.6
Years worked	Less than 1 year	58	8.9
	1–5 years	214	32.8
	5–10 years	141	21.6
	10–15 years	120	18.4
	More than 15 years	119	18.3
Position	Staff	253	38.8
	Assistant manager	121	18.6
	Manager	131	20.1
	Deputy director	131	20.1
	Above the department head	16	2.5
Education	High School Diploma	15	2.3
	Junior College	16	2.5
	Bachelor’s	482	73.9
	Master’s or above	139	21.3
Marriage	No	288	44.2
	Yes	364	55.8
Type of employment	Regular	630	96.6
	Irregular	22	3.4
Income Satisfaction	Strongly Disagree	32	4.9
	Disagree	131	20.1
	Neutral	304	46.6
	Agree	166	25.5
	Strongly Agree	19	2.9

. Women comprised a smaller share of the sample than did men. The age of most of the respondents was between 31 and 40 years old. Of the respondents, 38.8% held staff positions. Approximately 73.9% held bachelor’s degrees, 55.8% were married and 36.7% had worked for more than 10 years, 96.6% were regular employees and 28% satisfied their income requirements.

4. Methodology Data Analysis and Results

Structural equation modeling is used to validate the research model; enables analysis of the relationship and strength between constructs. Consistent with a growing number of management studies, the partial least squares (PLS) approach to structural equation modeling is used as the estimation procedure. PLS combines factor analysis with linear regression, makes only minimal assumptions with the goal of variance explanation, makes no assumptions regarding the underlying distribution of the data and does not require large sample sizes [53]. The data analysis is conducted by use of the smart PLS 2.0 and SPSS 18.0 software packages.

The reliability of the data and the convergent validity are analyzed. Before analyzing the data, however, exploratory factor analysis is conducted by using principle component analysis. A varimax orthogonal factor rotation is conducted.

Table 2. Exploratory factor analysis.

	Component
	1	2	3	4	5	6	7
SHAME5	0.884	0.104	0.167	0.059	0.080	0.056	0.022
SHAME4	0.861	0.092	0.158	0.090	0.142	0.076	0.025
SHAME6	0.859	0.130	0.160	0.033	0.104	0.014	0.059
SHAME2	0.683	0.081	0.343	0.110	0.145	0.137	0.252
SHAME3	0.659	0.097	0.290	0.142	0.105	0.131	0.288
SHAME1	0.593	0.105	0.302	0.094	0.084	0.175	0.273
ATTCH4	0.087	0.819	0.067	0.030	−0.028	0.076	0.128
ATTCH5	0.065	0.802	0.145	0.019	0.032	0.115	0.147
ATTCH3	0.126	0.777	0.075	0.086	0.024	0.034	−0.073
ATTCH2	0.092	0.748	0.013	0.008	0.092	0.036	0.089
ATTCH1	0.077	0.483	−0.129	0.212	0.252	0.213	−0.256
DET3	0.323	0.123	0.785	0.035	0.198	0.086	0.127
DET4	0.329	0.132	0.765	0.026	0.215	0.074	0.140
DET2	0.269	0.091	0.706	0.081	0.258	0.004	0.177
DET1	0.193	−0.029	0.652	0.194	−0.034	0.113	−0.080
COMM1	0.089	0.123	0.112	0.752	0.131	0.047	0.072
COMM3	0.004	0.027	0.130	0.747	0.130	0.100	0.203
COMM4	0.049	0.050	0.165	0.700	0.125	0.144	0.194
COMM2	0.174	0.037	−0.045	0.653	0.014	0.092	−0.212
COMP3	0.163	0.081	0.196	0.143	0.778	0.100	0.216
COMP1	0.140	0.098	0.205	0.092	0.743	0.001	0.289
COMP2	0.254	0.069	0.183	0.206	0.707	0.096	0.028
JOB_STAB 2	0.055	0.098	0.074	0.090	0.060	0.836	0.037
JOB_STAB 3	0.173	0.042	0.064	0.191	−0.006	0.766	−0.035
JOB_STAB 1	0.061	0.163	0.075	0.022	0.082	0.729	0.103
BELIF2	0.219	0.113	0.061	0.076	0.194	0.059	0.745
BELIF1	0.213	0.078	0.144	0.080	0.199	0.055	0.743

shows the results of the exploratory factor analysis.

The Cronbach’s alpha values are greater than 0.7, indicating that the data is reliable. Variables are considered internally valid if their composite reliability value is greater than 0.7 and their average variance extracted (AVE) value is greater than 0.5 [53]. As shown in

Table 3. Validity and reliability of the reflective constructs.

	Indicator	Mean	SD	T-Value	AVE	C.R.	R Square	Cronbach’s Alpha
Commitment	COMM1	3.90	0.93	30.33	0.62	0.86		0.79
	COMM2	2.71	1.27	13.61
	COMM3	4.09	0.86	45.95
	COMM4	4.10	0.84	61.20
Belief	SOC_BELIF1	4.08	0.94	78.15	0.80	0.89		0.75
	SOC_BELIF2	4.54	0.69	81.18
Attach	ATTCH1	3.72	1.07	8.11	0.58	0.87		0.81
	ATTCH2	4.57	0.74	21.44
	ATTCH3	4.20	0.92	39.47
	ATTCH4	4.45	0.70	46.59
	ATTCH5	4.57	0.72	44.68
Job Stability	JOB_ENV1	3.93	0.81	27.32	0.67	0.86		0.75
	JOB_ENV2	3.38	0.97	38.69
	JOB_ENV3	3.00	0.92	44.09
Deterrence	DET1	3.19	1.03	18.78	0.71	0.90	0.26	0.86
	DET2	4.26	0.69	63.24
	DET3	4.16	0.76	131.52
	DET4	4.12	0.79	109.46
Shame	SHAME1	3.97	0.88	38.94	0.73	0.94	0.32	0.93
	SHAME2	4.16	0.76	102.68
	SHAME3	4.23	0.72	94.56
	SHAME4	3.90	0.82	53.12
	SHAME5	3.91	0.85	48.33
	SHAME6	3.95	0.83	40.43
Compliance	COMP1	4.49	0.60	65.12	0.78	0.92	0.32	0.86
	COMP2	4.09	0.82	63.43
	COMP3	4.43	0.63	89.70

, the composite reliability and AVE values for all constructs is greater than the required thresholds for validity.

To satisfy discriminant validity, the square roots of the AVE values must be greater than the correlation coefficients between the construct and the other constructs in the model [53].

Table 4. Discriminant validity and correlation of the latent variable scores.

	Attachment	Belief	Commitment	Compliance	Deterrence	Job Stability	Shame
Attachment	0.760
Belief	0.230	0.893
Commitment	0.225	0.288	0.786
Compliance	0.268	0.489	0.449	0.885
Deterrence	0.261	0.427	0.341	0.529	0.841
Job stability	0.273	0.196	0.331	0.257	0.263	0.817
Shame	0.308	0.466	0.347	0.504	0.650	0.318	0.857

shows the correlation matrix for the constructs and, on the diagonal, the square roots of the AVE values. The square roots of the AVE values exceeded the correlation coefficients, verifying discriminant validity.

Now that the measures have been validated, the effects proposed in the model and their significance are estimated using PLS.

Table 5. Testing results of the structural model.

Path	B	T Statistics
Commitment → deterrence (H1)	0.186	4.162 ***
Commitment → shame (H2)	0.160	4.561 ***
Belief → deterrence (H3)	0.326	6.991 ***
Belief → shame (H4)	0.356	10.431 ***
Attachment → deterrence (H5)	0.115	2.734 ***
Attachment → shame (H6)	0.148	4.300 ***
Job stability → deterrence (H7)	0.106	2.706 ***
Job stability → shame (H8)	0.155	4.153 ***
Deterrence → compliance (H9)	0.349	8.064 ***
Shame → compliance (H10)	0.276	6.340 ***

*** p < 0.01.

shows the results of the structural model PLS regressions. The bootstrap method is used to evaluate the path (bootstrap time = 500). The model explains 32% of the total variance in employee ISS compliance.

Several versions of the research model have been tested. In the first model (Figure 2), all constructs are included and a direct path and an indirect path to compliance, as well as the effects of the control variable on compliance, are tested. Hypothesis 1, that commitment is positively associated with deterrence, is supported (ß = 0.186, p < 0.01). This result shows that an increased level of commitment is associated with an improvement in deterrence, meaning that it is associated with improved ISS compliance and inhibition of ISS violations, which supports Bulgurcu et al. [12] study. Hypothesis 2, that commitment is positively associated with shame, is supported (ß = 0.160, p < 0.01). This result means that as employees commit further to the organization, their potential shame about violating ISS increases.

Hypothesis 3, that belief is positively associated with deterrence, is also supported (ß = 0.326, p < 0.01). This result shows that increased belief is associated with an improvement in deterrence, which is consistent with Siponen and Vance [27]. Hypothesis 4, that belief is positively associated with shame, is supported (ß = 0.356, p < 0.01). In other words, as employees’ beliefs about what is acceptable versus unacceptable behavior strengthens, their potential shame associated with violating ISS increases.

Hypothesis 5, that attachment is positively associated with deterrence, is also supported (ß = −0.115, p < 0.01). This result shows that deterrence improves as attachment increases. Hypothesis 6, that attachment is positively associated with shame, is supported (ß = 0.148, p < 0.01), which supports Hirschi [30]’s study. This result shows that the more an employee is attached to his or her family the greater the potential shame of violating ISS.

Hypothesis 7, that job stability is positively associated with deterrence, is supported (ß = 0.106, p < 0.01), demonstrating that increased job stability improves deterrence, which is consistent with Crutchfield’s [39] study. Hypothesis 8, that job stability is positively associated with shame, is supported (ß = 0.155, p < 0.01), which indicates that more stable job environments engender more shame from employees who violate ISS policy.

Hypothesis 9, that deterrence is positively associated with ISS compliance, is supported (ß = 0.349, p < 0.01), which support many ISS studies (e.g., [18,28,42]). In other words, deterrence positively influences employee compliance with ISS. Hypothesis 10, that shame is positively associated with compliance, is supported (ß = 0.276, p < 0.01).

As

Table 6. Results of control variable influencing compliance.

Control Variables	B	T Statistics
Age	−0.102	1.572 N.S.
Gender	−0.127	3.376 ***
Education	0.057	1.839 *
Job durations	0.109	1.893 *

* p < 0.1; *** p < 0.01; N.S. = not significant.

shows, gender, education and job duration is associated with ISS compliance. On average, men comply with ISS more than women do. Education also influences compliance with ISS: a high level of education helps in ISS compliance. Longer job duration is also associated with improved ISS compliance.

In additional, the mediation effects of deterrence and shame are statistically tested. Such an analysis of a mediation effect explains how or why relationships between the independent variables and the dependent variable exist. The mediating effects of deterrence and shame are tested using logic from Baron and Kenny [54], which describes that a variable acts as a mediator when it satisfies the following three conditions:

• the correlation between the independent variable and the mediating variable (path a) is significant;
• the correlation between the meditating variable and the dependent variable (path b) is significant; and
• when path a and path b are controlled (when the mediator is introduced into the regression equation describing path c, from the independent variable to the dependent variable), the correlation in path c is no longer statistically significant and thus can be eliminated.

As Figure 3 shows, the direct paths from commitment, belief and attachment to ISS compliance are significant, but the direct path from job stability to ISS compliance is not significant. Therefore, job stability is excluded from the subsequent mediational analysis.

By introducing deterrence as a mediator of the path between the three independent variables and ISS compliance, the strength of the relationships between ISS compliance and each of commitment, belief and attachment is reduced, indicating a partial mediating effect of deterrence on the effects of commitment, attachment and belief on compliance (see Figure 4). This result shows that commitment, belief and attachment are related to ISS compliance via deterrence.

The same procedure is conducted to test the meditating effect of shame on the relationship between ISS compliance and each of commitment, belief and attachment. Shame demonstrates similar mediational effects as deterrence. The strength of the relationships between ISS compliance and each of commitment, belief and attachment is reduced, indicating a partial mediating effect of shame on the effects of commitment, belief and attachment (see Figure 5). In other words, commitment, belief and attachment are related to ISS compliance via shame. Thus, deterrence and shame contribute to a better explanation of ISS compliance in the context of attachment, belief and commitment.

Lastly, but not least importantly, the effects on ISS compliance of four control variables (gender, age, job duration and education) are tested. Of these, only gender is statistically significant. On average, men comply with ISS more than women do. Education and job duration seem to positively influence ISS compliance, but the relationships are not statistically significant.

Additionally, we conducted a common method bias (CMB) test based on Podsakoff, MacKenzie, Lee and Podsakoff’s CMB method [55]. The indicators of all constructs were reflectively associated with the method factor; each indicator variance was then computed as explained by the principle constructs and the method factor.

Table 7. Analysis of common method bias.

	Indicator	Substantive Factor Loading	Variance Explained	Method Factor Loading	Variance Explained
Commitment	COMM1	0.789 ***	0.622521	0.014 N.S.	0.000196
	COMM2	0.672 ***	0.451584	−0.099 **	0.009801
	COMM3	0.868 ***	0.753424	−0.018 N.S.	0.000324
	COMM4	0.81 ***	0.6561	0.074 ***	0.005476
Belief	SOC_BELIF1	0.892 ***	0.795664	0.004 N.S.	0.000016
	SOC_BELIF2	0.894 ***	0.799236	−0.004 N.S.	0.000016
Attachment	ATTCH1	0.525 ***	0.275625	−0.031 N.S.	0.000961
	ATTCH2	0.775 ***	0.600625	−0.012 N.S.	0.000144
	ATTCH3	0.806 ***	0.649636	0.005 N.S.	0.000025
	ATTCH4	0.847 ***	0.717409	−0.007 N.S.	0.000049
	ATTCH5	0.811 ***	0.657721	0.032 N.S.	0.001024
Job Stability	JOB_ENV1	0.756 ***	0.571536	0.031 N.S.	0.000961
	JOB_ENV2	0.875 ***	0.765625	−0.048 *	0.002304
	JOB_ENV3	0.82 ***	0.6724	0.019 N.S.	0.000361
Deterrence	DET1	0.707 ***	0.499849	−0.075 N.S.	0.005625
	DET2	0.851 ***	0.724201	0.003 N.S.	0.000009
	DET3	0.918 ***	0.842724	0.01 N.S.	0.0001
	DET4	0.877 ***	0.769129	0.039 N.S.	0.001521
Shame	SHAME1	0.599 ***	0.358801	0.227 ***	0.051529
	SHAME2	0.725 ***	0.525625	0.174 ***	0.030276
	SHAME3	0.695 ***	0.483025	0.188 ***	0.035344
	SHAME4	1.001 ***	1.002001	−0.142 ***	0.020164
	SHAME5	1.092 ***	1.192464	−0.248 ***	0.061504
	SHAME6	1.029 ***	1.058841	−0.193 ***	0.037249
Compliance	COMP1	0.905 ***	0.819025	−0.037 N.S.	0.001369
	COMP2	0.816 ***	0.665856	0.064 N.S.	0.004096
	COMP3	0.933 ***	0.870489	−0.025 N.S.	0.000625
Average		0.797096765	0.642272	0.000161706	0.006561

* p < 0.1; ** p < 0.05; *** p < 0.01; N.S. = not significant.

notes that most of the method loadings were not significant. Moreover, the common method-based variance for an indicator was only 0.006, whereas the average substantive explained variance was 0.797. Based on the results of these tests, it was determined that CMB was apparently not a significant threat in this study.

5. Discussion

This study investigates the factors that influence individuals’ perceptions of deterrence threats by analyzing the ISS compliance intentions of the Korean government employees. Nye’s social controls and Hirschi’s social bonding theory are integrated in the current study’s research model, which leads us to understand employees’ motivations for ISS compliance or violation and their different levels of perceived deterrence threat. Additionally, the presence of formal deterrence and shame as self-imposed punishment is analyzed to investigate the government employees’ ISS compliance intentions. An empirical study of this under-researched ISS topic can make a valuable contribution in the field of public administration and e-government.

This study makes several theoretical and practical contributions as follows:

An empirical study of this under-researched ISS topic can make a valuable contribution in the field of public administration and e-government. More specifically, most ISS studies have focused on formal deterrence; however, the roles of both formal and informal deterrence and individuals’ differences in perceptions of deterrence threats in increasing employee ISS compliance reflect the complexities of ISS compliance shape intentions of individual ISS compliance. Thus, this study reflects the complexity of employee compliance or noncompliance with ISS which requires a more comprehensive theoretical framework. Our research model integrates Nye’s social control theory with Hirschi’s social bonding theory to understand this complexity, which leads this study to provide novel and valuable insights. This study is one of very few studies that have investigated the role of and the effect of shame on ISS compliance, which provides empirical evidence for shame serving the roles of self-imposed punishment and informal deterrence.

Practically speaking, ISS policies for e-government should embrace employees’ motivations for compliance or noncompliance and the individual differences of their responses to sanction-based approaches. Because employees in the public sector may respond to both formal and informal deterrence, e-government ISS guidelines and training should emphasize to employees the repercussions of committing ISS violations, highlighting not only the formal sanctions but also the emotional punishment (e.g., shame and guilt) based on peers’ criticism, individual reputational damage and alienation. Because adult social bond elements, such as job commitment and job stability, are positively associated with perceived deterrence threats, the design of the deterrence system should incorporate them.

In this study, a research model has been constructed based largely upon Nye’s comprehensive social control theory, which specifies direct and indirect control of socially deviant behavior by an individual’s socially formed control and bond elements [20]. Despite criminology literature’s emphasis of the importance of informal deterrence, including shame and guilt, most ISS studies have focused on formal deterrence. Moreover, although individuals’ differences in their perceptions of deterrence threats affect their ISS compliance or noncompliance behavior, factors influencing such differences have not been studied sufficiently. The roles of formal and informal deterrence and individuals’ differences in perceptions of deterrence threats in increasing employee ISS compliance—and the relationships among them—reflect the complexities of ISS compliance.

Understanding the complexity of employee compliance or noncompliance with ISS requires a more comprehensive theoretical framework and Nye’s social control theory enables the examination of these complexities in a research model. Adopting constructs from the ASBT, this article has posited a research model in which four social bond constructs (commitment, belief, attachment and job stability) are mediated by deterrence and shame in improving an individual’s ISS-compliant behavior. Analysis of data collected from government employees largely supports the proposed research model, confirming the applicability of ASBT to ISS compliance in the public sector.

As expected, the analysis results show that adult social bonding elements—job commitment, belief, attachment and job stability in the ASBT—are positively associated with deterrence and shame, which in turn are positively associated with the ISS compliance of individual employees. Thus, ASBT is a useful theory for understanding the individual factors that influence employees’ perceptions of formal deterrence and informal shame related to ISS compliance in an e-government context.

Belief seems to have a greater effect on deterrence and shame than do the other three ASBT constructs. It can be inferred that, because belief is a norm compared to the other rather temporary constructs, such as commitment, a strong internal orientation is more important than are fragile punishments or rewards that increase commitment and that indirect social controls, such as attachment and job stability, may have weaker effects.

Very few studies have investigated the role of shame in reducing the incidence of ISS violation and the effect of shame on ISS compliance has rarely been studied. This article has provided empirical evidence for shame serving the roles of self-imposed punishment and informal deterrence and thus increasing ISS compliance. The identification of shame serving such a role can help in designing effective employee training programs.

This article has validated the mediation effects of deterrence and shame, which are elements of social control, on the ISS-compliance effects of elements of SBT. Specifically, through deterrence and shame, commitment, attachment and belief positively influence ISS compliance. The mediation effects show that the research model integrating SBT into social control theory explains well how employees comply with ISS.

6. Conclusions

Although it makes novel theoretical and practical contributions to the ISS literature, this study has several limitations. First, the use of a survey method may introduce self-report bias as a common survey bias. Second, because SBT is most applicable to conservative and collectivist countries, differences may limit the generalizability of this study [36]. Such cultural differences may provide direction for further research. Third, this study used ASBT elements as factors influencing individuals’ differences in perceptions of deterrence threats, but various factors may affect such differences in perception and additional research is required to identify those factors and examine their effect on deterrence. Fourth, although studies have reported the dimensions of differential perception of deterrence threat, those dimensions have not been considered in this study; further studies may investigate the factors that affect the level of perceived deterrence threat. In addition, the significance of the gender control variable, in which men are more likely to comply with ISS than are women, may be related to the job commitment element in the ASBT. Male employees may have greater job commitment than do female employees, which would then lead them to be more ISS-compliant than female employees. However, gender differences in ISS compliance and violation require further investigation.