Cyber Responsibilization

What’s responsibilization? It is a particular risk management strategy where governments provide advice, and then citizens either follow the advice, as advised, or faces the consequences of not doing so.


It works effectively for some risks, especially when the risk only hurts the person themselves. For example, Governments issue advice about good eating but people may choose to live on pizzas and sodas if they wish.

On the other hand, when people taking the risk impact others with their behaviours, responsibilization doesn’t work very well. In these cases the government steps in.

A good example is the fire risk. Fire fighting is not left to individuals – fire fighting services can be summoned to fight fires – so that it doesn’t get out of hand and destroy many homes.

What about Cyber Security? I did some work with Craig Orgeron, Merrill Warkentin and P Edward French, where we showed that the Five Eyes countries effectively responsibilize their citizens when it comes to Cyber Security. We argue that this is an unwise strategy, and suggest a better way forward.

The paper was published in the Public Administration Review and is freely available as an open source paper. Snapshot video below.