Wael Anwar Abdel Aziz Soliman

• Labres Mallmann, Gabriela & Soliman, Wael (2023). The Collective Violation Talk Show: How Do Workgroups Account of Cyberdeviance? IRIS Selected Papers of the Information Systems Research Seminar in Scandinavia. ISSN 1891-9863. 9. Vis sammendrag

  Cyberdeviance within workgroups is one of the most challenging cybersecurity problems facing modern organizations. Cyberdeviance is an intentional form of security policy violation, reflecting the outcome of a justification process deeming the violation acceptable for the violator. The collective nature of cyberdeviance within groups increases the challenge because group context can steer members to act in accordance with the group’s decisions, even when it violates organizational directives. Despite these challenges, we know very little about how workgroups justify cyberdeviance. We ask: How do workgroups create and validate accounts for cyberdeviance? Guided by the theoretical lens of accounts and based on insights from five deviant workgroups using unauthorized technologies (aka, shadow IT), our analysis points to three core findings. First, the group context is crucial to understanding the violation framing process. Second, at the discursive level, the groups use a unique set of verbalizations that deem cyberdeviance acceptable within the group. Third, we found that this set of verbalized accounts is instrumental to ensure group cohesion and belongingness. We discuss the theoretical and practical implications of these novel insights.

• Rinta-Kahila, Tapani; Penttinen, Esko; Salovaara, Antii; Soliman, Wael & Ruissalo, Joona (2023). The Vicious Circles of Skill Erosion: A Case Study of Cognitive Automation. Journal of the AIS. ISSN 1536-9323. 24(5), s. 1378–1412. doi: 10.17705/1jais.00829. Vis sammendrag

  Cognitive automation powered by advanced intelligent technologies is increasingly enabling organizations to automate more of their knowledge work tasks. Although this often offers higher efficiency and lower costs, cognitive automation exacerbates the erosion of human skill and expertise in automated tasks. Accepting the erosion of obsolete skills is necessary to reap the benefits of technology—however, the erosion of essential human expertise is problematic if workers remain accountable for tasks for which they lack sufficient understanding, rendering them incapable of responding if the automation fails. Though the phenomenon is widely acknowledged, the dynamics behind such undesired skill erosion are poorly understood. Thus, taking the perspective of sociotechnical systems, we conducted a case study of an accounting firm that had experienced skill erosion over a number of years due to reliance on their software’s automated functions. We synthesized our findings using causal loop modeling based on system dynamics. The resulting dynamic model explains skill erosion via an interplay between humans’ automation reliance, complacency, and mindful conduction. It shows how increasing reliance on automation fosters complacency at both individual and organizational levels, weakening workers’ mindfulness across three work task facets (activity awareness, competence maintenance, and output assessment), resulting in skill erosion. Such skill erosion may remain obscure, acknowledged by neither workers nor managers. We conclude by discussing the implications for theory and practice and identifying directions for future research.

• Soliman, Wael & Rinta-Kahila, Tapani (2023). Unethical but not illegal! A critical look at two-sided disinformation platforms: Justifications, critique, and a way forward. Journal of Information Technology. ISSN 0268-3962. doi: 10.1177/02683962231181145. Vis sammendrag

  Crowdsourced disinformation represents a two-sided-market model wherein a platform organizer orchestrates the interaction between disinformation requesters and crowdworkers for a fee. Academic research and industry reports demonstrate that the disinformation business is thriving and that its consequences can be severe; however, research on this topic has focused mainly on developing technical methods to detect disinformation, while leaving the social aspects of the phenomenon unaddressed. In particular, very little is known about the discursive tactics that platforms apply to justify disinformation-service offerings such that these appear acceptable to potential customers. Taking a critical approach to the topic, the paper examines how platform organizers justify their disinformation services and to what extent the justifications given are valid. These questions are addressed via a unique dataset from 10 crowdsourcing platforms specializing in social-media–based reputation management. Drawing on the lens of accounts, the analysis suggests that these platforms employ six means of justification for persuasion purposes: the “claim of entitlement,” “defense of the necessity,” the “claim of ubiquity,” “language sanitization,” “appeal to professionalism,” and “appeal to codified rules.” Critical discourse analysis scrutinizing these accounts against the validity claims of comprehensibility, truth, sincerity, and legitimacy indicates that they cannot be considered valid. The paper discusses the implications of the findings and offers several recommendations designed for improving the status quo.

• Soliman, Wael & Ojalainen, Anniina (2023). Conflict Resolution in an ISO/IEC 27001 Standard Implementation: A Contradiction Management Perspective. I Bui, Tung X. (Red.), Proceedings of the 56thAnnual Hawaii International Conference on System Sciences. HICSS Conference Office. ISSN 978-0-9981331-6-4. s. 4839–4848. Fulltekst i vitenarkiv Vis sammendrag

  The ISO/IEC 27001 standard provides organizations with guidelines to help them evaluate, document, and improve their information security processes. In practice, however, the generality of the standard can create a conflict between its requirements and the adopters’ expectations. To better understand how an organization manages such conflicts, we conduct a case study in a Finnish corporation during the standard’s implementation in one of its units. Two critical conflicts emerged: Conflict I reflects a tension between the standard requirement for disciplinary measures vis-à-vis the organization’s punishment-averse culture. Conflict II reflects a tension between the organization’s aspiration for concrete code reviewing instructions vis-à-vis the lack thereof in the standard. Our findings reveal that whereas the conflict resolution process was similar in managing both conflicts, their content was radically different. Specifically, whereas conflict I’s resolution was paradoxical, conflict II’s resolution was dialectical. We discuss the theoretical and practical implications of our findings.

Se alle arbeider i Cristin

• Soliman, Wael & Mohammadnazar, Hojat (2022). Revisiting neutralization theory and its underlying assumptions to inspire future information security research. Vis sammendrag

  Over two decades ago, neutralization theory was introduced to information systems research from the field of criminology and is currently emerging as an influential foundation to both explain and solve the information security policy noncompliance problem. Much of what we know about the theory focuses exclusively on the neutralization techniques identified in the original as well as subsequent criminological writings. What is often left unexamined in IS research is the underlying assumptions about the theory’s core elements; assumptions about the actor, the act, the normative system, and the nature of neutralizing itself. The objective of this commentary is to revisit the origin of neutralization theory to identify its core assumptions and to lay a foundation for future IS research inspired by these assumptions. This paper points to five core assumptions: (1) The actor is an early-stage offender; (2) The act is shameful; (3) Neutralizing precedes and facilitates deviance; (4) Normative rules are disputable; and (5) Specific neutralization techniques are more relevant to specific violations. Ignoring these underlying assumptions could lead to a situation where we make unfounded claims about the theory or provide practitioners with harmful, rather than helpful, guidance.

Se alle arbeider i Cristin