Copyright1996-2008

1

B2C Distrust Factors in the Prosumer Era

Roger Clarke

Xamax Consultancy Pty Ltd, Canberra Visiting Professor in eCommerce, Uni. of Hong Kong;

in Cyberspace Law & Policy, UNSW; and in Computer Science, ANU

http://www.anu.edu.au/people/Roger.Clarke/EC/...... Collecter08 {.html, .ppt}

CollECTeR Iberoamerica – Madrid – 25 June 2008

Copyright1996-2008

2

B2C Growth Metrics are Hard to Get

• Lots of pseudo-statistics from ‘consultancies’(Blue-sky projections from minimal data)

• Little authoritative empirical research(It’s very difficult and expensive to do)

• Considerable definitional changes over time• Bias inherent in the data

(e.g. conflating Internet Banking, shopping for a house, searching for information on products)

Copyright1996-2008

3

B2C Growth Metrics are Not Good!

• Too few committed online purchasers• Too few success stories, and many arise

from stick rather than carrot (discount air tickets)

• Mostly low transaction-values• Mostly low conversion rates:

• Info Searchers ==>> Customers• Prospects / Visitors ==>>

Customers• Other Sites’ Customers ==>> Ours

(i.e. low confidence transitivity)• Still the same old reasons are given

i.e. Security, Trust, Privacy

Copyright1996-2008

4

Use of B2C eCommerce is Fragile

Successive security scares have been associatedwith pauses in growth and ‘negative adoption’.Even in Internet Banking

Copyright1996-2008

5

Use of B2C eCommerce is Fragile

Successive security scares have been associatedwith pauses in growth and ‘negative adoption’.Even in Internet Banking

• Viruses• Worms

• Phishing• Spyware

especially keystroke-loggers

Copyright1996-2008

6

B2C Distrust Factors in the Prosumer Era

Agenda

• 'Distrust' rather than 'Trust'• From Passive to Proactive

Consumers

• Marketer - with - Prosumer Comms• Consumer Device Insecurity• Privacy Law, Policies and Practice

Copyright1996-2008

7

Recap: Phases of eMarketer Activity

• "Billboards along the Information Superhighway" (1994-95)

• Closed Electronic 'Communities' (AOL, MSN – 1995-97)• Widespread adoption of the term 'B2C' (1996-)• Push Technologies, 'web-casting' and 'channels' (1996-98)• Info-mediaries (1997-99)• Portals, then Vortals (1998-)• Malware, from cookie abuse (1996-), via pop-ups (1999-)

and web-bugs (1999-), to adware and spyware (2000-)• Data rapaciousness and consumer profile construction• Identity management and the consolidation of

individual consumers' multiple identities• Consumer Location and Tracking

Copyright1996-2008

8

Copyright1996-2008

9

The eCommerce Research Focus on 'Trust'

• "Dimensions of trust in an Internet vendor" are "competence, integrity and benevolence"

• "Benevolence is the ability of a company to hold consumer interests ahead of its own self-interest and indicates sincere concern for the welfare of the customers"

Chen S.C. & Dhillon G.S. (2003) 'Interpreting Dimensions of Consumer Trust in E-Commerce' Information Technology & Management 4, 2-3 (April 2003) 303-318

Copyright1996-2008

10

The eCommerce Research Focus on 'Trust'

Has Always Been Naïve

• "Dimensions of trust in an Internet vendor" are "competence, integrity and benevolence"

• "Benevolence is the ability of a company to hold consumer interests ahead of its own self-interest and indicates sincere concern for the welfare of the customers"

• 'Holding consumer interests ahead of a company's own self-interest' and ‘showing sincere concern’ are in direct conflict with business culture, and with the law

Copyright1996-2008

11

What Should eCommerce Research Do?

• The Focus on 'Trust' assumes that:• Consumer Marketers are altruistic• Consumers are stupid enough to believe

it

• A Focus on 'Distrust', on the other hand:• Draws attention to Key Impediments• Enables work on how to overcome them

Copyright1996-2008

12

Conventional B2C ThinkingIs Several Decades Out-of-Date

• Mass MediaOne-way, broadcast modeBillboards, print, radio, TV

• Mass ProductionHigh-Volume / Low Unit-Cost

• Passive Consumers

• Interactive MultimediaNow Immersive Media

• Mass CustomisationLow-Volume / Low Unit-Cost

• Active Consumers'rip, mix, mash' is 'what you do'

Copyright1996-2008

13

The GenerationsGen. Birth Age FeaturesSenior <'46 >62 RetireesBB1 '46-'55 53-62 Early Baby-Boomers

Post-War hard workBB2 '56-'64 44-52 Late Baby-Boomers

'60s counter-cultural loosening overlay

X '65-'78 30-43 Mass MediaBalance of work and play

Y '79-'99 9-29 Interactive Media, incr'gly Immersive

Have fun, constrained by workM? >'00 0-8 Millenials?

Pervasive/always-on, why work?

Copyright1996-2008

14

Phases of Society• Pre-Industrial

• IndustrialEmergent from the Mid-1700s

• Post-IndustrialEmergent from the 1960s / 1980s

• Production for Consumption

• Production for ExchangeProgress in material wellbeing came from specialisation of labour, and separation of production from consumption activities

• Production for ConsumptionPartial, selective, but important

Copyright1996-2008

15

The 'Prosumer'Or Proactive Producer-

Consumer

• The 'do it yourself' (DIY) movement• The 'home handyman' phenomenon• Self-service retail stores, checkouts• Focus groups, consumer panels• Direct data capture (ATMs, EFT/POS)• Internet Banking• The free software & open source

movements• Self-help, mutual service, FAQs• Wikipedia

Toffler A. (1980) 'The Third Wave' Pan, 1980

Copyright1996-2008

16

Conventional Publishing, 1450-1995

The PublishingIndustry Value-Chain

Copyright1996-2008

17

Conventional Publishing, 1450-1995

The PublishingIndustry Value-Chain

Parts of the PublishingIndustry Value-Chain

Desk-Top Publishing, 1985-20..

Copyright1996-2008

18

Electronic Publishing, 1990-20..

Copyright1996-2008

19

Electronic Publishing, 1990-20..

Cross-Media Publishing, 1998-20..

FormatConversion

Copyright1996-2008

20

Interactive 'Publishing', 1995-2095'Bees Around a Honey-Pot'

TheHoney

Pot

Copyright1996-2008

21

Prosumers Have Different Expectationsfrom Baby-Boomer & Gen-X

ConsumersAddled by Mass Media Massage

• 'How do you relate to me'Marketer - with - Prosumer Comms

• 'Which of us wears the risks'Consumer Device Insecurity

• 'What you do with my data'Privacy Law, Policies and Practices

Copyright1996-2008

22

Marketer - with - Prosumer Communications

A Normative Template

• Information• Terms of

Contract• Security• Choice• Consent• Recourse• Redress

Copyright1996-2008

23

Marketer - with - Prosumer Communications

A Normative Template

• Information• Terms• Security• Choice• Consent• Recourse

==>>• Redress

Recourse• Enquiry and Complaints Process

• accessibility• prompt acknowledgement• copy into the consumer's email-archive• responsiveness to enquiry or complaint

• acknowledgement• resolution

• Restitution• product quality shortfalls

• own products and services• third-party products and services

• fulfilment quality shortfalls• payment errors

• External Complaints Mechanisms• information provided about them• prompt and appropriate communications with

regulators

Copyright1996-2008

24

B2C Web-Site Features Generally

There are Positives

• User-Interface• Basic User Assistance• Features to allay consumers’ fears

about security, and about privacy• Clarity about the point of contract• Order checking• Delivery Tracking• Policy re

return/exchange/credit/refund

Copyright1996-2008

25

The Overall Verdict: Appalling

• Terms of ContractNo consolidated document

• Clarity of TermsSplit Personality between chummy sales documents and the actual lawyer-written Terms. Inconsistencies have probable legal implications

• Prior Versions of TermsNo access

• Changes to TermsUnilateral, without notice, let alone consent; and even with retrospective applicability

• Warranties and LiabilitiesEmphatic denials of all forms of warranty and liability, generally far in excess of the legal position, even asserting no responsibility for merchantable quality or errors in product descriptions

• Complaint MechanismsVery poor accessibility (even no Acknowledgement!), and no information about complaints processes

• RedressNo information at all

Copyright1996-2008

26

Copyright1996-2008

27

A Tourist’s Experience – Mon 23 Jun 08

• Guggenheim Bilbao says it offers a Wifi service• It doesn’t. It lets a telco sell a Wifi service• The web-page is in Spanish, and

the only other option is Euskadi• After taking money from the credit-card,

no loginid or password is provided• But the next page demands one• It is impossible to re-display the web-page• So the telco takes consumers’ money

without providing a service

Copyright1996-2008

28

Consumer Device Insecurity

• Second-Party Threats• Third-Party Threats:

• Within the System• Within the Device• Infiltration by Malware

• Consumer Device Vulnerabilities

• 'Which of us wears the risks'• How To Deal with Insecurity

Copyright1996-2008

29

A Risk Assessment Framework for Mobile Payments

Copyright1996-2008

30

Consumer Device InsecuritySecond-Party Threats

• Situations of Threat:• Banks• Telcos / Mobile Phone Providers• Toll-Road eTag Providers• Intermediaries• Devices

• Safeguards:• Terms of Contract• Risk Allocation• Enforceability• Consumer Rights

Copyright1996-2008

31

Consumer Device InsecurityThird-Party Threats – Within the

System(Who else can get at you, where, and

how?)• Points-of-Payment Physical:

• Observation• Coercion

• Points-of-Payment Electronic:

• Rogue Devices• Rogue Transactions• Keystroke Loggers• Private Key Reapers

• Network Electronic• Interception• Decryption• Man-in-the-

Middle Attacks• Points-of-Processing

• Rogue Employee• Rogue Company• Error

Copyright1996-2008

32

Consumer Device InsecurityThird-Party Threats – Within the

Device• Physical Intrusion• Social Engineering

• Confidence Tricks• Phishing

• Masquerade• Abuse of Privilege

• Hardware• Software• Data

• Electronic Intrusion• Interception• Cracking / ‘Hacking’

• Bugs• Trojans• Backdoors• Masquerade

• Distributed Denialof Service (DDOS)

• Infiltration by Software with a Payload ===>>

Copyright1996-2008

33

Consumer Device InsecurityThird-Party Threats – Infiltration by

Malware(Software with a Malicious Payload)

The Vector• Pre-Installed• User-Installed• Virus• Worm• ...

The Payload• Trojan:

• Spyware• Performative• Communicative• Bot / Zombie

• Spyware:• Software Monitor• Adware• Keystroke Logger• ...

Copyright1996-2008

34

Consumer Device Vulnerabilities• The Environment

• Physical Surroundings• Organisational Context• Social Engineering

• The Device• Hardware, Systems Software• Applications• Server-Driven Apps

(ActiveX, Java, AJAX)• The Device's Functions:

Known, Unknown, Hidden• Software Installation• Software Activation

• Communications• Transaction

Partners• Data Transmission

• Intrusions• Malware Vectors• Malware Payloads• Hacking, incl.

Backdoors, Botnets

Copyright1996-2008

35

'Which of us wears the risks'Consumer Device Insecurity

• In jurisdictions with strong consumer protections, consumers have not been held responsible for the security of the devices that they use to conduct transactions

• Banks in some countries recently sought to impose heavy responsibilities on consumers

• Those banks are losing that battle• They are also losing cred with prosumers

Copyright1996-2008

36

How to Deal with Insecurities in B2C Internet Commerce

Recognise that the risks are created by:• Technology Providers (inherently insecure products)• Financial Institutions (inherently insecure payment

processes)• Consumer Marketers (reliance on insecure infrastructure)Take appropriate steps:• Educate consumers• Provide on-demand advice to consumers• Make appropriate software readily available• Provide pre-packaged security-settings to download, install• Provide understandable advice on installation, configuration

Copyright1996-2008

37

'What you do with my data'Privacy Law, Policies and

Practices

• Legal protections are very weak• Legal protections are continually

undermined by technological change• Consumer marketers mostly 'don't get it'• Consumer marketers commit many blunders• Distrust of consumer marketers is rife• Prosumers demand much more

Copyright1996-2008

38

Conclusions from a PPS Study in 2005

• The 4 large marketers have done no more than create a pretence of being privacy-protective

• The sceptical, privacy-sensitive consumer would be aghast at the level of abuse of their privacy, and would decline to conduct business with any of them

• The pragmatic consumer is likely to be keeping an eyeopen for alternatives, and balancing availability and reliability of service against abuses of market power

• The desirable warm glow of trustworthiness of consumer eCommerce is distinctly lacking

Copyright1996-2008

39

Things Prosumer Marketers Can Do

1 Establish a comprehensive Privacy Strategy

2 Conduct Privacy Impact Assessments (PIAs)3 Publish Privacy Policy Statements (PPS)4 Ensure Business Processes reflect

the Strategy, the PIA outcomes and the PPS5 Apply Privacy-Enhancing Technologies

(PETs)

Copyright1996-2008

40

Snakes and Ladders

Copyright1996-2008

41

Snakes and Laddersin B2C eCommerce

• Huge Investment in Image Factorsproviding a small increase in Trust[really a decrease in Distrust]

QuickTime™ and aTIFF (Uncompressed) decompressor

are needed to see this picture.

Copyright1996-2008

42

Snakes and Laddersin B2C eCommerce

• Huge Investment in Image Factorsproviding a small increase in Trust[really a decrease in Distrust]

• Tiny Investment in Prosumer-Orientedcontract terms and privacy policies (let alonethe business processes to implement them)When things go wrong, there is a largerdecrease in Trust / increase in Distrust

QuickTime™ and aTIFF (Uncompressed) decompressor

are needed to see this picture.

QuickTime™ and aTIFF (Uncompressed) decompressor

are needed to see this picture.

Copyright1996-2008

43

BwithP Distrust Factors in the Prosumer Era

Agenda

• 'Distrust' rather than 'Trust'• From Passive to Proactive Consumers

• Marketer - with - Prosumer Comms• Consumer Device Insecurity• Privacy Law, Policies and Practice

Copyright1996-2008

44

BwithP Distrust Factors in the Prosumer Era

Roger Clarke

Xamax Consultancy Pty Ltd, Canberra Visiting Professor in eCommerce, Uni. of Hong Kong;

in Cyberspace Law & Policy, UNSW; and in Computer Science, ANU

http://www.anu.edu.au/people/Roger.Clarke/EC/...... Collecter08 {.html, .ppt}

CollECTeR Iberoamerica – Madrid – 25-28 June 2008