To Örebro University

The credibility of research on information system security is challenged by inconsistent results and there is an ongoing discussion about research methodology and its effect on results within the employee non-/compliance to information security policies literature. We add to this discussion by investigating discrepancies between what we cl/aim to measure (theoretical properties of variables) and what we actually measure (respondents’ interpretations of our operationalized variables). The study asks: (1) How well do respondents’ interpretations of variables correspond to their theoretical definitions? (2) What are the characteristics and causes of any discrepancies between variable definitions and respondent interpretations? We report a pilot study including interviews with seven respondents to understand their interpretations of the variable Perceived severity from the Protection Motivation Theory (PMT).

We found that respondents’ interpretations differ substantially from the theoretical definitions which introduces error in measurement. There were not only individual differences in interpretations but also, and more importantly, systematic ones; When questions are not well specified, or do not cover respondents’ practice, respondents make interpretations based on their practice. Our results indicate three types of ambiguities, namely (i) Vagueness in part/s of the measurement item causing inconsistencies in interpretation between respondents, (ii) Envision/Interpret ‘new’ properties not related to the theory, (iii) ‘Misses the mark’ measurements whereby respondents misinterpret the fundamentals of the item. The qualitative method used proved conducive to understanding respondents’ thinking, which is a key to improving research instruments.

Purpose: Research on employee non-/compliance to information security policies suffers from inconsistent results and there is an ongoing discussion about the dominating survey research methodology and its potential effect on these results. This study aims to add to this discussion by investigating discrepancies between what the authors claim to measure (theoretical properties of variables) and what they actually measure (respondents' interpretations of the operationalized variables). This study asks: How well do respondents' interpretations of variables correspond to their theoretical definitions? What are the characteristics of any discrepancies between variable definitions and respondent interpretations?

Design/methodology/approach: This study is based on in-depth interviews with 17 respondents from the Swedish public sector to understand how they interpret questionnaire measurement items operationalizing the variables Perceived Severity from Protection Motivation Theory and Attitude from Theory of Planned Behavior.

Findings: The authors found that respondents' interpretations in many cases differ substantially from the theoretical definitions. Overall, the authors found four principal ways in which respondents interpreted measurement items - referred to as property contextualization, extension, alteration and oscillation - each implying more or less (dis)alignment with the intended theoretical properties of the two variables examined.

Originality/value: The qualitative method used proved vital to better understand respondents' interpretations which, in turn, is key for improving self-reporting measurement instruments. To the best of the authors' knowledge, this study is a first step toward understanding how precise and uniform definitions of variables' theoretical properties can be operationalized into effective measurement items.

Purpose – Employees' compliance with information security policies is considered an essential component of information security management. The research aims to illustrate the usefulness of social action theory (SAT) for management of information security.

Design/methodology/approach – This research was carried out as a longitudinal case study at a Swedish hospital. Data were collected using a combination of interviews, information security documents, and observations. Data were analysed using a combination of a value-based compliance model and the taxonomy laid out in SAT to determine user rationality.

Findings – The paper argues that management of information security and design of countermeasures should be based on an understanding of users' rationale covering both intentional and unintentional non-compliance. The findings are presented in propositions with practical and theoretical implications: P1. Employees' non-compliance is predominantly based on means-end calculations and based on a practical rationality, P2. An information security investigation of employees' rationality should not be based on an a priori assumption about user intent, P3. Information security management and choice of countermeasures should be based on an understanding of the use rationale, and P4. Countermeasures should target intentional as well as unintentional non-compliance.

Originality/value – This work is an extension of Hedström et al. arguing for the importance of addressing user rationale for successful management of information security. The presented propositions can form a basis for information security management, making the objectives underlying the study presented in Hedström et al. more clear

A business’s information is one of its most important assets, making the protection of information a strategic issue. In this paper, we investigate the tension between information security policies and information security practice through longitudinal case studies at two health care facilities. The management of information security is traditionally informed by a control-based compliance model, which assumes that human behavior needs to be controlled and regulated. We propose a different theoretical model: the value-based compliance model, assuming that multiple forms of rationality are employed in organizational actions at one time, causing potential value conflicts. This has strong strategic implications for the management of information security. We believe health care situations can be better managed using the assumptions of a value-based compliance model.

This paper addresses managers’ intentions to overlook their employees’ Information Security Policy (ISP) violation, in circumstances when on-going projects have to be completed and delivered even if ISP violation must take place to do so. The motivation is based on the concern that ISP violation can be influenced by escalation of commitment factors. Escalation is a phenomenon that explains how employees in organizations often get involved in nonperforming projects, commonly reflecting the tendency of persistence, when investments of resources have been initiated. We develop a theoretical understanding based on Escalation of Commitment theory that centres on two main factors of noncompliance, namely completion effect and sunk costs. We tested our theoretical concepts in a pilot study, based on qualitative and quantitative data received from 16 respondents from the IT – industry, each representing one respondent from the management level. The results show that while some managers are very strict about not accepting any form of ISP violation in their organization, their beliefs start to change when they realize that such form of violation may occur when their employees are closer to completion of a project. Our in-depth interviews with 3 respondents in the follow-up study, confirm the tension created between compliance with the ISP and the completion of the project. The results indicate that the larger the investments of time, efforts and money in a project, the more the managers consider that violation is acceptable

Today, public organisations need to share information in order to complete their tasks. Over the years, scholars have mapped out the social and organisational factors that affect the success or failure of these kinds of endeavours. However, few of the suggested models have sought to address the temporal aspect of inter-organisational information sharing. The aim of this paper is to investigate the reshaping of social and organisational factors of inter-organisational information sharing in the public sector over time. We analysed four years' worth of information sharing in an inter-organisational reference group on copper corrosion in the context of nuclear waste management. We could trace how factors in the model proposed by Yang and Maxwell (2011) were reshaped over time. Two factors in the model – concerns of information misuse and trust – are frequently assessed by organisations and are the most likely to change. In the long run we also found that legislation and policies can change.

Despite the importance of inter-organisational information sharing (IOIS) in the public sector, such endeavours often fail. Existing research has shown that the values held by collaborating organisations are one important factor affecting these kinds of initiatives. However, research has sought only to a limited extent to address how value conflicts come into play over time. Therefore, this paper aims to explore how conflicting values shape an inter-organisational information-sharing practice in the public sector over time. Using the local/global network framework, we analyse four years’ worth of information sharing in an inter-organisational advisory group in the context of Swedish nuclear waste management. We conclude that different value conflicts are emphasised to different extents at different points in time. That is, values do not uniformly affect IOIS activities, and such conflicts over time reduce the set of potential IOIS activities. We also conclude that when IOIS activities are driven by an individual organisation’s values, individual value rational activities may co-exist with a dysfunctional long-term IOIS practice.

In today's complex environments, safeguarding organizations’ information assets is difficult and requires more than solely technical skills. In order to meet the need for future information security specialists, in 2018 the Informatics department at Örebro University launched an International Master’s Program in Information Security Management. The program content was developed in collaboration with industry and governmental partners. One of the challenges with this co-design effort was to elicit the requirements of the courses in the program from a diverse set of actors. Also, an educational program has a finite number of teaching hours, which means that a limited number of requirements, or topics on information security, can be covered. Consequently, there was a need to prioritize between the elicited requirements and make the partners prioritize. To both these ends, we employed the Delphi method. In this chapter, we give an account of the process of eliciting and prioritizing course requirements using an adapted Delphi method. The adopted process included three iterations, for which workshops and surveys were used to collect the necessary data. The implementation has been far from instrumental, and in this chapter we discuss the details related to design choices made and the rationale behind these choices.

Although inter-organisational collaboration is common, most information security (IS) research has focused on IS issues within organisations. Confidentiality, integrity of data and availability (CIA) and responsibility, integrity of role, trust, and ethicality (RITE) are two sets of principles for managing IS that have been developed from an intra-organisational, rather static, perspective. The aim of this paper is thus to investigate the relation between the CIA and RITE principles in the context of an inter-organisational collaboration, i.e., collaboration between organisations. To this end we investigated inter-organisational collaboration and information sharing concerning Swedish cooper corrosion research in the field a long-term nuclear waste disposal. We found that in an inter-organisational context, responsibility, integrity of role and ethicality affected the CIA-principles, which in turn affected the collaborating actors’ trust in each other over time.

When end users have to prioritize between different rationalities in organisations there is a risk of non-compliance with information security policies. Thus, in order for information security managers to align information security with the organisations’ core work practices, they need to understand the competing rationalities. The Value-based compliance (VBC) analysis method has been suggested to this end, however it has proven to be complex and time-consuming. Computerized software may aid this type of analysis and make it more efficient and executable. The purpose of this paper is to elicit a set of requirements for computerized software that support analysis of competing rationalities in relation to end users’ compliance and non-compliance with information security policies. We employed a design science research approach, drawing on design knowledge on VBC and elicited 17 user stories. These requirements can direct future research efforts to develop computerized software in this area.

Purpose: The purpose of this paper is to survey existing inter-organisational information securityresearch to scrutinise the kind of knowledge that is currently available and the way in which thisknowledge has been brought about.

Design/methodology/approach: The results are based on a literature review of inter-organisational information security research published between 1990 and 2014.

Findings: The authors conclude that existing research has focused on a limited set of research topics.A majority of the research has focused management issues, while employees’/non-staffs’ actualinformation security work in inter-organisational settings is an understudied area. In addition, themajority of the studies have used a subjective/argumentative method, and few studies combinetheoretical work and empirical data.

Research limitations/implications: The findings suggest that future research should address abroader set of research topics, focusing especially on employees/non-staff and their use of processes andtechnology in inter-organisational settings, as well as on cultural aspects, which are lacking currently;focus more on theory generation or theory testing to increase the maturity of this sub-field; and use abroader set of research methods.

Practical implications: The authors conclude that existing research is to a large extent descriptive,philosophical or theoretical. Thus, it is difficult for practitioners to adopt existing research results, suchas governance frameworks, which have not been empirically validated.

Originality/value: Few systematic reviews have assessed the maturity of existinginter-organisational information security research. Findings of authors on research topics, maturity andresearch methods extend beyond the existing knowledge base, which allow for a critical discussionabout existing research in this sub-field of information security.

Objective: This study aims to assess the effects of patient-directed feedback from remote symptom, medication, and disease activity monitoring on patient empowerment and treatment in Parkinson’s disease (PD).

Background: There is a need to empower patients with PD to be able to understand better and control their disease using prescribed medication and following recommendations on lifestyle. The research project EMPARK will develop an Internet of Things system of sensors, mobile devices to deliver real-time, 24/7 patient symptom information with the primary goal to support PD patients empowerment and better understanding of their disease. The system will be deployed in patient homes to continuously measure movements, time-in-bed and drug delivery from a micro-dose levodopa system. Subjective symptom scoring, time of meals and physical activities will be reported by the patients via a smartphone application. Interfaces for patients and clinicians are being developed based on the user center design methodology to ensure maximal user acceptance. 

Methods: This is a randomized controlled trial where 30 PD patients from 2 university clinics in Sweden will be randomized to receive (intervention group) or not (control group) continuous feedback from the results of the EMPARK home monitoring for 2 weeks. Disease-specific (UPDRS, PDQ-39), Quality of Life (QoL) (modified EuroQoL EQ-5D) and empowerment questionnaires will be collected prior and after the intervention. The correlation of technology-based objective and patient-reported subjective parameters will be assessed in both groups. Interviews will be conducted with the clinicians and observations will be made about the patient-clinician interaction to assess the potential treatment benefits of the intervention.

Results: Preliminary results from workshops with patients and clinicians show potential to improve patient empowerment and disease control among patients. Completion of the trial will show the degree of patient empowerment, individualized treatment, and patientclinician interactions.

Conclusions: Raising patients’ awareness about disease activity and home medication is possible among PD patients by providing them with feedback from the results of a home monitoring system. This randomized, controlled trial aims to provide evidence that this approach leads to improved patient empowerment and treatment results.

In the last decades a large number and variety of prototyped and commercial IT solutions have been dedicated to older adults with the purpose to make their activities as meaningful and diverse as possible; and to establish the environment around them as comfortable as possible. However, in most cases the requirements for the tools are derived from user surveys or are just a result of some innovative ideas of researchers and practitioners. This might be one of the reasons why the spectrum of possible IT solutions is much larger than the spectrum of actually used solutions. In this paper we propose to view IT solu-tions that are developed for older adults in the context, which is represented as a socio-cyber-physical system. Enterprise modeling is proposed as a means for context representation and analysis.

Different IT solutions exist for supporting older adults. However, the ways in which these solutions are positioned usually concern only specific activities or specific problems. In this paper we analyze the current research state regarding activities of older adults, the contexts of their activities, and supportive IT solutions to create a background for further investigations regarding alignment of IT solutions and daily routines of older adults. The paper presents illustrative mapping between older adult activities and IT solution categories and derives therefrom some aspects that are to be taken into account for successful alignment between IT solutions and daily routines of older adults.

The inability to understand the social aspects in IS security is pointed out as one of the biggest and most difficult problems in the IS security area. By applying a value perspective on IS security this thesis contributes to increased understanding of social aspects in relation to IS security and peoples’ security behaviours. The thesis especially contributes to the discussion concerning reasons for the lack of compliance with IS security rules and policies.

The aim of the thesis is to create an understanding of the relationship between formal and informal aspects of IS security by understanding peoples’ behaviour and values in an organization. Formal aspects are related to routines, policies, and guidelines for how information should be handled, while informal aspects are related to people’s attitudes, values and behaviour. This thesis focuses on IS security values on formal and informal systems and also value conflicts between these two.

Formal and informal values as well as value conflicts were studied and exemplified in a case study in an academic environment at three different departments. The study resulted in a list of formal and informal IS security objectives important at the different departments and a number of IS security problems caused by value conflicts. Values related to formal aspects of IS security were different at the different departments, while values identified at the informal level were similar at the different departments and related to business values. Different IS security problems and different value conflicts were identified at the different departments. The conclusion from the case study is that values related to what should be achieved with IS security were similar on the formal and informal level while value conflicts appear in relation to how IS security is implemented. Most of the identified value conflicts that caused IS security problems were related to conflicts between formal values such as: control, standardization, planning emphasized by persons responsible for IS security and informal values such as freedom, creativity and flexibility emphasized by users. Value conflicts lead to different IS security problems and ultimately to insufficient IS security.

The main contributions from applying a value perspective in IS security are: a wider view of IS security objectives, a wider view of IS security problems and an understanding of the reasons for how problems might occur. Another aspect is the increased understanding of the rationalities behind implemented IS security strategies and IS security behaviours by identifying and analysing values and value conflicts in formal and informal systems.

Aim: The aim of this thesis is to design a method that supports analysis of different values that come into play in compliance and non compliance situations within information systems security (ISS). The thesis addresses the problem of lack of ISS compliance methods that support systematic analysis of compliant and non-compliant behaviours as well as the reasons for these behaviours. The problem is addressed by designing a method that supports analysis of different values that come into play in compliance and non compliance situations in ISS. The method is called Value Based Compliance method (VBC method).

Research questions: The main research question of the thesis is: How should a method for analysis of different values that come in play in compliance and non-compliance situations within ISS be designed? This research question is answered by answering three sub-questions: 1) What values and goals (perspective) should the VBC method realize? 2) What underpinning design principles should the VBC method build on? 3) How should the VBC method be constructed to realize the VBC perspective and to incorporate the design principles?

Research method: Design Science Research (DSR) was chosen as a research approach in this thesis. DSR prescribe how to carry on a design process of an artefact with preserved rigor and relevance. The approach is both useful in order to solve real life problems and theoretically ground suchproblems. The VBC method is informed by a number of kernel theories and based on current knowledge in ISS compliance literature. The method is also empirically tested in three different contexts, during six DSR cycles.

Contributions: The three main contributions from the thesis are: the VBC perspective, the design principles and the VBC method. The VBC perspective is in line with a social view on ISS’s role in organisation. This perspective is realized in the VBC method by analysing values and value conflicts that come in play in compliance and non-compliance situations. Thus this study contributes to the field of ISS by designing a method that realizes the social view on ISS’s role in an organisation. The five design principles for a VBC method is the second contribution. The design theory with the five empirically tested design principles may be the point of departure for development of other compliance methods focusing on analysis of values and value conflicts that come into play in relation to ISS compliance. The design principles contribute also to the ISS compliance field by 1) extending compliance analysis with consideration of the different rationalities (values and goals) 2) acknowledging the difference between rational and non-rational ISS actions and 3) emphasizing the importance of finding articulated as well as unarticulated ISS actions. Finally, the VBC method itself contributes to the ISS compliance research and practice by offering a formalized, theoretically and empirically grounded method for systematic analysis of compliance and non-compliance situations as well as rationalities that come into play in these situations.

One of the problems highlighted within the ara of IS security is difficulty to handle humans’ security behaviors and praticularly a problem of lack of compliance between these behaviours and prescribed IS security rules. This paper presents findings form a case study at a municipality’s social services in Sweden. The aim of this study was to understand why social workers do not follow IS security rules. The understanding was gained by studying values behind prescribed IS security rules and values behind security behaviors. The major reason for lack of compliance with IS security rules among social workers were value conflicts between professional values and IS security values. The new IS security requirements required a culture change and developing of new work routines for social workers.

Privacy is considered as a main concern in developing and implementing smart home systems for elderly care (SHSEC). Privacy-by-Design (PbD) can help to ensure privacy in such systems and can support the designers in taking the protection of the privacy into account during the development of such systems. In this paper, we investigate the suitability of the PbD principles (PbDPs) suggested by Cavoukian et al. [1] in the context of SHSEC. This research is conducted as a qualitative case study, where we highlight limitations of existing PbDPs in this context. Based on our findings, we suggest seven additional PbDPs which complement the existing PbDPs and adjust them in the context of SHSEC.

Security culture is considered as an important factor in overcoming the problem with employees’ lack of compliance with Information Security (IS) policies. Within one organization different subcultures might transcribe to different and sometimes even conflicting, values. In this paper we study such value conflicts and their implications on IS management and practice. Shein’s (1999) model of organizational culture is used as a tool supporting analysis of our empirical data. We found that value conflicts exists between different security cultures within the same organization and that users anchor their values related to IS in their professional values. Thus our empirical results highlight value conflicts as an important factor to take into account when security culture is developed in an organization. Moreover, we found Shein’s model as a useful tool for analysis of value conflicts between different subcultures in an organization.

Although privacy is considered as a main concern in developing and implementing smart home systems for elderly care (SHSEC), the concept of privacy in this context is unclear and there is a lack of tools supporting the analysis of privacy in this context. Moreover most of existing project aiming at development and implementation of SHSEC have a narrow technical focus ignoring the complex social and organizational context in which the technologies are used. In this paper we propose Actor Network Theory (ANT) as a suitable analytical tool for analyzing privacy in the context of SHSEC. The suitability will be illustrated through a case study. The paper also contributes to a better understanding of the socio-technical nature of privacy in this particular context where many different actors are involved and technology is an integrated part of the elderly’s life and home. As we will show, ANT can help us to understand how the privacy requirements are negotiated during the design process, which actors are involved, what their interests and preferences are regarding privacy and which actors clearly outweighed the others.

In this paper we present a process of identifying individual and organizational values within an academic environment. These values have been identified by using Value Sensitive Approach (VSA) in the area of Information System Security (ISS). VSA is a methodological framework for identifying organizational and individual values. We believe that ISS objectives and ISS strategy suitable for each specific type of organization can be decided by eliciting these values. The study resulted in a number of value areas related to university general issues (UGV) and ISS issues important within an academic environment. The UGV and the ISS values can be further analyzed and transformed into ISS objectives suitable within an academic environment. Furthermore the identified values should be considered when ISS strategy to achieve those objectives is decided. Results presented in this paper will contribute to the ongoing research efforts to view security problems from a more holistic, socio-organizational perspective

Welfare technology (WT) is often developed with a technical perspective, which does not involve important ethical considerations and different values that come up during the development and implementation of WT within elderly care. This paper presents a study where we have applied an ethical value matrix to support systematic ethical assessments of WT intended for personal health monitoring. The matrix consists of values in a checklist and a number of stakeholders and it is possible to analyze which values are emphasized by which stakeholders. The aim was to assess the matrix and find out how the matrix supports identification of values and interests that drive the various stakeholders in the development and implementation of WT. We have realized that several values specified by different actors as especially important were not included in the matrix and that the values in the matrix did not visualize or enable identification of value conflicts.

Existing research shows that the Information Systems Security policies' (ISSPs) inability to reflect current practice is a perennial problem resulting in users' non-compliant behaviors. While the existing compliance approaches are beneficial in many ways, they do not consider the complexity of Information Systems Security (ISS) management and practice where different actors adhere to different and sometimes conflicting values. The unsolved value conflicts often lead to unworkable ISS processes and users' resistance. To address this shortcoming, this paper suggests a value conflicts analysis as a starting point for implementing work-friendly ISSPs. We show that the design and implementation of a work-friendly ISSP should involve the negotiation for different values held by the different actors within an organization.

This paper analyzes power relationships and the resulting failure in complying with information security rules. We argue that inability to understand the intricate power relationships in the design and implementation of information security rules leads to a lack of compliance with the intended policy. We conduct the argument through an empirical, qualitative case study set in a Swedish Social Services organization. Our findings suggest a relationship between dimensions of power and information security rules and the impact there might be on compliance behavior. This also helps to improve configuration of security rules through proactive information security management.

This paper analyzes power relationships and the resulting failure in complying with information security rules. It argues that an inability to understand the intricate power relationships in the design and implementation of information security rules leads to a lack of compliance with the intended policy. The argument is conducted through an empirical, qualitative case study set in a Swedish Social Services organization. Our findings indicate that various dimensions of power and how these relate to information security rules ensure adequate compliance. This also helps to improve configuration of security rules through proactive information security management.

One of the problems highlighted within the area of information security is that internatonal standards are implemented in organisations without adopting them to special organisational settings. This paper presents findings of information security goals found in policies, guidelines, and routines at a Swedish hospital. The purpose of the paper is to analyze the information security goals and relate them to confidentiality, integrity and availability (CIA) that are traditional objectives for managing information security in organisations. A critical view on the CIA-triad has been taken in the study, to see how it is related to a hospital setting. Seven main information security goals and 63 sub-goals supporting the main goals were identified. We found that the CIA-triad covers three of these main-goals. Confidentiality and integrity, however, have a broader definition in the hospital-setting than the traditional definitions. In addition, we found four main information security goals that the CIA-triad fails to cover. These are ‘Follow information security laws, rules and standards,’ ‘Traceability,’ ‘Standardized formation’ and ‘Informed patients and/or family.’ These findings shows that there is a need to adopt the traditional information security objective to special organisational settings.

Employees’ poor compliance with information security policies is a perennial problem. Current information security analysis methods do not allow information security managers to capture the rationalities behind employees’ compliance and non-compliance. To address this shortcoming, this design science research paper suggests: (a) a Value-Based Compliance analysis method and (b) a set of design principles for methods that analyse different rationalities for information security. Our empirical demonstration shows that the method supports a systematic analysis of why employees comply/do not comply with policies. Thus we provide managers with a tool to make them more knowledgeable about employees’ information security behaviours. 

Today, simple analogue assistive technologies are transformed into complex and sophisticated sensor networks. This raises many new privacy issues that need to be considered. In this paper, we investigate how this new generation of assistive technology incorporates Privacy by Design (PbD) principles. The research is conducted as a case study where we use PbD principles as an analytical lens to investigate the design of the new generation of digitalized assistive technology as well as the users’ privacy preferences that arise in use of this technology in real homes. Based on the findings from the case study, we present guidelines for building in privacy in new generations of assistive technologies and in this way protect the privacy of the people using these technologies.

Although new monitoring technologies (MT) supporting aging in place are continuously developed and introduced on the market, attempts to implement these technologies as an integrated part of elderly care often fail. According to the literature, the reason for that may be the prevailing technical focus applied during development and implementation of monitoring technologies in real settings. The aim of this paper was to investigate the socio-technical challenges that arise during implementation of monitoring technologies in elderly care. We used a qualitative case study and semi-structured interviews to investigate socio-technical (S/T) challenges in implementation of monitoring technologies generally and social alarms especially. Based on our findings we suggest a framework for classification of S/T challenges arising during implementation of monitoring technologies in elderly care and in this way this paper contributes to a better understanding of these challenges.

Welfare technology (WT) is often developed with a technical perspective, and little consideration is taken regarding the involvement of important ethical considerations and different values that come up during the development and implementation of WT. Safety, security and privacy are significant, as well as the usability and overall benefit of the tool, but to date assessments often lack a holistic picture of the WT as seen by the users. This paper suggests a user-centered ethical assessment (UCEA) framework for WT to be able to evaluate ethical consequences as a part of the user-centered aspects. Building on established methodologies from research on ethical considerations, as well as the research domain of human-computer interaction, this assessment framework joins knowledge of ethical consequences with aspects affecting the “digitalization with the individual in the center”, e.g. privacy, safety, well-being, dignity, empowerment and usability. The framework was applied during development of an interface for providing symptom information to Parkinson patients. The results showed that the UCEA framework directs the attention to values emphasized by the patients. Thus, functionality of the system was evaluated in the light of values and expected results of the patients, thereby facilitating follow-up of a user-centered assessment. The framework may be further developed and tested, but in this study it served as a working tool for assessing ethical consequences of WT as a part of user-centered aspects.

ICT-supported governmental elderly care services are often introduced in an ad-hoc, technology-driven manner, which results in a low level of acceptance by seniors. The current paper aims to address this shortcoming by applying a Value-focused thinking (VFT) approach to investigate value-based objectives of older adults. The presented solution is based on the interviews with seniors (65-85) in Poland and Sweden, two countries with very diverse approaches to governmental elderly care services. The designed research approach includes the analysis of the data gathered following the VFT approach, comparison of findings across the two countries, definition of fundamental and means objectives of seniors, and formulation of recommendations regarding strategies for the implementation of governmental elderly care services. The preliminary findings suggest that using VFT is promising in the identification of value-based objectives that can be included in policies guiding ICT-supported elderly care services.