Loneliness, life satisfaction, problematic internet use and security behaviours: re-examining the relationships when working from home during COVID-19

ABSTRACT

Working remotely from home within lockdown conditions can have implications on wellbeing and how people perceive and interact with technology to coordinate, communicate and collaborate with others. Previous research has shown relationships amongst life satisfaction, loneliness and problematic internet use and, also, between the latter and cyber security behaviours. We re-examine these relationships during the UK COVID-19 lockdown through an online survey completed by 299 participants working from home. The survey included demographics and work conditions questions and also the Satisfaction With Life Scale (SWLS), UCLA-3 Loneliness Scale, Problematic Internet Use Questionnaire-Short Form-6 (PIUQ-SF-6), and Security Behavior Intentions Scale (SeBIS). Structural equation modelling revealed that most notably, loneliness positively predicted problematic internet use, life satisfaction negatively predicted problematic internet use and that problematic internet use negatively predicted cyber security behaviours Implications includes educational and therapeutic interventions which could be applied by employers/governing bodies to target those at risk of loneliness and problematic internet use with the hope of mitigating these experiences and improving cyber security behaviours. The current findings may be especially relevant should waves of COVID-19 or similar crisis are experienced, and when working from home becomes a norm for some organisations and jobs.

KEYWORDS:

• Security behaviours
• problematic internet use
• loneliness
• life satisfaction
• working from home
• COVID-19 pandemic

1. Introduction

Following the declaration of COVID-19 as a worldwide pandemic in March 2020 (World Health Organization 2020), the number of online scams spiked by 400% resulting in COVID-19 being classed as the largest-ever cyber security threat (Panda Security 2020). Email phishing attacks were identified as the most common data breaches while working from home (WFH), with healthcare and financial industries being the most heavily targeted. The targeting of healthcare in attacks as well as scam sales of counterfeit personal protective equipment (FBI National Press Office 2020) could be devastating to public health by creating a false sense of security while facilitating further transmission of the virus, putting many lives at risk. The financial consequences are also severe; in the UK alone 2000 people have lost over £11.3 million due to COVID-related scams such as fake online sales, with nearly 14,000 COVID-related phishing emails being reported (Action Fraud 2020). More worryingly, Europol also identified a rise in child sexual exploitation such as an increased volume of new posts on online forums regarding interest in trading child sexual exploitation material (CSEM) as well as anticipation of grooming opportunities due to children being home more with possibly less internet supervision (Europol 2020). They emphasise that adults WFH are less able to effectively supervise their children, who are themselves not going to schools, and are also more vulnerable to phishing attempts which could compromise their personal information and be extorted against them and their children.

While technical factors have contributed to the increased prevalence of cyber-crimes during COVID such as insecure remote access to corporate networks (Ahmad 2020), many of the scams appear to utilise social engineering techniques and focus on the human factor, targeting users’ online security behaviours (Lallie et al. 2021). For example, many of the phishing attacks appear to take advantage of misinformation spread online such as fraudulent COVID-19 maps which deliver malware and emails claiming to be fines for leaving the home more times than necessary, thereby weaponizing people’s fears surrounding the pandemic (Forrest 2020). In traditional office settings, secure networks might prevent malicious emails from reaching employees, however for individuals WFH using insecure personal networks and devices (Morphisec 2020) without adequate preparation, the risk of these threats is amplified. There are also reports of employees actively engaging in riskier online behaviours – the 2020 Tessian Report found that while 91% of IT leaders trust their staff to follow best security practices when WFH, 52% of employees believe they can get away with riskier behaviour when working from home with 48% citing not being watched by IT as a reason for not following safe data practices (Sadler 2020). Therefore our research will aim to explore the human factors associated with individuals’ online security behaviours which place them at risk of falling for the scams that have been witnessed so far during the pandemic. In order to achieve this, we will first examine literature published since COVID-19 to identify the impacts of lockdown. We will then examine pre-COVID literature to explore psycho-social factors with established relationships to security behaviours, focusing on factors identified as relevant to lockdown. From here, we will create a statistical model to examine whether these relationships still hold during the pandemic under lockdown conditions. The continual insights could be used to provide guidance for possible mitigation suggestions for new waves of COVID-19, or even for similar future crises.

2. Background

The UK has been one of the countries most affected by COVID-19 both in terms of number of cases and secondary effects such as lockdown, having implemented one of the largest and most restrictive mass quarantines (Duddu 2020; British Broadcasting Corporation 2020). According to the Office for National Statistics (Office for National Statistics 2020a), nearly half of people in employment WFH during the early stages of lockdown with 86% of these people stating that this was a consequence of the pandemic. While employees who shifted to WFH may not have experienced the same financial insecurity as those who were dismissed or furloughed, changes to the working environment have been investigated with other negative impacts being documented. Several studies found that those WFH commonly reported challenges linked to communication and collaboration with colleagues through technology, lack of social contact, increased stress, burnout and difficulties with work-life balance (Hayes et al. 2020; Chung et al. 2020; Rubin et al. 2020). It is important to note that while there has been a shift towards WFH during the last decade (Felstead and Henseke 2017; Hern 2020), the pandemic has acted as a catalyst with the practice increasing out of necessity rather than choice and often without enough training and preparation.

With regards to factors such as work-life balance, experiences related to wellbeing such as stress and difficulties balancing work and family may be due to the need for working parents to arrange for alternative child-care and facilitate in home schooling, rather than the experience of WFH itself. This is supported by findings that increased stress was more severe among those who did not have the flexibility to WFH pre-pandemic (Hayes et al. 2020). Our research is exploring similar wellbeing-related experiences happening specifically due to COVID-19 lockdown where people are also experiencing other conditions such as having to do home schooling and observe physical and social distancing. In addition, implications on precautionary requirements and countermeasures when WFH is an obligation are different from it when WFH is a choice typically taken after proper training and assurance procedure and when occasional in-person meeting with colleagues and technical support department is enabled and required.

In the context of our research, these changes to employment due to the pandemic feed into negative mental health issues experienced during lockdown and highlight the relevance of social isolation. Evidence suggests that mental health issues in the UK have worsened by 8.1% on average since the beginning of the pandemic, mainly driven by social isolation with 7.4 million (nearly a third of those asked) reporting that their wellbeing was affected by loneliness during the first month of lockdown, a finding especially prevalent among working-age adults (Banks and Xu 2020; Marshall, Bibby, and Abbs 2020; Office for National Statistics 2020b). Additionally, there has been a reported decrease in life satisfaction among the working population due to increased distress levels and lowered job performance induced by the pandemic (Kumar et al. 2021).

As well as impacting wellbeing, the pandemic has also affected people’s behaviours. Several findings suggesting that during lockdown people have spent significantly more time using technology and social media, with an increase in both the prevalence and severity of addictive internet use (Garfin 2020; Cellini et al. 2020; Li et al. 2020). Research from previous pandemics and crises suggest that people seek out additional information to ease the anxiety caused by highly uncertain situations (Center for Disease Control and Prevention 2019). While social media platforms are increasingly becoming a source of information (David, San Pascual, and Torres 2019), the most unregulated and often health-related spreading of misinformation and fake news can make reliance on them problematic (Allington et al. 2020; Chou, Oh, and Klein 2018).

3. Methodology

In this section we discuss the foundations which led to formulating our hypotheses and our study design.

3.1. Theoretical underpinnings

Much of the recent literature has examined the pandemic’s influence on cyber-crime and people’s experiences during lockdown. However, exploration of literature from pre-COVID times is also necessary to provide a theoretically informed understanding of the factors associated with risky online behaviours relating to cybersecurity threats while working from home.

Considering the presence of misinformation, social engineering and the amplified role of social media during the pandemic, findings relating to internet addiction, also referred to as problematic internet use (PIU), are especially relevant. PIU is a heterogeneous construct and while there is still no agreed upon definition, the literature describes PIU as a condition involving excessive or poorly controlled urges and behaviours relating to Internet use that cause subjective distress and difficulties in managing one’s offline life (Moretta and Buodo 2020; Caplan 2005). PIU has been operationalised to include various constructs such as obsession, neglect and control disorder as well as salience, withdrawal, mood modification, and conflict (Demetrovics et al. 2016; Meerkerk et al. 2009). Cyber security behaviour (CSB) has been conceptualised to include factors such as password generation, proactive awareness, updating and device securement (Egelman and Peer 2015). One could argue that PIU is embodied by impulsive and irremissible urges which inherently contrast to the conscientious aspects of CSB. While previous literature has identified PIU to be linked to internet abuse in the workplace (Griffiths 2010; Greenfield and Davis 2002), recent findings explicitly looking at the relationship between PIU and cyber security found PIU to positively predict risky CSB (Hadlington 2017; Hadlington and Parsons 2017; Aivazpour and Rao 2018). While there are currently no theoretical frameworks associated with CSB specifically which may explain this relationship, we can instead draw from theories related to addictive and risky behaviour in general such as Jessor and Jessor’s Problem-Behavior Theory (Jessor and Jessor 1977; De Leo and Wulfert 2013). This theory posits that all behaviour is a result of person-environment interactions, and proneness to addictive behaviours is supported by a person’s perceived social environment where engaging in one problem behaviour increases the likelihood of engaging in other problem behaviours. When applying this theory to PIU and CSB, one could argue that if an individual engages in problematic behaviours such as neglecting their basic needs in favour of internet use (one aspect of PIU Demetrovics et al. 2016) then they may also be likely to engage in behaviours such as leaving their computer unlocked when they leave it unattended. While there is little research exploring how PIU can affect CSB in the workplace, our research hopes to apply this theory to expand the literature base of CSB in the context of work-related behaviours and WFH during the pandemic.

Research in both PIU and CSB explored the effects of individual differences in personality traits present consistent findings. For example, individuals high in extraversion and impulsivity are found to demonstrate higher PIU, poorer information security awareness and increased susceptibility to social engineering (Shinkins 2016; McBride, Carter, and Warkentin 2012; Alotaibi 2019; Uebelacker and Quiel 2014; Coutlee et al. 2014). However, while these findings are well-supported and reinforce the relevance of PIU in CSB, factors such as personality traits are relatively static and therefore not as relevant to the situational context of lockdown in which factors which are more dynamic in nature are more applicable to our research question.

Further investigation into PIU suggests that people tend to use social media more when they have less opportunity for physical/ face-to-face social contact, and this compulsive digital media use can negatively affect work performance (Benson, Hand, and Hartshorne 2019). Research exploring the relationship between PIU and psycho-social wellbeing identified loneliness and low life satisfaction to be significantly associated (Shinkins 2016; Dhir, Chen, and Nieminen 2015; Çelik and Odacı 2013; Kim, LaRose, and Peng 2009). Life satisfaction can be described as a ‘cognitive, global appraisal that people make when considering their contentment with life as a whole or in regard to specific domains of life such as family, environment, friends, and self’ (Suldo and Huebner 2004). One possible explanation for the association between life satisfaction and PIU could be that when individuals feel less satisfied with their lives they may turn to the internet as a form of escapism in order to gratify their social and psychological needs which are not being fulfilled, such as self-expression and entertainment (Ohno 2016; Foroughi et al. 2019). This is consistent with Baumeister’s Self-Escape Theory, which suggests that when individuals perceive a discrepancy between their current situation and their expectations, they seek to escape from the self to eliminate these negative emotions (Baumeister 1990). This idea is also consistent with the Needs-Affordances-Features Model of Technology Use which posits that individuals’ psychological needs motivate their use of technology (Karahanna et al. 2018). Loneliness has been defined as ‘the unwelcome feeling of lack or loss of companionship, the negative, unpleasant aspects of missing certain relationships as well as missing a certain level of quality in one’s relationships’ (de Jong Gierveld 1998). The relationship between loneliness and PIU could possibly be explained by Baumeister and Leary’s Belongingness Theory which suggests that people are motivated to establish social connections with others to fulfil their need for belonging (Baumeister and Leary 1995). In the context of PIU, when individuals cannot meet their need to communicate with others and build social connections face-to-face, they may feel withdrawn from society and instead turn to the internet to fulfil this need (Ayas and Horzum 2013). While all of these theories have been tested in relation to social media addiction, our research will contribute to these findings by applying them to the overall PIU (Sun and Zhang 2020; Walburg, Mialhes, and Moncla 2016; Gao, Liu, and Li 2017). These theories are consistent with the research during the pandemic as many people reported negative effects on their wellbeing due to feeling lonely during lockdown (Office for National Statistics 2020a); given that people have less options to connect, might they seek connection via the resources available to them i.e. the internet and social media? Furthermore, there is evidence to suggest that since COVID-19, many people are overall less satisfied with their life, with those WFH slightly worse off than those working in their office but better off than those who stopped working entirely (Zhang et al. 2020).

Given the consistency of the evidence suggesting loneliness and life satisfaction are associated with PIU, and their relevance to the lockdown context, we will explore these factors in the current study. Other studies discovered similar results with loneliness showing a positive correlation with problematic internet use and digital addiction as well as low self-control, theorising that individuals with low self-control may compulsively use the internet to escape negative feelings (Özdemir, Kuzucu, and Ak 2014; Mahapatra 2019). As low self-control is an aspect of impulsivity, these findings further support Hadlington’s (Hadlington 2017; Hadlington and Parsons 2017), although it remains questionable whether impulsivity is relevant to the different forms of digital usage, for example social media for leisure versus email and other online collaborative work platforms. Additionally, due to the missed usage of both experienced when people work from home in flexible hours, such investigation is even more needed to see whether the impact still applies and whether it applies to the same degree.

3.2. Hypotheses

Much of the initial literature regarding COVID-19 appeared to focus on a few factors surrounding people’s experiences of coping during the pandemic, and due to the unpredicted nature of the pandemic many sources were from news articles and the government. However, as the pandemic has progressed, so has the volume of academic literature. Conversely, while the literature regarding cyber security may be more established, findings were typically from pre-pandemic times and so were examining factors under ‘normal’ conditions. Therefore the current research aims to bridge this gap by re-examining these factors during COVID-19 to determine whether the relationships are still relevant in the context of WFH during lockdown. Through examining the literature we have identified the relationships between PIU and CSB, and furthermore loneliness and life satisfaction with PIU to be the most relevant to our research question. While we recognised the importance of other factors such as personality traits and their association with PIU and CSB, these were deemed less relevant to the context in which our study was conducted. Conversely, loneliness and life satisfaction strongly relate to the changes brought by lockdown and so comparing their relationship with PIU and CSB fit more appropriately to our research aims. Based on the literature reviewed and the new range of constraints and behaviours regarding digital usage and CSB, the current study will investigate the following hypotheses with regards to people working from home during lockdown period, summarised visually in the operational model presented in Figure 1:

H1: Life satisfaction is negatively associated with problematic internet use.

H2: Loneliness is positively associated with problematic internet use.

H3: Problematic internet use is negatively associated with cyber security behaviour.

Figure 1. The operational model.

3.3. Participants

Two hundred and ninety-nine adults WFH in the UK were recruited via an established purpose-built online crowdsourcing platform, Prolific (https://www.prolific.co/). The participants completed the survey online and received £1.50 reimbursement for their participation. Participant ages ranged from 18 to 69 years (μ 33.00, σ 0.48) and the sample comprised of 183 females (61.20%) and 116 males (38.80%). This study went through the ethics approval process of Bournemouth University. Data were collected during July 2020 while the UK was still in lockdown with many people still WFH, although restrictions had begun to ease. The demographics of the participants are shown in Table 1.

Table 1. Demographics of the participants.

(N = 299)	Frequency	Percent
Gender
Female	183	61.2
Male	116	38.8
Age (years)
18–24	38	12.7
25–29	78	26.1
30–34	65	21.7
35–39	59	19.7
40–44	29	9.7
45–49	19	6.4
50+	11	3.7
Education
No formal education	2	0.7
GCSEs or equivalent	14	4.7
A-Levels or equivalent	58	19.4
Bachelor's degree	142	47.5
Master's degree	61	20.4
PhD	17	5.7
Vocational programme	4	1.3
Prefer not to say	1	0.3
WFH before lockdown
Rarely, less than one day a week	205	68.6
Sometimes, 1 or more days a week	94	31.4
Device shared
Yes	23	7.7
No	276	92.3
Device use
Just work	66	22.1
Work and personal	233	77.9
Number of devices used
1	189	63.2
2	77	25.8
3	25	8.4
4	8	2.7

3.4. Measures

The scales used were presented nearly verbatim from the original sources, with the introductory statements changed to instruct participants to answer them based on their experiences during the COVID-19 lockdown. Details of how each scale was measured and scored can be seen in Table 2. The scales were chosen as they were used in previous relevant studies that we used as theoretical underpinnings and for comparison, e.g. in (Hadlington 2017; Hadlington and Parsons 2017; Shinkins 2016; Dhir, Chen, and Nieminen 2015).

Table 2. Measurement and scoring of each scale.

Measures	Scales	Scoring
Life satisfaction	7-point Likert: 1 = Strongly disagree, 7 = Strongly agree	Range of scores: 5–35. 20 = neutral point. 5–9 = extremely dissatisfied with life, 31–35 = extremely satisfied
Loneliness	3-point ordinal: 1 = Hardly ever, 3 = Often	Range of scores: 3–9. Higher scores indicate higher loneliness, > 6 = lonely
Problematic internet use	5-point ordinal: 1 = Never, 5 = Always/ almost always	Range of scores: 5–30. Higher scores indicate higher PIU, > 15 = problematic
Cyber security behaviours	5-point ordinal: 1 = Never, 5 = Always	Four final scores created from each subscale. Number of items in each subscale varies therefore score ranges different for each subscale, but higher scores indicate increased CSB

Life satisfaction: The Life Satisfaction first-order construct consists of five items, based on the Satisfaction With Life Scale (SWLS) (Diener et al. 1985). Items include: ‘In most ways my life is close to my ideal’, ‘The conditions of my life are excellent’, ‘I am satisfied with my life’, ‘So far I have gotten the important things I want in life’ and ‘If I could live my life over, I would change almost nothing’. This scale was chosen due to its brevity and well-established reliability (α = 0.87).

Loneliness: The Loneliness first-order construct consists of three items, based on the UCLA-3 Item Loneliness Scale (UCLA-3) (Hughes et al. 2004). Sample items include: ‘How often do you feel that you lack companionship?’, ‘How often do you feel left out?’ and ‘How often do you feel isolated from others?’. Like the SWLS, this scale was chosen as it has been rigorously tested and found to be robust (α = 0.72), and is concise.

Problematic internet use: The Problematic Internet Use, based on Questionnaire Short-Form (PIUQ-SF-6) (Demetrovics et al. 2016), is a second-order construct consisted of six items, allocated between the following three subscales: obsession (i.e. obsessive thinking about the Internet and mental withdrawal symptoms caused by the lack of Internet use; Cronbach α = 0.76), neglect (i.e. neglect of basic needs and everyday activities; α = 0.59) and control disorder (i.e. difficulties in controlling Internet use; α = 0.82).

Cyber security behaviours: This is a second-order construct based on the Security Behavior Intentions Scale (SeBIS) (Egelman and Peer 2015). The corresponding scale was chosen due to its target demographic of end-users which was suitable for the current sample of participants WFH. This construct consisted of 16 items, allocated between four subscales: device securement (e.g. locking a desktop screen when stepping away; α = 0.801), password generation (e.g. creating strong passwords, changing passwords; α = 0.764), proactive awareness (e.g. checking links before clicking them; α = 0.668) and updating behaviours (e.g. applying software updates in a timely manner; α = 0.719).

Other: As well as basic demographic questions, items related to WFH environments were included such as ‘What device have you been using to carry out work? Please tick all that apply’. Participants were also asked one open-ended qualitative question, ‘How has the COVID-19 lockdown affected your work activities? Please write a short description’. The purpose of this question was to acquire richer insight into individuals’ experiences of WFH and potentially identify common themes relevant to CSB. Further demographic information was collected outside of the survey via pre-screening filters and existing data stored by Prolific; these included questions regarding employment status, student status, country of residence and how many days spent WFH.

3.5. Consistency of the survey

Content validity of the constructs is accepted, considering that the sources stated previously are well-accepted for operationalising these constructs. Table 3 presents the means, the standard deviations, and the Cronbach alphas for all constructs. Additionally, this table presents the average variance extracted (AVE) for each construct, obtained by applying confirmatory factor analysis (CFA), and the bivariate correlation coefficients between all constructs used in the study. Taking into consideration that all Cronbach alphas are much higher than 0.70 (except that for the cyber security behaviours construct which is just less than 0.70), construct internal consistency is supported (Nunnally 1994). Construct validity is also supported because the scores of AVE for all constructs are higher than 0.50. Taking into consideration that the square root of each factor’s AVE is larger than its correlations with other factors, construct discriminant validity is also supported (Hair et al. 2010).

Table 3. Data properties.

Constructs	Means (standard deviations)	Cronbach alphas	Correlation coefficients
			Life satisfaction	Loneliness	Problematic internet use	Cyber security behaviours
Life satisfaction	4.22 (1.27)	0.867	[0.663]
Loneliness	1.81 (0.63)	0.822	−0.439**	[0.739]
Problematic internet use	2.28 (0.74)	0.812	−0.189**	0.307**	[0.727]
Cyber security behaviours	3.55 (0.53)	0.668	0.069	−0.069	−0.172**	[0.502]

Notes: **Correlations are significant at 0.01 level (2-tailed).

Figures in brackets indicate Average Variance Extracted (AVE).

3.6. Analysis

The current study undertook a predominantly quantitative approach with structural equation modelling (SEM) via AMOS-SPSS. The overall model fit was assessed by examining multiple indices because it is possible for a model to be adequate on one fit index but inadequate on many others (Bollen 1989). The fit indices employed are the following: Chi-square test (with critical significant level p > 0.05); the normed-Chi-square ratio (with critical level no more than 3); the goodness of fit index – GFI (with critical level not lower than 0.80); the normed fit index – NFI (with critical level not lower than 0.90); the comparative fit index – CFI (with critical level not lower than 0.90); the root mean squared residuals – RMR (with critical level not more than 0.10); and the root mean squared error of approximation – RMSEA (with critical level not more than 0.08) (Hu and Bentler 1999).

4. Results

4.1. The measurement model

We see in Table 3 that the correlation coefficient between life satisfaction and problematic internet use is significantly negative (r = −0.189), between loneliness and problematic internet use is significantly positive (r = 0.307), and between problematic internet use and cyber security behaviours is significantly negative (r = −0.172), supporting accordingly the hypotheses of the study. However, results based on correlation coefficients, even though they are interesting, may be confusing due to the exchanges between several variables. As a result, in order to isolate the possible links between the constructs involved in the operational model presented in Figure 1, we proceeded in estimating and examining the measurement and structural models.

By applying CFA to the measurement model that is constituted by the four constructs included in Figure 1, the fit indices (Chi-Square = 150.896, df = 84, p = 0.000, Normed-Chi-Square = 1.796, GFI = 0.935, CFI = 0.961, NFI = 0.916, RMR = 0.057, RMSEA = 0.052) indicated acceptable fit. By applying CFA to a model with all items loading on a single factor, the fit indices (Chi-Square = 842.636, df = 90, p = 0.000, Normed-Chi-Square = 9.363, GFI = 0.694, CFI = 0.557, NFI = 0.532, RMR = 0.105, RMSEA = 0.168) found to fit worse than the hypothesised model, supporting therefore the constructs of the measurement model. Further, comparing the results of the measurement model and the single factor model (i.e. ratio = ΔChi-square/Δdf = 691.74/6 = 115.29), we conclude that the constructs used in the study are distinct and that common method bias is limited because the ratio = 115.29 is much larger that the critical value of 3.84 per degree of freedom (Brown 2015).

4.2. The structural model

Applying SEM for estimating the operational model presented in Figure 1, the fit indices produced (Chi-Square = 219.005, df = 111, p = 0.000, Normed-Chi-Square = 1.974, GFI = 0.920, CFI = 0.938, NFI = 0.883, RMR = 0.127, RMSEA = 0.057) indicated a very good fit. As a result, the estimated operational model presented in Figure 2 is acceptable. It must be noted here that from the control variables used in estimation, Figure 2 includes estimation results with respect to age and number of devices only, because the estimated coefficients of all the other control variables were not significant. All figures that appear in Figure 2 refer to standardised coefficients. The significant levels of the structural coefficients are shown in Figure 2, whilst all the rest estimated coefficients are significant at level p = 0.001.

Figure 2 .#The estimated operational model.

4.3. Testing of hypotheses

From the results in Figure 2, we see that life satisfaction is negatively (β = −0.12, p < 0.05) associated with problematic internet use, supporting hypothesis 1; loneliness is positively (β = 0.28, p < 0.001) associated with problematic internet use, supporting hypothesis 2; and problematic internet use is negatively (β = −0.22, p < 0.001) associated with cyber security behaviour, supporting hypothesis 3. Taking into consideration that there is no direct significant link between life satisfaction and cyber security behaviour and between loneliness and cyber security behaviour, it is concluded that problematic internet use fully mediates the relationships between life satisfaction and loneliness, and cyber security behaviour.

With respect to the controls, considering the negative standardised coefficient of age (β = −0.13, p < 0.05) in association with loneliness, it is supported that older individuals may feel less lonely, and further, considering the negative standardised coefficient of age (β = −0.18, p < 0.01) in association with problematic internet use, is supported that older individuals may make less problematic internet use. Considering the positive standardised coefficient of number of devices (β = 0.14, p < 0.01), it is supported that the more devices individuals use, the higher their cyber security behaviour is.

4.4. Qualitative analysis

Qualitative analysis was carried out on the 299 text-based answers to the open-ended question ‘How has the COVID-19 lockdown affected your work activities? Please write a short description’. This was achieved by first examining the comments for keywords that appeared frequently, then by searching these terms and their synonymous to count how many times they were mentioned in order to identify the most common themes and patterns. Each theme was examined to gain a deeper understanding of participants’ perceptions and experiences whilst WFH during lockdown.

Table

Theme	Elaboration
Distractions	Many participants reported feeling more distracted whilst WFH for various reasons such as browsing on the internet, children and/or other people in the house, and uncomfortable workspaces. Distraction and fatigue can increase biases, potentially resulting in neglecting security measures (Berg et al. 2017).• ‘I often browse the Internet instead of doing work’.• ‘I find it hard to get into “work mode” from home. I struggle to concentrate at home for long periods of time. … Having a child at home and not at school was also a big problem as he will distract me all the time.’However, some participants also reported experiencing less social distractions than at their offices.
Productivity	While several participants mentioned productivity, the direction in which they felt it had changed was relatively even split. Many reported experiencing increased productivity due to flexible hours and reduced commuting time, while others reported decreased productivity due to factors such as reduced motivation, worsened mental health and disrupted work-life balance. Arguably, such factors can also relate to neglecting privacy and security measures, which are part of working thoroughly. Lack of motivation is associated with neglect of safety measures in general (Herath and Rao 2009).• ‘The COVID-19 pandemic and lockdown have had a strong negative impact on my mental health. This, in turn, has negatively affected my productivity.’• ‘I am less productive but spending more time on the computer’
Communication	Many participants reported that the biggest change to their job since WFH was moving to virtual platforms such as Zoom and Microsoft Teams to substitute face-to-face meetings with colleagues. Generally, comments regarding communication were relatively neutral, with many simply stating that their communication had changed rather than any particular consequences of this. This suggests that using online communication is unlikely by itself seen to have security connotations despite reports showing that, in reality, the use of these platforms can indeed be a vulnerability, e.g. unlocked meetings allowing disruptors and unwanted attendees to join (Kagan, Alpert, and Fire 2020; Ling et al. 2020).• ‘I am on my own only communicating through Microsoft teams and email’• ‘All interaction is now done via email or other online communications’

5. Discussion

Supporting previous findings (Shinkins 2016; Dhir, Chen, and Nieminen 2015), a significant relationship between life satisfaction and PIU was identified and so H1 was accepted. Loneliness was found to positively predict PIU, confirming H2 and supporting previous findings (Shinkins 2016). Similarly, PIU negatively predicted CSB therefore confirming H3 and supporting previous findings (Hadlington 2017; Hadlington and Parsons 2017). Furthermore, neither life satisfaction nor loneliness was found to directly predict CSB, suggesting that PIU acted as a full mediator in the model. The only significant relationships identified among demographic factors were among the age variable which negatively predicted loneliness and PIU, and number of devices which positively predicted CSB. The former finding is consistent with recent findings (Banks and Xu 2020) and suggests that younger people are more likely to feel lonely and demonstrate PIU. No particular literature was associated with the latter finding; one possible explanation could be that individuals using several computing devices may be more technologically adept and therefore more aware of cyber security, although this is purely speculative.

Qualitative analysis of the open-ended question ‘How has the COVID-19 lockdown affected your work activities? Please write a short description’ revealed common themes surrounding individuals’ experiences WFH. One of the most commonly reported changes experienced while WFH was distractions. Many participants reported feeling more distracted whilst WFH for various reasons such as children and/or other people in the house, uncomfortable workspaces, and most relevantly browsing on the internet (‘I often browse the Internet instead of doing work’). This finding is consistent with PIU and CSB research which found that heavier media multitasking and distraction can result in individuals being less likely to identify significant risks in their immediate environment and demonstrating riskier CSB due to limited attentional focus (Hadlington and Murphy 2018). Productivity was also a common theme, although the direction in which it was felt appeared to be relatively even split. Those who reported their productivity worsened while WFH claimed this was due to factors such as reduced motivation, worsened mental health (‘The COVID-19 pandemic and lockdown have had a strong negative impact on my mental health. This, in turn, has negatively affected my productivity’), and disrupted work-life balance. Comments related to productivity such as ‘I am more productive but the downside is that I work longer hours’ and ‘I am less productive but spending more time on the computer’ indicated that some people were working at their computer for longer periods of time than they perhaps would in an office. While attempting to connect these quotes to CSB is speculative, there is evidence to suggest that spending excessive time using screens can lead to impaired cognitive functioning (Zhou et al. 2011). This phenomenon has already somewhat been witnessed in the field of information security where task overload has led to burnout among staff, impairing their security performance (Pham, Brennan, and Furnell 2019). Furthermore, the biggest change to work that individuals reported was communication, specifically the increased use of virtual communication channels such as Zoom. Again, applying this finding to CSB may be speculative but there is evidence to suggest that reduced in-person, face-to-face communication when WFH can weaken the trust and cohesion among employees, which in turn can weaken workgroup information security effectiveness (Mustajab et al. 2020; Yoo, Goo, and Rao 2020). Furthermore, video conferencing tools have demonstrated vulnerabilities such as unwanted attendees disrupting calls (Kagan, Alpert, and Fire 2020; Ling et al. 2020). While this can be addressed by users locking rooms and using passwords, many users have experienced ‘Zoom fatigue’ as a result of increased use of video conferencing during the pandemic, so when applying previous findings regarding the negative effects of fatigue and distraction on attending to security measures it is not unreasonable to perceive a connection here, although more research is needed on the topic (Berg et al. 2017).

While further analysing these themes and their direct relation to CSB is beyond the scope of our research, they are consistent with emerging literature which suggests that employees experiencing stress from adapting to new technologies may be less productive and less receptive to cybersecurity-related workplace behaviours (Reeves, Delfabbro, and Calic 2021).

6. Implications

The SEM of the current study provides new insight on the literature on CSB and PIU and suggests that the relationship between these factors is still present among individuals WFH during lockdown, a context which is becoming increasingly relevant with many organisations shifting towards remote working (Felstead and Henseke 2017; Hern 2020). The current model has implications for employers who may benefit from checking on the wellbeing of their employees and facilitating social connection to prevent PIU especially when WFH with limited access to occupational health services. Possible actions could include dedicating a specific amount of time before virtual group meetings for social conversation to allow employees to reconnect with each other (Fischer 2020) and adapting social activities to take place virtually to maintain morale, e.g. using cycling machines at home or performing certain activities like cooking and video-streaming that together. However, addressing loneliness has proved to be a complex effort with little evidence to guide strategies, and loneliness is more nuanced than just social connectedness (Smith and Lim 2020).

Whilst in the traditional office environment employers may be able to limit access to potentially problematic websites such as those known to be malicious, such an approach may not be feasible while employees work from home likely. Although many organisations now provide their employees with devices such as a laptop and mobile phone, employees’ home Wi-Fi networks are typically less secure than those in an organisation. Furthermore, this approach does not take into account that such reliance on digital media comes with negative life experiences such as distracted sleep and reduced productivity. In situations such as lockdown and WFH, it might be questionable whether excessive use would be evitable and still lead to similar effects. Additionally, PIU can affect CSB when devices are owned by employees and still being used for work reasons. While this can happen at any time, working entirely from home may be yet another extreme which needs to be investigated.

Even if employers were able to monitor internet use at home (e.g. by implementing their own network), these findings should not be interpreted as a means to eliminate employees demonstrating PIU as evidence suggests punitive action can be counterproductive, creating further issues of increased staff turnover and worsened employee morale (Young and Case 2004). Instead, employers should focus on therapeutic interventions to help reduce employees’ risk of PIU. For example, encouraging individuals to develop self-regulating strategies may be effective (Breslau et al. 2015). While typical interventions for addictive behaviour usually focus on distancing oneself from the problematic substance, the necessity of the internet for many job duties (especially when WFH) instead requires an intervention which allows people to simply limit their usage. For example, organisations could encourage more responsible internet use by implementing the use of digital wellbeing applications and software among their employees. Considering our qualitative findings, reporting challenges with distraction and productivity while WFH, as well as previous literature demonstrating distraction leads to risky CSB, utilising digital wellbeing applications to minimise distractions could help foster healthier CSB (Hadlington and Murphy 2018). However, we recognise that such suggestions are speculative and require research to test their potential.

Furthermore, as phishing attacks were identified as the most common type of cyber-crime to occur since the pandemic (Panda Security 2020), solutions specifically targeting the behaviours of obsessive internet users who may consequently lack proactive awareness should also be considered for these scams which in part exploit victims’ lack of awareness. While companies such as Facebook and Amazon have implemented technical measures to remove content flagged by health organisations as misinformation (Richtel 2020) and illegitimate products (BBC News 2020), existing literature regarding mitigation strategies for social engineering attacks suggests that a combination of technical and human-based detection is required in order to optimise effectiveness (Zulkurnain et al. 2015). This could be carried out universally by incorporating reminders into social media feeds to critically evaluate content and how to identify warning signs of illegitimate emails, products and services themselves, something Facebook has initiated by allowing the WHO to advertise for free and by directing users to the WHO if ‘coronavirus’ is searched (Benson 2020). Reflecting on Cellini et al. (2020) findings that digital media use during the pandemic has increased towards bedtime, a novel suggestion to increase the likelihood that such reminders are especially seen by those demonstrating obsessive PIU could involve increasing the frequency of these adverts and reminders at night. Organisations could implement similar measures by regularly encouraging employees to be mindful of suspicious information which could be tailored to the specific threats faced by their company. Furthermore, while training employees to be aware of phishing attacks in the workplace is not a new concept, this training needs to go beyond the premise of the traditional workplace. As the previously discussed 2020 Tessian Report findings revealed that half of employees reported disregarding security measures (Sadler 2020), it is clear that training protocols must be adapted to the context of WFH where individuals have less restrictions surrounding their online behaviours.

WFH, with a heavy reliance on technology, presents an interesting amalgamation of the use of digital media where boundaries between work and social end leisure are blurred. Therefore, the nuances of the relationship between PIU and CSB while working from home are yet to discover as in workplaces, employees tend to use networks and internet largely for work and where they tend to have a separation between work time and leisure and socialisation time.

7. Strengths and limitations

One of the objectives of the current study was to re-examine previously established factors associated with CSB to explore whether the relationships still hold during lockdown While questions in the survey explicitly instructed participants to answer based on how they felt during the UK lockdown, in order to truly answer this research question, knowledge of people’s experiences before lockdown would have been particularly illuminating by providing a ‘pre-’ and ‘post-test’ condition. However, given the unpredicted nature of the pandemic such data acquisition could not be planned for.

Another limitation of this study was the reliance on correlating self-report data rather than a manipulated experimental design. Although the theories behind the relationships were backed by literature, any causal inferences suggested should be interpreted with caution. However, the robust fit of the SEM computed must not be ignored and the findings have demonstrated valuable implications for both businesses and public health. Ideally, the current findings could be extrapolated on using experimental design to actually manipulate variables with the hope of providing evidence of cause and effect. For example, after screening participants to identify those exhibiting PIU and measuring reported CSB, participants could be exposed to various interventions (Turel, Mouttapa, and Donato 2015) and then re-tested to determine whether attempts of PIU can be effective in improving CSB.

Similarly, the use of only self-report measures rather than measuring direct behaviours may limit the validity of our findings. Participants may respond in a way that makes them appear favourable (Anwar et al. 2017), although the online delivery of the survey rather than in-person may have reduced this bias and provide some anonymity, encouraging more honest answers. There were also some limitations with regards to self-reporting issues specific to the scales used. The relationship between loneliness and PIU is complex with evidence that controlling for other variables can reveal the association to be weaker (Moretta and Buodo 2020; Shappie, Dawson, and Debb 2020), and while the PIUQ-SF-6 is multidimensional, relying on scales can cover only what the scales are being built on, i.e. the subscales and the theories behind them. Similarly, the PIUQ-SF-6 mostly defined PIU in terms of excessive and obsessive use rather than the types of activity; this may neglect to differentiate between PIU from excessive scrolling on social media compared to say online gambling or even potentially beneficial internet activity such as educational YouTube videos. It may be that in terms of consequences for CSB perhaps the addictive aspect itself is sufficiently detrimental, however future research could clarify this speculation and investigate whether the types of online activities play a role. For example, participants’ online activity could be tracked and compared to their reported CSB.

Similarly, while the SeBIS was useful for measuring reported behaviours rather than just attitudes towards cyber security, it only provides a partial view of CSB covering four factors. This indicates a limitation in the literature in the definition of what CSB means in a measurable format, i.e. in operationalising it. For example, while the SeBIS measures intentions for positive behaviours, it does not capture aspects of cybersecurity which might practically limit one’s ability to carry out said behaviours such as perceived barriers to CSB and security self-efficacy which are detected by other scales (Donaldson and Grant-Vallone 2002; Lopez-Fernandez and Kuss 2020). Furthermore, the SeBIS does not directly measure the occurrence of said behaviours. The intention-behaviour gap is a common limitation in this field of research (Bada, Sasse, and Nurse 2019; Gundu 2019), however, Egelman, Harbach, and Peer (2016) validation study found that participants’ reported responses to the four factors of the SeBIS corresponded with their actual behavioural responses which suggest the scale is ecologically valid. Future research could build on the current findings by measuring the same psycho-social factors along with real CSB to confirm the ecological validity. For example, Egelman et al.’s validation study measured the awareness component of SeBIS by showing participants screenshots of an illegitimate but realistic-looking website and asking them to describe it in an open-ended response. Those who used the included URL bar to acknowledge that it was a phishing website demonstrated high proactive awareness.

Finally, the qualitative data identified some common themes of participants’ experiences of WFH during lockdown which were not covered in other questions of the survey such as issues relating to childcare and feelings of lack of motivation and productivity. While comparing this qualitative data against the quantitative scores was beyond the scope of this study, perhaps future research could explore these themes to see whether these other factors of WFH impact CSB, for example whether individuals who reported feeling more distracted also demonstrated lower CSB scores.

8. Conclusion

The current study attempted to identify the psycho-social factors contributing to people’s vulnerability to the many cyber-crimes present during the COVID-19 pandemic. The current findings make useful contributions to the emerging body of literature on PIU and CSB during lockdown. All hypotheses were confirmed – loneliness positively predicted PIU, life satisfaction negatively predicted PIU and PIU negatively predicted CSB.

Several implications for the findings were identified such as targeted wellbeing and educational measures to help those at risk of PIU become more aware of how to spot the types of cyber-crimes related to COVID-19. While the methods used were limited to self-report surveys, the study provides robust results of value. Suggestions for future research focused on expanding on the current findings with manipulative experimental design. With the UK already experiencing the second wave of COVID-19 and warnings of new COVID variants emerging (Department of Health and Social Care 2021), if the UK were to go back into lockdown it would be wise for organisations to consider findings such as this and act swiftly. Considering the long-term impact of the current study, these findings may still be relevant for similar crises or other pandemics in the future.

Availability of data and materials

The datasets used and/or analysed during the current study are available from the corresponding author on reasonable request.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Correction Statement

This article has been republished with minor changes. These changes do not impact the academic content of the article.

Additional information

Funding

Open Access funding for this article has been provided by the Qatar National Library. The research has received funding from the EU's Horizon2020 research and innovation programme under the Marie Sklodowska-Curie [IDEAL-CITIES (H2020-778229). Bournemouth University funded participant reimbursement for the data collection of this research.