Circumventing Circumvention: An Economic Analysis of the Role of Education and Enforcement

Debabrata Dey, Abhijeet Ghoshal, Atanu Lahiri

Research output: Contribution to journalArticlepeer-review


The role of education and enforcement in ensuring compliance with a law or policy has been debated for more than a century now. We reopen this debate in the context of security circumvention by employees, currently a leading cause of information security and privacy breaches. Drawing on prior literature, we develop a microeconomic framework that captures employees’ circumventing behavior in the face of security controls. This allows us to obtain interesting insights that have implications for how an organization should employ anticircumvention measures. First, unless circumvention is rampant, education and enforcement often work better in combination, and not in isolation. Second, there are incentives for an organization to tolerate circumvention to an extent, even when education and enforcement are cheap. Finally, education and enforcement may be strategic complements or substitutes in different parts of the parameter space. When they are complements, if a change in cost parameters compels the organization to increase one, it would also require an increase in the other in lockstep. In contrast, when they are substitutes, an increase in one is associated with a decrease in the other.

Original languageEnglish (US)
Pages (from-to)2914-2931
Number of pages18
JournalManagement Science
Issue number4
StatePublished - Apr 2022
Externally publishedYes


  • IT security
  • circumvention
  • economics of IS
  • education
  • enforcement
  • privacy

ASJC Scopus subject areas

  • Strategy and Management
  • Management Science and Operations Research

Cite this