Let me just say up front: This is not a formal correlation as the result of a study, but rather an anecdotal correlation that occurred to me this week. The source discussion involved how people act on the east coast vs. the (upper) midwest where I grew up. However, the principle seems to apply very broadly.
Simply put, my hypothesis is: As communities grow in size, the values represented by that community will shift from being community-centric to being individually oriented. That is, at a certain tipping point a community will be large enough that people will stop taking into consideration the entire community, and will instead focus almost exclusively on their own, selfish needs.
This is not to say that I think that focusing on our own needs is a bad thing. However, we lose a lot of benefits when we make that transition from small to large community. For instance, I've seen this play out in traffic. In small communities, I've literally been stuck at a 4-way stop sign where people (who know each other!) arrived at about the same time and then hand gesture for the other person to go... for a very long time (a couple minutes)! On the flip side, in larger communities where peoples' interest is primarily with themselves, those "right of way" conditions at stop signs see the most aggressive person going first, and oftentimes lead to angry words, if not accidents. Why? Because both people have stopped looking at the condition as a group concern, and have instead positioned it as an individual concern.
We see this behavioral change play out in a variety of circumstances. Consider a playground. In a small community, parents are typically looking out for all of the kids, often while chatting together. In larger communities, I've seen just the opposite, where each parent minds their own child(ren), and little or no adult socializing occurs. I've even seen it where the adults then encourage their child(ren) to play alone, rather than with other kids, even if the kids are all getting along and playing nicely. It's actually a bit sad as this goes completely against most of our upbringing that teaches cooperation and manners.
The other area where I've observed this change in behavior is in large corporations. When companies are small startups, they oftentimes have good energy and a true sense of community. Everybody pulls together to make the startup succeed. However, at some point you cross over to where individual contributors start focusing on their own needs over the needs of the corporation. Oftentimes, these attitudes are accompanied with a sense that there's little an individual contributor can do to significantly impact the corporation, so there's no real point in focusing on the corporation's wellbeing.
Of course, as we see in infosec all the time, individual contributors can absolutely have an impact on an entire organization. Most frequently we see this as a negative impact, such as through a lost device with sensitive data or clicking on a bad link or file. However, there are myriad examples, both positive and negative, where individual contributors can impact an entire organization. We need to do a better job of finding ways to connect people to these impacts, which is especially hard to do as a community grows in size.
At the root of this discourse is the principle of the Human Paradox Gap (from Michael Santarcangelo), wherein peoples' actions+decisions are disconnected from the resulting consequences and impacts. My thinking is that a large reason for this is the loss of community-centric values as organizations grow. This problem is exasperated by the Internet, which represents a mega-community that creates tremendous distance (physical, logical, and temporal) between decisions and impacts.
The open-ended question then becomes: How can we start fostering improved community-centric values that will start narrowing the gap between decisions and impacts? How do you reinvigorate a community-centric mindset in people who are intrinsically focused on their own individual needs? I submit that, without engaging people into a shared community that puts a premium on community-centric values, there is no way to improve peoples' security behavior in a meaningful way.
PS: Just before posting, I ran across this new story up on NPR, and it hits the nail on the head!
Starbucks CEO: Can You 'Get Big And Stay Small'?
Great quote:
"Not unlike the English pub in the U.K.," he says, Starbucks serves as a "third space between home and work, an extension between people's lives, at a time when people have no place to go."
