In recent years, AI ethics declarations, commitments, and frameworks for AI systems development have proliferated. Yet, implementation remains persistently low. This phenomenon, often termed “AI ethics washing,” has been widely criticized but lacks empirical investigation. Our paper examines these gaps between declarations and operations in AI ethics through the organizational psychology concept of “decoupling”—the disconnect between what organizations say and what they do. Using data collected through in-depth interviews with 32 practitioners across diverse companies, from early-stage startups to large corporations, we present a systematic analysis of decoupling between declarations and operations in AI ethics, producing the first analysis of decoupling not only in AI ethics but in any technology development field. Our findings identify and characterize (i) common types of AI ethics declarations, such as policies and internal communications, (ii) common types of AI ethics operations, such as reviews and testing, (iii) common rationales behind companies’ approaches to AI ethics, and (iv) distinct decoupling profiles, i.e., common ways in which AI ethics declarations come apart from operations. Our discussion includes recommendations for increasing AI ethics adoption tailored to each profile. These recommendations differ from traditional AI ethics frameworks. While traditional frameworks prescribe ideal practices based on regulatory or industry expectations, this paper offers recommendations grounded in an empirical analysis of how AI ethics efforts succeed or fail in practice. Our decoupling-informed perspective fundamentally reshapes how practitioners and scholars can approach the challenge of AI ethics implementation.

The rapid diffusion of software systems into all aspects of human life has exacerbated security threats and thus amplified the requirement for proactive approaches for designing security as a default. Following evidence from previous studies, indicating or ganizational climate as a key influencer on developers’ security mindsets and behaviors, this study was focused on examining the relations hip between team security climate level and developers’ actual practices when addressing security threats during software development. The empirical study was conducted in a defense software development organization and included a survey questionnaire completed by 212 developers from 50 software teams. The results were compared to managers’ evaluations regarding the implementation level of security mechanisms in the teams’ development. The findings indicate a positive relationship between team security climate level and the implementation level of security mechanisms in the teams' software development and that team productivity climate moderates this relationship. The results also reveal that team security climate mediates the association between manager developer relationships and the implementation level of security mechanisms in software development. The study provides support to organizational climate theory and to the specific scale of organizational security climate, demonstrating the predictive validity of this scale, and sheds light on the influence of leadership and competitive facets on security engineering.

Security by design is a recommended approach, addressing end-to-end security and privacy in the design of software systems. To realize this approach, proactive security behavior is required from software developers. This research follows results from previous studies that suggest that personal and organizational characteristics influence security-related behaviors during the software design process. The research is aimed at gaining an in-depth understanding of proactive security behavior and the factors affecting it. Leveraging organization climate theory from organizational psychology, we propose a theoretical model, detailing different factors and their relations with proactive security behavior and test it in empirical settings. The empirical study was conducted in collaboration with an internationally distributed information technology enterprise and included a survey questionnaire completed by 499 software developers working in seven countries. The results of the survey confirm the moderation-mediation relations in the proposed model, revealing that organizational security climate and security self-efficacy are both positively associated with proactive security behavior, organizational security climate is positively associated with security self-efficacy, and cultures promoting individualism moderate the relationship between organizational security climate and security self-efficacy, thus impeding proactive security behavior. The body of knowledge of organizational psychology points to directions that can effectively be activated for improvement.

Privacy requirements have become increasingly important as information about us is continuously accumulated and digitally stored. However, despite the many proposed methodologies and tools to address these requirements, privacy engineering is often underperformed in most domains of the software industry. Two of the major reasons underlying this under-performance are (1) the low expertise and understanding of privacy by the two main actors in requirements engineering: users and analysts, and (2) the fact that software developers often do not perceive privacy requirements as a priority for their companies, thus neglecting to meet these requirements even when they do have the required knowledge, skills, and supporting tools to do so. To address these two problems, we propose to integrate knowledge from software engineering and organizational psychology in an iterative, customizable, socio-technical environment. Such environment has the potential to support the design of systems by providing technical tools for eliciting, modeling, and designing privacy aspects, thus addressing the knowledge gap of both data subjects and analysts, and social mechanisms for achieving a supportive and sustainable organizational privacy climate within a company, thus reorienting the organizational attention and engagement toward addressing privacy requirements.

Human barriers were found to impede the acceptance, adoption, or effective use of technology, manifested as under-usage of systems, non-compliance with regulations, short-term use of behavioral change systems, and more. These barriers can be overcome only by meeting appropriate requirements. However, such requirements are frequently overlooked. Different visual models are offered for supporting the derivation of requirements from, e.g., goals and emotions; however, we found no visualization techniques that support the elicitation and specification of requirements derived from known human barriers. The recruitment of Service Design visualization methods for visually expressing such barriers may help bridge this gap. This paper presents this vision and a demonstration for the case of Electronic Health Records, utilizing the Causal Loop Diagram to represent clinicians’ barriers when using a system. The visualization enabled by the diagram allows, for example, identification of use cases in which the system output may be overloaded with information (inducing cognitive overload) and still lacking relevant information (e.g., patient information beyond their clinical data), ultimately leading to suboptimal clinical decisions. This demonstration indicates the promise of this approach for eliciting frequently missed requirements rooted in users’ cognitive barriers.

Abstract We report on a mixed-method, comparative study investigating whether there is a difference between privacy concerns expressed about pet wearables as opposed to human wearables – and more importantly,why. We extracted the privacy concerns found in product reviews (N=8,038) of pet wearables (activity, location, and dual-function trackers), contrasting the (lack of) concerns and misuse to a curated set of reviews for similar human-oriented wearables (N=20,431). Our findings indicate that, while overall very few privacy concerns are expressed in product reviews, for pet wearables they are expressed even less, even though consumers use these devices in a manner which impacts both personal and bystander privacy. An additional survey of pet owners (N=201) eliciting what factors would cause them to not purchase (or stop using) pet wearables indicated comparably few privacy concerns, strengthening the representativeness of our findings. A thematic analysis reveals that the lack of privacy concerns may be explained by, among other factors, emotional drivers to purchase the device, and prioritization of (desired) functionality to support those emotional drivers over privacy requirements. Moreover, we found that pet wearables are used in different ways than originally intended, which raise novel privacy implications to be dealt with. We propose that in order to move towards more privacy-conscious use of pet wearables, a combination of understanding consumer rationale and behavior as well as ensuring data protection legislation is adequate to real-world use is needed.

INTRODUCTION: The Physics of Notations (PoN) is a theory for the design of cognitively effective visual notations, emphasizing the need for design grounded in objective and verifiable rationale. Although increasingly applied, no systematic analysis of PoN applications has yet been performed to assess the theory's efficacy in practice. OBJECTIVES: Our primary objective was to assess the scope and verifiability of PoN applications. METHOD: We performed a systematic literature review (SLR) of peer-reviewed PoN applications. We analyzed what visual notations have been evaluated and designed using the PoN, for what reasons, to what degree applications consider requirements of their notation's users, and how verifiable these applications are. RESULTS: Seventy PoN applications were analyzed. We found major differences between applications evaluating existing notations and applications designing new notations. Particularly, in the case of new notations, we found that most applications adopted the PoN with little critical thought towards it, rarely considered its suitability for a particular context, and typically treated and discussed the PoN with few, if any, verifiable details and data. CONCLUSION: The results warrant consideration for those applying the PoN to do so carefully, and show the need for additional means to guide designers in systematically applying the PoN.

Privacy by design (PbD) is a policy measure that calls for embedding privacy into the design of technologies at early stages of the development process and throughout its lifecycle. By introducing privacy considerations into the technological design, PbD delegates responsibility over privacy to those in charge of the design, namely software developers who design information technologies (hereafter called developers). Thus, for PbD to be a viable option, it is important to understand developers' perceptions, interpretation and practices as to informational privacy.

In this paper we describe a proposed framework for Cooperative Adaptive Personalized Education for Life-long Learning and Activation (CAPELLA). CAPELLA comprises four models: A Knowledge Organization Model, a Learning Process Model, a Community Collaboration Model and a Gaming Model. The underlying pedagogical approach is based on the four pillars of learning: Learning to know, learning to do, learning to collaborate and learning to be. Based on these models and principles, CAPELLA provides a theoretical framework that may assist IT developers to develop state-of-the-art educational platforms and advanced learning applications. Using an example of a UML Diagramming Workshop we demonstrate how CAPELLA incorporates the principles of Adaptive Learning.

This paper proposes a systematic framework for applying the Physics of Notations (PoN), a theory for the design of cognitively effective visual notations. The PoN consists of nine principles, but not all principles lend themselves equally to a clear and unambiguous operationalization. As a result, many visual notations designed according to the PoN apply it in different ways. The proposed framework guides what information is required of a reported PoN application to ensure that the application of each principle is verifiable. The framework utilizes an evidence-driven design rationale model to structure information needed to assess principles requiring user involvement or cognitive theories. This approach aims to reduce ambiguity in some of the principles by making design choices explicit, and highlighting the level of evidence presented to support it. We demonstrate the proposed framework in a showcase of a recently published visual notation which has been designed with the PoN in mind.

This position paper presents the preliminary findings of a systematic literature review of applications of the Physics of Notations: a recently dominant framework for assessing the cognitive effectiveness of visual notations. We present our research structure in detail and discuss some initial findings, such as the kinds of notations the PoN has been applied to, whether its usage is justified and to what degree users are involved in eliciting requirements for the notation before its application. We conclude by summarizing and briefly discussing further analysis to be done and valorization of such results as guidelines for better application.

Code review is a highly important task in the software development lifecycle. However, some of the characteristics of code review hinder practitionersâ?? performance of this task. Code review is considered to be tedious and uninteresting, and includes challenging human aspects, such as collaboration among stakeholders. Despite the many concerns that need to be taken into consideration when performing code review, a comprehensive, formal definition thereof is yet to be determined. In a previous research, a set of formal guidelines for code review was presented, in the context of performing this task in a gamified environment. In this ongoing research, we explore whether the field of software engineering provides a formal definition for code review, and whether a formal definition is needed. The preliminary findings of this research indicate that while the field does provide several definitions for code review, in all that concerns the human aspect of this task, a formal definition is in order. As a response for this need, we present a framework of the task of code review toward its formalization, embedding gamification for motivation enhancement.

New visual languages and extensions of existing notations are increasingly introduced for various purposes. There are many frameworks and theories that aid designers in creating cognitively effective visual notations. They usually provide general guidelines, which are not easily operationalized without extensive user involvement. However, often such user involvement is difficult to achieve, especially in scientific settings where finding enough participants with the needed background knowledge is far from trivial. In this paper we propose the idea of creating a searchable marketplace of visual elements, in which designers could share and exchange elements of visual notations. A key feature of such marketplace would be the ability to certify such elements via procedures grounded in empirical research. We discuss a proposed structure of the marketplace, and the challenge that the need for certification poses to its design.

Declarative approaches to business process modeling are regarded as well suited for highly volatile environments, as they enable a high degree of flexibility. However, problems in understanding and maintaining declarative process models often impede their adoption. Likewise, little research has been conducted into the understanding of declarative process models. This paper takes a first step toward addressing this fundamental question and reports on an empirical investigation consisting of an exploratory study and a follow-up study focusing on the system analysts’ sense-making of declarative process models that are specified in Declare. For this purpose, we distributed real-world Declare models to the participating subjects and asked them to describe the illustrated process and to perform a series of sense-making tasks. The results of our studies indicate that two main strategies for reading Declare models exist: either considering the execution order of the activities in the process model, or orienting by the layout of the process model. In addition, the results indicate that single constraints can be handled well by most subjects, while combinations of constraints pose significant challenges. Moreover, the study revealed that aspects that are similar in both imperative and declarative process modeling languages at a graphical level, while having different semantics, cause considerable troubles. This research not only helps guiding the future development of tools for supporting system analysts, but also gives advice on the design of declarative process modeling notations and points out typical pitfalls to teachers and educators of future systems analysts.

Inconsistency is a major challenge in requirements engineering, commonly perceived as a problem that needs to be eliminated on sight. However, in practice maintaining consistency at all times is an intractable problem. Accordingly, recent paradigms for inconsistency management acknowledge that it is sometimes desirable to tolerate inconsistency, e.g. to allow distributed teamwork and prevent premature commitment to design decisions. However, a successful adoption of inconsistency managment paradigms in industry depends highly on the human factor: intolerant attitudes of practitioners toward inconsistency may pose significant barriers to a wider acceptance of these paradigms. A thorough analysis of cognitive factors is a key to overcoming these barriers. This paper reports on our preliminary empirical findings highlighting existing perceptions and attitudes of practitioners toward inconsistency, and propose dimensions for their classification. Based on these results, we outline a general research program for exploring cognitive factors in inconsistency management.

Conceptual modeling represents a domain independently of implementation considerations for purposes of understanding the problem at hand and communicating about it. However, different people may construct different models given the same domain. Variations among correct models, while known and familiar in practice, have hardly been investigated in the literature. Their roots are in the decisions made during the modeling process, where modelers face the need to map reality into modeling constructs. This paper reports an empirical study whose aim is to explore model variations and in particular to examine possible directions for reducing them. Specifically, the study uses a multimethod research paradigm to examine the effect of applying ontology-based modeling rules on modeling decisions as reflected in resulting model variations. The findings of the study provide insights into the variations phenomenon, as well as to the application of ontology-based modeling rules.