In all research, consideration should be given to both the ethics of the research itself and of the methods used in that research.
All the SMEs interviewed were granted anonymity by the researcher and with the use of a consent form outlining conditions of participation. An overview of the question topics was provided to the micro and small businesses along with the consent form. All interviewees were asked if they had read and were happy to participate at the start of each interview. In examples where the interviewee could not recall or remember the information listed on the consent form this were repeated and confirmation was sort that they were still happy to continue.
During this study Cranfield University Research ethics and integrity policy were followed and online ethics training was undertaken and passed. Furthermore, before any of the interviews were conducted ethics approval by the Cranfield University CURES system was obtained (Reference number CURES/3517/2017).
1.1.1 Funding, Marketing and Reward
The study has not funded by any third party and it was clearly stated to all the participants that this research would not be used as a platform to market or sell any product or service. It was mentioned that a benefit of participating would be taking some time to consider cyber risks that could impact your business, however, there could be no guarantee that the interviewee would personally experience benefits from participating in this study.
1.1.2 Anonymity & Confidentiality
In section X the requirement for the anonymity of research participants was discussed. Security professionals, by their nature, are often guarded and hesitant to unnecessarily share information particularly where this may be attributed to them or the organisations which they are working to protect. In order to counter this reluctance to share information (Granado and White, 2008) the anonymity of participants would need to be ensured.
Careful consideration was given to the construction of the survey questions ensuring that:
No personally identifiable information was required, and that where participants had the option to submit their email address in order to receive a copy of the published research they were aware that this would not form part of the research and would only be retained until the research had been published and shared with them.
Questions relating to the participant’s organisation were assessed to ensure that responses would not inadvertently identify the organisation. As such we limited the collection of this data to:
Approximate size of the organisation
Continental location of the organisation’s headquarters
The organisation’s primary industry
These steps ensured that participants could complete the survey honestly without concern that the responses could be attributed to them. Additionally, it provided the researcher with confidence that should the results be disclosed (through say a cyber-breach of the online survey provider) they could not be used to identify the participants.
1.1.3 Consenting Process
Informed consent represents a critical component of ethical research involving human participants. Nishimura et al. (2013)
1.1.4 Participation and Withdrawal Process
The selected interviewees had the right to decide whether to participate in the study using the informed consent process and could withdraw without penalty or consequence at any time. Participants could withdraw from the study at any point, and email and telephone contact details were provided to all interviewees during the initial correspondence, and this information was also provided on the consent form.
No research interviewees requested to withdraw after the interviews, however, it was noted that one individual declined to take part in the study after the initial information about the scope of the research was provided. It was disclosed that this was because the whole IT subject was the most hated of their part of their job and answering anything would have been a struggle. It was explained that IT was not their forte, being wholly outsourced, and the whole topic is something that they didn’t want to get involved in. In addition, five other individuals, who initially stated that they would be willing to participate in the study subsequently did not reply to correspondence to arrange an interview date. These individuals were sent an initial arrangement interview and one subsequent email asking if they were still willing to particulate in the study. A further two businesses also stated that they would be willing to take part in the study however during the six-week window when the interviews were being conducted they did not have any free time to participate.
1.1.5 Data Protection and Retention
To ensure that the finding can be replicated data from this research has being stored in an encrypted electronic format until the study has been concluded. This includes paper notes and records taken during the interviews which have been scanned and then subsequently shredded. At the end of the research all data will be securely deleted.
1.1.6 Measures for Ethical Protection
As the research involved discussing business practices, security measures and controls the research required assurance for the confidentiality of collected data. It was explained to all interviewees on their consent forms and before the interviews commenced that access to the research data would be restricted and any identifying data anonymised.
During the interviews whenever any identifying information was mentioned the time was noted and this information was removed from the recorded raw data before it was sent off for processing.
The company that was selected for
1.1.7 Transcription Non-Disclosure Agreement
It was verified that transcribers at GoTranscript have signed a non-disclosure agreement so all processed information would be treated as confidential. A sample of the non-disclosure form for the transcribers has been included in the APPENDIX X. A separate non-disclosure agreement could have been requested for each of the processed data files for each transcriber involved however considering that identifying information had already been removed from the recordings this was not deemed necessary. Furthermore, the recorded interviews are split into 10-15 minute sections no one transcriber no one have access to the whole transcript.
1.1.8 Development of Interview Questions
The questions raised with the small business owners were based upon the information identified in the literature review.
The core questions to each interview participant were identical, however, depending on the answers provided further questions were asked help to provide comprehensive responses for analysis. Where possible all questions were phrased open ended and whereas this allowed for a better understanding of decisions and considerations of the interviewees it made the analysis more challenging.
Trials of the interview questions was conducted before starting the interviews with the SMEs and this resulted in refinement to both the questions and the order in which they were asked. The first trial was conducted with a…
1.1.9 Data Analysis
The analysis the interviewees qualitative responses utilised a simplified thematic coding approach using Nvivo. This is suitable for qualitative analysis (Robson, 2016). The data acquired was partially coded to identify points of interest with the same codes grouped together to form a theme then used for further data analysis and interpretation.
After preparation of the interview questions, the researcher undertook a review utilising data gathered in the literature review to verify credibility of the questions. The literature review utilised two areas of data. The first being the available standards related directly or indirectly to bleed air purity. The second being an understanding of oil leakage into the air supply based upon broad aviation industry understanding and documentation from those directly involved in the relevant areas in an engineering capacity.
Each question was reviewed to ensure the question was valid in terms of: credibility, validity, clarity, time required to respond and therefore completeness of data, logical flow of questions and language.
Interpretation of the interviews was crucial and therefore care was taken to ensure a framework was not placed on the data. Rather the data generated the themes and subsequent analysis and the data was checked regarding representativeness and consistency. The categories identified during the analysis were compared with the answers provided by the respondents to ensure validity of the research. Other aspects considered were lack of respondent bias, prolonged association enhancing credibility and quality of data, verification of data with respondent, search for negative cases and audit trail of interview raw data.