Shared responsibility or not? A responsibility messages experiment during a cyber crisis in designing for risk communication

Responsibility awareness is a vital component of several countries’ crises preparedness policies. In recent years there has also been a formal shift in responsibility, from state level to regional and local levels, as well as to households. The shift is emphasized in risk communication activities targeted at the citizens. However, even with the close connection between risk communication and responsibility for risk prevention and preparedness measures, surprisingly little is known about the relationship between communicating responsibility, and the effects on responsibility awareness and self-preparedness. The aim of the study is to identify how citizens’ reception of responsibility messages concerning a crisis event, influence how residents view their own responsibility awareness and self-preparedness intent. In our study we selected a cyber-crisis scenario as a case to prepare for. A post-test only quasi-experimental cross-sectional survey research design conducted on data collected from 3395 survey participants of the Citizen panel revealed that the responsibility messages with the government taking almost all the responsibility, does not lead to a decrease in the citizens’ own responsibility awareness, and that a responsibility message with shared responsibility but also a message where the citizen is left to their own devices, both lead to an increased own responsibility awareness. However, neither of the responsibility messages lead to an increased self-preparedness intent.


Introduction
Given the pressing challenges posed by climate change, pandemics, armed conflicts, and cyber threats, the significance of promoting crisis preparedness among citizens through effective risk communication is emphasized in both policy documents and in research.In policy documents, various guiding principles assert that effective risk communication plays a crucial role in ensuring that citizens are adequately informed and prepared to confront imminent dangers or threats [The Organization for Economic Cooperation and Development (OECD)) 2016; United Nations Office for Disaster Risk Reduction (UNDRR)) 2015; World Health Organization (WHO)) 2017].Risk also plays a significant role in distributing responsibilities among various stakeholders (Cooper et al. 2020;Johnston, Taylor, and Ryan 2020).In recent decades, the crisis preparedness policies of many countries have shifted their focus from centralized responsibility at the state level to regional or local level, and ultimately to households and individuals.This shift is driven by the notion that if many residents are adequately prepared to manage on their own during a crisis, it allows authorities to prioritize assistance to the most vulnerable and severely affected individuals (Hobbins 2017;Johnston, Taylor, and Ryan 2020).The narrative of responsibility is also often suggested as a means of effectively involving residents and addressing their significant individual and collective preferences regarding the adoption of risk information (Cooper et al. 2020).This approach aligns with the perspective put forth by Johnston, Taylor, and Ryan (2020), who argue that individual citizens must acknowledge their shared responsibility for protection by taking appropriate measures and avoiding potential harm.In the wake of that, in countries like Sweden, there has been an increase in risk information and communication initiatives targeting residents, which explicitly highlight the division of responsibilities in risk and crisis situations (see, e.g.Hobbins 2017).Studies also shows that while governments advocate for 'shared responsibility' , they do not provide a clear plan or a communication strategy on how to get there (Monteil et al. 2022;Singh-Peterson et al. 2015).
The research on the connection between attribution of responsibility and risk perception and behavior is already extensive (see, e.g.Dawson 2020;Rickard et al. 2017), but the understanding of how different types of responsibility messages affect citizens' responsibility beliefs and preparedness behavior is still novel (Van de Poel and Fahlquist 2012), compared to, for example, the well-considered effect of fear-appeal messages in public risk and preparedness campaigns (see, e.g.Rogers 1983;Ruiter, Kessels, Peters et al. 2014;Witte 1992).Based on both scholars' and practitioners' horizons, we therefor argue for the need for more knowledge on the effects of different responsibility messages.
The aim of our study is to identify how citizens' reception of responsibility messages concerning a crisis event, influence how residents view their own responsibility awareness and the intent to prepare for a specific crisis event.We chose a quasi-experimental approach since a contemporary trend in risk communication research is an increased interest to sort out the causal mechanisms (Gutteling 2015) and to clarify what effect risk communication can have on preparedness behavior (Gurabardhi, Gutteling, and Kuttschreuter 2004;Ruiter et al. 2014).The chosen scenario for our quasi-experiment focuses on a man-made risk and crisis, in the form of a cyber crisis.This case selection is motivated by the scarcity of experimental research on man-made risks and the escalating seriousness of cybersecurity threats worldwide, which pose significant dangers to organizations across various sectors.Additionally, and most central, the case of man-made risks escalating into such as cyber crises present intriguing responsibility elements that remain understudied but could hold extra importance for future preventive risk communication (Renaud and Dupuis 2019;Zhang and Borden 2020).While some studies have assessed and managed cybersecurity risks (Busby, Green, and Hutchison 2017;He, Devine, and Zhuang 2018), little attention has been given to analyzing the effectiveness of different communication messages (Nam 2019;Zhang and Borden 2020).
The paper is organized as follows.In the overview of the current state of knowledge that follows in Literature Review and Research Hypotheses section, communicative and expectancy related barriers for crisis preparedness, the effects of responsibility beliefs on crises preparedness and, risk communication, responsibility awareness and crisis preparedness are presented, and existing knowledge gaps are identified and discussed.Additionally, our proposed strategy for addressing the gaps is presented through our three hypotheses on the matter.Materials and Methods section presents the setup of the quasi-experiment, whereas Results section presents the results.In the last Discussion section, our conclusions, as well as implications and limitations of the study and proposals for future research is discussed.

Communicative and expectancy related barriers for crisis preparedness
Risk communication with the goal to motivate behavioral change and protective action (Covello, Slovic, and Winterfeld 1987) generally begins with raising risk awareness and risk perception, in order to further motivate action (Sjöberg, Moen, and Rundmo 2004;Wachinger, Renn, Begg et al. 2013).
The challenge for risk communication compared to crisis communication, is therefore in short to convince people to act and mitigate in relation to something that not yet is a direct threat, but which may occur in the distant future (Seeger 2006).In addition to this more general problem, there are two overarching factors that can constitute barriers to increasing protective action -communicative factors and individual factors.In general, through applying risk communication models like EPPM (Witte 1992), PADM (Lindell and Perry 2012), PTM (Rogers 1983) but also models used interchangeably for crisis communication like IDEA (Sellnow, Lane, Sellnow et al. 2017) etc., we know how to design risk communication to increase citizens' risk awareness and self-preparedness (Johansson and Sandstig 2024).Besides choosing the most suited channels, trustworthy senders, and means to make the messages relevant, the best results are obtained through emphasizing self-and response efficacy in the messages.
A whole range of Risk Research (see Goerlandt and Li 2022) on mostly natural hazards has tried to understand why individuals do not prepare or act even if their risk awareness and risk perceptions towards the risk is high.Besides accepting the risk and not having enough resources or capability to handle the situation, the explanations for why individuals do not act/self-prepare despite a high-risk perception, is because the individual does not know or see that he/she is responsible to act/prepare.Instead, the responsibility is shifted to someone else (Wachinger et al. 2013).

The effects of responsibility beliefs on crisis preparedness
Previous research on natural hazards like wildfire (Martin, Martin, and Kent 2009;McNeill et al. 2013), earthquakes (Lindell and Perry 2000) and tornadoes (Mulilis and Duval 1997) has shown that besides the perceived risk (i.e.perceived threat likelihood and severity) (Lindell, Arlikatti, and Prater 2009), responsibility beliefs matter the most for preparedness measures.Studies on disaster preparedness (Lindell and Whitney 2000;Martin, Martin, and Kent 2009;Mulilis and Duval 1997) showed that, perceived protection responsibility (respondents that believe that they are personally responsible for their own safety) correlates significantly and positively with own preparedness intention/behavior.Lindell and Perry (2000) conducted a comprehensive analysis of studies on how households adapt to earthquake preparedness.Their review confirms that perceived responsibility for protection has a favorable impact on earthquake preparedness.McNeill et al. (2013) conducted a study to examine the impact of expectations (risk perceptions and perceptions of responsibility attribution) on various preparedness behaviors (such as planning and evacuating) in the event of an Australian wildfire.They found that perceived risk (especially risk severity) and perceived responsibility for protection were positively linked to all types of earthquake preparedness.However, the latter did not significantly predict preparedness after controlling for other predictors and demographics (ibid).In another study of wildfire, the locus of responsibility as well as other factors like direct experience and knowledge of the risk and self-efficacy has shown to influence own-self preparedness and risk reduction (Martin, Martin, and Kent 2009).
Nonetheless, some studies on communication provide more detailed insights into the outcomes.In a message experiment with an earthquake scenario, the attribution to self-responsibility only occurred if the individual also has the necessary resources to handle the situation (Lalwani and Duval 2000).Bodas et al. (2015) conducted a study on a societal risk that assessed the emergency preparedness of households in Israel for war.The researchers discovered that the willingness to seek information was the key factor influencing household preparedness, while beliefs about responsibility were not significant.So, even though there is some empirical evidence of the importance of responsibility beliefs for crisis preparedness, research related to man-made risks related to communication is scarce.Here, there is also a need for on the one hand research on responsibility beliefs regarding different levels of government in relation to informal sources such as friends, relatives, neighbors, and co-workers (Lindell and Perry 2000), and on the other for evidence based research on the causal relationship between responsibility beliefs in terms of responsibility attribution and preparedness intention/behavior (McNeill et al. 2013).

Government/institutions taking full responsibility (H1)
Risk research has, as mentioned, shown that one of the ways to understand why individuals do not act or self-prepare, is because the responsibility for one's own action is shifted to someone else, an external actor (e.g. the government) (Wachinger et al. 2013).Here responsibility is linked to the question of trust in the external actor (ibid).There are results from previous studies on natural hazards like flooding (Terpstra, Lindell, and Gutteling 2009), heatwaves (Mishra, Suar, and Paton 2009), and health risks (Wong and Jensen 2020), but also on a more general level (Paton, Smith, Daly et al. 2008) which point towards the conclusion that when citizens trust that authorities have taken effective measures to keep them safe, their desire to engage in preparation decreases and they are less likely to self-prepare.In other words, shifted responsibility to a highly trusted external actor can have a negative effect on the level of self-preparedness.Research has also shown that some communication messages can lure people into a sense of false security (lulling effect), because they believe that the government takes care of them (Graham and Weiner 1995).They therefore underestimate the risk that is supposed to impact the citizens' self-efficacy, their belief in the ability to handle the crisis, or the belief that they do not have to do anything themselves to control the risk (ibid).
If we look at the importance of institutional trust from both a risk and a crisis communication perspective, our general knowledge of message design aimed at increasing self-preparedness (Sellnow et al. 2017) is that a belief in government agencies protecting the public is beneficiary to getting a message through because you trust the sender.However, related to the fact that high trust in authorities can lead to less preparedness, we can in the context of Sweden as one of the countries where the trust in government and institutions is the among the highest in the world (Charron and Rothstein 2018), also identify a specific potential challenge in designing messages aimed at the citizens taking responsibility for their own self-preparedness.When it comes to communicative barriers that could cumber effective communication before or in times of crisis, one such barrier could then be excessively emphasizing that the government takes responsibility for all citizens.
In sum, the core of the research on predominantly natural hazards but also health risks tell us that communication messages including information about excessive institutional responsibility can lure people into a sense of false security (lulling effect) because they believe that the authorities take care of them.Here they can both underestimate the risk or the need to self-prepare, and their own perceived ability (self-efficacy) to handle the threat.To our knowledge, neither the causal relationship between responsibility messages and the effect on responsibility beliefs or self-preparedness intent, nor cases of man-made risks leading to cyber crises has been studied.We therefore formulate the following hypothesis: H1: The group of citizens exposed to the responsibility message that emphasizes government/institutions taking full responsibility for handling a cyber-attack and the collapse of national bank and payment services will have lower own responsibility beliefs and self-preparedness intent, compared to the group of citizens that weren't exposed to a message.

Government/institutions and citizen share responsibility (H2)
In their study of the paradox of the positive in public communication for preparedness, Johnston, Taylor, and Ryan (2020) claim that governments' lack of resources but also the uncertain nature of a crisis, means that governments cannot take responsibility for all citizens and therefore need to have a shared responsibility together with the citizens.In a similar manner, Cornia, Dressel, and Pfeil (2016) suggest that for managing crises in risk-cultures like Sweden, where trust in government and institutions is high, is '[…] to promote the idea that citizens and authorities share the responsibility for community preparedness and safety' (ibid, 301).Through interviews with public officials on how risk communication took place, Johnston, Taylor, and Ryan (2020) found that shared responsibility was a common topic.Shared responsibility was expressed in three different ways.First as acknowledgements that individual community members are responsible for hazard preparedness.Secondly as a type of community resilience, or with joint responsibility as a foundation for their preparedness goals.And thirdly as an awareness of a historical shift that due to the government's limited resources, citizens need to prepare themselves (Johnston, Taylor, and Ryan 2020).What we know less about, is if the reception of how messages where either government are taking all responsibility, or shared responsibility is stressed, and how this affects citizens' responsibility awareness and self-preparedness.However, there are also studies that show that the use of shared responsibility can be counterproductive.In the study by Cooper et al. (2020) of shared responsibility and community engagement in bushfire risk information in Australia, the authors question the idea that shared responsibility is a universal solution and point out that shared responsibility does not work if the citizens in the local context mistrust the official messages.We also know that preparedness can be built through communication seen as a social process.Here, people turn to others in their community to get the information they need to reduce their insecurities and assist them in their preparations (Paton et al. 2008).So, an explorative part of the study will analyze interaction effects of trust in institutions and trust in other people.

Government/institutions take no responsibility and the citizen is left with all responsibility (H3)
So, even though there are different ways of mitigating a crisis were trusting the community around you matter, we also know from studies of survivalists (Mitchell 2002;Peterson 1984) and research on prepper culture (Gonowon 2011), that those best prepared for crises are also those who distrust society and other people.Research has also shown that the prepper's identity like the survivalist is based on beliefs that other people, or the government cannot be trusted and that institutions are corrupt (Sims and Grigsby 2019).We also know that if you believe that you have no choice but to act, there is a greater incitement for self-preparedness (Hung, Shaw, and Kobayashi 2007;Baan and Klijn 2004).To test whether communicating a message where society throws in the towel and leaves the responsibility solely to its citizens, we present the hypothesis that: H3: The group of citizens exposed to the responsibility message that emphasizes that the government and institutions no longer can take responsibility in terms of protecting the citizens and that the citizens are now left to take responsibility for handling the crisis on their own, will have higher own responsibility beliefs and self-preparedness intent, compared to the group of citizens that weren't exposed to a message.

Materials and methods
A post-test only quasi-experimental cross-sectional survey research design was employed to test the research question and hypothesis.Sampling procedures, participants, message design, measurements, statistical analysis, and ethics approval statement are described in the following paragraphs.

Sampling procedures
The sample consists of participants recruited from The Swedish Citizen Panel, a nationwide panel that consists of 55,000 active respondents (80% self-recruited and 20% randomly selected) throughout Sweden, managed by the Laboratory of Opinion Research (LORE) housed at the University of Gothenburg in Gothenburg, Sweden.An a priori power analysis was carried out to determine the required size of the samples to be included in the study.A power analysis (effects size 0.20, sigma 1.4, power 0.90 and alpha 0.05) yielded a sample size of 1030 participants in each group (four groups, see section on Message Design).We over-recruited to account for respondents that choose not to participate.Even though the sample was not designed to be representative, measures were taken to stratify the samples.The sample selected for this experiment, N = 7 000, was pre-stratified to be representative of the Swedish population regarding three key demographics: gender, age, and level of education.LORE conducted the survey online, in Swedish, between 25 May 2022 and 15 June 2022.Potential respondents in the pre-stratified sample were invited to participate.The respondents selected to participate as volunteers and no compensation was provided to those who chose to participate in the study.
Among the respondents, gender in the pre-stratified sample is representative of the Swedish population, however age and education are not.In the pre-stratified sample, the elderly and the highly educated are overrepresented in relation to the general public (Statistics Sweden 2022) (see Table 1).

Participants
Out of the invited, 3 395 chose to participate, yielding a gross participation rate of 48.5%.Once participants accessed the online survey through Qualtrics.comand provided consent to participate, the survey system randomly assigned each respondent to either one of the three treatment groups or to the control group.Each respondent in each treatment group was then exposed to the stimulus messages for that group (the control-group did not receive any message).23.2% (n = 780) were assigned to the treatment that emphasizes government/institutions taking full responsibility for handling a cyber-attack and the collapse of national bank and payment services, 25.2% (n = 847) were assigned to the treatment that emphasizes that both the government/ institutions as well as the citizens take responsibility for handling a cyber-attack and the collapse of national bank and payment services, 25.3% (n = 848) participants were assigned to the treatment that that emphasizes that the government and institutions no longer can take responsibility in terms of protecting the citizens and that the citizens are now left to take responsibility for handling the crisis on their own.Finally, 26.2% (n = 879) were assigned to the control group that did not receive any news message.As highlighted in Table 1 and Table 2, neither of the demographics of the sample nor the control factors on trust vary significantly across conditions and control or treatment groups.Comments: a chi-square goodness-of-fit test indicates there was no significant difference in the proportion of men identified in the current sample (50.9%) and the value of the general population (50.4%), nor in the women identified in the current sample (49.1%) and the value of the general population (49.6%) compared to statistics sweden 2022, x 2 (1, n = 3395) = 0.262, p = 0.609.however, the chi-square goodness-of-fit test indicates there was significant difference in the proportions of the six age categories used in the sample as compared to the values of the general population ( 18 .random assignment to conditions explains why individual differences did not vary significantly across the treatment and comparison groups.Thus, we can conclude that the four treatment groups are equivalent and not significantly different from one another in terms of demographic distribution (e.g.sex, age and education).b The 71 respondents (control = 10, treatment 1 = 21, treatment 2 = 21, treatment 3 = 9) that choose the answer 'Don't'know/ Do not want to answer' , the 4 respondents (control = 2, treatment 2 = 1, treatment 3 = 1) that answered 'other' and the 52 respondents (control = 10, treatment 1 = 17, treatment 2 = 14, treatment 3 = 11) that were system missing are not included in the n and n values in the table.The reason why it does not look the same in variables related to education, gender or age has to do with the fact that those who were invited to participate in the survey are stratified on those variables and lore therefore have information about this beforehand.for the income question, on the other hand, previous answers were missing for approximately 7% of the sample that was invited, and the question was therefore asked again in the survey.

Message design
All the respondents, independent of treatment or control group, read the same crisis scenario text that described the specified type of risk with cyber-attacks in focus.The scenario related to a similar one from previous research (van Laere et al. 2017).Besides describing the same type of risk to the treatment or control groups, the aim of the crisis scenario was also to provide a scenario that heightened the risk perception for the specific type of risk, if it was not already high.This in line with PTM theory (Rogers 1983), the EPPM model (Witte 1992), and previous studies on instructional communication, for instance the IDEA model (Sellnow et al. 2017) by emphasizing the probability and severity of the consequences if the risk actually occurred.The scenario thus situated the risk as if the crisis scenario had already happened (amplified the probability aspect of the message) and the severity of the consequences was potentially amplified in the scenario text.The latter was done by adding on the specific consequences of major disruptions in the municipality's community service and difficulties in Comments: a chi-square tests for independence (Pearsons chi-square) indicated no significant association between condition and trust in Government (grouped into four categories) [X 2 (9, n = 3277) > = 8.334, p = 0.501], condition and trust in Municipality (grouped into four categories) [x 2 (9, n = 3274) = 11.631,p = 0.235], condition and trust in other people in general (grouped into three categories) [x 2 (6, n = 3280) = 4.920, p = 0.554] or condition and trust in other people in your neighborhood (grouped into three categories) [x 2 (18, n = 3281) = 18.430, p = 0.428].random assignment to conditions explains why individual differences did not vary significantly across the treatment and comparison groups.Thus, we can conclude that the four treatment groups are equivalent and not significantly different from one another in terms of control factors related to trust (e.g. in Government, in Municipality, in other people in general, and in other people in the neighborhood).b The 9 respondents (control = 2, treatment 1 = 1, treatment 2 = 1, treatment 3 = 5) that were system missing for Trust in the Government, 12 respondents (control = 2, treatment 1 = 2, treatment 2 = 4, treatment 3 = 4) that were system missing for Trust in the Municipality, 6 respondents (control = 1, treatment 2 = 3, treatment 3 = 2) that were system missing for Trust in other people in general and the 5 respondents (control = 3, treatment 2 = 1, treatment 3 = 1) that were system missing for Trust in the people in my neighborhood are not included in the n and n values in the table.The reason why is that previous answers were missing in the sample that was invited, and the question was therefore asked again in the survey.
procuring vital necessities such as food, fuel, and medicine, and that it could take several weeks or months before things would get back to normal again.
In our quasi-experimental design, the respondents were randomly assigned to one of the three treatment groups or to the control group.The treatment for each group consisted of a simulated text (approximately 100 words long), announcing messages of taken and/or suggested responsibility.To clarify, responsibility was emphasized either through describing measures taken/not taken to handle the crisis, or messages suggesting measures to take to handle the crisis or downplaying the measures.
The first treatment group read a statement that emphasized 'the lulling effect' (Wood et al. 2012), indicating that the municipality succeeded in taking responsibility for the situation, while the responsibility of the individual was described in the most passive kind of way.The second treatment group read a statement that emphasized 'shared responsibility' (Johnston, Taylor, and Ryan 2020), where both the municipal responsibility as well as that of the individuals to handle or how they handled the cyber crises was described.The statement read by the third treatment group emphasized a 'survivalist' (Gonowon 2011;Mitchell 2002;Peterson 1984) perspective, where the municipality failed in every way to take their responsibility, and the individual was left to take responsibility as best he/she could.The control group was not exposed to any message on responsibility.
After reading the scenario and treatments, the participants completed the survey.Before the respondents exited the survey, they were informed of that the news text used was simulated, apologized if worry was caused, and the purpose of the survey was specified.There was also a possibility to leave open-ended comments on the survey and the email address of the responsible researcher was given for possibility to ask questions.

Measurements
The dependent variables 'responsibility beliefs' and 'self-preparedness intent' were operationalized in the following way.

Responsibility beliefs (dependent variables)
The two questions on responsibility beliefs were asked directly after the scenario and treatments.They both relate to previous research on natural hazards (Lindell, Arlikatti, and Prater 2009;Lindell and Perry 2000;Martin, Martin, and Kent 2009;McNeill et al. 2013;Mulilis and Duval 1997) and disaster preparedness (Lindell and Whitney 2000;Martin, Martin, and Kent 2009;Mulilis and Duval 1997), where own responsibility beliefs (perceived protection responsibility or locus of responsibility) positively correlate with own self-preparedness measures.
The first question asked the respondents to consider the scenario and reflect on what responsibility the respondents thought that they themselves and other groups have in order to avoid that they themselves are seriously injured.The first item 'My self' measured the own responsibility beliefs.The answers were measured on a four-point Likert-type scale ranging from 'Have a very small responsibility' (1) to 'Have a very large responsibility' (4).The second question emphasized the behavioral dimension of responsibility beliefs and asked the respondents to imagine that the cyber-attacks happened today and answer what responsibility the respondents thought that they themselves and other groups would take so that they themselves would not be seriously injured.The items were the same as in the first question and the answers measured in the same way but ranging from 'Would take a very small responsibility' (1) to 'Would take a very large responsibility' (4).

Self-preparedness intent (dependent variable)
The question of self-preparedness intent asked to which extent one would self-prepare for cyber-attacks similar to the one in the scenario, measuring self-preparedness intention, after the scenario and treatments, and after the questions on responsibility beliefs.The answer to the question was measured on a four-point Likert-type scale ranging from 'To a very small extent' (1) to 'To a very large extent' (4).

Control variables
Age, education, income, and trust in the government and the municipality, and trust in people in general as well as in their neighborhood were used as control variables.The reasons for this were that previous research has shown these variables to be related to either responsibility beliefs and/or self-preparedness.Elderly people are better prepared than younger (Brown et al. 2016), and individuals with higher income and education are better prepared than those with lower (Wisner, Blaikie, Cannon et al. 2003) and attribution to self-responsibility only occurred if the individual also had the necessary resources to handle the situation (Lalwani and Duval 2000).Previous research has shown that responsibility beliefs are linked to the question of trust in institutions (Mishra, Suar, and Paton 2009;Paton et al. 2008;Terpstra, Lindell, and Gutteling 2009;Wachinger et al. 2013;Wong and Jensen 2020) as well as trust in other people in the community (Paton et al. 2008).
Table 1 presents sample values for the demographic variables, and Table 2 presents sample values for the trust variables.As is noted in the comments to both tables, neither of the demographics of the sample nor the control factors on trust vary significantly across conditions and control or treatment groups.

Statistical analysis
IMB SPSS 29.0.0 was used to do statistical analyses.The data was analyzed using an analysis of variance (ANOVA) coupled with a Tukey's post hoc test (to test for significant differences between treatment groups for single measure items).

Ethics approval statement
The study was conducted in accordance with the Declaration of Helsinki.Ethical review and approval were not required for the study on human participants in accordance with the national legislation and institutional requirements (according to Swedish legislation, ethical review is only demanded for studies involving personal sensitive information).This survey study did not ask for or use any personal sensitive information.All respondents gave their informed consent for inclusion before they participated in the study.

Results
The aim of the study was to identify how citizens' reception of responsibility messages concerning a cyber-crisis event would influence how residents view their own responsibility awareness and self-preparedness intent.The effects were tested through three hypotheses and an explorative study of interaction effects.
The results of the one-way ANOVA tests for variance in responsibility beliefs revealed a statistically significant difference in average mean between the control group and the treatment groups in the beliefs that one has (F(3)=25.935,p < 0.001) as well as that one would take (F(3)=14.056,p < 0.001) own responsibility so that one does not come to severe harm in a similar event as in the scenario (Table 3).Thus, what we now know is that all three hypotheses in some ways might support the predicted effects on the responsibility awareness.However, what we still don't know is between which treatment group/groups and the control group, the variance is statistically significant.However, there were no statistically significant differences in average mean between the control group and the treatment groups that that had the intent to self-prepare (F(3)=0.551,p=.647) (ibid).Thus, we also know that neither of the three hypotheses support effects on self-preparedness intent.
The first hypothesis predicted that the group of citizens exposed to the responsibility message that emphasizes government/institutions taking full responsibility for handling a cyber-attack and the collapse of national bank and payment services would have lower own responsibility beliefs and self-preparedness intent, compared to the control group, a so called 'lulling effect' .A Tukey post-hoc test did however not detect any significant pairwise differences in average mean between the control group and the group exposed to the lulling effect treatment, neither for responsibility beliefs that one has or that one would take responsibility.Thus, the first hypothesis, with a decrease in responsibility beliefs was not supported.As previously showed neither of the hypotheses support effects on self-preparedness intent The second hypothesis predicted that the group of citizens exposed to the responsibility message that emphasizes that both the government/institutions as well as the citizens take responsibility for handling a cyber-attack and the collapse of national bank and payment services would have higher own responsibility beliefs and self-preparedness intent, compared to the control group.A Tukey post-hoc test revealed significant pairwise differences in average mean between the group exposed to the shared responsibility treatment, and control group (with an average difference of .24,p < 0.001 for the belief that one have own responsibility, and with an average difference of .11,p=.02 for the belief that one would take own responsibility) when it came to beliefs that one has an own responsibility in a similar situation.Thus, the second hypothesis was supported with increased responsibility beliefs, and as previously showed.As previously showed neither of the hypotheses support effects on self-preparedness intent.
The third hypothesis predicted that the group of citizens exposed to the responsibility message that emphasizes that the government and institutions no longer can take responsibility in terms of protecting the citizens and that the citizens are now left to take responsibility for handling the crisis on their own, will have higher own responsibility beliefs and self-preparedness intent, compared to the control group.A Tukey post-hoc test revealed significant pairwise differences in average mean between the group exposed to the survivalist treatment, and the control group (with an average difference of .23,p < 0.001 for the belief that one has an own responsibility, and with an average difference of .16,p < 0.001 for the belief that one would take own responsibility) when it came to beliefs that one has own responsibility in a similar situation.Thus, the third hypothesis was supported with increased responsibility beliefs.As previously showed neither of the hypotheses support effects on self-preparedness intent.
In the more explorative regression analysis of the interaction effects that we tested for, there were significant interaction effects of level of income, and trust in the people in your neighborhood, but none related to level of education, trust in the government, trust in the municipality that you live in, or trust in other people in general.For those exposed to the survivalist message, the lower the trust in other people in your neighborhood, the more own responsibility you would take in a similar situation (see appendix).However, the lower the income, the less the preparedness intent, due to exposure to the survivalist message (see appendix).

Discussion
The results from the experiment lead us to a crucial conclusion: responsibility messaging, particularly when emphasizing shared responsibility and necessity, can positively influence citizens' own responsibility beliefs, even in the presence of messages that emphasize excessive responsibility assumed by the state or municipality.This finding specifically pertains to cyber crises within the context of Sweden.Therefore, it is reasonable to suggest that emphasizing citizens' responsibility awareness in crisis preparedness policies, by both public officials, communicators, and journalists, can be effectively achieved through risk communication before and crisis communication during a crisis.In the following sections, we will discuss this main conclusion in detail, exploring its implications for policy and practice, identifying areas for further research, and acknowledging the limitations of our study.
The results indicated that messages sharing responsibility between the municipality and individuals concerning cyber crisis preparedness and management increased respondents' beliefs in taking own responsibility are encouraging.This finding supports previous research by Johnston, Taylor, and Ryan (2020) in the broader context of preparedness, emphasizing the need for citizens to recognize the shared responsibility for their own protection.It also aligns with the proposition made by Cornia, Dressel, and Pfeil (2016) that in a state-oriented risk culture like Sweden, it is essential to promote the idea that authorities and citizens share the responsibility for preparedness and community safety during a crisis in general.However, while responsibility awareness is a crucial component of crisis preparedness policies in many countries, and governments advocate for shared responsibility, they often lack a clear communication plan on achieving this goal (Monteil et al. 2022;Singh-Peterson et al. 2015).Based on our findings, the policy and practical implications of emphasizing shared responsibility in risk messaging before and during a cyber crises should involve clear communication on how authorities assume their responsibility and what actions individuals are expected or recommended to take.However, caution must be exercised as this recommendation may not be universally applicable (Cooper et al. 2020), as shared information with shared responsibility has been shown to be ineffective if citizens in the local context distrust official messages (ibid).Therefore, this recommendation is possibly particularly relevant for countries with similar characteristics as Sweden, where citizens generally have high trust in institutions.
Contrary to previous research, which examined the effects of messages where the government assumes all or most of the responsibility, our study did not find any reduction in beliefs about individual responsibility in the cyber crisis context.This result particularly contradicts the prevailing literature on general preparedness, which suggests that communication can induce a false sense of security, known as the 'lulling effect' , by fostering the belief that the government will fully take care of individuals (Johnston, Taylor, and Ryan 2020).It has also been suggested that excessive confidence in governmental protection during disastrous situations could lead to a decreased need for personal actions (Wachinger et al. 2013).
Nevertheless, it is crucial to delve into the reasons behind the absence of lulling effects regarding beliefs about individual responsibility in coping with the cyber crisis.Furthermore, we should explore the possibility that our findings have contributed to a more comprehensive understanding of the role of trust.This includes examining how trust impacts the effectiveness of authorities in communicating messages and the challenges associated with excessive trust in institutions within a state-oriented risk culture.High institutional trust in Sweden appears to coexist with or amplify individuals' sense of responsibility.If the state or municipality assumes a significant responsibility, citizens may also adopt a similar mindset.This line of reasoning aligns with the observation made by Cornia, Dressel, and Pfeil (2016) that state-oriented risk cultures are characterized by well-established democracies with well-functioning public authorities.This, in turn, could lead to a stronger relationship between the opinions of the state and the those held by the citizens.A similar pattern can be observed in previous research on institutional trust and trust in others, where institutional trust can foster trust in other people (Charron and Rothstein 2018).In other words, if institutions assume a significant responsibility for cyber crisis management, citizens may also feel inclined to take on their own responsibilities.However, the findings from the experiment which partly question the 'lulling effect' in the Swedish cyber crisis context have potential practical implications for related public officials such as safety, risk, and crisis managers with communication duties.It cautiously suggests that it may be 'safe' to use responsibility messages that overemphasize the state or municipalities taking full or almost full responsibility for crisis management during a cyber crisis, without risking citizens neglecting their own responsibility.
Our study also contributes explicit knowledge regarding citizens' reception of survivalist-inspired responsibility messages concerning the cyber crisis, where the municipality could not assume responsibility and citizens were left to their own devices.We found that these messages increased respondents' beliefs in taking personal responsibility.So, how should we interpret this result?One possible explanation is that the message conveys the idea that citizens have no choice but to act.This supports previous explanations provided by Hung, Shaw, and Kobayashi (2007) and Baan and Klijn (2004).Another explanation relates to the implications of trust for responsibility awareness.Our exploratory analysis revealed that citizens with lower income or fewer social resources, indicated by lower trust in their neighborhood, were the most affected by the survivalist responsibility message.In essence, lower socioeconomic resources can make individuals more vulnerable to survivalist messages, leading them to rely on their own abilities, which could eventually result in diminished trust in institutions.Paton et al. (2008) suggested that preparedness could be fostered through communication as a social process, where people seek information from others in their community to alleviate their concerns and assist them in their preparations.Based on our results, we recommend conducting additional research on citizens' mistrust in institutions and other people within local communities in high-trust countries.
Although our study found that messaging regarding the responsibility for cyber-crises can enhance awareness of personal responsibility, it did not influence the intent to prepare oneself.This outcome is consistent with Bodas et al. (2015) study on responsibility beliefs related to the adversarial risk of war, which did not show a significant impact on household preparedness.However, our results contradict previous research on natural hazards and disaster preparedness (Lindell, Arlikatti, and Prater 2009;Lindell and Perry 2000;Lindell and Whitney 2000;Martin, Martin, and Kent 2009;McNeill et al. 2013;Mulilis and Duval 1997), where personal responsibility beliefs led to increased self-preparedness.This disparity in results can potentially be attributed to the unique characteristics of cyber crises, man-made technological risks with antagonistic elements, which introduce intriguing and potentially distinct elements of responsibility and trust.Consequently, this creates different conditions for designing effective responsibility communication messages, compared to natural hazards.Cyber risks and crises, to a greater extent than natural hazards, seem to fall into the complex category where individuals lack personal experience, making it challenging for them to assess the risks and perceive the dangers.Thus, trust in experts or expert systems administered by authorities (e.g.Giddens 1999) becomes especially important in communicating the risk of cyber-attacks before and during cyber crisis.However, it is important to note that our study's findings are preliminary.
The present study has some additional limitations which should be considered when the results are interpreted.Even though the sample sizes of the groups primarily were built for high power, to avoid the serious cost of failing to find things that are not there and doing the experiment all over again, the large sample size could cause type I errors (finding things that are not there) in the analyses.In guarding against type I error inflation, we kept down the number of hypothesis and variables, since the number of hypotheses and variables increases the probability of the occurrence of investigation-wise type I errors (Cohen 1982).While we did establish a causal relationship between responsibility messaging during a cyber-crises event and responsibility beliefs, like all studies with elements of explorative characteristics further research is needed to replicate the findings and explore the specific conditions in greater depth.Specifically, additional investigation into messaging of responsibility concerning man-made cyber crises in other geographical contexts is warranted to gain a more comprehensive understanding.

Disclosure statement
No potential conflict of interest was reported by the authors.

Appendices
If you do not trust other people in your neighborhood the effect on taking own responsibility (b=.500, p < 0.001) is larger than the effect in the model without the interaction effect (b=.158, p < 0.001).In the model without the interaction effect the coefficient shows the average for all values for trust in other people in your neighborhood, but now we can see that the positive effect of not trusting is stronger.So, if the respondent does not trust, the effect of the survivalist message is stronger.The effects of the survivalist message manipulation on taking own responsibility if you have a high trust (b=.126,p < 0.001) is however smaller than the effect in the model without the interaction effect (b=.158, p < 0.001).So, if the respondent has a high trust, the effect of the survivalist message is weaker.None of the values with control for the confidence intervals overlap 0, so to summarize both effects are significant independent the levels of trust.
If you have a low income the effect (b= − 296, p = 0.004) on behavioral intention is larger than the effect in the model without the interaction effect (b= −0.023, p = 0.531).In the model without the interaction effect the coefficient shows the average for all income, but now we can see that the negative effect of low income is stronger.So, if the respondent has a low income, the effect of the survivalist message is negatively stronger.The effects of the survivalist message manipulation on self-preparedness intent if you have a high income is b= −0.037), which also is larger than the effect in the model without the interaction effect (b= −0.023).So, if the respondent has a high income, there is no effect of the survivalist message is also negatively stronger.However, even though the values with control for the confidence intervals for low income do not overlap 0, the confidence interval for high income do.The confidence interval is significant for low and middle income, but not for high income.

Table 1 .
sociodemographic characteristics of participants by condition.a

Table 2 .
Trust factor characteristics of participants by condition.a

Table 3 .
Descriptive statistics between-subjects results for responsibility awareness and self-preparedness intent (average mean).