Please ensure you read this participation information sheet in its entirety. Once you have read it, you may scroll to the bottom of the page where you will see the "create account" button.


MSc Cybersecurity student

24 July 2024 Faculty of Science School of Computing Sciences
University of East Anglia
Norwich Research Park
Norwich NR4 7TJ
United Kingdom

Email: mukutiller@gmail.com Tel: +4459704804 Web: www.uea.ac.uk

PARTICIPANT INFORMATION SHEET
(1) What is this study about?

You are invited to take part in a research study I am conducting as part of a postgraduate study for my Cybersecurity course. The purpose of this study is to investigate the factors contributing to poor password hygiene among users as well as assessing the impact of stringent security rules on users’ password fatigue. Furthermore, I aim to compare password hygiene practices between different user groups.


This Participant Information Sheet tells you about the research study. Knowing what is involved will help you decide if you want to take part in the study. Please read this sheet carefully and ask questions about anything that you don’t understand or want to know more about.
Participation in this research study is voluntary. By giving consent to take part in this study you are telling us that you:

 Understand what you have read.
 Agree to take part in the research study as outlined below.
 Agree to the use of your personal information as described.
 You have received a copy of this Participant Information Sheet to keep.

(2) Who is running the study?

The study is being carried out by the following student - Mr Mukudzei Chauruka - who is conducting this study as the basis for the degree of MSc Cybersecurity at the University of East Anglia. This will take place under the supervision of Miss Sally Earl and Miss Debbie Taylor.

(3) What will the study involve for me?

It would simply require you to perform the following steps:

1. Create an account on the webpage I have created by inputting a username and password (It is important that you do not use a password you curently use for any existing accounts).

2. Log into said account.

3. Fill out a survey about your password practises.
Once participants have created their accounts and filled out the survey, I will observe whether certain security measures lead to a higher cognitive load on a user and whether there is a correlation between a particular group and their password practises.

You will not have the opportunity to review information generated about you prior to publication.

(4) How much of my time will the study take?

5 - 10 minutes

(5) Do I have to be in the study? Can I withdraw from the study once I have started?

Being in this study is completely voluntary and you do not have to take part.
Your decision whether to participate will not affect your current or future relationship with the researchers or anyone else at the University of East Anglia now or in the future.
If you decide to take part in the study, you can withdraw your consent at any point before you submit the results of your first questionnaire.
(6) What are the consequences if I withdraw from the study?

If you decide to take part in the study and then change your mind, you are free to withdraw at any time before you have submitted the questionnaire. Once you have submitted it, your responses can only be withdrawn by contacting the researcher via the information provided.
(7) Are there any risks or costs associated with being in the study?

Aside from giving up your time, we do not expect that there will be any risks or costs associated with taking part in this study.
(8) Are there any benefits associated with being in the study?

You will benefit from learning about your own password behaviours and the risks assocciated with them.

The broader community will benefit from the study because security designers will be encouraged to communicate and collaborate with users in the future.

(9) What will happen to information provided by me and data collected during the study?

The information you provide will be analysed by myself and then added to my dissertation project but will remain anonymous.


Your personal data and information will only be used as outlined in this Participant Information Sheet, unless you consent otherwise. Data management will follow the Data Protection Act 2018 (DPA 2018) and UK General Data Protection Regulation (UK GDPR), and the University of East Anglia's Research Data Management Policy.

The information you provide will be stored securely and your identity will be kept strictly confidential, except as required by law. Study findings will be used for the purposes of my dissertation and may also be used for other scholarly and educational purposes such as research publications and in teaching. Although every effort will be made to protect your identity, there is a risk that you might be identifiable due to the nature of the study and/or results if you decide to participate in this study. Where the study findings are solely used for the dissertation, the data will be destroyed following the examination of the dissertation. Where the study findings will also be used for other purposes such as publications, the data will be kept for at least 10 years beyond the last date the data were used. The study findings may be deposited in a repository to allow it to facilitate its reuse. The deposited data will not include your name or any directly identifiable information about you.

(10) What if I would like further information about the study?
When you have read this information, Mr Mukudzei Chauruka (mukutiller@gmail.com, +4459704804) will be available to discuss it with you further and answer any questions you may have.

(11) Will I be told the results of the study?
You are not able to receive feedback about the overall results.

(12) What if I have a complaint or any concerns about the study?
If there is a problem please let me know. You can contact me via the University of East Anglia at the following address:

Mr Mukudzei Chauruka
School of Computing Sciences
University of East Anglia
NORWICH NR4 7TJ
mukutiller@gmail.com
+4459704804
If you would like to speak to someone else you can contact my supervisor: Miss Sally Earl (s.earl@uea.ac.uk). If you are concerned about the way this study is being conducted or you wish to make a complaint to someone independent from the study, please contact the Head of School of Computing Sciences: Raheel Hassan (raheel.hassan@uea.ac.uk, ).

(13) How do I know that this study has been approved to take place?
To protect your safety, rights, wellbeing and dignity, all research in the University of East Anglia is reviewed by a Research Ethics Body. This research was approved by the SCI S-REC (Faculty of Science Research Ethics Subcommittee).

(14) What is the general data protection information I need to be informed about?
According to data protection legislation, we are required to inform you that the legal basis for processing your data as listed in Article 6(1) of the UK GDPR is because this allows us to process personal data when it is necessary to perform our public tasks as a University.

In addition to the specific information provided above about why your personal data is required and how it will be used, there is also some general information which needs to be provided for you:

• The data controller is the University of East Anglia.
• For further information, you can contact the University’s Data Protection Officer at dataprotection@uea.ac.uk
• You can also find out more about your data protection rights at the Information Commissioner's Office (ICO).
• If you are unhappy with how your personal data has been used, please contact the University’s Data Protection Officer at dataprotection@uea.ac.ukin the first instance.

(15) OK, I want to take part – what do I do next?

Continue to the account creation page.

If there are changes to the information provided, you will be notified by email or text