There is a lot of drama surrounding the subject of security awareness. Whether it is because of the limited resources available in the face of ever-increasing demand, or the fact that awareness measures are still largely the responsibility of technically trained security experts – one could say that security awareness is surrounded by an air of tragedy.
How can you get users to manage data and devices securely? People have long wondered how to craft a message that moves people (to do something) – since well before the invention of advertising or awareness campaigns. It’s the same problem that lies at the heart of artistic communication between actor and audience. This article is, therefore, not about drama in the proverbial sense, but rather about literary drama as a work of art (of the theatre). Can literary scholarship provide us with insightful answers to this big question? First, we’re going to have a look at Aristotle and the Classical Drama.
Aristotle and catharsis
Aristotle, the founding father of the drama, provided us with a set of rules for writing a play with his Poetics, which had an unparalleled influence on the literary genre from Sophocles to Goethe and well into the 19th century.
At the heart of Aristotle’s definition of tragedy is the concept of imitation (mimêsis), which he considers fundamental to human existence. His concept of imitation is like a kind of gamified learning. He argues that we learn by imitating others – e.g. our parents – and that we are rewarded with joy by this act of replication at the same time since it is fun.
A good tragedy allows the audience to identify with the stage characters and to suffer with them. Therefore, the audience experiences the ups and downs of life and is purified of its own ‘bad’ emotions. Aristotle uses the term catharsis (Κάθαρσις, Greek for ‘purgation’) for this dynamic. Iphigenia’s powerlessness, Creon’s grief and Medea’s anger are lessons and substitutes for one’s own experiences – the audience learns indirectly from the mistakes made by the plays’ characters.
In this context it is important to note that in Aristotelian Drama it is always apparent what is a mistake or not, what is right or wrong, what is to be rewarded or punished. For Aristotle, it is the divine laws that provide a definite basis for judging an action – later, these would become social customs.
Influence on Schiller and Hamlet
Friedrich Schiller’s speech, Die Schaubühne als eine moralische Anstalt betrachtet, depicts the influential power accredited to tragedy and its cathartic forces. In 1784, the German writer enthusiastically discussed the effect of the theatre in front of the Kurpfälzische Deutsche Gesellschaft in Mannheim:
«So gewiß sichtbare Darstellung mächtiger wirkt, als todter Buchstabe und kalte Erzählung, so gewiß wirkt die Schaubühne tiefer und dauernder als Moral und Gesetz.»
Since theatre is able to portray rule-compliant coexistence in a lively and accessible way, it reinforces the messages of religion and law. The audience is given practical and convincing instructions and references for behaviour.
However, the power of theatre has its limits too – as e.g. Shakespeare’s Hamlet had discovered. The King of Denmark is dead and his son Hamlet suspects his uncle of murder. To confirm his suspicion, Hamlet organises an evening of theatre. The play depicts the alleged crime and reveals the murderer on the basis of his emotional reaction. To the Danish prince, the uncle’s reaction is proof enough that he is guilty of murdering the king. But of course, his emotional identification with the murderer on stage is not sufficient to convict and punish the uncle. It is difficult to bridge the gap between theatre and reality. A guilty conscience does not necessarily call for major, meaningful action to be taken.
Conclusion: Aristotle and security awareness
Now let’s replace the divine world order with the security guidelines of an organisation. Then Aristotle’s remarks on drama can be used to draw some inspiration for security awareness campaigns. In this context, communication measures must be designed such that employee identification is encouraged and they are freed from their desire to behave in an unsafe manner.
In order to achieve this, security awareness campaigns must mimic reality and present the repercussions of bad behaviour in a comprehensible way. For example, a violation of the security guidelines can be narrated tragically – like in an article, newsletter, poster or video – beginning with the motivation, moving on to the misbehavior followed by the consequences, and finally relieved by penance and remorse. This kind of campaign needs to be centered around a heroic character with whom employees can identify. As a proxy for the target audience, this character makes mistakes and, like Creon in Sophocles’ Antigone, the prime example of Classical Drama, comes to the conclusion: «I’ve learned it in my pain.» The empathetic suffering the audience experiences as a result encourages them not to make these mistakes. At least that’s the theory. As we have already established by the example of Hamlet, bridging the gap between theatre and reality is not quite that simple.
This is where Bertolt Brecht’s concept of Epic Theatre comes in. He strives to move away from the Theatre of Illusion, from identification and purification, towards the active re-evaluation of reality by the audience. More on this in Part II.
 Schiller, Friedrich: Die Schaubühne als eine moralische Anstalt betrachtet. In: Schillers Sämmtliche Werke, vol. 4. J.G. Cotta’sche Buchhandlung, Stuttgart, 1879: 39-46. P. 42.