Analysts International

Cyber Ethics in K-12

2

Introductions• Mark Lachniet from Analysts International,

Sequoia Services Group• Former I.S. Director of Holt Public Schools• Senior Security Engineer and Security

Services technical lead• Frequent presenter and trainer• Certified Information Systems Security

Professional (CISSP)• Microsoft MCSE, Novell Master CNE, Linux

LPI Certified LPIC-1, Check Point Certified CCSE, TruSecure TICSA, etc.

3

Agenda• Cyber ethics and Computer Security

• Issues to consider (target age, success indicators, integration with curriculum, etc.)

• Growing up with computers

• The 10 Commandments of Computer Ethics

• Intellectual property, copyright, fair use

• Student safety

• Computer etiquette

• Computer security

• Tips for teachers, parents, students and districts

• Cool resources

• Acceptable Use Policies

• Web Sites

4

Disclaimer• Alas, I am no longer working directly in

education, I am now a consultant• It is somewhat “phony” for me to give this

presentation, because I haven’t personally done it• However, this topic is very relevant to a number

of organizations that I am a member of (HTCIA, Infragard, ISC^2, etc.), to me personally, and because it is something our society really needs to address (and hasn’t)

• If nothing else, I can help to process some of the available resources, put together lists of good materials, and maybe get a dialog going

• Perhaps even assist in an implementation or two if someone is serious about it

5

Cyber Ethics and Security• Many of the available resources mix together topics

of computer ethics and computer security• For example, mixing software piracy in with hacking

and viruses in the same curriculum• These are somewhat different topics, because we are

talking about being on the initiating end (ethics) and the receiving end (security)

• However, this is probably the best way to approach it, as they flow well, and you probably don’t have the time or resources to do each of them as separate units

• One way to think about this is that we have an ethical responsibility to protect ourselves, as part of being a good Internet citizen (spreading viruses, etc.)

• From this point on, we’ll discuss them under the umbrella topic of “ethics” despite the slight misnomer

6

What are “Cyber Ethics” ????• http://www.cybercitizenship.org/ethics/ethics.html

• “Character is what you do when no one is watching”

• Essentially, this is all about responsible social behavior, and not about technology

• Don’t cloud the waters by talking too much about technology – technology is just the vessel – use metaphors that relate issues to the real world

• At Holt Schools, we took the perspective that (for example) looking at porn on the computer is no different than bringing in a naughty magazine

• Similarly, an invasion of privacy (looking at or deleting files, for example) is no different than going into someone’s locker or bag without permission

7

What are “Cyber Ethics” ????• Unfortunately, our society has not done a good job of

reinforcing the parallel between the computer and real worlds

• Many people (most people?) trivialize computer ethics:– Copying music (MP3) and software is widespread for

adults as well as children– Copyright is misunderstood, “fair use” as well– There is a myth of the “hyper intelligent hacker” –

many parents, when confronted with their children’s inappropriate behavior respond that they are proud that their children are smart

– “At least they aren’t on the streets” (presumably doing physical crimes, instead of electronic ones)

– Hacking isn’t a real crime, or if it is, there is no way they will really be caught and/or prosecuted

8

Growing Up With Technology• I believe that there is a disconnect between

generations – those who grew up with technology and those who did not (I’m of the former)

• Technology can provide a window to a different world for students that is compelling

• Information = POWER. Young people seek power. Many avenues are closed to them, but in the anonymous world of the Internet, there are many opportunities:– The 14-year old stock broker (respect and $$)– The online “Anarchists Cookbook”, guns, blowing

things up, and the “trench coat mafia”– Access to counter/sub-culture (sex, drugs, music, etc.)– Future job potential and $$ (jobs in technology)– The power to mess people up! (phreaking/hacking)

9

10

Issues To Consider• What is the ideal age to start?• What topics to you direct at each age group?• Should you integrate ethics with the existing

curriculum (Intro to computing? Keyboarding? Library orientation?)

• How much do you tell children about the bad people that are out there?

• How will you know if you are successful?• How will you pay for it? Are grants

available? (I couldn’t find any)• What topics are important to cover, and what

resources are available for teachers?! (here are a few)

11

The 10 Commandments of Computer Ethics

(From the Computer Ethics Institute

http://www.brook.edu/its/cei/cei_hp.htm) 1. Thou Shalt Not Use A Computer To Harm

Other People

2. Thou Shalt Not Interfere With Other People’s Computer Work

3. Thou Shalt Not Snoop Around In Other People’s Computer Files

4. Thou Shalt Not Use A Computer To Steal

5. Thou Shalt Not Use A Computer To Bear False Witness

12

The 10 Commandments of Computer Ethics

6. Thou Shalt Not Copy Or Use Proprietary Software For Which You have Not Paid

7. Thou Shalt Not Use Other People’s Computer Resources Without Authorization Or Proper Compensation

8. Thou Shalt Not Appropriate Other People’s Intellectual Output

9. Thou Shalt Think About The Social Consequences Of The Program You Are Writing Or The System You Are Designing

10. Thou Shalt Always Use A Computer In Ways That Insure Consideration And Respect For Your Fellow Humans

13

Intellectual Property“Information Wants to be Free”• One of the biggest areas to address in ethics• We must differentiate between cost in the sense of

“cost to distribute” and “cost to create” or inherent value

• The incorrect logic is that since it costs virtually nothing to copy a CD or cut-n-paste some text, that therefore it is not wrong – nobody is harmed

• Whether this is true or not depends upon the type of information we are talking about – is it something that is intended to be free and a benefit to society such as a technological standard?

• The fallacy of this lies in economics – if enough people copied it for free, there would be no impetus for the information to be developed

14

Intellectual Property“Information Wants to be Free”• To some degree, I think some schools may muddy the

issue about Int. Property, copyright and fair use• School systems frequently use the “fair use” standard

to provide a lot of information to students• Since most people learn about intellectual property in

the school system, we may be inclined to think that it is okay to copy articles, pictures, movies, etc. outside of the school environment

• Do we ever tell our students “its okay to copy this movie because of a concept called fair use, but its not okay to do at home”?

• The argument is also made that if the sole purpose of the copying is personal education, then it is okay (even outside of the school environment)

15

Physical Property vs. Intellectual Property

• One way to get the point across is to talk about the similarities between Intellectual and Physical property. There are many scenarios

• For students: “Imagine that you spend weeks painting a really great picture - so good that you could sell it to someone. Now imagine that someone broke into your locker and stole the picture. Would that be okay? What if someone borrowed it, copied it, returned it and sold it before you could. Would that be okay? What if they just gave it away to anyone who wanted it, and claimed it was theirs?”

• Lets not forget simple economics – if nobody paid for it, there would be no motivation to develop it in the first place and we would not have as much good stuff to read, listen to or install

16

Copyright• http://www.csusa.org/copykids/cbasicsframes.htm • Copyrights are used to protect the rights of authors• Specifically, it gives you the right to control how your

works are used – you alone can decide• For example: making copies, performing or

displaying the work publicly, making derivative works, etc.

• Things that are protected by copyright:Literary works Computer softwareMusical works Dramatic worksChoreographic works Pictures, sculpturesMotion pictures Audio/Visual worksSound recordings Architectural works

17

Fair Use• http://www.csusa.org/copykids/teachrentframes.htm • Fair Use is the main exemption to copyright but it is

not all-encompassing!• It is the right to make copies without explicit

permission, granted only under certain circumstances• “For purposes such as criticism, comment, news

reporting, teaching, scholarship, or research.“• Must take into consideration several things:

– The purpose and character of use (commercial?)– The nature of the work (is it creative, or factual?)– The amount of the work used (a paragraph?)– The effect of the use (taking $ away from author?)

• An online quiz you can use:http://www.csusa.org/copykids/quizframes.htm

18

Student Safety• Protecting our students should be the

highest priority• Sexual predators are not just a myth –

they are really out there and they are really trolling for victims

• If you don’t believe me, try creating a chat room account as a 13 year old girl who “likes boys” and watch the chat requests start coming in

• We need to teach personal safety to students

19

Student Safety – Kids Rules1. Check http://www.safekids.com/kidsrules.htm for a

list of “Kids’ rules for Online Safety” or (800) 843-5678 for a copy

2. I will not give out personal information such as my address, telephone number, parents’ work address/telephone number, or the name and location of my school without my parents’ permission

3. I will tell my parents right away if I come across any information that makes me feel uncomfortable

4. I will never agree to get together with someone I "meet" online without first checking with my parents. If my parents agree to the meeting, I will be sure that it is in a public place and bring my mother or father along

5. I will never send a person my picture or anything else without first checking with my parents

20

Student Safety – Kids Rules5. I will not respond to any messages that are mean or

in any way make me feel uncomfortable. It is not my fault if I get a message like that. If I do I will tell my parents right away so that they can contact the service provider

6. I will talk with my parents so that we can set up rules for going online. We will decide upon the time of day that I can be online, the length of time I can be online, and appropriate areas for me to visit. I will not access other areas or break these rules without their permission

7. I will not give out my Internet password to anyone (even my best friends) other than my parents

8. I will be a good online citizen and not do anything that hurts other people or is against the law

21

Computer Etiquette• Helping students to understand computer etiquette will

improve their experience on the Internet (they will be better received, and receive less abuse)

• Written email is very hard to interpret! You must be very clear about your intentions, and must also give people the benefit of the doubt when reading

• “Do unto others as you would have others do unto you” Remember that these are real people!

• Avoid flames – NEVER send an email when you are angry – you will regret it! (as many of us can attest)

• DON’T TYPE IN ALL CAPS!!!!• Do not use rude, obscene or abusive language• Format your text, use a dictionary• Remember that a LOT is archived on the Internet – your

comments may haunt you in the future (job interviews for example)

22

Computer Security• To be a good “cyber citizen” we must understand the

rudiments of computer security• If not to protect our own data, then because we don’t

want to be a third party to something nasty such as a virus outbreak or have someone use our computers to hack others

• Viruses and prevention practices• E-mail and Attachments• Downloading and running programs from unknown

sources (especially peer-to-peer like KaZaa, Morpheus, Instant Messanger, IRC)

• More technical topics in secondary schools – firewalls, patching computers, VPNs, etc.

23

Tips for Teachers• http://www.educationworld.com/a_tech/tech055.shtml • Draw parallels between the real world and the

electronic world• Involve students in constructive activities• Post a written acceptable use policy in your classroom,

and include the consequences for violating it• Reinforce proper behavior. Treat offenses as mistakes

rather than "crimes," especially in the beginning • Assign students to work with technology buddies, other

students who have already worked with technology and will set a good example. Peers can help sell a point that students might not accept from adults

• Take advantage of every teachable moment• Don't model inappropriate behavior • Instill a sense of responsibility, point out the real costs

of misusing technology

24

Tips for Parents• Parent involvement will make a huge difference• Thus, our efforts should include communications

with parents to keep them informed of what we are doing and what they can do to help (some of these letters are already written for you!)

• Tips for parents:– Education *yourself* about the issues– Discuss the technical and ethical issues of computers– Discuss “bad people” and “bad sites” – they are

probably going to hit a pornographic web site by accident eventually (www.whitehouse.com for example)

– Monitor computer usage– Use filtering software and parent lockout features– Create a “computer contract” that defines what is

okay, and what is not

25

Tips for Districts• http://www.techlearning.com/db_area/archives/TL/

112000/cyberethics.htm

• The following are things to be aware of:– Posting photos without names, eliminating photos entirely,

or only using them at a protected intranet site.

– Using only first names in bylines and minimizing other personal information posted.

– Providing information about the class as a whole rather than individual students.

– Password protecting the school Web site with passwords given out to families only. (This may seem extreme, but it can be effective.)

– Looking at how other schools are successfully posting on the Internet. What are they doing and is it appropriate?

– PROTECT YOUR TECH! (don’t get hacked)

26

Acceptable Use Policies• Acceptable Use Policies are a necessary part of

promoting appropriate behavior• Intended to provide high level guidance on how

technology should be used, and what expectations of privacy can be expected. They should also detail what the consequences of non-compliance are!

• AUPs need to exist at the district level, and need to be backed up by administration

• AUPs can also exist at the classroom level, and may be more meaningful

• One idea that I have seen is to engage your class with creating your own AUP – that way it is internally generated and not from the “outside” of the classroom

• Once again, focus on issues, not on technology! Technology will change

27

Teaching Resources• You don’t have to do all of the hard work yourself – a

lot of information and teaching materials is available• There are numerous places that will send you free

posters, brochures, software, etc. that you can use• Involve your school board and community• Rely on your librarians! They are usually very aware of

all of these issues (check www.ala.org to watch them fight the good fight)

• Ask for guest speakers to talk to your students. There are many who would be glad to help – computer techs, local and state police officers, lawyers, and other students

• One speaker who allowed me to use his name is Mark Bowser from the Ingham County Sheriff’s Department (517) 336-2048. He is available to speak to groups larger than 100 (maybe a full assembly?)

28

Disney’s Surfwell• Disney has a neat web site that is child-appropriate

• It includes different types of games and quizzes

• http://disney.go.com/family/surfswell2001/index.html

29

Disney’s Surfwell

30

McGraw-Hill’s CyberSmart• Check out: www.cybersmartcurriculum.org• By far the best resource that I have found, and it is all

free! (If they are at the conference, go thank them!)• All of the resources can be downloaded or printed

anonymously from the web site• I have printed out a couple of posters and exercises to

pass around – this is just one - there are many more• There are a variety of lesson plans and activity sheets• Cites the “National Educational Technology

Standards” (e.g. Performance Indicator #6)• Provides a sequence of events and suggested activities

around the worksheets• Provides links for additional information• Material is broken down by age group

31

Web Siteshttp://www.cerias.purdue.edu/k-12/

http://disney.go.com/family/surfswell2001/index.html

http://www.usdoj.gov/kidspage/

http://www.iisw.cerias.purdue.edu/k-12/top10_educators.php

http://www-tradoc.army.mil/dcsbos/tralinet/intersaf.htm

http://www.nicekids.net/indexf.htm

http://www.ed.gov/pubs/parents/internet/

http://www.cyberspacers.com/home.html

http://www.chatdanger.com/

http://www.safekids.com/

http://www.pta.org/programs/ftright.htm

http://www.globalethics.org/default.htmlhttp://www.fcps.edu/dis/OITS/start/start_manual/manual/ethics.htm

http://www.netsafe.org.nz/kits/kits_default.asp

http://www.cybercrime.gov/rules/kidinternet.htm

http://www.cwrl.utexas.edu/%7Eburniske/cpl/

32

Discussion!

Mark Lachniet, Sr. Security Engineermlachniet@analysts.com

CISSP, MCNE, MCSE, CCSE, LPIC-1, TICSAAnalysts International - Sequoia Services

3101 Technology Blvd. Suite ALansing, MI 48910

phone: 517.336.1004fax: 517.336.1004