-- ColinSylvester - 13 May 2022

Over the past two decades, human interaction has increasingly moved from the physical space to cyberspace. Computing advances facilitated the proliferation of inexpensive, portable hardware devices like tablets and netbooks, making it easier for people to access the Internet’s benefits. These hardware developments – combined with the ever-expanding provision of services from the world’s largest information technology companies (“ICTs”) – have revolutionized how humans learn, work, and play. For many, the productivity gains and social benefits derived from ICTs are life-changing, and their convenience, ease of use, and price point of “$0.00” have made them indispensable.

Few pause in their daily life, however, to consider how a company like Facebook became profitable by offering “free” services to customers. The answer, of course, is that users pay Facebook by trading some of their privacy for convenience. Raising awareness about the consequences of this exchange – and, relatedly, empowering people to stop using parasitic platforms that monetize and profit off of their personal information – are among the most pressing cybersecurity challenges of the 21st century.

In a perfect world, people knowledgeable about data privacy and security would share their understanding of ICTs to ICT users. Those users, equipped with a better sense of the true “cost,” would then cease using ICT hardware and/or software to better safeguard their privacy. Unfortunately, this is not the world we live in – old habits die hard, and for many, the prospect of taking affirmative steps to protect oneself on the internet is too daunting to consider.

So where do we go from here? The focus should turn towards those less entrenched in the existing system and more amenable to learning new skills – young people, between the ages of 9 and 14. Children around that age can learn about data privacy and security in an age-appropriate, accessible way, while also benefitting from being young enough to internalize the lessons and “course correct” away from a reliance on ICTs.

The “curriculum” will vary based on the experience of the instructor and competencies of the students, but encouraging this privacy paradigm shift in young people rests on what I consider to be three foundational principles. First, young people should learn that the old economics aphorism claiming “there’s no such thing as a free lunch” applies equally to the use of ICTs – if the service is “free,” then they are the ultimate product marketed by the service provider. The second lesson is that no mechanism exists to control the spread of their personal information once ICTs have it, nor is there any way to reclaim their data once shared. Lastly, it should be emphasized to students that they are responsible for the security of their own data; ICTs have an economic interest antithetical to preserving their privacy, and they cannot trust the government to serve as the ultimate backstop or regulator in this space.

Young people are capable of internalizing these lessons, but educators must acknowledge two conceptual difficulties they may have. The first is a natural byproduct of cyberspace’s intangibility. In the physical world, it is easy for a child to envision what an invasion of privacy might look like: a stranger leering through their bedroom window, for example, or someone reading a letter or piece of mail addressed specifically to them. By contrast, equally intrusive invasions of privacy in cyberspace may be harder to grasp, as much of the surveilling is not done by a particular person or tangible object. The second challenge stems from young people’s dearth of life experience and capacity to comprehend consequences. An American 12-year-old may struggle to appreciate the stakes fully, especially when every adult in their life has a smartphone, uses Gmail, and maintains active social media accounts on multiple platforms.

Neither of these shortcomings preclude successful instruction about privacy, but they suggest educators should design ways to make privacy instruction interesting and relevant to their target audience. Speaking in (very broad) terms, pre-teens value social clout and having spending money, as they gain more autonomy in the world. I think a way to play on young people’s desire to maximize their social and financial standing would be to frame smart privacy practices as a competition, where the students with the smallest digital footprint at the end of the year win a small cash prize in addition to bragging rights.

What might this look like? I think drawing on principles of behavioral economics to “nudge” students in the right direction would be helpful, as it would allow educators to explain why privacy is important while preserving the agency of students to make their own decisions. I envision a pilot program designed roughly as follows:

At the beginning of the year, students are given both Freedom Boxes and Chromebooks and trained on their use. As part of the training, students would learn about the differences between using a personal server versus servers provided by ICTs, and how the former is better for controlling their personal data. They would also be informed about a competition to keep their digital footprint as small as possible during the school year. Midway through the year, students would be permitted to “opt out” of using the Freedom Box and exclusively use the Chromebook. While some students will surely prefer the convenience and perceived “coolness” of the Chromebook, the hope is that enough students will continue to use the Freedom Box and reap its benefits. At the end of the year, students and teachers can then compare the difference between those who used the Freedom Box versus those who used Chromebooks, allowing the lessons about privacy to concretize in an objective manner.

<--/commentPlugin-->