Legal and Ethical Concerns, and Safe Computing
Mateo finds the perfect song for his video, hits download, and posts it. Two days later the video is taken down. Meanwhile, his cousin gets an email that looks like it's from his bank, clicks the link, and loses his account. Both stories come down to the same question: what are you allowed to do with other people's work and data, and how do you keep your own safe? By the end of this page you'll be able to answer both.
Copyright and licenses
When you create something original, like a photo, a song, a drawing, or a program, you own the copyright to it automatically. You don't have to fill out a form or add a © symbol. That means nobody else may copy, share, or sell your work without your permission.
Most people do want others to use their work in some ways. A license is the permission slip. The creator states what others may do with the work.
Common CC conditions:
| Label | Meaning |
|---|---|
| BY | Attribution: you must give credit to the creator. |
| NC | Non-commercial: you may not use it to make money. |
| SA | Share-alike: if you change it, share your version under the same license. |
Related ideas: open source software has its source code shared so anyone can read, use, and often modify it. Open access research is free for anyone to read. Attribution means naming the creator and where the work came from.
a) Who automatically owns the copyright to a photograph that Mia takes? b) What does a Creative Commons license do for the creator and for people who want to use the…
- a) Who automatically owns the copyright to a photograph that Mia takes?
- b) What does a Creative Commons license do for the creator and for people who want to use the work?
Mateo wants to use a song in an online video that will show ads and earn money. He finds three songs with these licenses: Song 1: all rights reserved Song 2: Creative…
Mateo wants to use a song in an online video that will show ads and earn money. He finds three songs with these licenses:
-
Song 1: all rights reserved
-
Song 2: Creative Commons BY (attribution required)
-
Song 3: Creative Commons BY-NC (attribution required, non-commercial use only)
- a) For each song, say whether he may use it in his video and what he must do.
- b) Which song would be a problem even if he gives credit, and why?
Personal information and privacy
Your full name, home address, phone number, Social Security number, and photo are PII. So are biometric data like a fingerprint. A favorite color or the fact that you like pizza is not PII on its own, because it can't point to one person. Notice the catch: several harmless details combined (school, birthday, neighborhood) can identify you.
Apps and websites collect data to work, but they also collect it to sell or to target ads. Two good habits follow:
-
Data minimization: collect only what you need. If a flashlight app asks for your contacts, ask why.
-
Read what you agree to. A privacy policy that says data may be shared with "partners" is vague. You don't know who they are.
The risks are real. If data is sold or shared, you lose control over who uses it. If a database is breached, criminals can use PII for identity theft, such as opening accounts in your name.
Personally identifiable information (PII) is information that can be used to identify, contact, or locate a specific person. Which of these are PII? Explain each answer.…
Personally identifiable information (PII) is information that can be used to identify, contact, or locate a specific person. Which of these are PII? Explain each answer.
- i) Full name and home address
ii) Favorite color
iii) Social Security number
iv) The fact that a user likes pizza
Chloe builds a free study app for her high school. The app asks users for their full name, school, phone contacts, and real-time location. Its privacy policy says that…
Chloe builds a free study app for her high school. The app asks users for their full name, school, phone contacts, and real-time location. Its privacy policy says that the data may be shared with "partners."
- a) Identify which of the collected items are PII, and explain which ones the app probably does not need to work.
- b) Describe two privacy risks: one if the data are sold to third parties and one if the app's database is breached.
- c) Recommend four changes (to what is collected, how it is stored, and what users are told) that would reduce the risks, and explain each.
Passwords and multi-factor authentication
Attackers often use brute force: trying every possible password. The more possibilities, the longer it takes. The number of possibilities is
$$\text{(characters available)}^{\text{length}}$$Each extra character multiplies the possibilities, and each extra kind of character makes every spot bigger. So long and varied beats short and simple. And never reuse a password: if one site is breached, attackers try the same password everywhere else.
A password plus a code sent to your phone is MFA. Two passwords are not, because both are things you know.
Multi-factor authentication (MFA) requires two or more different kinds of proof of identity. Which of these is MFA? Explain. i) A password and then a second password.…
Multi-factor authentication (MFA) requires two or more different kinds of proof of identity. Which of these is MFA? Explain.
- i) A password and then a second password.
ii) A password and then a code sent to the user's phone.
iii) A very long password.
An attacker uses brute force, trying every possible password. Compare the number of possibilities for each type: i) A 4-digit PIN (digits 0-9) ii) An 8-character…
An attacker uses brute force, trying every possible password. Compare the number of possibilities for each type:
- i) A 4-digit PIN (digits 0-9)
ii) An 8-character password using only lowercase letters
iii) An 8-character password using lowercase letters, uppercase letters, and digits
- a) Compute the number of possible passwords for each. Write the last two in scientific notation, rounded to three significant figures.
- b) Explain what these numbers show about password length and variety.
- c) Why is reusing the same password on several websites dangerous even if the password is strong?
Encryption
Encryption scrambles a message so only the right person can read it. The original is plaintext; the scrambled version is ciphertext. Decryption turns it back.
-
Symmetric encryption: one shared key both locks and unlocks. It's fast, but you must get the key to the other person safely first.
-
Public-key encryption: each person has a public key (shared with everyone) and a private key (kept secret). Anything locked with the public key can only be unlocked with the private key.
This is why strangers can communicate safely. Sophia's browser uses the website's public key, which anyone may see, to lock her message. Only the website's private key, which never leaves the site, can unlock it. No secret has to be shared beforehand. The padlock and HTTPS in your browser mean the connection is encrypted.
Sophia sends a private message to a website. The browser shows a padlock because the connection uses public-key encryption. a) Explain the difference between symmetric…
Sophia sends a private message to a website. The browser shows a padlock because the connection uses public-key encryption.
- a) Explain the difference between symmetric encryption (one shared key) and public-key encryption (a public key and a private key).
- b) Which key does the website publish, and which key does it keep secret?
- c) Why does public-key encryption let strangers communicate securely without having met first?
Phishing, malware, and public Wi-Fi
Phishing tricks you into giving up information by pretending to be someone trustworthy: a fake bank email, a text about a missed package delivery, a "government" message. Warning signs: urgency, odd sender addresses, links that don't match, requests for passwords or codes.
Malware is software designed to harm or spy, such as viruses, ransomware, and keyloggers (which record what you type). It spreads through bad links, attachments, and fake downloads. Defenses: keep software updated, use antivirus, and don't install unknown programs.
Public Wi-Fi is risky in two ways:
-
Rogue access point: an attacker creates a network with a believable name, like "Airport_Free_WiFi." Anything you send passes through their device.
-
Intercepted traffic: on an open network, unencrypted data can be read by others nearby.
Protections, roughly from most to least useful there: using your cellular data avoids the untrusted network entirely; HTTPS and a VPN encrypt your traffic; MFA limits the damage if a password is stolen. Layers work best together, but each has trade-offs, like speed, cost, or convenience.
Ethan is waiting at the airport and connects to a free public Wi-Fi network named "Airport_Free_WiFi" to check his bank account. a) Describe two ways an attacker could…
Ethan is waiting at the airport and connects to a free public Wi-Fi network named "Airport_Free_WiFi" to check his bank account.
- a) Describe two ways an attacker could steal his information on this network (for example, an imitation network or intercepted traffic).
- b) Rank these protections from most to least helpful here and justify your ranking: using a VPN, checking that the bank's website uses HTTPS, enabling MFA, and using his phone's cellular data instead.
- c) Explain one risk that remains even when he uses HTTPS and a strong password, such as phishing or malware on his device.
Back to the start: Mateo's video was removed because the song's license didn't allow his use, and his cousin lost his account to a phishing link. Both were avoidable by reading the license and checking the message before clicking.