Skip to main content
CSP LabBy Educator Today

Pilot · L12 · 60 minutes

Privacy, permissions and safe computing

Investigate a fictional RouteNow app to judge reuse against stated licences, see why attribution alone is not permission, evaluate data use against stated consent, explain the risks of combining personal data, and match a safeguard to a specific threat while naming what it leaves unprotected.

Topics: 5.5 Legal and Ethical Concerns · 5.6 Safe Computing

Goals and vocabulary

By the end you can:

  • Decide whether a reuse is consistent with a stated licence.
  • Explain why attribution alone does not grant permission.
  • Evaluate a data-use choice against the consent users gave.
  • Explain how combining datasets can expose personal information.
  • Match a safeguard to a threat and state a remaining limitation.
Licence
An owner’s stated permission for reuse, with conditions.
Attribution
Crediting the creator of a work.
Consent
Agreement to a specific, stated use of your data.
PII
Personally identifiable information: data that can identify a person.
Authentication
Checking that a user is who they claim to be.
Encryption
Encoding data so only someone with the key can read it.
Phishing
A trick message that tries to get someone to reveal credentials or information.

Reuse, licences and attribution

Creative work is protected by copyright as soon as it is made. A licence is the owner’s stated permission and its conditions. Reuse is allowed only when you follow every condition the licence sets.

Common licence conditions
ConditionWhat it requires
AttributionCredit the creator in the way they ask.
Non-commercialDo not use it for a money-making purpose, including inside a company’s product that is given away free.
Share-alikeRelease your adaptation under the same licence.
All rights reservedNo reuse without asking the owner for permission.

Evidence pack: RouteNow

Worked example

Checking RouteNow’s choices
ChoiceConsistent with permission?Why
Use map tiles in the free tier, with creditNoThe free tier belongs to a company app funded by its premium tier. Charging no fee and giving credit do not make that non-commercial.
Use map tiles in the paid premium tierNoThe licence forbids commercial use.
Get separate permission from the tiles’ owner for commercial app useYesPermission from the owner can cover a use the stated licence does not.
Use icons with a credit lineNo“All rights reserved” means permission must be asked for; credit alone is not enough.
Share location history with a café chainNoUsers consented only to showing nearby routes.

Personal data and combining datasets

Personally identifiable information (PII) is information that can identify a person, alone or combined with other data: a name, email address, home address, phone number, precise location history or device ID.

Combining datasets can reveal more than either one does. A location history alone shows where a device goes every night. Combined with a café’s loyalty records, it can reveal who lives at that address, their routine and where they shop.

Threats and matching safeguards

Worked example

Protection goals
GoalMeaningExample safeguard
ConfidentialityOnly authorised people can read the data.Encryption of stored and sent data.
AuthenticationChecking a user really is who they claim to be.Multifactor authentication (password plus a code).
IntegrityData is not changed without authorisation.Checks that detect altered files.
AvailabilityData and services are there when needed.Backups and redundant servers.
Matching a safeguard to the threat
ThreatSafeguardRemaining limitation
A stolen password is used to log inMultifactor authenticationA user tricked into sharing the code can still be attacked.
Data is intercepted on public Wi-FiEncryption in transitDoes not stop a logged-in attacker reading their own view of the data.
Phishing email asks for a passwordCheck the sender and go to the site directly, never via the linkConvincing fakes can still fool careful users.

Authentication is not encryption: MFA checks who is logging in, while encryption keeps data unreadable to anyone without the key.

Explore each concept

Choose a concept, change its inputs and follow the explanation. Each example models the stated rule or scenario; completing it is practice rather than evidence of mastery.

  • Consented versus proposed data use
  • Different recipients
  • Legal permission versus ethical judgement
Open this example on its own

Change it · step through · explain

Change an input, predict what will happen, then advance one step. Read why the state changes, reset and experiment. This fixed teaching model does not save progress or award XP.

Ready · Make a prediction

Ready to explore: Consent, purpose and a less intrusive alternative
  1. Consented purposepassword-resetWaiting
  2. Proposed usepassword-resetWaiting
  3. Alternativeminimum-dataWaiting

Ready to explore: Consent, purpose and a less intrusive alternative

Why: Change an input, predict the first effect, then advance one step.

Try this: Change one input or choose another listed case. Predict the effect, reset and compare the states and governing rule.

Step through and experiment

Change it · step through · explain

Change an input, predict what will happen, then advance one step. Read why the state changes, reset and experiment. This fixed teaching model does not save progress or award XP.

Ready · Make a prediction

Ready to experiment
  1. Input 1noncommercialWaiting
  2. Input 2commercialWaiting
  3. Input 3yesWaiting

Ready to experiment

Why: Predict the first change, then advance one step.

Try this: Keep credit yes and choose no-permission. Why is credit insufficient?

Step through and experiment

Change it · step through · explain

Change an input, predict what will happen, then advance one step. Read why the state changes, reset and experiment. This fixed teaching model does not save progress or award XP.

Ready · Make a prediction

Ready to experiment
  1. Input 1phishingWaiting
  2. Input 2mfaWaiting

Ready to experiment

Why: Predict the first change, then advance one step.

Try this: Keep the threat fixed and compare safeguards. Which mechanism directly addresses it?

Common misconceptions

  • Credit makes it allowed

    The belief: If I credit the creator, I can reuse anything.

    What is actually true: Credit satisfies an attribution condition only. “All rights reserved” work still needs permission.

    Check yourself: Does the licence actually allow reuse?

  • Logging in encrypts data

    The belief: A strong password or MFA means the data is encrypted.

    What is actually true: Authentication checks identity; encryption protects the data itself. They are different goals.

    Check yourself: Could someone intercepting the data read it?

  • Possible means acceptable

    The belief: If the app can share the data, it is fine to.

    What is actually true: Ethics depends on consent and harm, not on technical ease.

    Check yourself: What did users agree to?

Guided practice

Guided: audit RouteNow

Read the RouteNow evidence pack.

  1. For each of the map tiles and the icons, decide whether RouteNow’s use is consistent with the stated terms and give a reason.
  2. Explain why adding “Icons by the designer” does not fix the icon problem.
  3. Compare the café-sharing plan with what users consented to.
  4. Name one harm that combining location history with café loyalty records could cause.

Independent practice

Independent: protect RouteNow accounts

RouteNow learns that attackers are logging into accounts using passwords leaked from another site.

  1. Name the protection goal under threat.
  2. Choose a safeguard that targets this threat and explain why it helps.
  3. Explain why encrypting stored routes would not stop this attack.
  4. State one limitation that remains after your safeguard is added.

Exit check

  1. Explain in one sentence why crediting a creator is not the same as having permission.
  2. Connect one threat to a safeguard and name one limitation that remains.

Check yourself

Practice only: answers are checked in your browser and nothing is saved or sent to your teacher. Each explanation links back to the section it practises.

Lesson practice

  1. Question 1 of 6Which choice about the map tiles is consistent with their stated licence?

    Select one answer.

    Read this first

    Fictional evidence pack — RouteNow. RouteNow is a free walking-route app made by a small company that earns money from a paid premium tier. Its map tiles come from a collection licensed “free to reuse with attribution, non-commercial use only”. Its icons come from a designer’s site that says “All rights reserved. Credit appreciated.” At sign-up, users agree that RouteNow may use their location “only to show nearby routes”. The company is now considering sharing users’ location history with a local café chain for targeted offers.
  2. Question 2 of 6RouteNow adds the line “Icons by the designer” under each icon. Why is the icon use still not permitted?

    Select one answer.

    Read this first

    Fictional evidence pack — RouteNow. RouteNow is a free walking-route app made by a small company that earns money from a paid premium tier. Its map tiles come from a collection licensed “free to reuse with attribution, non-commercial use only”. Its icons come from a designer’s site that says “All rights reserved. Credit appreciated.” At sign-up, users agree that RouteNow may use their location “only to show nearby routes”. The company is now considering sharing users’ location history with a local café chain for targeted offers.
  3. Question 3 of 6How does the plan to share location history with the café chain compare with users’ consent?

    Select one answer.

    Read this first

    Fictional evidence pack — RouteNow. RouteNow is a free walking-route app made by a small company that earns money from a paid premium tier. Its map tiles come from a collection licensed “free to reuse with attribution, non-commercial use only”. Its icons come from a designer’s site that says “All rights reserved. Credit appreciated.” At sign-up, users agree that RouteNow may use their location “only to show nearby routes”. The company is now considering sharing users’ location history with a local café chain for targeted offers.
  4. Question 4 of 6RouteNow’s engineers say sharing location history with the café would take one afternoon to build. Which two are ethical issues that remain regardless of how easy it is? Select two.

    Select exactly two answers (0 of 2 selected).

  5. Question 5 of 6A fictional fitness app asks for the following at sign-up. Which is personally identifiable information?

    Select one answer.

  6. Question 6 of 6A dataset of anonymous night-time locations is combined with a public list of addresses and owners. What is the main consequence?

    Select one answer.

Your practice so far

Check an answer to see its rationale.

Apply it somewhere new

  1. Question 1 of 4Attackers are logging into RouteNow accounts using passwords leaked from a different website. Which safeguard most directly reduces this threat?

    Select one answer.

  2. Question 2 of 4Which two statements correctly describe confidentiality as different from other protection goals? Select two.

    Select exactly two answers (0 of 2 selected).

  3. Question 3 of 4A user receives an email: “RouteNow Security: your account will be closed in 1 hour. Click here and enter your password to keep it.” What is the strongest sign this is a phishing attempt?

    Select one answer.

  4. Question 4 of 4A student logs into RouteNow on public café Wi-Fi and worries that others on the network could read their data as it is sent. Which response reduces this stated risk?

    Select one answer.

Your practice so far

Check an answer to see its rationale.