Lorrie Faith Cranor, a professor of computer science and of engineering and public policy in her office at Carnegie Mellon University in Pittsburgh, Pa.
PITTSBURGH, Pa. – Online programs bring new educational resources to classrooms and homes.
And with them comes the responsibility to ensure children are safe when they log in to play games, chat with friends and explore the world. Policymakers, businesses and educators continue to debate appropriate controls. The U.S. Department of Education last week released new tools for educators to help them keep student information safe.
Last week, The Hechinger Report sat down to discuss this with Lorrie Faith Cranor, a professor of computer science and of engineering and public policy at Carnegie Mellon University in Pittsburgh, Pa. “Kids care a lot about privacy, but their view of privacy threats may be a little bit different than adults,” Cranor said.
Cranor, who is also director of the university’s CyLab Usable Privacy and Security Laboratory, says understanding the different ways in which children and adults think about security and privacy might improve their conversations.
Q: Can you tell me a little bit, first of all, about your “Security Blanket” quilt?
A: I took a collection of stolen passwords that had been published to the Internet, and there were about 32 million passwords. Then we made a big word cloud of the thousand words that appeared most frequently. I digitally printed it on fabric and made it into a quilt called the Security Blanket. There are a lot of words that relate to love, I love you and various misspellings of that in different languages, lots of people’s names, pets’ names and cartoon characters’ names. There are a few four-letter words mixed in, but actually not so much of that.
Q: What do you think that tells you about the human psyche?
A: Well, it’s clear that people are thinking about positive things and things they like when they make passwords. It seems like people are thinking about other people who are important to them and characters they like and their pets, so that’s the kind of sentiment that we see in passwords. This also makes them really predictable, though.
Q: More recently you’ve done work with young children asking them what privacy or security means to them?
A: We have a project called Privacy Illustrated. We went to schools, and we asked students to draw pictures of what privacy means to them. Then we also went online and asked adults to do it. We have them on the Privacy Illustrated website, and people can contribute to our collection and also browse the collection. We have them all categorized by keywords, so you can pick a word and see what other people think about it. There are lots of pictures that have doors. A lot of the children, when they think about privacy, they think about keeping their siblings out of their stuff.
Q: Some things never change.
A: Yeah.
Q: Did you notice that it seems like the younger students were thinking more of physical space, and then as they got older they changed?
A: The children were definitely focused on that physical privacy, and so we see doors, bedrooms, even blankets — hiding under the blanket as a manifestation of privacy. One of my favorites is that Spiderman needs privacy so he can change his clothes.
Q: That’s very creative.
A: It’s what they’re thinking about. We see a lot of that with kids. We see that with adults, too. There are plenty of adults who drew pictures of brick walls, of fences around their house, of closing the curtains in their house, so same sort of thing. But we also see some additional things in the adults. As they get older we start seeing concepts related to Internet privacy, securing your computer, surveillance, the NSA, video cameras, surveillance cameras and those sorts of concepts.
Related: Sign up to latest news on blended learning delivered for free to your inbox
In this April 2, 2014 file photo, Pre-K students use electronic tablets at the South Education Center in San Antonio. (AP Photo/Eric Gay, File)
Q: Do you have any tips for K-12 teachers who want to try things but want to make sure they’re being safe with students?
A: First of all, the teachers should preview what they’re going to do before they send their class there. You want to avoid things that have lots of advertisements or are going to be asking the kids to type in personal information.
Q: What is personal these days?
A: I think for children, they shouldn’t even be putting their name on the Internet. We’ll start there. With children really anything that can be used to connect something with them. A good kids’ site is either not going to make them log in, or it is going to ask them to make up a name.
Q: Interesting. Not even their name?
A: My kids, at their school, they use a math site. Each kid is given a user name and they’re all made up words. They’re not asked to put their real names in there.
Q: Would you recommend teachers reading the terms of service completely? That can be a dull read.
A: They’re a dull read and really hard to understand. I don’t think they’re going to get that much out of doing it, sadly. I think often it’s better to get other people’s opinions and to look for recommendations on sites. If you’ve stumbled across a random site, you might try looking for reviews of that site, and seeing if other teachers have had a good experience with that site.
Q: How do you start to teach students age appropriately about cyber security and privacy and passwords?
A: In my house, we have a lot of computers and we set up accounts for everybody in the house on the computers, largely so that people wouldn’t delete each other’s files. Initially, my kids had accounts from the moment that they could type at all on the keyboard, which was about age three. Initially it had to be a password that was going to be really easy for a 3-year-old to type. But the 3-year-olds could never remember their passwords, so everybody else in the house knew the password. The typical conversation was, “I want to use the computer. What are the letters in my password?” As they got older, we started saying, “No. Actually you should have a password that’s a secret that other people don’t know, other than your parents. I’m going to know your password.”
Q: About what age was that do you think around?
A: I think once they could get to a point where they could actually remember a password on their own, and I think once they realized that when their big brother knew their password and he could go mess with their account. That was like, “Oh. I don’t want my brother to know my password. I can see there’s a consequence if my brother knows my password.”
Q: Is there anything that worries you or you wish that more people were thinking about in this area?
A: I think that a lot of kids have trouble figuring out what the threats are. Not just kids, people in general. You see these articles that say, “Oh, kids don’t care about privacy.” I think that that’s been demonstrated to be really not true. Kids care a lot about privacy, but their view of privacy threats may be a little bit different than adults. Their main fear about privacy is that their parents will see things, their teachers will see things, and maybe their siblings will see things that they don’t want them to see. They’re not thinking about the government, the National Security Agency, and they’re certainly not thinking about future employers. When adults say to them, “Don’t post that. When you try to get a job your employer will see …” and they go, “When am I going to get a job? That’s like five years from now, 10 years from now.”
Q: Maybe it’s better to put it in terms they can understand?
A: It’s hard to figure out how to put it in terms that they can understand and to get across the notion that time passes, you will change. Part of it is to say, “Remember, you’re 10 now, when you were eight you were really different. You liked different things, and when you’re 12 you’re going to like different things. When you post something to the Internet, it can be there forever, and think about whether you’re going to want people to see this about you forever.”
This interview has been edited and condensed for clarity and length.
[Cross-posted at The Hechinger Report]
