English:Encryption and Data Privacy
Encryption and Data Privacy
Introduction
Encryption and Data Privacy is a Grades 9–10 aiMOOC about how digital information can be protected, shared responsibly, and kept private. You will learn what encryption does, how keys work, why HTTPS matters, what cookies and metadata can reveal, and how to make practical privacy decisions.
Whenever you send a message, sign in to a website, store a photo, or use a school platform, data moves through devices, networks, and online services. Some of that data may be personal. Protecting it requires both technical security and careful choices about collection, access, sharing, and retention.
By the end of this course, you should be able to:
- Encryption: Explain the difference between plaintext and ciphertext and describe the role of a key.
- Symmetric encryption: Explain why one shared secret key can be both useful and difficult to distribute safely.
- Asymmetric encryption: Distinguish public keys from private keys and explain why a private key must remain secret.
- Hashing: Explain why hashing is useful but is not the same as encryption.
- Data privacy: Identify personal data, metadata, tracking risks, and privacy-friendly choices.
- HTTPS: Explain what encrypted web connections protect and what they do not prove.
- Digital literacy: Apply privacy and security habits to realistic school and everyday situations.
The video above introduces core cybersecurity goals. As you watch, notice that protecting data is not only about secrecy. Systems also need reliable information and dependable access.
Security, Privacy, and the Value of Data
Security is about protecting systems and information from unauthorized access, unwanted change, loss, or disruption. Privacy is about appropriate control over personal information: what is collected, why it is used, who receives it, and how long it is kept. The two ideas overlap, but they are not identical. A database can be technically secure while still collecting more personal information than users reasonably expect.
A common model in information security is the CIA triad:
- Confidentiality: Information should be available only to authorized people or systems.
- Integrity: Information should remain accurate and should not be altered without authorization.
- Availability: Authorized users should be able to access systems and data when needed.
Encryption mainly supports confidentiality, although cryptographic tools can also help protect integrity and authenticity.
Personal Data and Digital Footprints
Personal data is information connected to an identifiable person. Examples can include a name, account identifier, photo, location history, device identifier, school account details, or combinations of data that make a person recognizable. Some information is more sensitive than other information, and the legal definition of personal or sensitive data varies by jurisdiction.
A digital footprint includes information created by your online activity. Some of it is obvious, such as a public post. Other information is less visible, such as login times, device type, approximate location, search history, or which pages you visited.
Metadata is data about data. A photo may contain the image itself plus metadata such as creation time, device information, or location coordinates. A message service may encrypt message content but still need some metadata to deliver the message, such as sender and recipient accounts or timing information.
A useful privacy question is: Does this service need this information for the task I want it to perform? This leads to data minimization, the principle of collecting and keeping only the data that is reasonably necessary for a stated purpose.
Privacy, Security, and Anonymity Are Different
Privacy concerns appropriate handling of personal information. Security concerns protection against threats. Anonymity means that a person's identity is not known or not easily connected to an action. These concepts can support each other, but one does not automatically guarantee the others.
For example, an encrypted school account may protect data in transit, but the school platform can still know which student account is signed in. Encryption can prevent outsiders from reading a connection without automatically making the user anonymous.
How Encryption Works
Encryption changes readable information, called plaintext, into an unreadable form, called ciphertext, using an algorithm and a key. Decryption reverses that process when the correct key is available.
A strong modern encryption system does not depend on keeping its algorithm secret. Instead, security should depend on well-studied algorithms and appropriately protected keys. Key length, implementation quality, device security, and correct use all matter.
From Caesar Cipher to Modern Cryptography
A Caesar cipher shifts letters by a fixed amount. It is useful for learning the idea of substitution, but it is not secure for modern communication because there are only a small number of possible shifts and patterns are easy to test.
Try a simple example on paper: choose a shift, encrypt a short sentence, and ask a classmate to recover it. Then discuss why this method would fail against a computer that can test many possibilities quickly.
Modern cryptography uses mathematics and carefully tested algorithms rather than simple letter shifts.
Symmetric Encryption
In symmetric encryption, the same secret key, or closely related secret material, is used to encrypt and decrypt data. It can be very fast and is widely used for protecting stored data and large amounts of network traffic.
The main challenge is key distribution. If two people need the same secret key, they need a safe way to establish or exchange it. If an attacker gets that key, the protected data may become readable.
AES is a widely used symmetric block cipher. You do not need to calculate AES by hand to understand its role: it transforms blocks of data through repeated mathematical operations controlled by a secret key.
Asymmetric Encryption and Key Pairs
In asymmetric cryptography, a user has a mathematically related public key and private key. The public key can be shared. The private key must be protected.
One important use is public-key encryption: someone can use a recipient's public key to encrypt information so that only the matching private key can decrypt it.
Public-key systems are also used for digital signatures and for helping devices establish shared secrets. In real systems, symmetric and asymmetric techniques are often combined because each is good at different jobs.
The image above uses a color-mixing analogy to illustrate the idea behind Diffie–Hellman key exchange: two parties can establish shared secret material even though some information travels over a public channel.
Hashing Is Not Encryption
A cryptographic hash function takes input data and produces a fixed-size output called a hash or digest. Hashing is designed to be one-way: it is not intended to be decrypted back into the original input.
Hashes can help check whether data changed. Password systems should not simply store readable passwords. Well-designed systems store password-derived values using specialized password-hashing methods with salts and appropriate work factors.
Encryption is used when authorized users need to recover the original data. Hashing is used when a one-way fingerprint or password-verification process is needed.
Keys, Passwords, and Secrets
A cryptographic key is not automatically the same thing as a password. A password is usually something a person remembers or stores in a password manager. A cryptographic key may be a long, randomly generated value used directly by software.
Good key management matters. Strong encryption can fail if a key is copied into an insecure chat, stored in an exposed file, reused carelessly, or stolen from an unlocked device.
Encryption in Everyday Systems
Encryption appears in many everyday technologies: secure web connections, device storage, messaging systems, backups, wireless networks, and software updates. The exact protections differ by system.
HTTPS and TLS
When a website uses HTTPS, the browser communicates with the site using TLS. TLS can provide encryption in transit, integrity checks, and server authentication based on digital certificates.
A secure-connection symbol means the connection to that website is encrypted and authenticated according to the browser's certificate checks. It does not mean that every claim on the website is true, that the business is trustworthy, or that you should share unnecessary personal information.
Encryption at Rest, in Transit, and End to End
Encryption in transit protects data while it moves between systems. Encryption at rest protects stored data, such as information on a device or server. End-to-end encryption is designed so that message content can be decrypted only at the communication endpoints rather than by intermediate service providers.
These labels describe different protection goals. A service may use more than one type of encryption. You should also remember that encryption does not automatically protect data after an authorized device decrypts it.
What Encryption Cannot Solve by Itself
Encryption is powerful, but it is not a complete privacy solution. It cannot by itself:
- Phishing: Stop you from giving a password to a convincing fake login page.
- Malware: Guarantee that an infected or unlocked device will keep decrypted data safe.
- Metadata: Hide every detail about who communicated, when, or through which service.
- Data minimization: Decide whether an organization should collect a particular piece of information.
- Human error: Prevent someone from sharing a private screenshot or sending information to the wrong person.
Good privacy therefore combines cryptography with authentication, access control, secure software, clear policies, careful data practices, and informed user choices.
Tracking, Cookies, and Consent
Websites often need to remember information between page requests. One mechanism is an HTTP cookie, a small piece of data that a website asks a browser to store and send back under defined conditions.
Cookies can have useful purposes, such as keeping you signed in or remembering a setting. They can also contribute to tracking, especially when data from different contexts is linked to build a profile.
Tracking can also involve pixels, device identifiers, account logins, browser storage, IP addresses, app permissions, and data collected by embedded services. Blocking one technology does not automatically stop every form of tracking.
Consent and Meaningful Choice
Consent should be informed and meaningful. A privacy notice should help users understand what is collected, why it is used, who receives it, and what choices are available. Exact legal requirements differ by country, age, service, and context.
A good privacy decision is not just clicking the fastest button. Before allowing access to contacts, photos, microphone, camera, or location, ask whether the permission is necessary for the feature you want.
Data Minimization and Retention
Data minimization means collecting only what is needed for a clear purpose. Retention means deciding how long data should be kept. Keeping data forever can increase risk because information that no longer serves a useful purpose may still be exposed in a future breach.
A privacy-friendly design therefore asks: What data is needed, who needs access, how long should it remain, and how will it be deleted safely when no longer needed?
Privacy Principles and Rights
Privacy rules differ across countries, but several ideas appear in many privacy frameworks and laws:
- Transparency: People should receive understandable information about data practices.
- Purpose limitation: Data should be used for clear, stated purposes.
- Data minimization: Collection should be limited to what is reasonably needed.
- Data security: Appropriate safeguards should protect information.
- Access control: Only authorized people and systems should be able to reach protected data.
- Accountability: Organizations should be able to explain and justify their data practices.
Depending on the jurisdiction and situation, people may have rights involving access, correction, deletion, objection, restriction, or portability of personal data. Laws such as the GDPR are important examples, but the exact rights and duties depend on where you live and which organization is processing the data.
For a Grades 9–10 learner, the most transferable skill is to ask informed questions rather than assume one global rule applies everywhere.
Threat Modeling and Practical Habits
A threat model is a structured way to think about what you want to protect, from whom, and under what circumstances. You do not need advanced technical knowledge to use the idea.
Ask:
- Asset: What information or account matters?
- Threat: What could go wrong?
- Adversary: Who or what could cause the problem?
- Vulnerability: What weakness might be used?
- Safeguard: What reasonable action reduces the risk?
Useful habits include using unique passwords, enabling multi-factor authentication where available, installing updates, locking devices, reviewing app permissions, backing up important files, checking links before signing in, and sharing personal information only when there is a clear reason.
A password manager can help generate and store strong unique passwords. Multi-factor authentication adds another verification step, reducing the risk that one stolen password alone is enough to access an account.
Ethical Choices and Real-World Scenarios
Digital privacy is also an ethical issue. A technically possible action is not automatically a responsible action.
Consider these scenarios:
- Photo sharing: A class group takes a photo. Before posting it publicly, ask whether everyone pictured agreed to the intended audience.
- School platform: A learning app asks for location access even though the assignment does not use location. Question whether the permission is necessary.
- Group chat: A private message is easy to screenshot. Respect the original context instead of redistributing it without permission.
- Data breach: If a service reports that accounts were exposed, change affected passwords, avoid password reuse, and follow credible guidance from the service or school.
- AI and personal data: Before entering personal or confidential information into an online tool, check whether the information is necessary and how the service handles submitted data.
The goal is not to avoid technology. The goal is to use it with enough knowledge to make proportionate, informed decisions.
Interactive Tasks
Quiz: Test Your Knowledge
What is the main result of encryption? (Plaintext is transformed into ciphertext) (!A password is turned into a username) (!A file is permanently deleted) (!A website becomes anonymous)
What is characteristic of symmetric encryption? (The same secret key is used for encryption and decryption) (!Only a public key is needed) (!No key is used) (!The ciphertext is always shorter than the plaintext)
What must be kept secret in a public-key system? (The private key) (!The public key) (!The algorithm name) (!The website address)
Why is hashing different from encryption? (Hashing is designed as a one-way transformation) (!Hashing always uses a public key) (!Hashing makes data anonymous) (!Hashing guarantees a secure website)
What does HTTPS mainly protect during web browsing? (Data moving between your browser and the website) (!Every statement written on the website) (!Your identity from the website itself) (!All files stored on your device)
What is metadata? (Data that describes other data) (!A secret encryption key) (!A type of computer virus) (!A replacement for authentication)
What does data minimization mean? (Collecting only data that is needed for a clear purpose) (!Keeping every record forever) (!Publishing all collected data) (!Removing every password requirement)
What is a useful purpose of a web cookie? (Remembering a session or preference) (!Decrypting every website) (!Repairing damaged hardware) (!Making all browsing anonymous)
Why can multi-factor authentication improve account security? (It requires more than one form of verification) (!It makes every password public) (!It removes the need for software updates) (!It encrypts every file automatically)
Which statement best describes privacy and security? (They overlap but are not the same) (!They always mean exactly the same thing) (!Privacy matters only when data is encrypted) (!Security removes the need for privacy choices)
Memory Game
| Plaintext | Readable information before encryption |
| Ciphertext | Encrypted information that is not directly readable |
| Public key | Shareable key used in asymmetric cryptography |
| Private key | Secret key protected by its owner |
| Metadata | Information that describes other data |
| Hashing | One-way transformation used to create a digest |
| Minimization | Collecting only information needed for a clear purpose |
Drag and Drop
| Match the correct terms. | Topic |
|---|---|
| Plaintext | Readable data before encryption |
| Ciphertext | Data after encryption |
| Public key | Shareable part of an asymmetric key pair |
| Private key | Secret part of an asymmetric key pair |
| Data minimization | Limiting collection to what is needed |
...
Crossword Puzzle
| Encryption | What process changes readable data into protected ciphertext? |
| Ciphertext | What do you call data after it has been encrypted? |
| Metadata | What word means information that describes other data? |
| Consent | What word describes informed permission for a data use? |
| Password | What secret text is commonly used to help verify an account user? |
| Privacy | What concept concerns appropriate handling of personal information? |
LearningApps
Cloze Text
Open-Ended Tasks
Easy
- Personal data map: Difficulty: Easy. Create a one-page map of the kinds of data a school app might collect, separating data that is necessary from data that may be optional.
- Caesar cipher poster: Difficulty: Easy. Encrypt a short classroom-safe message with a Caesar cipher, then design a poster that explains why this cipher is useful for learning but weak for real security.
- Permission audit: Difficulty: Easy. Review the permissions of one app or browser site on your own device or a demonstration device and make a short table showing which permissions are necessary, optional, or unclear.
- Privacy vocabulary comic: Difficulty: Easy. Create a four-panel comic that correctly uses the terms plaintext, ciphertext, metadata, and consent.
Standard
- Cookie investigation: Difficulty: Standard. Use browser settings or a teacher-provided screenshot to identify stored site data, then write a short explanation of one useful cookie function and one possible tracking concern.
- Privacy interview: Difficulty: Standard. Interview a teacher, librarian, parent, or school technology staff member about one privacy practice and summarize the answers without including unnecessary personal details.
- HTTPS explainer video: Difficulty: Standard. Produce a two-minute video explaining what HTTPS protects, what the browser lock symbol means, and one thing it does not guarantee.
- School data flow: Difficulty: Standard. With permission, visit your school library or technology office and create a diagram showing how one type of school data moves from collection to storage, access, and deletion.
Advanced
- Threat model project: Difficulty: Advanced. Build a threat model for a fictional student account, identifying assets, threats, vulnerabilities, safeguards, and remaining risks.
- Privacy notice comparison: Difficulty: Advanced. Compare the privacy notices of two age-appropriate online services and evaluate transparency, purpose, retention, permissions, and user choices.
- Encryption experiment: Difficulty: Advanced. Compare the effect of changing one character in a plaintext message when using a classroom demonstration cipher and a teacher-approved modern encryption tool, then explain the limits of your comparison.
- Privacy by design proposal: Difficulty: Advanced. Design a privacy-friendly plan for a fictional school event app, including data minimization, access control, retention, consent, security, and a clear response plan for a data breach.
Learning Assessment
- Concept transfer: Explain why a website can use strong HTTPS encryption and still have poor privacy practices; support your answer with two different examples.
- System comparison: Compare symmetric and asymmetric encryption and justify why many real systems combine both approaches.
- Privacy decision: A classroom app asks for microphone, camera, contacts, and location access. Decide which permissions could be justified for a specific learning task and explain what additional information you would request before agreeing.
- Incident reasoning: A student reused one password on three services and one service reports a breach. Propose a response plan and explain how unique passwords and multi-factor authentication change the risk.
- Design critique: Review a fictional service that keeps every user record forever. Evaluate the design using data minimization, retention, security, and accountability.
- Communication challenge: Create a short explanation for a younger learner showing why encryption, hashing, authentication, and privacy are related but different.
Evidence of Learning
Strong evidence of learning can include:
- Knowledge: Accurate explanations of plaintext, ciphertext, keys, symmetric encryption, asymmetric encryption, hashing, HTTPS, metadata, cookies, consent, and data minimization.
- Skills: Ability to identify privacy risks, distinguish useful data collection from unnecessary collection, interpret basic security indicators, and build a simple threat model.
- Products: A clear diagram, poster, comparison, video, interview summary, or privacy-by-design proposal that uses correct terminology.
- Reasoning: Explanations that connect technical protections with human choices, policy, permissions, retention, and context.
- Transfer: Applying course ideas to unfamiliar apps, school systems, websites, group communication, and account-security situations.
- Reflection: Recognizing that no single tool guarantees privacy and that good decisions depend on the purpose, data, users, threats, and available safeguards.
OERs on the Topic
Explore the English Wikipedia article on encryption for additional background:
Explore the English Wikipedia article on information privacy for a broader view of privacy questions:
Linked Learning Areas
aiMOOC Projects
MOOCwiki · Deutsch
Nach dem Lernen ist vor dem Lernen
Entdecke direkt den nächsten Lernkurs. Weitere Inhalte erscheinen, wenn Du weiter nach unten scrollst.
Zur MOOCwiki-HauptseiteMediathek
Mediathek
Mediathek wird aus dem Wiki geladen ...
Keine passenden Inhalte gefunden. Bitte ändere Suche oder Filter.