Hive Toronto Privacy Badges: A Facilitator s Guide

Transcription

1 Hive Toronto Privacy Badges: A Facilitator s Guide By: Karen Louise Smith, Kathryn Meisner and Teen Peer Researchers

2 Table of Contents Background... 3 What are Open Badges?... 3 What are the Hive Toronto privacy badges?... 3 Badges you can issue by printing... 4 Badges earnable through Mozilla Webmaker... 4 Who are the Hive Toronto privacy badges geared towards?... 5 Who can facilitate the learning activities associated with the badges?... 5 What are the overarching themes and badge concepts?... 5 Personal Information... 6 Privacy Policy... 6 Privacy in Everyday Life... 6 Privacy Futures... 6 What are some appropriate icebreaker activities to explore privacy?... 7 What can facilitators explore before facilitating the learning activities associated with the Hive Toronto badges?... 8 Connected learning... 8 Creative Commons and open licenses... 9 Hypertext markup language (HTML)... 9 What are some suggested pathways for use of the badges? What are some tips for facilitating the learning activities? Anonymizer facilitation tips IP Address Tracer facilitation tips PIPEDA Remixer facilitation tips Profiler facilitation tips Requester facilitation tips Data Trail Timeline facilitation tips Mobile facilitation tips Privacy Coach facilitation tips Internet of Things facilitation tips Drones facilitation tips Printable worksheets and handouts HTML Cheat Sheet IP Address Tracer Worksheet Internet of Things Worksheet Privacy Response Worksheet Acknowledgements Credits

3 Background Hive Toronto is a learning network with a membership of over 60 youth-serving organizations in the Greater Toronto Area. The Hive Toronto learning network is stewarded by Mozilla, a global non-profit that encourages people, including youth, to participate in making the web. In , Hive Toronto received a grant from the Office of the Privacy Commissioner (OPC) of Canada to design 10 prototype level badges to encourage Canadian youth, ages 13 and up, to learn about privacy. The badges and the learning activities were co-designed with 8 peer teen researchers who engaged in the project for up to 70 hours each. This facilitator s guide introduces what Open Badges are, the learning activities developed in this project, and provides tips for facilitating privacy education with teens. To access the badges and learning activities associated with this project, please visit: What are Open Badges? An Open Badge is a special kind of digital badge. Open Badges use an open technical standard to enable learners to display what they have learned on websites or social networking profiles. Open Badges are sometimes described to include an image plus metadata, such as the issuer and the criteria that were achieved to earn the badge. - For more information on Open Badges see What are the Hive Toronto privacy badges? The 10 Hive Toronto badges are prototypes of Open Badges for privacy education. A prototype is often defined as an early version of a design. In this Open Badges project, we were inspired by the open educational community, which aims to make learning resources reusable and remixable by educators. We are releasing our curriculum, along with badge prototypes. The privacy badge prototypes that were developed for this project were created at two different levels. 3

4 Badges you can issue by printing Seven of the Hive Toronto privacy badges are easiest to issue by printing them out. These badges are being released at an early prototype level through the Hive Toronto website. This means that the images and metadata necessary to be issued as an open badge are in place, but not yet implemented on a website for learners to claim their badges. Hive Toronto has released the learning activities and badge designs to encourage organizations to work with the learning resources, and potentially even implement the images and metadata as earnable Open Badges through their own programs and websites. If you want to start using all the badges right away, issuing the badges through print outs is the quickest option. Badges earnable through Mozilla Webmaker Three of the badges that were designed are fully functional Open Badges that can be earned on Mozilla s Webmaker site ( Like the other 7 Hive Toronto privacy badges, the images and metadata have been created. Additionally, learning activities that can be used to support learners to earn the badges can be accessed from the Hive Toronto site. We consider the badges on the Webmaker site to be late level prototypes, but they may still be adapted or remixed in the future by organizations that implement them. The badges created for this project are accessible via the Hive Toronto website at All badge designs and curriculum resources that were created for this project are licensed under a Creative Commons Attribution-4.0 International License to encourage remix and reuse. The open badge prototypes for privacy (images and metadata) are available on 4

5 Who are the Hive Toronto privacy badges geared towards? The Hive Toronto privacy badges are geared towards teen learners ages 13 and up. There is no particular background knowledge of privacy that is necessary to dive into the activities. The learning activities do not require prior technical experience, but some activities involve the use of hypertext markup language (HTML) to remix or code basic webpages. There is a beginner HTML activity in the Anonymizer badge that is recommended if you or your learners are new to HTML. Who can facilitate the learning activities associated with the badges? The curriculum materials and privacy badges associated with this project can be facilitated by: - After school program facilitators - Civic and legal educators - Librarians - Peer or teen facilitators - Other educators (broadly defined) The learning activities can be aligned with the learning objectives in courses as well as informal learning programs. Easy linkages can be drawn to courses and programs that explore digital citizenship, digital media literacy, civics and legal education, maker education, and learn-to-code initiatives. What are the overarching themes and badge concepts? The Hive Toronto privacy badges are organized under four themes, but it is important to note that the badges can be used in any way you wish. The badges 5

6 can be used as stand-alone activities, or in any combination with other activities. The four themes and the badges they contain are: Personal Information Personal information can include details like your name, address, and any numbers associated with you. This theme explores what personal information is through badges such as the Anonymizer and IP Address Tracer. Privacy Policy Numerous policies and laws are relevant to privacy in Canada. The badges in this section explore learning about privacy laws, such as the Personal Information Protection and Electronic Documents Act (PIPEDA), as well as the institutions and organizations associated with privacy. The implications of emerging technologies such as drones are also explored. The badges in this section include the PIPEDA Remixer, Profiler, and Requester. Privacy in Everyday Life Have you ever been captured by a security camera when grocery shopping? Do soccer advertisements keep popping up in your social media accounts after you are surfing the web? Privacy is something that must occur within everyday life where numerous forms of surveillance are also occurring. The Data Trail Timeline, Mobile and Privacy Coach badges are part of this theme. Privacy Futures There are many emerging technologies. The Internet of Things (IoT) badge and Drones badge, open up the possibility to think about privacy outside of the frame of our current experiences. Each of the overarching themes has an introductory teaching kit available through the Hive Toronto site. The teaching kits provide an introductory exploration of the theme to help you get started. Some of the Hive Toronto badges are cross-listed between the themes. 6

7 What are some appropriate icebreaker activities to explore privacy? Facilitators such as librarians, community center workers, or peer facilitators who are engaging others to learn about privacy may wish to use an icebreaker activity with a group. Some simple icebreakers that may be effective include: Step forward if Prepare several statements related to privacy and teens such as: Step forward if you have a password on a cell phone or another mobile device Step forward if you update a social media account at least 3 times a day Step forward if you have posted something on social media that you regretted Form a circle with your group. Read aloud your statements and have individuals step forward when one of the statements applies to them, if they feel comfortable. Have individuals reform the circle before each statement is read. 7

8 Paper privacy memes Print out some images related to privacy. Have learners mount their chosen image on a larger piece of paper and write out a meme style caption. The meme example included here reads: Geo Data I know what you did last summer! Memes can be witty, funny, and ironic statements about privacy. What can facilitators explore before facilitating the learning activities associated with the Hive Toronto badges? Connected learning The privacy badges were designed to reflect the ideas behind connected learning. Connected learning is openly networked, interest powered, productioncentered, peer supported, and is linked by a shared purpose. Facilitators will notices that all of the privacy badges include learning, which involves productioncentered learning through making, designing, creating, exploring, or experimenting. Peer-to-peer learning is also emphasized through discussions, group work, and creation activities. - Connected Learning Alliance 8

9 Creative Commons and open licenses Many of the learning activities associated with the privacy badges make use of remix. You may find that your learners need access to Creative Commons or openly licensed work to use in their projects. Creative Commons licenses allow creators to set the terms that others can use and sometimes remix their work. You can read up on Creative Commons licenses: - Creative Commons Homepage - Creative Commons Search You may also find alternative open licenses to be helpful for your learners projects. Materials licensed in the public domain for example are also remixable in your projects. Hypertext markup language (HTML) Hypertext markup language (HTML) is the code that is used to make content ready to display on the World Wide Web. HTML typically includes pairs of tags. The following example shows normal text and strong text. See the opening and closing tags in the Code column of the diagram. To edit the text that appears on the website, you need to edit the text between the tags. Code <p>this text will appear normal.</p> <p><strong>this will appear strong.</strong></p> Display on a webpage This text will appear normal. This text will appear strong. Inserting images into webpages is also a skill you may need. The image source tag has a single tag only and specifies the location of the image, the alternative text for the image, and the size of the image in pixels. 9

10 Code Display on a webpage <img src= " sb-stick _640.png" alt="usb key" height="474" width="200"> To learn more about HTML some options include: - Mozilla Developer Network US/docs/Web/HTML - W3Schools - Codecademy If you create webpage projects with learners, you may crewish to store and display them online. Some places where you can create an account to store and display projects include: - Mozilla Webmaker - CodePen What are some suggested pathways for use of the badges? As stated earlier, facilitators and educators are encouraged to use the badges and associated learning activities in any way that is useful to you. Sometimes, it may be possible to weave in one of the badges, to any already existing course or workshop. Other times, organizations may choose to make use of multiple badges as part of a more extended program. The choice of how to use the badges and learning activities is yours. To help different kinds of facilitators get started with the badges, we provide the following suggested learning pathways, which you can take up, or remix. 10

11 After-school programs After-school programs that take place in settings like community centers, may find it useful to being with the Privacy in Everyday Life badges. The Data Trail timeline activity is an engaging introductory activity to privacy. The Mobile badge relates to everyday practices of youth. The Internet of Things badge provides the opportunity to discuss internet fridges and produce a web comic. After school programs with a youth-led focus may find the Privacy Coach badge aligns with peer-to-peer learning strategies. Public libraries Libraries may find that multiple badges relate to their already existing programs and are appropriate to weave into stand-alone workshops. The Anonymizer badge can be introduced in learn-to-code programs in library branches. The Drones badge can be used with 3D printing programs for libraries with maker spaces. The Data Trail Timeline badge can be used in a video or media production oriented workshop. 11

12 Civic or legal education organizations Civic or legal education organizations may be interested in the themes raised in the Personal Information and Privacy Policy themes. The Anonymizer badge is a starting place to examine what personal information is. The Privacy Policy badge sequence of the PIPEDA Remixer, Profiler, Requester and finally Drones can be followed. Peer-to-peer facilitation Peer-to-peer facilitation of the privacy badges can include the Privacy Coach badge. Peer facilitators are encouraged to draw from the other activities that best align with their interests. For example, privacy and coding can be explored through the Anonymizer, Profiler, and Internet of Things badges. 12

13 What are some tips for facilitating the learning activities? Each of the four themes for the Hive Toronto privacy badges, has a teaching kit with background information to assist facilitators. We recommend reading the teaching kits to familiarize yourself with the concepts to be introduced through the learning activities. Each activity kit for the Hive Toronto badge system, also has an accompanying tips sheet for the facilitator. Each tips sheet contains: 1) An Overview: The overview provides a brief description of the activity with additional information to explain the rationale for creating the badge, or insights about using the learning activities with youth. 2) Discussion tips: Each of the discussion questions is listed with key points and information that you can utilize to inform a take up discussion with your learners. Occasionally, extra questions, likely to surface in your group are also addressed. 3) Low connectivity tips: We recognize that access to computers may be limited when you want to utilize these activities. Facilitation options to use paper, or reduce the computer set up to a single computer connected to the internet and a projector, are provided whenever possible. 4) Extension Ideas: Extension ideas go beyond the original activity and may help you move forward with learners who express a strong interest in the initial activity. Extension activities will take longer than the suggested timeline for the activity. 13

14 Anonymizer facilitation tips Overview The Anonymizer badge involves having learners hack a Wikipedia biography page for a celebrity or prominent person. The idea behind the badge is to learn what details may be considered personally identifiable information (PII) in a biography page and to alter them by using a tool called X-Ray Goggles. For example the name of a celebrity could be changed to something like Green Penguin and their place of birth to The Purple Iceberg. Discussion tips Typical responses to discussion topics which emerge when facilitating the Anonymizer badge are provided here. We provide some information to help facilitate a discussion on remixing and hacking for learning and then provide helpful points to assist with take up for the discussion questions. Am I hacking Wikipedia? Learners in this activity are asked to remix a Wikipedia page and this can be considered a form of hacking. The term "hacking" gets a lot of negative press, but that doesn't necessarily mean it's always a bad thing. When we talk about hacking on Webmaker, we are talking about the act of rolling up your sleeves, taking something apart, understanding how it works, and using the original parts to do something new and creative. When you use X-Ray Goggles, you're not actually breaking in to the web page itself like a cyber attacker would. X-Ray Goggles actually "forks" a copy of the page and hosts it on a brand new web page, adding in the changes that you decide to make with using the tool. The goggles allow you to actually view the page's source code, so you can understand how it works and learn valuable skills to enhance your own digital work. With X-Ray Goggles you remix or hack code on your local machine, and if you 14

15 choose, publish your changes to a new page on a Webmaker server. Source: - What kinds of personally identifiable information (PII) were present in the biography page? Learners may identify names, birthplaces, job titles, team names, movie titles, or numerous other details as PII. - Was there any information in the biography page you anonymized that would not be considered personal information (PI) under PIPEDA in Canada? The name and job titles of employees are not considered PI under PIPEDA in Canada. These details were probably anonymized in many of the hacked biography pages. - Do you share any personal information through the internet or use of apps? Learners will likely identify that they share details like their names, addresses, phone numbers, ages, geo-location data, photographs, and more. - If working in a group setting, were you able to guess the identity of the original biography page of any of the other teams? Anonymized biography pages are frequently identifiable by other teams. Details like a prominent accomplishment (i.e., writing a best selling novel, or winning an Oscar) or connections to other prominent individuals can sometimes be the hint that reveals the real identity. - Was there any PI or PII that you could not remove from the biography page? Sometimes teams notice that the overall page url on Wikipedia is not changed through the X-Ray Goggles activity, if learners do not publish their hacked version of the webpage. Learners may also notice that many teams skip changing the URL addresses of the hyperlinks in the biography page which may reveal PI or PII. When taking up this discussion question, it is a good idea to remind learners that digital activities can leave traces of our identities. 15

16 Low Connectivity tips If you want to facilitate this activity without computers, one idea is print out biography pages from Wikipedia and ask learners to create their remixed biography page on a piece of chart paper by cutting and pasting together text. PII can be replaced by new hand-written details. Extension activity Have learners search for themselves online to examine what their online identities reveal about them. Review the tips sheet provided by MediaSmarts on establishing a positive presence online. - Tip Sheet from MediaSmarts Positive Presence Online 16

17 IP Address Tracer facilitation tips Overview Internet protocol (IP) addresses are a kind of personal information that may be collected online that many people do not even think about. Wikipedia defines that an IP Address is a numerical label assigned to each device (e.g., computer, printer) participating in a computer network that uses the Internet Protocol for communication (Wikipedia, IP address ). An IP address is a string of digits that looks something like Discussion Tips - Do you think an IP Address is personal information? Why or why not? An IP Address is considered personal information by the Canadian government. Learners in your group may be aware that sometimes organizations like a school share a single external IP address and argue against an IP address being PI. - Were there any websites that you tracked where the location information, such as the city or country, was different from where you thought the site should be located? Sometimes IP addresses are masked to appear to be elsewhere. This means that the location of the device or website is made to appear to be elsewhere in the world. - Can you find any statements on whether an internet company or government agency considers an IP address to be personal information? Many Government of Canada websites state that IP addresses are considered PI. For example on February 22 nd, 2014, the following statement was retrieved from Service Canada: the Government of Canada considers the IP address to be personal information, particularly when combined with other data automatically collected when visitor requests a Web page such as the page or pages visited, date and time of the visit. 17

18 - Have you heard of any news stories involving IP addresses? What issues were at stake? Numerous news stories involve IP addresses. Some examples from include: Netflix s perspectives on Canadians use of foreign IP addresses to access extra content Problematic changes, or vandalism, made to Wikipedia pages from particular IP addresses - What steps do people take to keep their IP addresses private? Individuals may choose to use a virtual private network (VPN) or proxy to obscure their IP addresses. Low Connectivity Tips If you want to facilitate this activity without computers you can print out a list of popular IP addresses and have your learners create a paper map. A printable worksheet is available for this activity for your learners to record their research responses on IP addresses. This activity will also work with one internet connected computer and a projector. Extension Idea If your learners have an interest in legal topics, look up cases where IP addresses have factored into prominent cases. Examples of cases include: - Morris v. Johnson, 2011 ONSC 3996 (CanLII) In this case a mayoral candidate who lost the election sought to have the host of the website auroracitizen.ca to release identifying information of anonymous defendants, who she claimed defamed her online - BMG Canada Inc. v. John Doe, [2004] 3 FCR 241, 2004 FC 488 (CanLII) In this case a music industry company sought to have the court order Internet Service Providers (ISPs) to link internet pseudonyms to IP addresses associated with music downloading 18

19 PIPEDA Remixer facilitation tips Overview The idea behind the PIPEDA Remixer badge is to crowdsource the reading and interpretation of a privacy policy, like PIPEDA. Learners in your group will research and explain a portion of PIPEDA such as a fair information practice, or section of the bill, and write up their summary on a remixed webpage template. All the individual pages from this activity, can by hyperlinked off a collaborative main page which acts as the repository for the group s knowledge. Using the webpage templates for this activity requires the ability to edit text in an HTML document. Discussion Tips - What did you learn about the purpose and application of PIPEDA? Groups may note that PIPEDA governs how personal information can be collected and used in relation to commercial activities. It applies for information collected during commercial activities in Canada. In some provinces and territories there is similar legislation in place, that will apply instead of PIPEDA. The Office of the Privacy Commissioner of Canada has resources on the application of PIPEDA that you can refer to for further information. A Guide for Individuals: Protecting your Privacy - How would you characterize the principles from PIPEDA? The principles from PIPEDA are drawn from the fair information principles in the Canadian Standards Association's Model Code for the Protection of Personal Information. Your learners may notice that the principles connect to social values or fairness. - What type of complaints do you expect have been lodged in Canada under PIPEDA? Numerous types of complaints have been launched under PIPEDA. One prominent complaint that was fuelled by students, was a 2008 complaint 19

20 complaint launched through the Canadian Internet Policy and Public Interest Clinic (CIPPIC) in Ottawa. Students were concerned over issues like the inability to truly delete their Facebook profiles and Facebook responded to these concerns. Read more at: CIPPIC Facebook Privacy Commissioner Finds Facebook Violating Canadian Privacy Law Unauthorized credit checks are another area where complaints have been lodged. CBC Story on Unauthorized Credit Check - What was the experience like to try to distill the key points from privacy law? Learners may note that the legal text was difficult to read and understand. Prompt the group to identify strategies that they used to make use of the complex text, such as group discussion. - Where would you look for further information on privacy law in Canada? Some options for further information on privacy law in Canada include: MediaSmarts Government Offices such as the Office of the Privacy Commissioner of Canada or provincial offices Low Connectivity Tips If you lack computers, but still want to facilitate this activity, using print outs and chart paper is an option. Extension Ideas Use your PIPEDA Remix homepage to link together other relevant projects or makes. 20

21 Profiler facilitation tips Overview This badge follows in the tradition of civics education initiatives in Canada, which sometimes aim to familiarize learners with the organizations and individuals involved in policy-making. It is hard to understand policy-making if you don t know what bodies like the House of Commons and people like Members of Parliament are supposed to do. Similarly, it is important to understand the organizations, offices, and job titles that relate to privacy in Canada. Knowing about institutions like the Office of the Privacy Commissioner of Canada (OPC) and the existence of privacy officers in organizations such as corporations, may assist young people to better understand their privacy rights. Discussion Tips - Which organization or job title related to privacy did you profile and why? The activity prompts for the options of the Office of the Privacy Commissioner of Canada (OPC) or privacy officers as a job title. Learners may also locate law clinics, advocacy organizations, research groups, civil society organizations, or provincially-based offices that are active in the debates about privacy in Canada. - How was your organization or job title related to privacy and PIPEDA? The answers that learners provide to this question can be diverse. Sometimes offices and organizations related to privacy are mentioned directly in the legislation. Other times, the organizations may be active in discussions, debates, complaints or news stories about the law. - How might the organizations or professionals associated with privacy work together or otherwise interact? Organizations and privacy professionals may interact through conferences, professional associations, or industry events. For example, the Conference Board of Canada maintains a Council of the Chief Privacy Officers ( with a series of annual meetings. Staff of the OPC and industry representatives sometimes speak at public events, such as the We Are Wearables talk on Wearable Tech Privacy & Identity Payments held in March 2015 ( 21

22 Organizations and professionals associated with privacy can also be involved in complaints processes through the OPC or provincially-based privacy offices. Legal challenges that are taken through the courts also sometimes occur. - Did you uncover any controversies or complaints related to PIPEDA while creating your privacy profile? If any learners in your group choose law clinics or advocacy organizations, they may uncover complaints or privacy challenges raised under PIPEDA. These could include cases like the Facebook complaint, described in the tips for the PIPEDA Remixer activity. Learners may also uncover controversies about technologies that were invading the privacy of users. Low connectivity tips If you lack computers, this activity can be facilitated with print outs and the use of chart paper and markers to construct the profile pages. Extension Idea Create a profile for a privacy relevant organization outside of Canada. 22

23 Requester facilitation tips Overview One of the fair information practices that guides PIPEDA is the right to request personal information that is held about you. This badge is intended to explore some different ways to facilitate practicing this right with teens. Facilitating this activity requires preparation at least a month in advance. If you plan to request information from a telecommunications company, it is recommended that you request the information at least a month in advance. Downloading an archive from Twitter or Facebook should be conducted at least a week in advance, as there may be a delay to generate an archive you can download. Discussion Tips - Are there any differences from the data that can be downloaded from a social media company like Facebook and Twitter, and the personal information that may be requested from a telecommunications company? Learners may note that some social media companies, such as Twitter and Facebook, have built in a feature to allow users to download their data. From the button or link, it is hard to tell what the archive will contain. The process outlined to request personal information data from a telecommunications company includes detailed, itemized requests for particular types of information. In the samples we generated when trialing this activity, IP addresses were not visible from the telecommunications company or Twitter archive, but were visible in the Facebook data. The Twitter and Facebook archives contained photographs, but the response from the telecommunications company had no photographs. - What personal information was in the Twitter archive you reviewed? If you downloaded a Twitter archive you may notice that it contains all of the contents of your tweets. This can include information on events you attended, your political opinions, or friends you interacted with via Twitter. - How might you use your personal information from a download from a social media account? 23