Digital Literacy and Online Safety
Your digital footprint, spotting scams and fake news, protecting your accounts, and what to do when something online goes wrong.
Your digital footprint
Your digital footprint is the trail of data you leave behind online. It is far larger than most people realise, and much of it is permanent.
Two kinds
- Active footprint. Things you deliberately post: messages, photos, comments, videos, profiles.
- Passive footprint. Data collected without you doing anything: which pages you visit, how long you stay, your location, your device, what you search for.
Why it matters
- Universities and employers do look at public social media
- Anything can be screenshotted, even on apps that promise messages disappear
- Deleting a post does not delete copies other people have made
- Data collected about you is used to target advertising, and is sometimes sold on
Reducing it
- Check your privacy settings, and check them again after every app update
- Think before posting: would you be happy for a teacher, a parent and a future employer to see this?
- Turn off location tagging on photos
- Do not fill in quizzes that ask for your first pet or your mother's maiden name, because those are security question answers
- Log out of accounts on shared devices
Assume that anything you put online is permanent and public, even when the app tells you it is not.
Step 1 of 4 Active footprint: everything you deliberately post.
- Everything you do online leaves data behind: posts, searches, purchases, location and cookies.
- Companies join the pieces into a profile of you.
- Advertisers, websites and data brokers use the profile, to sell to you or to sell it on.
Scams, phishing and misinformation
Phishing
A phishing message pretends to be from an organisation you trust, in order to steal your details.
Warning signs:
- Urgency: "your account will be closed in 24 hours"
- A generic greeting such as "Dear customer"
- Spelling and grammar mistakes
- A link whose address does not match the organisation, for example
amaz0n-security.net - Asking for a password. No legitimate organisation ever asks for your password.
- An attachment you were not expecting
If in doubt, do not click the link. Go to the organisation's website by typing the address yourself.
Other scams
- Fake competitions asking for personal details to claim a prize
- In game offers of free currency in exchange for your account details
- Fake shops with prices that are too good to be true
- Requests for money from a friend's hacked account
Misinformation
Misinformation is false information shared by someone who believes it is true. Disinformation is false information spread deliberately to mislead.
How to check a claim:
- Who published it? A recognised news organisation, or an account with no history?
- Is it reported anywhere else? Real news is covered by many independent sources.
- When was it published? Old stories are constantly recirculated as if they were new.
- What is the evidence? Does it link to a source, or just assert?
- How does it make you feel? Content designed to make you angry is designed to be shared before you think.
Photographs are easily edited, taken out of context, or generated entirely by AI. A reverse image search takes ten seconds and often shows a photo is years old and from a different country.
- The sender's address does not match the real organisation.
- The message is urgent and threatens you, to stop you thinking.
- It says Dear Customer instead of using your name.
- Spelling and grammar mistakes.
- The link goes somewhere different to what it says, which you can see by hovering over it.
- An attachment you were not expecting, here a program file.
Protecting yourself
Account security
- Long passwords, different for every important account
- Two factor authentication wherever it is offered, so a stolen password alone is not enough
- A password manager is safer than reusing one password everywhere
- Never share a password, not even with your closest friend
Cyberbullying
If it is happening to you, or you see it happening:
- Do not reply. A response is what the bully wants.
- Screenshot everything. Evidence matters, and deleted posts cannot be reported.
- Block and report through the platform.
- Tell an adult you trust. A teacher, a parent or a carer.
You are not in trouble for reporting something. The person doing it is the one with the problem.
The law
- The Computer Misuse Act 1990 makes it a crime to access someone else's account without permission, even if you change nothing.
- The Data Protection Act 2018 controls how organisations use your personal data and gives you the right to see what they hold about you.
- The Copyright, Designs and Patents Act 1988 makes it illegal to copy or share music, films, games or images without permission.
Logging into a friend's account to post something as a joke is a criminal offence, not a prank.
- A common word is cracked at once, however long it feels to type.
- Eight random characters from 95 symbols: about 6.6 quadrillion possibilities.
- Five random words from a list: far more possibilities, and easier to remember.
- Something you know: your username and password.
- Something you have: a code sent to, or made by, your phone.
- Only when both are right are you let in. A thief with just the password is stopped at step 2.
- Do not reply. A response is what the bully wants.
- Screenshot everything as evidence, before anything is deleted.
- Block the person and report them on the platform.
- Tell an adult you trust.
Key terms you must be able to define
- Digital footprint
- The trail of data a person leaves behind through their online activity.
- Active footprint
- Data you deliberately share, such as posts and photographs.
- Passive footprint
- Data collected about you without any action on your part, such as browsing history.
- Phishing
- A fraudulent message pretending to be from a trusted organisation, designed to steal personal information.
- Misinformation
- False information shared by someone who believes it to be true.
- Disinformation
- False information spread deliberately in order to mislead.
- Two factor authentication
- A security method requiring a second proof of identity as well as a password.
- Computer Misuse Act 1990
- The law making unauthorised access to a computer or account a criminal offence.
Flashcards
Say the definition out loud before you flip the card. Retrieving it from memory is what builds recall, reading it again is not.
Reach the top grade on this topic
The strongest answers here are specific and practical.
Give the warning sign, not just the label. Not "you can tell it is phishing", but "the greeting says Dear Customer rather than your name, and the link points to amaz0n-security.net rather than amazon.co.uk".
Explain why the advice works. Two factor authentication helps because even if someone steals your password they still cannot log in without the code sent to your phone.
Know the law by name. Being able to say "logging into someone else's account without permission breaks the Computer Misuse Act 1990" is far stronger than "it is against the rules".
- List four warning signs of a phishing message
- Explain the difference between an active and a passive digital footprint
- Give the four steps to take if you are being cyberbullied, in order
- Name the three acts and say what each protects
Mistakes that cost marks here
- Saying deleted posts are gone. Screenshots and archives outlive the original.
- Thinking a message must be a scam only if it is badly written. The most effective ones are perfectly written.
- Replying to a bully to defend yourself, which escalates the situation and gives them what they want.
- Confusing misinformation with disinformation. The difference is whether the person knew it was false.
Every photograph taken on a phone can store the exact location where it was taken, hidden inside the file as metadata. Posting a holiday photo can therefore tell a stranger precisely where you are.
Knowledge check
Exam-style questions
Five written questions in the style of the real paper. Write a full answer, then let the marker check it against the mark scheme.
- LThe trail of data left behind by online activity
- LIncludes both what you post and data collected automatically
A digital footprint is the trail of data that a person leaves behind through everything they do online. It includes an active part, made up of the things you deliberately share such as posts, photographs and comments, and a passive part made up of data collected about you automatically, such as the pages you visit, how long you spend on them, your searches and your location.
- LIt creates a sense of urgency
- LThe link address does not match the real organisation
- LIt asks for personal details or a password, or uses a generic greeting
A phishing email usually creates a sense of urgency, warning that an account will be closed or money will be lost unless you act immediately, because panic stops people checking carefully. The link in the message will point to an address that does not belong to the real organisation, for example a domain with an extra word or a substituted character. Phishing emails also commonly use a generic greeting such as Dear Customer rather than your actual name, and they ask you to confirm personal details or a password, which no legitimate organisation ever does.
- LDo not reply to the messages
- LTake screenshots as evidence
- LBlock the person and report them to the platform
- LTell a trusted adult such as a parent or teacher
The student should not reply to the messages, because a reaction is what the sender is looking for and responding usually makes the situation worse. They should take screenshots of every message first, because this is the evidence that allows the platform and the school to act, and messages can be deleted by the sender at any time. They should then block the person and report them through the platform's own reporting tools. Finally they should tell a trusted adult such as a parent, carer or teacher, who can help them deal with it properly. Reporting is not getting someone into trouble unfairly, and the person being bullied is never the one at fault.
- LIf one service is breached, the password becomes known to attackers
- LAttackers try that same password on other accounts
- LUsing different passwords means only one account is affected
Companies do get hacked, and when a service is breached the usernames and passwords it stored can end up in the hands of attackers. Those attackers then automatically try the same email address and password combination on hundreds of other popular sites, because they know most people reuse passwords. If you use the same password everywhere, a breach at one small website you barely remember signing up to can give someone access to your email, your bank and your social media. Using a different password for each important account means a breach only ever affects the single account it came from.
- LIt can be copied or screenshotted and shared beyond your control
- LDeleting the original does not remove copies other people have
- LPhotographs can contain metadata revealing the location
- LFuture employers or universities may see it
The first reason is that once a photograph is posted you lose control of it. Anyone who can see it can screenshot it and share it anywhere, and deleting your original post does nothing about the copies that other people already have, so the picture may still exist years later. The second reason is that photographs can reveal more than you intend. Phones store metadata inside the image file, which often includes the exact GPS coordinates of where the picture was taken, so a photograph posted publicly can tell a stranger precisely where you live or where you are right now. Beyond both of these, universities and employers do look at what people have posted publicly, so a photograph posted at fourteen can still be found at twenty two.