For Year 3 students, we created a fictional persona of a ‘dodgy Internet guy’ who was going to use students’ personal information for nefarious ends. As one student in particular kept mentioning a ‘real life’ story of someone being murdered after sharing their information online, we decided to make the content a bit less scary – we focused on people being able to use personal information to impersonate you.
To demonstrate this, we had students fill out personal profiles for reference, then had randomly chosen classmates fill them out using the information they already knew. We then matched the profiles to see how similar they were, and compared them to a real-life web form and the minimal information it requests. We then looked at everything which could be done via the website which was requesting the information – all things which could be done while pretending to be someone else based on very little information, as few websites perform much verification.
To end things, we reminded students that of course, sometimes you need to share personal information with others, such as close, trusted friends, teachers, parents and other close relatives – however there is no hard and fast rule for when and with whom this is appropriate. We tried to set some rules, but found too many non-examples, and collectively settled that no personal information – even a first name – should be given to anyone from outside of school students and staff without permission from a parent or teacher, to whom the situation has been explained.