Abstract:

By analysing the network traffic of individuals, it is easy to draw conclusions about their interests, personality traits, beliefs, activities, plans, relationships, etc. There is potential for exploitation of such gathered information not only from providers of social media platforms or search engines but also from Internet service providers (ISPs), governments and operators of proxy servers and virtual private networks (VPNs). Servers routing data packets between networks are able to specifically monitor users based on their IP addresses and analyse their unencrypted communication as well as their network traffic metadata. Many users do not know which details of their traffic are unencrypted and thus readable, nor how they can protect themselves from such "man-in-the-middle" surveillance.

In order to raise awareness of privacy and encryption on the Internet among teenagers and young adults, an educational game in the form of an Escape Room was designed, tested and evaluated. Players analyse a prerecorded network traffic of a stranger using WireShark in order to find out all possible information about them. Participants find login data from unencrypted HTTP traffic, logs of visited websites from DNS queries, and read emails sent via SMTP. Students subsequently realise which common network protocols are typically unsafe and should be avoided or enhanced via additional encryption layers. Additionally, participants realise how much information can be found about individuals based on a relatively short traffic recording.

An Escape Room is here defined as a time-limited challenge (less than 60 minutes) in which participants work together in small groups (up to 4 people) to try to solve the problem in an exploratory manner without much instruction or help from a tutor. In order to solve the challenge, learners develop and try out strategies collaboratively, which is generally intended to promote social competencies and problem-solving skills.

The concept was successfully tested with small groups of pupils between the age of 16 and 18 in secondary education (n = 14), as well as in two large courses at University, once in face-to-face teaching (n = 74) and once via synchronous remote teaching (n = 104). After solving the Escape Room, learners showed significantly increased interest in the topics of privacy and encryption. Many students expressed surprise about how much can be found out about individuals based on comparatively short network traces, thus proving the need for raising awareness in this area. Teachers and lecturers reported increased motivation among students when exploring these topics more in-depth in the succeeding lessons. The game has proven successful as a motivating entry point in this field both in secondary education as well as in higher education.

Keywords:

Gamification, data protection, data privacy, higher education, teaching methods, escape room, computer networks.