Abstract:

Personal consumer data has been referred to as the new oil of the Internet and the new currency of the digital world. Due to its increasing importance for economic decision-making, individuals need to be aware of the value of data and how to manage their information to avoid falling prey to unfavorable business practices or even cybercrime. Data about consumers’ web browsing, online activities and shopping is at the forefront of the development of new business practices. Particular concerns are related to behavioral tracking, and resulting actions such as targeted advertisements and online price discrimination.

Motivated by these observations, we developed a semester project that involves students in a multifaceted study about targeted behavioral advertising on the Internet. The project was introduced in a Fundamentals of Information Security sophomore class which is a required course in an interdisciplinary bachelor’s program on Security and Risk Assessment, which attracts students with diverse backgrounds and interests, and allows them to specialize in different directions with foci on technology, analysis, or social science. Because of this diversity, our project needed to account for many levels of technological expertise. Further, like a typical sample of Internet users we expected them to have struggled with security and privacy decisions in the past.

With the project, we aimed to address multiple intertwined learning objectives. First, students developed technical skills when they acquired, installed and configured a cutting-edge computer security and Internet measurement tool. That is, students were put “in the shoes” of a typical computer security professional who needs to be constantly updating her skills and familiarize herself with constantly evolving technologies. Second, the tool was utilized by the students on a realistic dataset (i.e., a diverse set of Internet websites) to measure the extent to which these websites use technologies to track user behavior.

Students learned what artefacts are used by websites and third-party affiliates to authenticate and to compile behavioral records about users. Third, students were also required to use analytic skills by using the collected data to comprehensively answer a number of questions about behavioral tracking and to create meaningful visualizations (e.g. “which advertisers are most prevalent across the sites visited?”). Students learned about the pervasiveness of user tracking and the deeply complex business relationships that shape, for example, the online advertisement industry. Fourth, students reflected on their technical and analytic findings with an essay.

Together these steps aimed to guide students to overcome their lack of knowledge about privacy and security practices in a scenario with high relevance for their own lives. Students studied what websites collect that they use on an everyday basis, and where they share deeply personal information or use sensitive credentials. Similarly, we laid out a path for students to not only become sophisticated consumers of data, but even more so producers of knowledge in an area that is still largely unexplored. We report quantitative and qualitative findings about learning assessments and solicited feedback we received from the students. We enrich our study with observations about specific challenges we encountered during the semester, and recommendations for conducting measurement projects in an interdisciplinary class context.

Keywords:

Measurement, computer science literacy, interdisciplinary, security, education.