Education DCL: EAGER: Teaching Privacy via Stakeholder Modeling

Education about the social impacts of privacy and cybersecurity is critical to individual welfare and to creating technology that is in the public interest, but it is also challenging to make effective. Students often struggle to relate abstract concepts like the right to privacy, control over personal data, or freedom of speech, to the concrete technical choices they must make. This project realizes and evaluates a new pedagogical approach to teaching privacy and cybersecurity, focused around "stakeholders": people who are directly or indirectly affected by a technical system. The project's novelties are (1) the stakeholder approach, which combines teaching about abstract, high-level concepts with concrete applications, and (2) a preliminary investigation of the effectiveness of this approach. The project's broader significance and importance are that it creates an effective template for privacy and cybersecurity, produces open-source assignment materials, and impacts computer science education through new pedagogies and curricular recommendations. The project develops a new, stakeholder-focused approach to teaching privacy and security. The stakeholder approach is a template for reasoning about privacy and cybersecurity concerns in the development of technical systems, with a focus on relating high-level, abstract concepts to concrete implementation choices via stakeholder needs. The stakeholder needs give students concrete but possibly conflicting requirements to support. Ideally, the stakeholder approach leads to (a) students making deeper and more substantive connections between abstract concepts related to privacy and cybersecurity (e.g., data autonomy and ownership, transparency, accountability) and concrete social impacts (e.g., identity theft, reputational damage); (b) students engaging more deeply with social impact concepts and how they relate to technical decisions they face; and (c) students perceiving cybersecurity as an area in which they can work towards fair and equitable computing systems. The research team is developing and deploying stakeholder-based assignments in five computer science courses at Brown University, spanning introductory, intermediate, and upper-level courses taken by undergraduates and cybersecurity master's students. The data collected from these assignments will help answer the central research question of whether the stakeholder approach results in meaningful improvement in students' ability to relate normative concepts to concrete problems and technical design decisions. This work will therefore contribute to academic computer science education, workforce development, and socially-responsible computing by proposing new pedagogies and curricular structures for effective teaching of privacy and cybersecurity and their societal context. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.