Keywords

1 Introduction

Using a realist review approach from a qualitative and pragmatic perspective, this papers aims to develop a Cybersecurity and Online Safety (CSOS) pedagogical approach for Initial Teacher Training. Schools prepare children for adult life, but not just by “socializing people to function well (and without complaint) in the hierarchical structure of the modern corporation or public office” [1, p. ix]. Cyberspace permeates all aspects of this life and makes deviant, or socially unacceptable content accessible to young people. As such, effective, appropriate and factual CSOS education in schools is now essential. This has been recognised in the recent “Teaching Online Safety in School” document [2]. In addition, the need to raise all teachers’ awareness is apparent. “Schools also need an understanding of the risks that exist online”, teaching about online safety and harms should be a “whole school approach” [2, p. 3, emphasis added]. This development is welcome and underpins the need for this research.

However, there is no known body of work on the preparation of trainee-teachers or their trainers to teach CSOS at this time. This work is part of a larger project to fill the gap. It aims to provide a needs based and socially situated approach to CSOS education in schools. It will start by explaining why it is unrealistic to expect that teachers, trainees or initial teacher trainers have the knowledge or skill-set to deliver the concepts and issues behind 15 pages of tabulated harms [2, pp. 3–23] without support and training. Next it will explain the methodological approach used to research and identify a suitable theoretical model for the future realist review. The findings are then presented, alongside discussion of how the approach can be utilised. Finally, the way this work will underpin future work is outlined.

2 The Need for the Approach

The teaching online safety in school document has stated that from September 2020 pupils will be taught about online safety and harms [2, p. 5]. This is to be compulsory in all United Kingdom (UK) state schools. Schools “need an understanding of the risks that exist online so they can tailor their teaching and support to the specific needs of their pupils” [2, p. 3]. Schools are also expected to safeguard children from becoming radicalised committing crime, or becoming a victim to crime [3]. The UK National Cyber Security Strategy, additionally, tells us we lack the necessary cyber skills in both the public and private sector [4, p. 22]. Yet we still do not teach the necessary skills in schools and we are only now introducing compulsory CSOS education.

This is a fast changing technological world. It is not enough to tell our children about the exploits, threats or online harms. They need tools or heuristics that they can apply to present and future problems [5]. They need to be able to understand how attacks, whether cybercrime or cyber harm, work and how to protect against them.

It could be argued that we should not show children how to carry out attacks as it could in some way weaponise them “the threat they pose is unimaginable” [6, p. 3758]. However, there are countless websites that already show you how to carry out attacks. There are many hacker groups of varying fame and there is usually a helpful video to lead you through attacks, step-by-step. It is interesting that YouTube is currently considering banning videos that show “Instructional hacking and phishing: Showing users how to bypass secure computer systems or steal user credentials and personal data” [7]. Tim Erlin, quoted by Claburn [7] saying that “Google’s intention here might be laudable, but the result is likely to stifle valuable information sharing in the information security community.”

Children are often not aware of the seriousness of their computer misuse [8]. Young people are the most likely to commit crimes, with peak offending occurring somewhere between the ages of 15–18, trailing off after this as they grow out of crime [9, p. 1170]. Unfortunately, this coincides with their years in education and it is clear that computer literate young people have been involved with very serious cybercrimes. It is not surprising that some would consider it dangerous to teach children about hacking techniques [6].

To enable children to avoid crime we need to teach them the techniques of crime. This is controversial [6, 10], we need to be mindful of what leads youngsters to commit crime. We need to develop policies and intervention strategies for teachers. We need those with the knowledge to commit cybercrime to be channelled into more productive use [11, p. 3]. Children will not be aware if we are not discussing ethics and the law with them? Children will not develop the necessary skills if we do not have the teachers that have the knowledge and are prepared to teach them.

We can not expect to block children from accessing deviant or harmful content. For example the recent, rather ill thought out, UK age restriction plans to restrict underage access to pornography. Despite promises that a system would be in place by Summer 2019, this failed to materialise. This is not surprising. Uni-national restrictions to web-based material can be bypassed by Virtual Private Network (VPN) technology. Unregulated sites or on the Dark Web might become an alternative source that could be far more damaging to young people and additionally illegal [12, 13]. Children are exposed to online harms. They are vulnerable to committing and being the victims of crime. We need them to develop a skill-set that is lacking in society. 2/3 of children aged 12 and under and almost half of 13–18 year old say they would welcome more online safety education [14, p. 87].

In just a few lines we start to touch upon the complexity of cyberspace. We can not expect trainees to come ready packaged with sufficient knowledge of this field. Therefore, schools and Initial Teacher Training (ITT) providers need guidance if teachers are to engage our young with CSOS meaningfully [14, p. 37]. Teachers and teacher trainers come to the profession from a variety of subject disciplines and a range of experiences. Many will have had little to no formal cybersecurity and online safety input. Many will have no technical background. The lack of technically qualified teachers is a continuing problem [15]. There is less empirical work on teacher CSOS knowledge, but Pusey and Sadera [16] found that teachers were not prepared to teach or model the topics. However, the proposal here is that teachers do not need to be technical experts or to have in-depth knowledge of the more deviant part of cyberspace, to understand and deliver effective CSOS. We can expect teachers and trainees to have sufficient knowledge about teaching, learning, society, law and behaviour. These are the skills and knowledge bases that we should leverage here.

Teacher education programmes are under extreme pressure of time, diversity and complexity. So trainees need accessible theoretical under-pinning rationale for the practices being promoted [17]. With only 12% of children taking a computing subject post 14 [18] it is not suitable for CSOS education to be delivered predominantly in the computing curriculum. Especially when even teachers of computing do not all feel that they have the necessary skills to teach CSOS with 65% saying that they would like training in this area [19]. Elsewhere in the curriculum we need to prevent a culture where it is acceptable to “not get technology” [20, p. 672].

We can not expect that new teachers will receive CSOS pedagogical input from their colleagues. We do not have an education workforce with skills or knowledge to teach cybersecurity skills [21, p. 103], [22, p. 7]. The lack of educational provision in universities and colleges is blamed for the huge cyber security skills gap in industry [21, p. 103] and so it is unlikely that we will be able to fulfill the needs of education. Computing teachers, themselves, are calling out for training [19].

We have a legacy of inadequate training of teachers in this area. The Ment0rs [sic] (Lloyd Blankenship) 1986 hackers’ manifesto continues to make for uncomfortable and contemporary reading: incompetent teachers contributing to the development of bored young hackers who “hungered for steak but were fed baby food” [23, np]. Little has changed. Training at the time did not even meet the expectations of teachers [24], leaving them with a lack of confidence and a negative view of Information Communication Technology (ICT) [22, 24,25,26]. This legacy created a curriculum that the 2012 education minister Gove [27] decried as boring and taught by bored teachers. This led to the change to teaching computing in 2014.

Computing can answer some CSOS issues. However, it is not the most suitable subject to engage children in understanding of social issues or deviance. CSOS is a far bigger issue and needs to have context that can only be offered as part of the wider curriculum as the DfE [2] acknowledges. Children receive little CSOS education up to the age of 14 and often none after. Only 11.9% of eligible pupils took a computing GCSE in the UK in 2017 [18, 28, 29]. Activities to develop useful hacking skills are reserved for elite children in schools to “encourage the best young minds” [30]. Cellan-Jones [28] states that it is hard to find anyone that is happy with the direction that computing education has gone. CSOS education is not compulsory at Further Education (FE) or university and so many will enter the workforce with no formal training or advice at all [31].

There is now a growing corpus of literature that tells us that CSOS education is needed at all levels but at the same time questions the efficacy of what we are currently doing [11, 32,33,34]. We need to understand technology, but that understanding needs to be situated amongst our personal needs and those of society. The work suggests that in order to understand the cyberspace landscape we need: to start CSOS education earlier; to be honest and factual with children; teachers to engage in dialogue with their children.

So to sum up we find ourselves in a position where: we are asking people to teach about things they might not know about; by trying to bank information to only a proportion of our children, who might not actually care; whilst ignoring their needs and desires; out of the context of their societal situation. Perhaps another approach is needed, perhaps one where we start by considering people’s attitudes, beliefs and perceptions [35].

3 Methodology

The methodological approach is a realist review. This does not “discover ‘whether’ an intervention works, but trades instead on its ability to discover ‘why’, ‘when’ and ‘how’ it might succeed” [36, p. 9]. Friere’s Pedagogy of the Oppressed approach is used, a pedagogy of the cyber-oppressed if you will. Friere’s work concentrated on improving literacy and general education of Brazilian peasants. He realised that a “banking approach” delivered by educated middle classes was unlikely to have impact [37]. As such he sent experts from many academic disciplines into the field to find out what the peasants needed, from their perspective. From the reports back, Friere generated themes that could be used to enter into dialogue with the peasants leading to understanding of their own problems. Problems were analysed with the learners to develop a conscious understanding of the issues, conscientisation or conscientização [37]. The parallels for this work are clear. Our teacher trainers are pedagogically aware, but might not have specific CSOS knowledge. The trainees may additionally lack the pedagogical knowledge. Neither the trainers nor trainees know every individual children’s needs, beliefs or aspirations. For conscientização to occur a starting point for dialogue is needed.

The “reports back” from the experts in this work consisted of analysis and consideration of over 500 academic papers and books covering many aspects of CSOS. Relevant works were identified through a realist synthesis, zigzagging approach [38], where initial literature searching becomes increasing purposeful as more synthesis of the material is made. The process was inductive and iterative. As new works were added to the corpus new themes were identified. Themes and curated works were frequently revisited and reconsidered. The works were categorised using the commercial program Zotero resulting in over 100 initial themes (or generative words) for the purpose of this and the basis of future research. The method is outlined below.

  1. 1.

    Developing generative words

    Creating an abstract conceptual understanding of the issue. Generative words are keywords used in research about the issues under investigation.

  2. 2.

    Totalising and situationalising the issue

    Identify and situate the totality of the issue. Historical, political, geographical, sociological and criminological influences are all considered at this stage. The outcome is to produce a descriptive outline. Unfortunately, there is insufficient space to go into detail of this work here. However, the outcomes can be seen in the results and discussion section.

  3. 3.

    Decoding and generating new themes

    Themes are then developed from the constituent parts of the issues. These perspectives are normally generated with human subjects. In this case these perspectives come from analysis of a learner and trainee needs.

  4. 4.

    Re-codifying the issue

    The themes are re-framed as investigative questions to be developed between the teacher and the learner. This leads to a theoretical framework with which to develop mutual understanding. This framework allows students and practitioners to develop their mutual understanding and to deepen their previous knowledge.

  5. 5.

    Conscientisation

    This stage is part of ongoing and future research.

4 Results/Discussion

The results and discussion are run together here as the realist zigzagging approach needs explanation. Some outcomes seem simplistic if taken out of context. However, as Vygotsky reminds us, we can only understand concepts that are within our zones of proximal development [39, p. 59]. It can be argued that too often CSOS education fails because it is either of no concern to the recipient, or too far removed from what they know. As such, it is hoped that the reader appreciates that this work has the non-expert and school children at the heart of the rationale. The aim being to produce a useful framework to engage the learners in meaningful conversation about CSOS. The hope is to provide a starting point for the creation or dialogue to lead to Friere’s conscientisation (conscientização) of the topic being considered [37].

The initial thematic analysis produced a bewildering and ever growing amount of over 100 themes and sub-themes associated with CSOS. This clearly illustrated the extensive and complex nature of the subject domain.

Fig. 1.
figure 1

The needs of the trainee to fulfil their professional role

Full size image

The next stage was to consider these themes alongside the needs of the trainees. Teachers and trainees need to comply with UK teacher standards and the requirements of the government’s Teaching Online Safety in school guidance. In addition, trainees need to evidence this thoroughly in order to achieve Qualified Teacher Status (QTS). The most relevant strands of the teacher standards are shown in Fig. 1. It is clear here that it is impossible to map every CSOS issue to the needs of trainees. It is also unreasonable to expect that they have the knowledge required to effectively address the issues. Following on from Freire’s pedagogical approach we need to decode and generate new themes that are relevant to the needs of the learners.

It is this rationalising of the themes that leads to simplicity and a surprise. As themes were re-codified a very familiar pattern started to emerge. The irony is not lost, as several years of work, reading and categorising over 500 sources, reduces CSOS learner needs to Maslow’s Hierarchy of Needs, diagram Fig. 2. The model here is flattened and slightly modified.

Fig. 2.
figure 2

CSOS needs, a deconstructed digital Maslow [40] Hierarchy of Needs

Full size image

The hierarchical nature of Maslow’s pyramid of needs is often critiqued (even by himself [41]) and not relevant to the usage here. Very quickly one can see how applicable the model is. Briefly, some examples might be to consider: that basic needs such as food are often bought online or in store with a card or phone; cyber security needs are self explanatory; health and well-being issues with online usage or addiction; love and belonging, where many of us find partners or like minded groups online; our self esteem needs perhaps being translated as likes or followers; respect of others online opinions or not in the case of trolling; and finally our self actualisation where we become the person we would like to be, perhaps by finding others that share our views, or sexuality, online or maybe link in with us to further our careers. Each and every CSOS issue can be considered with our personal needs or desires in a way that gives meaning to any dialogue about harms or security needs. This reduction in complexity of CSOS to Maslow’s Needs should give confidence to the educator and offer a starting point for any discussion.

Much of our needs can end up turning to desires and even deviance. Like Dalal and Sharma [42] this work considers if Freud’s Id, Ego and Super Ego is a suitable theory to consider when situating out needs with the needs of society. The Id being our unconscious, unchecked desires for our online pleasure seeking. The Superego parents, teachers and society with underlying moral codes, laws, ethics and customs that might not fit in with our Id desires. Our Ego or judge that helps us decide if we should fulfil our desires or not.

Table 1. Tönnies and Harris [43, p. 192] original list of Gemeinschaft and Gesellschaft
Full size table

As shown in Fig. 1, teachers have to help pupils gain understanding for the “respect of others”. This now requires us to situate our needs or Id with respect to the needs of society. There are two clear theoretical contenders as starting points here. The first is what Tönnies and Harris [43] referred to as the Gemeinschaft (community) and the Gesellschaft (society) and can be seen in Table 1. The second is Ecological Theory of Bronfenbrenner [44] which can be seen in Fig. 4a. Both these ecological theories consider social change and human development. With Tönnies and Harris [43] work considered to look at societal change on a macro and historical level. Bronfenbrenner [44] being more descriptive and more focussed on considering a child’s changing environment at different life stages  [45].

Fig. 3.
figure 3

Main learning centred themes of CSOS (Maslow, Bronfenbrenner and Tonnies)

Full size image

A first attempt at trying to rationalise CSOS needs in context of Gemeinschaft and the Gesellschaft led to, the perhaps unwieldy, interpretation in diagram Fig. 3. As can be seen there is also some attempt to incorporate the Bronfenbrenner [44] Ecological Theory. The aim here was to keep the individual needs centred and situated within societal needs. Whilst also taking into consideration the knowledge and conscious cognition of what we need in order to fulfil our needs. This is a little clumsy, however. The flow of thoughts is not consecutive. The main ideas of Tönnies and Harris [43] fit well within Bronfenbrenner’s and so further consideration was given to that representation.

In diagram Fig. 4a we can see my reproduction of a typical early representation of Bronfenbrenner’s Ecological Theory. The other systems are: the microsystem or immediate environment; the mesosytem which is the connecting threads of the individuals immediate environment with the exosystem; the exosystem is the larger community that individuals and their close connections are involved with such as schools, places of work; the macrosystem is the social and cultural values that establish normal practice. This representation also has Bronfenbrenner’s later addition of the Chronosystem, to reflect societal changes in time, added. Bronfenbrenner, himself declared this approach was open to interpretation and needed further refinement. One criticism, addressed here, has been the lack of focus on the individual needs and desires in the model. It is self-evident that the all pervasive nature of digital technology could now be incorporated.

This leads to diagram Fig. 4b or what has presumptively been called a “Techno-Ecological Theory”. If we remember the aim here is to give an educator a tool to situate CSOS. We can not expect that educator to be a CSOS specialist, especially in the context of an ITT trainee from a non technical subject. Following Friere’s approach we can not expect our learners to be interested in whatever banking approach to CSOS that we might adopt. We have to situate the topic in a manner that both can understand and that both can engage in. Topics that are within our zones of proximal development that Vygotsky tells us are necessary for understanding [39]. Topics that can be re-framed as investigative questions to be developed between the teacher and the learner. Hopefully, leading to Friere’s mutual understanding [37].

Fig. 4.
figure 4

Adaptation of Bronfenbrenner’s Ecological Theory

Full size image

The techno-ecological approach, proposed here, is intended to evolve Bronfenbrenner’s representation for the current age. The centre is more obviously focussed on the individual needs. These needs might be considered first and are dependent on the learners age and stage of Piagetian development. Once personal CSOS actions are reflected upon they can be reconsidered within the scope of the other systems within the theory. The intention is to provide anchors for meaningful discussion about the issues.

Bronfenbrenner added the Chronosystem to reflect changes in time. Here this has been repurposed as the Techno-chronosystem. Historical technological changes having long been influencers on all aspects of society. In addition, factors might affect the balance of this Techno-chronosystem have been added. The balance at the bottom is to illustrate how technology changes can move our social development both forward and backward.

The words in the Techno-chronosystem are not intended to be either negative or positive. The arrows are pointing in opposite directions to illustrate this. Hacking might give us driverless cars, drones or Google Glass eyewear. All of which can be espoused for the great technological leaps forward that they are making. Someone adopting a more Luddite approach might counter that driverless cars or drones might cause accidents and, if so, who is responsible? Adoption of technology such as Google Glass might be opposed because of privacy concerns.

Online activism and passivity, cyberharm and resilience to those harms can be illustrated in similar ways. All issues can be contextualised within the scope of the other systems. This helps us to gain the “cognition” at the base of the diagram. Our conscientização that informs our decisions and realisation of needs.

Our needs might then inform actions, such as finding out how to manage passwords. Our conscientização might draw our attention to a societal wrong and this might lead to our activism. Our conscientização will help us situate the online safety harms outlined in the over fifteen pages of the DfE [2]. But it should do so in a way that encourages a greater understanding of technology and the place of that technology within our societal needs.

5 Conclusion

The aim of this paper is to analyse suitable and accessible theoretical approaches to support teacher trainers and trainees with context, mechanisms and outcomes of CSOS. This starting point is intended to help learners and educators of CSOS to come together on common ground and eventually develop conscientisation of the issues.

The topic areas surrounding CSOS are numerous and complex. This paper has highlighted the historical reasons why it is unlikely for teacher trainers or their trainees to be experts in the field and certainly not in all areas of the field. This paper has pointed out why it is not reasonable to expect these non-specialists to be able to deliver the requirements of the Teaching Online Safety guidance without support [2].

The approach suggested here is meant to develop understanding by prompting discussion about issues, within the context of what we know; or our zones of proximal development. According to Friere, once “conscientisation” is achieved the learner and educator can move forward together to address the issues.

The ultimate aim here is to provide a toolkit of heuristics for teachers to deliver CSOS. The theoretical position outlined above is a starting point. The next step is to use this to inform a realist review to find out what works for who, in what situations for CSOS. Not just for now but also in the future, as new CSOS issues emerge.

Early candidates are the “nudges” and “boosts” that Hertwig and Grüne-Yanoff [5] suggest. Nudges to promote good CSOS compliance, which could be as simple as a screen saver on the school computers. Boosts or heuristics that will help pupils make their own decisions in the future. An example might be Toulmin’s approach to argument analysis to spot fake news [46]. Additionally, pedagogical approaches to deliver will be considered such as Papert’s constructionist approach to practical computing education [47] or Bandura’s theory of social learning [48].

This research adds to our knowledge by suggesting the adoption of a new approach to CSOS education. It does so by recognising that we have to avoid a banking approach to CSOS education and that Friere’s pedagogy is a more suitable option. To support this approach to conscientisation, modified versions of Maslow’s Needs and Bronfenbrenner’s Ecological Theories have been proposed. Additionally, in order to situate individual’s needs within the needs of society, Freud’s theory of id, ego and superego is suggested.