Information security aims to preserve confidentiality, integrity and availability. Confidentiality limits who can access data; integrity protects against improper changes; availability allows data to be used when needed. These properties are related, although one measure does not automatically achieve them all. A recoverable backup may help after file loss while also disclosing information if it is exposed. Evaluating protection requires knowing which objective it addresses, under which conditions it works and which need remains unresolved.

Measures also act at different times. Prevention reduces exposure before a problem; detection supplies signals for recognising it; response fits what has happened and verifies recovery. Passwords, alerts and backups are therefore not interchangeable. Their usefulness becomes clear by connecting risk, function and limitation instead of relying on a reassuring label. Recovering files, for example, addresses a different need from deciding who may view them.

This technical explanation needs to include people. Fraud may cause fear, and harassment requires support as well as controls. The person harmed is not responsible for that harm, and enabling help is part of an appropriate response. The campaign uses fictional cases to make these decisions understandable without asking for personal accounts. Its purpose is to explain protection and access to responsible support without promising an absence of risk or turning individual mistakes into a public assessment.

Privacy concerns the use of personal information and conditions of access, purpose and circulation. A digital footprint includes voluntary posts, activity records and information inferred by combining them. A nameless photograph may reveal location, schedule or relationships through content and context. Setting a profile to private limits an audience, but does not automatically remove earlier copies or prevent an authorised viewer from resharing.

Each setting should relate to a function: post audience, location, tags, contacts and application permissions. Minimisation means using only data necessary for a purpose, rather than accumulating it in case it becomes useful. Check before and after from the intended role in a simulated profile. Hiding information on one screen does not establish its disappearance from records or copies. Access security may support privacy, but a well-authenticated account may still disclose excessive information through its owner’s decisions. Explain which exposure each change reduces and which control it still does not provide.

Maintenance reviews the operating system, applications and available protection according to the platform. Updates fix known problems in the component being changed; updating one application does not establish the whole computer’s status. Record previous state, authorised action and a follow-up task check. A protection tool does not make a doubtful download trustworthy. Use official channels and school configuration without installing incompatible programs to complete a checklist.

A long, unique password reduces guessing and reuse risks. An approved manager helps preserve distinct credentials, but its own access also needs protection. A second factor adds a check from another category, such as possession, to knowledge of a secret; entering two passwords does not itself create two factors. None guarantees that an open session is legitimate. Recovery codes are secrets and must not be photographed or submitted. Practise with fictional credentials and describe access and recovery verification without copying values. Also document planned maintenance frequency and sign-out.

Phishing uses impersonation to obtain data or induce actions. Urgency, apparent sender and links are signals requiring verification; neither good spelling nor a padlock guarantees legitimacy. Check through a known official route or a channel independent of the message. Distinguish receiving a notice, opening a page, disclosing a credential and executing a file: they describe different exposures and do not automatically establish infection.

If only received, avoid interaction and use the planned channel to verify and report. If a password was disclosed, seek support to regain control from a trusted device, change the affected credential and review sessions and recovery according to the service. After suspicious execution, stop using the computer and notify the responsible person for the school’s protocol rather than improvise cleaning. For harassment or impersonation, provide adult support, preserve only relevant evidence with help and avoid amplifying content. Blocking and reporting may help but replace neither support nor justify investigating or confronting others.

A backup protects availability only if it preserves what is needed and survives the incident considered. Define scope, destination, date or version and restoration procedure. Another folder on the same device may help with some changes but not complete disk loss. Synchronisation keeps locations related and may propagate deletions; it is not assumed equivalent to an independent backup. History preserves versions under service conditions and also needs checking.

The test uses a fictional document with recognisable content. Preserve the original and recover a practice version to another authorised destination; open it and compare data and version. An icon or copy-button screenshot does not establish usable content. Record expectation, observation and conclusion, including remaining dependencies. Restoring a file does not automatically recover a compromised account or explain who caused a change. After an incident, its cause also needs review with responsible support. The workshop demonstrates this relationship without destroying valid files or promising recovery of information never copied.

Digital wellbeing considers attention, rest, posture, sleep and relationships alongside technical protection. Notifications and social comparison may influence an experience, but a small classroom record cannot diagnose health or establish a universal rule. Propose a specific voluntary adjustment for a comparable task, such as grouping non-urgent alerts, while preserving an agreed help channel. Measure task interruptions without collecting conversations or intimate habits.

For younger classes, adapt vocabulary and present one decision per example without hiding important limitations. The eight-minute workshop may allocate two minutes to the case, two to settings, two to a prepared maintenance-and-backup demonstration and two to a new case and questions. This is an indicative rehearsal script within the submissions. Use clear text, readable size, contrast and a transcript for audio. Do not send trap messages or publicly classify mistakes. Check whether the audience can decide and seek help in another situation, rather than merely recall a slogan.

Profiling uses automated processing of personal data to evaluate or infer characteristics and guide decisions or messages. Understanding it requires distinguishing observed data, inference and the resulting action. Recorded activity provides an observation; the meaning attributed to it is a deduction that may be wrong. Data selection, purpose and context shape that interpretation. A statistical prediction does not know with certainty what a person thinks, even when it is used to select the message shown to them.

Displaying a message and demonstrating influence are different outcomes. A campaign may try to change decisions without that intention establishing its effect on every recipient. Analysis therefore needs evidence and limitations and cannot attribute every behaviour to a single platform or technique. In The Great Hack, separating scene, testimony, testable claim and the team’s interpretation reveals what is observed and which explanation needs documentary support.

Checking sources turns an impression into a reasoned conclusion. First we state a specific claim; then we look for its original source, date and supporting evidence. A testimony may describe an experience without establishing a general effect on its own. If information is missing, the conclusion keeps that uncertainty. This analysis also guides protective decisions: data minimisation means using only the data needed for a purpose. Reviewing permissions or reducing the data shared turns a conclusion about profiling into a guideline whose application can be checked.

An educational campaign communicates a guideline and allows it to be applied, but does not replace the technical demonstrations it promises. Material should connect privacy settings, maintenance and recovery with observable tests. A slide recommending backups does not establish that a file was restored. Rehearsal combines explanation, a prepared demonstration and a new case with different context and appearance to test transfer of the idea rather than memory of a button’s colour.

A01 combines audience, objectives, three cases, protocol, wellbeing, sources and an initial rehearsal with configured profile and executed checks. A02 completes the campaign, demonstrations, restoration and feedback-based review. Record the actual rehearsal audience; do not arrange other-class visits outside school coordination. An indicator such as justified responses out of total participants describes that group and time, not guaranteed behaviour during real incidents. Exclude names and individual errors from the report. Each member explains a decision, a test and a verified improvement. Audiovisual checks and practice belong to the two existing submissions.