Legal, ethical, social — three different questions
These three words are often used interchangeably and the paper distinguishes them carefully.
A legal question asks what the law permits, and the answer differs between countries and changes over time. An ethical question asks what is right, and something can be perfectly legal and still wrong — selling users' browsing history may be lawful and remains a betrayal. A social question asks what effect a technology has on how people live: on employment, on relationships, on the gap between those with access and those without.
The distinction is worth a mark on its own
When a question asks for "ethical and legal issues", it wants two different kinds of answer, not the same point twice. Copying software without paying is illegal — it breaches copyright. Writing software that quietly makes it hard to cancel a subscription is legal in most places and unethical. Naming which category each of your points belongs to shows the examiner you understood the question.
Privacy and personal data
Personal data is any information that identifies a living person — name, address, national identity number, photograph, location history, even a browsing record detailed enough to single someone out.
The principles that govern its use appear in data protection law almost everywhere. Collect only what you need for a stated purpose. Use it only for that purpose. Keep it accurate and no longer than necessary. Keep it secure. And let people see what you hold about them and have errors corrected.
- Consent must be informed and freely given. A checkbox pre-ticked in tiny print is not consent.
- Data minimisation — a shop that only needs to deliver a parcel does not need your date of birth.
- Purpose limitation — data collected for delivery should not be sold to an advertiser.
- Security — encryption, access control, and prompt disclosure when a breach occurs.
- Retention — delete it when the purpose has been served rather than keeping it for ever.
Cybercrime and how attacks work
The syllabus expects the common attack types by name, together with the countermeasure for each. Most successful attacks target the person rather than the machine, which is why training matters as much as software.
| Threat | How it works | Countermeasure |
|---|---|---|
| Phishing | a fake message imitating a trusted organisation | check the sender and the URL; never follow a link to log in |
| Malware / virus | harmful software that spreads and damages or spies | antivirus, updates, do not run unknown files |
| Ransomware | encrypts your files and demands payment | offline backups — the only reliable defence |
| Hacking | unauthorised access to a system | strong unique passwords, two-factor authentication |
| Identity theft | impersonating someone using stolen details | guard personal data; monitor accounts |
| Cyberbullying | harassment through digital channels | block, keep evidence, report to the platform and an adult |
| Plagiarism | presenting others' work as your own | cite sources; use quotation properly |
Why offline backups are the answer to ransomware
Ransomware encrypts everything it can reach — including backup drives left plugged in and cloud folders that sync automatically. A backup that is disconnected cannot be encrypted. This is the single most useful practical point in the chapter and is worth stating explicitly whenever ransomware appears in a question.
Intellectual property, and the social questions
Copyright protects the expression of an idea — the actual code, text or image — automatically, without registration. Using software without a licence, or copying an image into your own work without permission, infringes it. Licences set out what you may do: proprietary licences restrict copying, while open-source licences permit it under stated conditions, which is why open source is not the same thing as public domain.
The wider social effects are examinable too. The digital divide is the gap between those with reliable devices and internet access and those without — a gap that widens every time a service moves online and assumes everyone can reach it. Automation removes some jobs and creates others, but rarely for the same people in the same place. And e-waste from discarded electronics contains heavy metals that contaminate land and water where it is dumped.
Before you leave this chapter
- Legal = what the law allows. Ethical = what is right. They are not the same, and a question asking for both wants two kinds of answer.
- Collect only the personal data you need, for a stated purpose, keep it secure, and delete it afterwards.
- Phishing targets the person, not the machine. Check the sender and never log in through a link.
- Offline backups are the only reliable defence against ransomware.
- Copyright is automatic; a licence states what you may do. Open source is not the same as no rights.
Recognising a phishing message
Phishing is the attack most students will actually meet, and every successful one relies on the target not stopping to check four things. None of the four requires technical knowledge.
Check the sender and the link in particular. Only the part immediately before the final dot identifies the owner — "hbl-verify-account.com" belongs to whoever registered that name, not to the bank.
The rule that makes phishing fail
Never log in through a link in a message. If a message claims there is a problem with your account, close it, open your browser, and type the address yourself. This single habit defeats phishing regardless of how convincing the message is, and it is the answer worth giving whenever a question asks how to protect against it.