In 2022, a report from the eSafety Commissioner found that many young people engage in risky online behaviours or encounter negative online experiences.
That report, alongside several real-world incidents, prompted Charles Sturt University colleagues Dr Julie Maclean, Researcher in Computing, and Professor Yeslam Al-Saggaf, Professor in Computing, to question whether data shared by young people’s devices could be contributing to this risk.
‘We began to ask: Are students aware of what their devices might reveal about them?’ Maclean tells Teacher.
This question led the researchers to undertake a study in 7 New South Wales schools, the findings of which were recently published in the open access report – Protecting Children From Smartphone’s Leakage Of Security Sensitive Information (Al-Saggaf & Maclean, 2024).
About the study
‘We were particularly struck by [the eSafety Commissioner’s] findings showing that, despite their technical fluency, many adolescents have a limited understanding of the privacy risks associated with everyday smartphone use,’ says Maclean. ‘Tech-savvy doesn’t necessarily mean privacy-savvy.’
To better understand the current attitudes and behaviours of students, and what role schools can play in mitigating the risks, 4,460 students in 7 regional NSW high schools were asked a range of questions about how they use their smartphones, what risks they perceive, and the concerns they have. They were then provided with a hands-on smartphone safety intervention – aimed at enhancing their knowledge and awareness of sensitive information leakage from smartphones and building their awareness of data privacy and the security risks associated with smartphone use – before completing the survey again.
In 2 of the 7 schools, M5Stack Core 2 ESP32 devices capable of detecting Wi-Fi traffic and Bluetooth signals were also installed to capture data-leakage levels before and after the hands-on intervention.
‘Tech-savvy doesn’t necessarily mean privacy-savvy’
Data from the Office of the Australian Information Commissioner (2023) and eSafety Commissioner (2022) show 91% of 14 to 17-year-olds have their own smartphone.
‘It’s a common assumption that, as ‘digital natives’ who have grown up with technology, young people intuitively know how to protect their privacy online,’ says Maclean.
Yet, when they initially assessed students’ smartphone behaviours, they found high rates of data leakage.
‘Many students may not realise that certain actions, such as using location services, checking in on social media, or granting app permissions, share their data. This lack of awareness can lead to unintentional data leakage, as these actions aren’t always viewed as privacy risks,’ says Maclean.
She adds that, for some who are aware of that data-leakage, convenience is outweighing the perceived risk – especially as young people are less likely to have experienced any negative consequences to these behaviours.
‘While some students may understand that data is shared, they often don’t fully grasp the potential consequences … This mindset … can foster a willingness to trade privacy for convenience.’
Maclean says that this serves as a reminder that being ‘adept at navigating social media, gaming and apps’ doesn’t necessarily translate into an understanding of how these actions affect data security and privacy.
‘[It] highlights the importance of targeted education on privacy and data security, so young people can develop both the technical skills and critical thinking needed to make safer online choices.’
The impact of intervention
The project team delivered a hands-on intervention across all 7 schools, demonstrating how smartphones leak sensitive information, how easily a simple computing device like an M5Stack Core 2 ESP32 can capture and record this information, and how to manage their smartphones to prevent such leaks.
Post-intervention survey findings revealed significant improvements in smartphone privacy knowledge, particularly in managing Wi-Fi settings, setting non-identifiable device names, and preventing IP address tracking.
Results from the M5Stack Core 2 ESP32 devices also indicated a substantial reduction in network traffic, showing that students made tangible changes to their smartphone settings, such as disabling Bluetooth and managing location services.
However, Maclean says they were somewhat surprised by a persistence in certain students continuing to engage in risky behaviours, even when they said they were aware of the risks – what’s called the ‘privacy paradox’.
‘The lowest change was in students' attitudes toward privacy settings, with mean attitude scores significantly lower than knowledge scores … while adolescents recognise privacy risks, particularly related to data misuse and harassment, their attitudes do not always translate into protective actions.’
What schools can do to help
The survey findings show that young people’s knowledge of how to keep themselves safe, and their attitudes towards data-leakage, can pose a risk to their online safety.
Maclean says schools can play a critical role in educating students and reducing this risk – particularly by engaging with experts to provide hands-on, practical training.
‘Schools play a critical role in fostering smartphone safety by integrating digital privacy education into the curriculum and promoting a culture of digital responsibility … Providing scenarios or simulations that illustrate data-sharing risks can help students connect these practices to real-world concerns.’
She also highlights how teaching staff need to be supported through ongoing professional development, so that they have the knowledge to guide students in developing safe smartphone habits.
As a starting point, you can view the below resources, recommended by Dr Julie Maclean, at the links below.
- Introduction video for students and parents
- Webinar for parents and teachers
- Online cyber safety lesson for students
References
Al-Saggaf, Y. & Maclean, J. (2024). Protecting Children from Smartphone’s Leakage of Security Sensitive Information. Final Report. eSafety Commissioner Online Safety Grants Program. Charles Sturt University.
eSafety Commissioner (2022). Mind the Gap: Parental awareness of children’s exposure to risks online. Aussie Kids Online: eSafety Commissioner. https://www.esafety.gov.au/research/mind-gap
Office of the Australian Information Commissioner. (2023). Australian Community Attitudes to Privacy Survey 2023. Australian Government.
How do you promote digital technology responsibility to your own students?
Have you integrated digital privacy education into your curriculum?
Have you used scenarios or simulations to illustrate data-sharing risks? If not, how could you incorporate these kinds of activities to make real-world links for students?
