My 13-year-old-niece wrote an article for me about social engineering, and I got a chuckle out of her writing, “Maybe I’m old-fashioned, but I only use email. I don’t have my own FaceBook site.”
Can you imagine email being old-fashioned?! Gosh, my hand-written letters must be prehistoric!
Well, I shared this with my friend Ray, and he told me (thanks Ray!) that his teen and tween nieces told him email was for “old people.” They use instant messaging (IM) and texting to do their communications. The teen said that the numbers of teens using email is “getting smaller and smaller.” They even provided a couple of links to prove email is for old people! See:
* “The Death of E-Mail”
* “In The US, Email Is Only For Old People”
YIKES!
Something else my niece told me was that her school in a large district in Austin, Texas, provides *NO* education to students about computer security, Internet security, or anything related. Considering all the risks involved with IM and texting (see a couple of my blogs about IM risks here and here; I need to do more research on texting vulnerabilities and risks…they exist while texting not only via phone, but also via web based) this really concerns me.
Laws, such as the Children’s Online Privacy Protection Act (COPPA) address some security and privacy concerns for obtaining personally identifiable information (PII) from children, but there is none that I’m aware of off the top of my head that addresses how adults or organizations can, or more importantly cannot, communicate with children via IMs and texting.
It makes me wonder how many children are being communicated with inappropriately through IMs and texting; there are many published IM and texting social engineering exploits. Most kids put their texting and IM information on their FaceBook and MySpace pages…
We need more information security and privacy education in elementary and secondary schools. We need to teach kids how to use encryption for IM and texting. It’s not as hard as some people want to make everyone believe it is.
How can we expect to have strong information security and privacy leaders in the future if we don’t start teaching kids about these issues when they are young and already using the technologies? It’s kinda like letting them drive a car with no brakes or seatbelts…they’re out on the information highway completely unprotected.
Do we need more laws to address this also? I don’t know…I’m not an advocate of passing yet even more laws to address a narrowly scoped issue…but I also would hate to see no recourse and no significant legal sanctions for bad things criminals and predators do by exploiting lack of laws governing IMing and texting minors.
Tags: awareness and training, COPPA, IM, Information Security, instant messaging, IT compliance, personally identifiable information, PII, policies and procedures, privacy, privacy breach, privacy incident, risk management, security risk, security training, texting