Source: AP Computer Science Principles Course Framework
Tags: digital divide, computing bias, crowdsourcing, citizen science, intellectual property, copyright, creative commons, fair use, open source, open access, plagiarism, PII, personally identifiable information, encryption, symmetric key, asymmetric key, public key, private key, phishing, keylogging, malware, virus, worm, ransomware, DDoS, rogue access point, authentication, multi-factor authentication, digital certificate, certificate authority
Difficulty: Intermediate Prerequisites: None for the concepts. Big Idea 4 (networks, protocols) helps with the safe computing section.
Big Idea 5 accounts for 26% of the exam, making it the second-largest section. It covers the societal, ethical, and legal impacts of computing. You need to understand the digital divide (who has access and who does not), how computing bias arises, the legal framework for intellectual property (copyright, Creative Commons, fair use), and the principles of safe computing (encryption, authentication, malware, phishing). The encryption section, especially symmetric vs. asymmetric keys and digital certificates, tends to feel abstract at first, but it is tested directly. If you can explain how public key encryption works and name the factors that influence the digital divide, you are covering the highest-priority material.
Computing innovations have both beneficial and harmful effects. The digital divide creates unequal access to technology across demographics, economics, and geography. Computing bias arises from biased data and algorithms. Intellectual property is protected by copyright, with legal sharing through Creative Commons, fair use, and open source. Safe computing requires strong passwords, multi-factor authentication, and encryption. Symmetric encryption uses one shared key; asymmetric (public key) encryption uses a public key to encrypt and a private key to decrypt.
Digital divide
The gap between those who have access to technology and the internet and those who do not. Influenced by demographics, socioeconomic status, and geography.
Computing bias
When technology amplifies existing human biases, perpetuating inequality. Arises from biased training data, biased algorithms, or lack of diversity in the teams building the technology.
Machine learning model
A computer program that can learn from data and make predictions or decisions without being explicitly programmed for each scenario. Susceptible to biases in its training data.
Crowdsourcing
The practice of collecting a large amount of input or information from many people over the internet. Organisations often do not need to pay for the contributions they receive.
Citizen science
Scientific research that the general population helps conduct. Ordinary citizens contribute data to research projects using computing devices (e.g. counting birds at local feeders). Citizen science is a form of crowdsourcing.
Intellectual property (IP)
Creations of the mind: inventions, literary and artistic works, designs, and images used in commerce.
Copyright
The legal right that the creator of a work has to control its use. Includes economic rights (financial benefits) and moral rights (right to claim authorship, right to prevent harmful changes).
Plagiarism
Taking someone else's content and claiming it as your own.
Public domain
Creative works that are free to use without permission. Copyright has expired, been forfeited, or was never applicable.
Creative Commons
A public copyright licence that creators use when they want to give others permission to use their work under specified conditions.
Fair use
A legal doctrine that allows the use of copyrighted material without permission for limited purposes such as news reporting, education, commentary, or parody. Evaluated using the PANE criteria.
PANE (fair use criteria)
Purpose (is the new use transformative?), Amount (how much of the original work is used?), Nature (is the original factual or creative?), Effect (does the new use harm the market for the original?).
Open source
Software or other work that can be freely distributed, used, and modified by anyone. The source code is publicly available.
Open access
Research available to the general public free of restrictions, such as academic journals. Often free of copyright restrictions.
Personally identifiable information (PII)
Information that can be used to identify a specific individual: age, race, phone number, medical information, biometric data, social security number.
Targeted marketing (targeted advertising)
Using collected personal data (search history, location, browsing habits) to show users specific advertisements. Benefits businesses but incentivises the collection of private information and can be abused.
Malware (malicious software)
Software intended to damage or gain unauthorised access to a system. Includes viruses, worms, ransomware, and adware.
Virus
A malicious program that copies itself and must be activated by the user (e.g. opening an infected file). Cannot operate independently.
Worm
A malicious program similar to a virus but can operate and spread independently without user action.
Ransomware
Malware that makes a computer inaccessible until a ransom is paid.
Adware
Malware that displays unwanted advertisements and slows down a computer.
Phishing
A scam where attackers trick users into providing personal information by posing as a trustworthy group (e.g. a fake bank email asking for login credentials).
Keylogging
Recording a user's keystrokes to capture passwords and other sensitive information.
Rogue access point
A wireless access point that gives unauthorised access to a secure network. Can modify, analyse, and intercept data passing through it.
Passive interception
Reading data on a network without modifying it.
Active interception
Reading and modifying data on a network.
DDoS (Distributed Denial of Service)
Multiple computers overwhelm a website or server with too many requests, causing it to slow down or crash.
Authentication
Measures that prevent unauthorised access to an account or system.
Multi-factor authentication (MFA)
Requiring multiple verification methods to access an account. The three categories are knowledge (password, PIN), possession (a phone receiving a one-time code, an access badge), and inherence (biometrics: fingerprint, voice).
Encryption
The process of encoding data to prevent unauthorised access. Encrypted data is called ciphertext; unencrypted data is called plaintext.
Decryption
The process of decoding encrypted data back into readable form.
Symmetric key encryption
Uses the same key for both encrypting and decrypting. Both the sender and receiver share one secret key. Simpler but requires a secure way to share the key.
Asymmetric (public key) encryption
Uses a pair of keys: a public key (shared openly) to encrypt, and a private key (kept secret) to decrypt. The sender encrypts with the receiver's public key; only the receiver's private key can decrypt it.
Digital certificate
Issued by a Certificate Authority (CA) to a trusted site. Contains a copy of the site's public key. Used to verify that a website is what it claims to be, fostering trust in public key encryption.
Certificate Authority (CA)
An organisation that verifies the identity of websites and issues digital certificates. The trust chain: the user trusts the client, the client trusts the CA, the CA trusts (has verified) the server.
Benefits: improved medical technology, better engineering and product design, flourishing global communications, ability to create and share creative works
Harms: digital divide, computing bias, copyright and legal concerns, malware and security risks, loss of privacy, job displacement, technology dependence, negative health outcomes
Targeted advertising helps businesses but incentivises collecting private data
Machine learning benefits many fields but can produce biased or discriminatory results
Influenced by three factors:
Demographics: younger and more educated people tend to use technology more
Socioeconomic status: higher income makes it easier to purchase and maintain technology
Geography: some areas (especially rural) have limited internet access
Harmful impacts: students without stable internet suffer educationally (as seen during 2020 pandemic remote learning), workers without internet access face disadvantages in finding and performing jobs
Reducing the divide: digital literacy programmes, government funding for internet access in underserved areas
Biases are tendencies or inclinations, especially those that are unfair or prejudicial
Examples: criminal risk assessment tools trained on historically biased data, facial recognition systems with fewer images of women and minorities, recruiting algorithms biased against certain demographics
Prevention: use diverse data sets, review algorithms for potential biases, increase diversity in the tech industry
Crowdsourcing collects input from many people online
Citizen science is a form of crowdsourcing where ordinary people contribute to scientific research
Benefits: access to more diverse data, wide participation, reduced costs for organisations
Copyright protects creators with economic rights (profit from their work) and moral rights (claim authorship, prevent harmful modifications)
Plagiarism: claiming someone else's work as your own
Creative Commons: a licence that lets creators grant specific permissions for others to use their work
Fair use (PANE): Purpose, Amount, Nature, Effect
Purpose: is the use transformative, with a new purpose?
Amount: is only a small portion of the original used?
Nature: is the use based on factual rather than creative work?
Effect: does the use avoid harming the market for the original?
Open source: freely distributed and modifiable software
Open access: research available to the public without restrictions
Malware: viruses (need user activation), worms (spread independently), ransomware (locks your computer until payment), adware (unwanted ads)
Phishing: impersonating a trustworthy entity to steal personal information
Keylogging: recording keystrokes to capture passwords
Rogue access points: fake Wi-Fi hotspots that intercept data
DDoS attacks: flooding a server with requests to crash it
Protection: security patches (fix bugs), firewalls (monitor traffic, cannot catch everything), antivirus software (scans and identifies malware)
Strong passwords: mix of uppercase letters, numbers, and symbols
Multi-factor authentication (MFA): requires two or more of: knowledge (password), possession (phone code), inherence (fingerprint)
Encryption: encoding data so only authorised parties can read it
Symmetric key: one shared key encrypts and decrypts. Both parties must have the same key.
Asymmetric (public key): the sender encrypts with the receiver's public key. Only the receiver's private key can decrypt it. No need to share a secret key.
Caesar cipher is a simple example of symmetric encryption (shift each letter by a fixed number)
Digital certificates: issued by Certificate Authorities. Contain a copy of the site's public key. Used to verify a website's identity.
Trust chain: user → browser → Certificate Authority → server
Analogy: a digital certificate is like a verified signature on a cheque; the CA confirms the signature is real
Facial recognition technology in law enforcement has faced criticism for higher error rates on women and people of colour, a direct example of computing bias from non-diverse training data.
HTTPS (the padlock in your browser) uses public key encryption and digital certificates to protect your data when you shop online or log into your bank.
Students confuse symmetric and asymmetric encryption. Symmetric uses one shared key for both encryption and decryption. Asymmetric uses two different keys (public to encrypt, private to decrypt).
Students think the digital divide is only about income. Geography and demographics (age, education level) also play significant roles.
Students assume collecting more data eliminates bias. If the additional data comes from the same biased source, the bias persists. The type and diversity of data matter more than volume.
Students confuse copyright with plagiarism. Copyright is the legal right a creator holds. Plagiarism is the act of claiming someone else's work as your own.
⚠️ Symmetric vs. asymmetric encryption: know how each works and when each is used. This is tested directly.
⚠️ The PANE criteria for fair use appear in multiple-choice questions. Memorise all four.
⚠️ Know the three factors of the digital divide (demographics, socioeconomic, geographic).
⚠️ PII: be able to identify examples of personally identifiable information.
⚠️ Virus vs. worm: a virus requires user activation; a worm spreads independently.
⚠️ Digital certificates and Certificate Authorities: understand the trust chain.
⚠️ Crowdsourcing and citizen science: know that citizen science is a form of crowdsourcing.
True or False: A virus can spread independently without user action.
Fill in the blank: The four criteria for fair use are Purpose, Amount, Nature, and __________.
True or False: Asymmetric encryption uses the same key for encrypting and decrypting.
Fill in the blank: The gap between those with and without access to technology is called the __________.
True or False: Citizen science is a form of crowdsourcing.
Answers: 1. False (a virus needs user activation; a worm can spread independently). 2. Effect. 3. False (asymmetric uses a public key to encrypt and a private key to decrypt). 4. Digital divide. 5. True.
Q: Explain the difference between symmetric and asymmetric encryption.
A: Symmetric encryption uses a single shared key for both encrypting and decrypting data. Both the sender and receiver must have the same key. Asymmetric encryption uses a pair of keys: a public key (shared openly) encrypts the data, and a private key (kept secret by the receiver) decrypts it. Asymmetric encryption eliminates the need to securely share a secret key.
Q: A company's hiring algorithm consistently ranks female applicants lower than male applicants with identical qualifications. What is this an example of, and what could be done about it?
A: This is an example of computing bias. The algorithm is likely trained on historical hiring data that reflects past gender discrimination. To address it, the company could use more diverse training data, audit the algorithm for biased patterns, and ensure diverse teams are involved in building and reviewing the system.
Q: What is the role of a Certificate Authority in public key encryption?
A: A Certificate Authority (CA) verifies the identity of a website and issues a digital certificate containing the site's public key. When a user's browser connects to the site, it checks the certificate against the CA's records. If the certificate is valid, the browser trusts that the site is legitimate. The trust chain runs: user trusts the browser, browser trusts the CA, CA has verified the server.
Q: A student finds an image online and uses it in a school presentation, claiming they created it. What two issues does this raise?
A: First, it is plagiarism (claiming someone else's work as your own). Second, it may be a copyright violation if the image is not in the public domain and the use does not qualify as fair use under the PANE criteria.
Q: Name two ways to reduce the digital divide.
A: (1) Organisations and governments can fund internet access in underserved areas (rural regions, low-income communities). (2) Digital literacy programmes can teach people how to use technology and navigate the internet.
Computing bias here connects to bias in data (Big Idea 2), where biased data sources produce biased results regardless of how much data is collected.
Encryption and binary connect to Big Idea 2 (Data) and Big Idea 4 (Computer Systems and Networks), where data is represented in bits and transmitted in packets.
Crowdsourcing and collaboration connect back to Big Idea 1 (Creative Development), where collaboration is presented as a core principle of software development.
digital divide, computing bias, machine learning bias, crowdsourcing, citizen science, intellectual property, copyright, economic rights, moral rights, plagiarism, public domain, Creative Commons, fair use, PANE, open source, open access, personally identifiable information, PII, targeted marketing, targeted advertising, malware, virus, worm, ransomware, adware, phishing, keylogging, rogue access point, passive interception, active interception, DDoS, authentication, multi-factor authentication, MFA, encryption, decryption, ciphertext, plaintext, symmetric key encryption, asymmetric encryption, public key encryption, private key, digital certificate, Certificate Authority, CA, Caesar cipher, AP CSP, AP Computer Science Principles, Big Idea 5