Josh Rykowski - Weaponizing our youth The Case for Integrated Cyber Ethics

yeah definitely all right frowned upon

welome all right all right thank you very much I I appreciate the the warm reception the warm welcome you know first I just want to thank uh you know besides Augusta for putting on this event you know allowing a lot of us to kind of step out in front of the the community really and kind of put some ideas out there and uh you know get some hopefully get some feedback and that's really what I'm here for today I know it's kind of a catchy title weaponizing our youth you know the case for uh integrated cyber ethics but really I just want to kind of step out with with this brief today or this uh talk today

is just the fact that this is I I'm trying to initiate a discussion here so don't take anything I say here with any finality or any sort of like I'm providing a solution I want to really kind of get try to get the community engaged in this issue and we'll talk more about that in a bit so again you know the talk is weaponizing our youth the case for integrated cyber ethics uh I am Josh rowski there's my email up there if you have any questions or comments you want to throw my way after the talk please go Ahad and send them there so a little bit about myself uh so background so Mark alluded to it um I am

a programmer you know definitely python Focus because I mean who really doesn't like python right I mean python is where uh where you need to be in my eyes um I'm also an educator um spent some time teaching at West Point teaching computer science and uh really focused there on teaching the cs1 class or the uh the introductory um computer science class to trying to get those you know students focused and really excited about stem and that's why put in there I have a passion for stem um but more importantly I've got a passion to try to instill a passion in others for stem um and so that's kind of where you know kind of

led me down the path to get to this talk and of course you know you know everyone has to have a hobby and my hobby is I'm also a revivor of dead arcade games right yeah exactly who doesn't like arcade games right yeah exactly so that's actually a picture of my garage a couple years old actually it's it's according to my wife it's a disease right um my first pitch was like I'm just going to flip these and I haven't sold a single one yet so I've got a garage half full of arcade games but again you know I just wanted to throw it out there so uh you got my email address you want to

play some arcade games let me know which one that's a bad dudes from from the 90s jamama based so yeah good times though which one I do not uh great question so far but again you know I just want to throw that up there yeah I could probably have a whole talk about that and how to revive old arcade games but you know what that' kind of give away the tradecraft and uh I'd be fighting all of you for the arcade games around the uh CS so so we'll see maybe there'll be a talk for next year but uh so why does this matter so why am I talking about the fact that we're trying

to weaponize our youth and really when I talk when I say weaponize our youth I'm talking about we are trying to teach younger um uh younger uh students you know hacking techniques both offense and defense um so we keep shifting this to the left in that educ education timeline which is great I'm all for it because again you know I want to go ahead and instill that passion for stem and this is one of those ways to kind of get that get our hooks into those young uh young minds and say okay let's focus on science technology engineering and math um however in my eyes there's there's a flaw in the process we're using currently and that flaw is we're making

an assumption um that they have a a fully formed or a very or a more fully formed moral construct um which is definitely not the case down in the high schools or even younger than that um so that is part you know so that's part of the issue the fact that they're they have an immature moral construct and the way we're kind of teaching now to kind of give you an analogy is it's like handing it's like sitting a child down talking to them about gun safety talking to them about how to load a weapon fire the weapon down range clear it and then say okay we've now talked about this in a very nice environment

just you and me talking about it uh here's your gun here's your bullets the range is over there and you let and you say go and the expectation at that point is for them to know how to do everything and be able to do it complete and I don't think we're kind of we're kind of missing the point with that and I'll get more to that in the rest of my talk here so again trying to highlight the fact that we're moving this to the left in this education timeline um so here are just some just a few uh examples that I found so I'm currently involved in the uh the a AFA cyber Patriot which

is you know focused down into the high school level you also have hicker high school you know again High School curriculum you got some ctfs focused directly to the high school level and then you got miter cyber Academy so again these are very age focused programs that're focused at getting this education down into the high school level um however they're making that age agnostic assumption they're making that assumption that we can teach kids these topics just like we teach adults these topics and like I said there's a there's a flaw there that adults have a little more fully formed moral construct and kids don't they're still forming that construct and so I think we need to uh we need to get

at that and to get at that um sorry hit the button there little I'm going I'm going to propose three tenants here in a second however look at that right there right isn't that Epic Big Wall of text that is a professional organiz organization's code of ethics that's page one of five or six right that's why I put up their code of ethics tldr way too much I mean this is the same thing as when you install software I mean who actually reads the in user licensing agreement okay I've got I've got one kudos to you my friend however are the rest of us like okay where's the okay where where do I I click accept and

that's kind of where I feel the code of ethics are it's like it's this big long junp jungle jumble of legales a lot of words in there ah and I don't want to take the time to read it so and that's me saying that as an adult now imagine taking a high school student dropping a code of conduct in front of him and say hey let's talk about this you think they're going to read that whole thing beginning to end probably not right but what are they going to do they're going to tell you they read it because what do they want to do at that point if you're teaching them hacking they want to hack right

they're like okay this is just a hurdle I have to get through to be able to hack all the things like uh like Ed likes to say so they're going to say yep got it okay you want to talk about it I'll do that too and and really I think that's the wrong approach at this level um for these kids so like I alluded to earlier here are my three tenants that I I feel we need to get at when trying to uh you know teach um the Cyber education down to this level the first I feel it needs to be application based right we can't just teach ethics by itself and then stop there and say okay let's go on to

the next subject it's got to be application Focus or application based we need to provide them opportunities to fail constructively seems kind of counter intuitive right we don't want to fail you know we're taught from an early early age failure is bad um however I'll talk a little more into that and really the the key point of that is fail constructively and how do we provide that to them uh and the last piece of course is mentorship and that ties into the fail constructively peace um because again with mentorship you want to be able to have someone there to kind of pick them up when they fall down dust them off a little bit have a

discussion and then send them back on their way so they can be a little better uh better uh have a better mindset when moving forward and they hit that problem again okay so let's get a a little dig a little deeper into the first one so application based it's very clear or it's very easy to see that ethical dilemmas do not occur in a vacuum right if you're sitting there at home doing nothing TV's not on nothing's going on there's very little chance of you having an ethical dilemma however if you're out there doing something hanging out with friends making decisions there's the potential for an ethical Dilemma to occur and that's one of the things I was talking

about earlier one of the pieces I was talking about that were missing we need to provide this ethical this integrated integrated ethical training while teaching these kids these these Concepts and these topics because like I said these these ethical dilemas do not occur in a vacuum we need to make sure that we integrate it and and move forward um and like second bullet says there you know the ethics cannot be disjointed from the situation so again if we teach ethics by itself and then move on into the situations and continue to teach that they're not drawing any correlations they're not drawing any they don't see how it applies there's no application to it and so without the

application they're left on their own to make a decision now this works when we have adults right because adults have a little more fully formed moral construct to kind of lean back on they're like yeah I've got a little World experience I've got a little wisdom I can sit there I can take a look at it well I maybe I've seen this before for so then I can make a decision kids not so much they're still in the learn phase they're still building that moral construct as they as they learn and so um so again I feel like e ethics education sits at the intersection of the situation and ethics itself so we cannot teach them

disjointed we're doing them a disservice by by doing so we need to make sure that we integrate it and like I said it helps the students draw the correlations right sometimes learning is just doing a little pattern matching at first right you have different levels of learning however if we teach them the pattern matching enough what'll happen is they'll be able to take that pattern matching and then when they get into a unstructured ambiguous problem they should be able to attack it or at least disect it a little bit to say okay what does right look like in this situation and sometimes it's not even right sometimes it's like what is more right than less right you know and again gets

that ambiguous piece of it but again so the application-based tenant is you know like just to recap um ethical dilemas don't happen in vacuum and we need to make sure we teach them that uh as they move forward we teach them with applications we show them how to apply ethics to their situations as opposed to uh just talking about it clicking okay at the at the end of the code of conduct and then moving on to the cool things so this brings me my second uh tenant the opportunity to fail constructively this is one that's near and dear to my heart uh first and foremost because failing is easy right try as we might try as hard as we can it is very easy to

fail I mean I failed several times this morning when I hit the snooze four times right failed to get up on time failed to get up on time failed to it happens it happens so the catch though is how do we turn that failure into a learning point right this is the hard part like I said failing is easy however learning from our failures or helping others learn from their failures is very difficult but it's also very rewarding now when I was kind of working through an analogy in my mind I kept going back to scaffolding however uh scaffolding really doesn't quite a get out the problem here so you see I've got this really cool picture up here see I was a

prior engineer for a little while did some construction had some fun um however what you see up there's what I call a concrete form right scaffolding is what you put up when you want to clean windows on a building doesn't really help form anything right it's their temporary so think of the the opportunity to fail constructively as a concrete form it's something I have to build to p the concrete into and then let it sit and wait and solidify right so the opportunity to fail constructively provides that form it says okay I see you failed but let's go and talk about why you failed let's go and see okay H maybe you didn't fail as

bad as you did sometimes you know we're our our own worst critic and you know we can kind of not see the good from the bad and so but however having someone there or a construct there to say okay you failed and let's let's talk about it and then let's see what let's let's talk about what right looks like in that certain situation and that's where the concrete form comes in uh it provides the opportunity for them to kind of lay that foundation and then also for that Foundation to solidify because if you pull the concrete forms too early your concrete's not fully set and it'll fail so again the opportunity to fail constructively is just to make sure that

we uh we provide them the feedback in that now this ties into my third tenant here and that is the tenant of of mentorship with this we want to get inside their thought process we want to see you know what's going on you know what's happening how they arrived at the decision so it's it's more so and that's that's why I kind of fail in on menhip because again we don't want to just find them a critique at the end right because a critique is is what it's a one-way directive it's like this is what you did wrong and this is what I think you should do to fix it and what does that do to the student or the the individual

receiving it well sometimes they're like H this seems like a a lot of words I don't have enough time and you know what I'm just going to go and do it again and so they kind of throw it out or they flush it but with menhip it allows you to open a dialogue with that individual and again this is more this is difficult because it it's a two-way street it's just not you providing a critique of their performance it's you saying okay let's sit down let's talk about what went right what went wrong and let me see okay that I see in this point you made this decision can you explain that decision to me and then get inside that

thought process and provide feedback and sometimes your feedback is not rece not well received because everyone learns differently right everyone receives feedback in a different form and so they can say well I don't understand what you're saying or no I don't agree with that and there's that dialogue that two-way dialogue so you know again we just want to make sure that we we initiate initiate that dialogue and make sure it's not a uh it's not a directive it doesn't end up as a directive at the end of the day so the final takeaways and again like I said I wanted to just mention that I know this was kind of a quick one but I was hoping to kind of initiate

some discussion today um because again I'm not what I'm not what I'm providing here is not a final solution to what I see as a problem but the initiation of a discussion um also you know as I was working through this you know I realized that yeah I was focused at teaching this down to you know handing this down to the high school level however this can be used anywhere and should be used anywhere on the education timeline um the only thing that changes are the nuances right mentorship is still mentorship whether it's Superior uh Superior subordinate or if it's peer-to-peer at some at some point you have someone's a little more knowledge than another person providing some

feedback initiating in a dialogue you know the same thing with uh failing constructively you know maybe people have a lot more wisdom and so you can provide different uh just a different Viewpoint to them but again just to kind of tie back to my three tenants you know I'm focused on I want this to be application based to to fully integrate cyber ethics cyber ethics education we we need to provide them opportunities to fail constructively you know again that to kind of learn from our mistakes you know don't just say that was wrong and move on say that was wrong this is why and let's see if we can do a little better next time allowing basically

building that concrete form to allow that Foundation to fully set before moving on into something else and then finally providing that mentorship piece where we open that dialogue with the individual and try to get that discussion going and not just making a one-way directive of hey you this is what you did wrong and this is how you fix it and then walking away and never talking to them again so like I said at this point I'd like to open it up for questions comments put a little screen image up there you can kind of you know see if we can kind of pull out some comments but please feel free uh if you don't agree with what I have to say to

you know say that to me now I'm kidding I no please please throw the throw the questions out there I'd like to I'd like to get this discussion going yes okay so what age groups are you thinking about

correct correct

okay [Music] correct effective but I'm not sure how much trying to teach ethics at that age how much

imp no you bring a you bring up a very very Salient point and you're right I would like to take this as early as possible um that the furthest left I can go in that education timeline in in a perfect world and given a you know with unconstrained resources all that I would take it as far left as possible because personally I feel by by integrating this early on we would solve some other secondary and tertiary issues misuse of Technology cyber bullying um so on and so forth but I see it you know I'd like to get it that far you know to the far to the farthest to the left as possible however the reason why I focus on high

school is because right now that's where I see a lot of the programs are focused on and that's where a lot of the resources are being driven towards so that's why I fell in on on high schools however I feel like what I said at the end there the age agnostic approach I feel this can be shifted anywhere and just kind of be dropped um the difficult part of this and what I didn't mention in there is this is time intensive it's resource intensive and that's why I think a lot of programs have gone to the first lesson of the program is we're going to talk about the code of ethics okay everyone rais their hand we all

understand what it said right yes okay and then we move on and I think that because that's the easy solution um but you're right but this is this is time intensive resource intensive and it takes commitment from the instructor or the educator to make this happen ums

hopefully sure and and that's and that's what I'm kind of getting at here yeah you're right yeah I'm

sorry I'm

so yes I can hear it one sure one oful class computer science science techology but most of the questions in that are not specific to technology it's ethics are ethics in general an industry issue per it's just an education issue in general we need to start bring up to our kids um I mean it's effective there but kids are making decisions they can years and I didn't it was

sure place any particular class or structure that I've been exposed to specifically teaching exactly and that's that's kind of what I'm getting at you're right you know it's I think eventually we we get to a point where you know at a certain point there there's a kind of a failover where okay there no matter what we throw at them ethics wise or ethics training wise like you said your moral compass is already defined you know right wrong or indifferent it is what it is and there's very little you can do at that point it's like trying to steer an aircraft carrier right you don't make a you talk about a one degree shift rather than 90°

um and so it it does make it it does make it different ult but um but I do feel again you back to what I what I was saying if we move that further left just exposing them to it just exposing them to the situational base not just the wall of text code of code of ethics um I feel will will help maybe not with a course correction but expose them to topics that they may not be thinking about initially um and that's what I'm trying to that's what I'm trying to propose here but but great I appreciate that the feedback on that got a couple more questions I'll go yes please yes just a couple of

comments sounds like a

disc Should

students but this this perspective is like that's a solution so I think your question is education andp as as

possible exactly ethics as they get older secondary posteducation

exactly

yeah sure no exactly and the one thing I did leave out here uh purposely is the fact that you know I didn't build the backdrop I'm saying we should teach it to high school age kids but you're right you know this could start at home because again it comes down to it's a very time at time intensive uh resource intensive um way of doing this and so I'm not sure if the schools will be able to pick this up and run with it so maybe it does start at home initially um with some of those initial discussions uh but exactly I appreciate it I think I had a question back here two points one was one of the

challenges I think that we face with you know trying P this not just us universally is the relativism invol withs as far asure

CAC one chog you mentioned this the way I saw it wrong um treating this kind of we want

security everything exactly not a goal not a lesson AER that from the beginning all no I agree and and that's what I was you know when I put that wall of text up there in the beginning and with the tldr um I was trying to get at that because when when educating adults on this it is an end or an end state or a goal because again I think the Assumption has been made you know a long time ago that adults have a more fully formed moral construct and so we can allow them lean on that already and all we've done is picked that whole construct up and dropped it on a younger education and so you're right it it

shouldn't it should be a state of mind or a property and not an in in and of itself fantastic appreciate that all the way back um so as far ascentives for behavior that children tell hey don't your reputation jobed all sorts of fun stuff like that and it's really easy to say um you know disincentives for for bad behavior the incentives for good behavior but what sort of things can you offer to someone in high school or middle school this is why you need to act this way it's easy to say these are the rules you follow we have a you know red asphal for driving videos you know the rules you're bloody mess what are you going to do for

for cyber ethical fing the rules that and that is a good point you know again you know these are all fantastic points and you know I that was one of the things I kind of wrestled with when coming up with this a little bit uh mainly because when you talk to kids that age and you try to incentivize or de incentivize certain things what happens right when you're trying to get coercion out of someone which is what I feel that that process tries to get at what happens you get the fact that they follow the rules until you're not watching or until they figure out how to subvert them and so and that's that's a

good point that's why I I kind of wanted to steer away from that and and get out of the okay you know do this and this is why because you might get whacked or you might lose your online profile or I might delete your Facebook account you know and get away from that and get into the okay you made that decision let's talk about why it was bad and try to instill the you know the dialogue or the fact that okay you know there's in the world we live in there's very little right and wrong you know that's all on the very periphery the rest of it's in the gray space in the center and try to

tell them like okay you're going to be living a majority of your life in that gray space and so the the incentivizing gets at the right and wrong but doesn't really address the the large gray space in the middle does that does that kind of answer your question I I know it's a hard one right it's you know because again it's it's about the mindset and when you get to that age too you know they're they're at different um maturity levels so it's it's hard to kind of come up with a one size fits all and that's where you know I went through trust me I went through several iterations until I came up with these these three tenants I

feel are worthwhile at that level Alex

that's a good point as well so again we're still even though we've been around for a while we're still building tradecraft we're still building you know this this Foundation or the forms really the concrete forms I alluded to thank you over here he yes would your go Lake what I let him go to a lake but didn't know how to swim that's a very very um interesting question uh the first answer for me is is my wife present no I'm kidding no I I I just because I I am less risk averse than my wife is and so I would say yes because in my eyes learning through situations I.E if I go in the shallow water I'm

fine if I go a little deeper I'm still okay if I go into my mouth yeah not so good let me back up I'm I'm more of the mindset let them learn by doing my wife is more risk averse and saying okay life s floaties CPR mask um lifeguard on duty uh you know the checklist goes on and on right um and so I guess it depends on on what your mindset is and that's why I try to keep this you know abstract enough to provide you know not not more of a directive but like hey these are kind of these are tenants but I'm sorry no you're fine

sure that uh so I'm not not so much a maturity model because again dealing with younger kids like that you're not sure um it's very hard to to well there's there's a broader maturity range and so I'm not I'm not going so much for a maturity model I'm not saying if they're at this age then they can hack this thing if they're here they can do this defense I'm not saying that at all I'm I'm saying it needs to you know it's more um ethics okay so I so I say hacking but then let's back it up and talk defense so let's say I'm looking at packet captures right and I'll and I see some

stuff that I probably shouldn't in those packets what do I do with it that's still an ethical

dilemma so okay everybody says I actually do a lots and issue don't know so you have to say I think information insurance is where it starts

ating so so I'm sorry my hesitation is to the fact that I'm still trying to um figure out you know what parents actually send their kids to class without knowing you know what's being taught but again my parenting model is different than others I I see where you're going with it um I don't know what the foundation is at this point um to be honest with you I'm I'm trying to be non-committal here on purpose because again um I don't want to make a stand on something because that's this is nothing I've thought about yet sure yeah no I appreciate the question thank you very much yes so to a

little knows how to a lot of isn't

and you know same with the carry a load firearm because that is how you up your parents

that when children are where is that and and again that's a very good point and uh you know because in a perfect world that mentorship should be coming from parents first and foremost that should be you know the first Mentor you have in this world should be your parents however that may not be the case in situations like this or situations where you know the parents may not have the same education that that the kids have so when they hit high school it's you know that the disparity is large so the parents you know they get they don't want to be out of their comfort zone so that that is a good point and that's

where I was I was saying the the at that point then the mentorship comes from the educator and that's why I'm saying it's a resource intensive uh process um