Session 33: Online Safety & Digital Citizenship
At a glance: pupils protect their personal information, think before they post, build a strong practice passphrase and use S.T.O.P. to spot phishing scams. · Time: 90 minutes (adjust the timings if your period is shorter) · Workbook pages: 6
Learning outcomes
By the end of the session, pupils can:
- Identify Personally Identifiable Information (P.I.I.) and remove it from a fictional profile.
- Explain why a digital footprint is like wet cement, and apply the T.H.I.N.K. test before posting.
- Explain why a long passphrase beats a short password, and use S.T.O.P. to spot a phishing message.
Before the session
- Test the Password Fortress and Spot the Phish labs on the projector PC and a pupil PC. Keep the offline pack on USB, as neither lab should need the internet.
- Copy the fake MoMo message from Figure 33.3 onto the board or a slide.
- Prepare pens or pencils for striking out P.I.I. on Page 5.
- Have your school's procedure for reporting online worries to hand, in case a pupil discloses something.
Running order
| Time | Activity | Workbook | What the mentor does |
|---|---|---|---|
| 0–10 min | Typing warm-up | – | Pupils open the typing trainer (Typing in the menu, or the warm-up banner on the session page) and do the 10-minute warm-up. Walk round checking posture and home-row fingers. |
| 10–18 min | Digital citizens and the P.I.I. shield | Page 1 | Compare being a citizen of Ghana with being a digital citizen. Sort board examples into "shield" and "safe". |
| 18–23 min | The school uniform rule | Page 1 | Ask what a badge tells a stranger: school, town, daily routine. |
| 23–33 min | Wet cement and T.H.I.N.K. | Page 2 | Explain the screenshot factor. Test a sample WhatsApp rumour against each letter. |
| 33–42 min | Passwords and passphrases | Page 3 | Compare kofi2026 with MangoBicycleRiverDrumLadder#4. Pupils say the Golden Password Pledge together. |
| 42–54 min | Password Fortress lab | – | Demonstrate, then pairs build passphrases. |
| 54–62 min | Phishing and S.T.O.P. | Page 4 | Spot the 4 warning signs in the fake MoMo message together. |
| 62–72 min | Spot the Phish lab | – | Pairs sort the emails. |
| 72–80 min | Lab missions 1–3 | Page 5 | Pupils strike out P.I.I., invent a practice passphrase and read the pledge. |
| 80–86 min | Scenarios and review questions | Page 6 | Discuss each scenario aloud. |
| 86–90 min | Self-assessment and sign-off | Page 6 | Sign off using the evidence below. |
Key ideas and how to explain them
- The P.I.I. shield: anything that can locate or identify you: full name, age or birthday, home address or area, phone or MoMo number, passwords and PINs, walking route, photos showing your badge.
- Wet cement: your footprints set hard and stay. Even deleted posts may have been screenshotted in one second.
- T.H.I.N.K.: True, Helpful, Inspiring, Necessary, Kind. "If you wouldn't say it to your teacher's or mother's face, don't type it."
- Length beats complexity: computers try billions of guesses a second; five random words in a long chain are easy for people to remember and hard for computers to guess. Three words are cracked quickly.
- Phishing: the fisherman on Lake Volta with fake bait. S.T.O.P.: Suspicious sender, Too good to be true, Over-urgent tone, Password/PIN request.
The 3D lab
Two labs today. In Password Fortress, demonstrate Try "password123" and send the robot on the projector so everyone sees it break in. Pairs then do Build a wall that the robot CANNOT break and Make your own passphrase of 5 words. This matches the workbook, which also asks for five words. The lab counts words typed with spaces (Chalk Window Bucket Fan Broom#7) or joined in CamelCase (ChalkWindowBucketFanBroom#7) the same way. Stress the lab's own warning: never use a real password. In Spot the Phish, do Read the first email and decide: Safe or Phishing? together, checking the full sender address. Pairs then do Catch 3 phishing emails and shred them and Sort all 8 emails. Ask pairs to name the S.T.O.P. letter behind each catch.
Common mistakes and quick fixes
| Pupils often… | Try this |
|---|---|
| Type their real password into the lab or workbook | Stop them kindly. Tell them to change that password at home with a parent. |
| Copy the example passphrase (Chalk Window Bucket Fan Broom#7) | Ask for five new words from things they can see in the room. |
| Build a passphrase from their own name or birth year | Point to ama123 and ghana2026 on Page 3: personal facts are guessable. |
| Trust an email because the name looks official | Read the full address: numbers and .xyz are red flags. |
| Strike out only the address in the profile | Ask: "Could a stranger find Kofi at 6:30 tomorrow morning?" |
When things go wrong
- No internet: both labs run from the offline pack. If the PCs are down, run phishing as a board game: read out messages and pupils show S (safe) or P (phishing) cards.
- Not enough PCs: threes, rotating the mouse each mission; the others read clues aloud and check with S.T.O.P.
- A PC freezes or the power goes: carry on with Pages 1–6 on paper. Every key idea today can be taught without a screen.
Answer key
Lab Mission 1, Profile Sanitizer (Page 5): strike out the full name (Kofi Boateng), the home address (House Number B42, Dansoman, near the round-about), the school (JHS 1 student at Bozoma Model JHS), the mother's MTN number (024-555-1234) and the routine (6:30 AM walking alone along High Street). Strike out the age (13) too: age is personal information. Safe information left over: loves science, plays football, dreams of becoming a software engineer. Praise pupils who suggest a made-up username instead of the full name.
Lab Mission 2: open task. Look for: five random, unrelated objects from the classroom plus a symbol and number, with no names, birthdays or school, and not copied from the example. It must be a practice phrase, never a real password.
Scenario Decisions (Page 6)
- Gaming site asking for home address and school name: Risky.
- Photo of partner's drawing after asking permission: Safe.
- Unknown WhatsApp number offering free 50GB data: Risky (too good to be true, and a link from an unknown sender).
- Best friend asks for your school portal password: Risky.
Written Review Questions
- Like footprints in wet cement that set hard, what you post online stays permanently and you lose control of it, and someone may screenshot it even if you delete it.
- S: Suspicious sender. T: Too good to be true. O: Over-urgent tone. P: Password/PIN request.
Support and stretch
- Needs more support: work through the profile one sentence at a time, asking "Could a stranger use this to find Kofi?" Let them do the phishing lab with a partner reading aloud.
- Finished early: write their own fake (fictional) phishing SMS and swap it with a partner to find the S.T.O.P. signs.
Evidence for sign-off
The pupil shows a correctly sanitised profile, a practice passphrase that meets the rules (and isn't a real one), all four scenarios correct, and both review answers. They can explain one phishing warning sign from the Spot the Phish lab, and have built a wall the robot cannot break in Password Fortress.
Safety and wellbeing
All data today is fictional. Never ask to see, check or write down a pupil's real password, and don't let pupils type real ones into the labs. Discussing scams and cyberbullying may prompt a disclosure: listen calmly, don't promise secrecy, and follow your school's safeguarding procedure. Pupils must ask permission before photographing classmates, and should tell a mentor or teacher straight away about any uncomfortable message.