Why Canadian Education is so Reluctant to Move on Digital Literacy

 I had a talk the other evening with a Vancouver educator teaching cybersecurity curriculum at his local school board. Like me, Todd has been working alone, offering the local students he has access to the opportunity to learn cyber-skills that would benefit them in any field of study. And, like me, he has helped to launch a few students into careers in this radically underserved career pathway.

Despite being 3 time zones away, Todd is running into the same difficulties I am in Canada's regionally siloed education systems. When he reached out to other districts in British Columbia they didn't engage, and so his work remains isolated to his district. Cyber-attacks on education fill the news, yet the vast majority of students have no access to learning this emerging (and essential) digital media literacy.

In 2017/18 we got involved in CyberTitan, the Canadian centre of excellence for the international CyberPatriot competition (the world's largest student cybersecurity competition). From there we developed a thriving cybersecurity extracurricular program that has since influenced our in-class curriculum in timely and diverse ways., but when I asked a system 'lead' if we could help other schools to engage in the same competition I was told, "it's already running at your school." Leaving us in the same place that Todd finds himself.

With headlines like these (an extensive list of Canadian education hacks can be found at the bottom of the post) wouldn't cybersafety training in every school be a good idea?

Ontario school board trying to recover from cyber incident

Personal data of 70,000 students accessed in school board cyberattack

Cyber-education is just the most obvious part of a much bigger digital skills iceberg.

Yet we barely cover coding in public schools, let alone the rest - even though we depend on it in every subject. Digital technology has become integral to learning in 2023, yet no one has a dedicated curriculum to teach the cybersafety and the technical skills needed to use it safely and effectively. It's why remote learning during the pandemic became an abject failure.

Cyber-Education: an Educational Failure in Education

You have to ask yourself why schools aren't engaging in the cyber-education they should have started when eLearning and other online education technology placed student data and attention in potentially hackable online locations. The answer to this question has eluded me for years, but I'm starting to formulate a theory. It began with seeing yet another example of the rhetoric that public education likes to lean on:

"The lack of robust cybersecurity measures stems from underfunding within schools and #educational groups. Often, they don’t have enough resources or budget to invest in #cybersecurity or train staff and students to practice good cyber habits."

Why are Canadian schools so vulnerable to cyberattacks?

ICTC-CTIC has been offering free cyber-learning opportunities for years in addition to running CyberTitan since 2017 with the support of the Communication's Security Establishment (Canada's cryptography agency charged with securing government communications). It doesn't get more credible than that this, yet we struggle to engage individual teachers let alone school system 'leaders' with these FREE programs. The reticence isn't about cost, it's an unwillingness to make time and take responsibility for our rampant use of education technology. The vast majority of cyberattacks depend upon user digital illiteracy to succeed and we face a global digital skills crisis, yet education seems determined to do as little as possible to address any of it. The question is why.

No where did our failure to address
digital literacy appear more apparent than
during the remote learning emergency.

Perhaps picking up the baton now would highlight a failure that has been decades in the making. By doing nothing, public education remains the victim of cybercriminals and technology disruption, just like the rest of us.

We should have begun developing this technology media fluency the moment we placed student learning in hackable online spaces. It's not a flattering analysis, yet moving past this head-in-the-sand approach is essential if we're going to keep putting student (and staff) information where criminals can exploit it. Our collective ignorance is the cause of the current cybersecurity crisis and the global digital skills shortage; it's a failure of education... by education!

Our Failure to Systematically Teach Digital Literacy Even As It Becomes an Expectation in All Subjects

Poor user digital fluency is the result of our failure to teach it in any kind of systemic manner. The cunning plan so far has been to hope parents are doing it at home* (*this link shows that they might be, if they can afford it). Meanwhile parents are assuming a comprehensive digital skills curriculum is happening in schools, and by comprehensive I mean year on year skills development in dedicated subject time using curriculum that results in functional and safe technology users. We obviously don't have those.

The students I see arriving in grade 9 suggest that this is not systemically happening, and where it does happen it is because a single teacher is trying to bridge this gap themselves. The assumption many parents labour under is that teachers are digitally literate, but they are much like the general population. Worse actually, because the education itself has dragged its feet engaging with digital transformation resulting in the people in it being less digitally savvy than the general population.

If we taught digital skills like we taught other foundational skills that are required across all subject areas (literacy, numeracy, etc), we would have periods focused on developing those skills and integrated subject specific digital fluency across all disciplines, but we don't even cover digital literacy development as comprehensively as we do geography (mandatory k-8 dedicated subject time and a mandatory grade 9 course). There are no mandatory digital literacy courses in any Ontario high school and in K-8 curriculum, where it happens at all, it's usually fixated on coding which does little to teach cybersafety. The ongoing digital skills shortage and a rash of user ignorance driven cyber incidents suggest that the piecemeal approach we've grudgingly adopted isn't working.

I've been pointing to these embarrassing statistics and presenting on the importance of filling this foundational gap in our curriculum for years on Dusty World: 

2022 TMC7 Research Symposium: Table Talks and Future Skills

(2020) How to Pivot Ontario Education to Prepare for The Next Wave

(2017) The Digital Divide is Deep and Wide

(2012) The New Literacy

Perhaps now, in a maelstrom of bad press and the potential for real financial damage to staff and students (and their families), education will finally take on systemic transformation to address digital skills and especially cybersecurity awareness. The benefits would go far beyond reducing the number of successful cyber breaches. A more digitally literate society would be able to pivot to remote learning in an emergency and might also offer climate reduction possibilities by reducing the need for face to face schooling. It would even help create a less factory driven/age based system that relies on millions of gallons of diesel to deliver bodies to age appropriate facilities every day. The central problem is that the digitally delayed education system is the least likely place to find this future friendly vision.

We could have used the pandemic to finally
engage with digital literacy - instead it became
another excuse to play victim to our own
lack of foresight.

Do you know how many times cybersecurity is mentioned in Ontario computer technology or computer science curriculums? Not once - not even in the two specialist subjects it should be covered in. We've driven students onto potentially insecure online learning environments for years now and even the compsci students don't learn how to secure it.

 Nowhere has this failure to address digital literacy been more apparent in emergency remote learning where many students were thrust into online mediums that they have very little understanding of with unsurprising results. Most students still equate technology with entertainment, which is why implementing it in classrooms has been fraught with problems. Most teachers have less digital fluency than anyone in a modern office setting.

One of the early myths used to justify this bury-it approach to digital literacy was that of the 'digital native' - the idea that students who grew up with digital technology were somehow magically imbued with the ability to understand it technically and use it safely and effectively. This is like saying that because I grew up in the 1970s and was familiar with cars, I already know how a car works and how to operate one. This absurd belief persists in many schools despite being summarily discounted by research.

Being familiar with digital technology means you don't have to overcome the fear that older people have in making a mistake with it, but I can assure you, students are not immune to making poor technical decisions based on digital ignorance. The rush by students in my school to use 'free' VPNs to bypass blocks on social media sites isn't digital native genius, it's profoundly ignorant. The criminals offering these services aren't offering them for free. This gives a fine example of how digitally illiterate school systems are. Blocking content and driving students to put their digital information at risk through questionable technology is about where we're at in education these days. Incredibly, many educators then point to this as an example of just how good the kids are with technology.

Research on the poor state of digital skills across entire populations shows an astonishing lack of capability, even as we increasingly depend on networked digital technologies to support every aspect of public education. When technology fails, the learning stops in 2023..

This isn't just a Canada problem, it's worldwide.

Addressing the digital skills gap for future education

A global measure of digital and ICT literacy skills (it isn't pretty)

"higher socioeconomic status was associated with higher proficiency both within & across countries - student experience of computer use & their frequency of computer use at home were positively associated with proficiency" - Because we off-load this essential literacy because we don't want to take responsibility for it.

The Distribution of Users’ Computer Skills: Worse Than You Think

Nearly 1 in 3 workers lack foundational digital skills

Canada struggles to prepare its workforce for changing digital economy

"81 per cent of Canadians say they don’t have the resources to learn the digital skills required by businesses today, and 86 per cent say they are not prepared to meet the digital skills requirements of the future."

Summary 

Cyber-education is the sharp end of this failure to teach digital literacy because of the fear that surrounds the subject and the dire consequences of not addressing it. Convincing educators to engage with cybersafety, cybersecurity and data privacy learning is virtually impossible, especially as most staff are no more digitally savvy than anyone else. You have to be trying exceptionally hard to not be using digital technology in 2023. Your lights are on because of it and your lessons are available to students because of it, yet no one wants to teach it, or learn it as a specific technology/media skill.

Beyond the sharp point of cyber, we have a population that spends an inordinate amount of their time, both professional and personal, in networked technology, yet almost no one knows how it works, what to do when it goes wrong or how to secure it. Younger people aren't afraid of it, but their bravado creates dangers of a different kind.

If we're going to use networked technology in every subject, we should have K-8 curriculum in place with mandatory time given to specifically learning digital skills well beyond coding, and also include digital literacy integration with all subjects. This should begin the moment we put students in online learning.  A systemic approach to this would start solving the educator digital skills crisis and eventually result in a dramatic drop in successful cyber-attacks as we begin to heal the ignorance that current attacks exploit. Many federal programs exist, but Canada's chaotic, siloed education landscape means that with no central authority, provincial ministries and local school boards are left with the responsibility to engage with a problem that operates well beyond their jurisdictions.

Digital skills gaps cost billions in lost jobs and opportunities and exacerbate existing inequalities. By resolving this failure of vision that public education has been central in creating, we might finally assume the role it should have played all along. It doesn't require lengthy apologies, but it does require some humility before a systemic failure we've all played a part in. I only hope the people leading education in Canada are more interested in doing the right thing for students, staff and their families instead of maintaining the expedient idea that digital literacy happens by magical birthright, or at home.

Yes, it's a tsunami of cyberattacks on canadian education:

Vancouver Film School hit by paralyzing cyberattack
Attackers say they have deleted data stolen from Ontario school board
School board confirms hack; attacker sent note through photocopiers
Ministry beefing up security after school board 'cyber incident'
Ottawa french public school board paid hackers ransom after data breach
Teachers and parents urge answers as investigation into school board hack continues
OSSTF confirms current and past members’ information compromised in cyberattack
Former members call out OSSTF for handling of personal information stolen in cyberattack
Maple Ridge-Pitt Meadows school district alerts families of potential data leak
“It’s pretty scary”: TRU students concerned after possible hacking of student aid websites
https://canadatoday.news/ca/vancouver-park-board-to-consider-new-revenue-streams-including-more-restaurants-223298/
https://www.therecord.com/news/waterloo-region/2022/09/15/at-least-three-former-wrdsb-employees-report-identity-theft-attempts-since-cyber-attack.html
https://cupe.ca/statement-crystal-krauter-maki-educational-assistant-and-cupe-4148-president-regarding-ransomware
A failure to educate staff

Psychology, Cybersecurity and Collaboration in Educational Technology

Growing number of parents experiencing ransomware attacks on children's schools

The Digital Skills Crisis:

Can you imagine if nearly a third of Canadian
students couldn't read? Yet that's how we
continue to approach digital fluency.

Why Leaders Need To Close The Digital Skills Gap In The Global Economy
More than 90% of cyberattacks are made possible by human error
The global digital skills gap
Canada's critical 'skills gap' problem explained in 6 charts
World Skills Clock
The skills shortage is 2022’s biggest threat
5 ways we can develop the digital skills our economy needs

How can teachers and parents promote students’ digital literacies skills?

Gen Z says school is not equipping them with the skills they need to survive in a digital world

What our failure in education looks like to the people experiencing it:

"44% said that school only taught them very basic computing skills, 37% said that school education didn’t prepare them with the technology skills they needed for their careers. 40% consider learning new digital skills essential to future career options"

How To DIY Your Way To Digital Fluency

 "We've all become used to thinking of Gen Z as the first truly “digital native” generation. They were born when the internet was available to everyone and don’t remember a time when it wasn’t normal to carry a smartphone wherever they go and document their lives on TikTok and Instagram. Unfortunately, it turns out that this form of digital native might not translate to being able to work with the tools and technologies that are expected to shape the 21st century."

- Is Our Digital Future At Risk Because Of The Gen Z Skills Gap?

The digital skills gap is an ongoing concern, but in building a successful digital skilling program over the past two decades I've trial and errored my way to an efficient process for getting students from thinking they have digital fluency to actually having it. Here's how:

Step 1: Start Where People Are Most Familiar (I.T.!)

Information Technology (or I.T.) is where most people have regular contact with digital technology, though many people don't know what I.T. stands for. The devices we live our lives on in 2023 all depend on digital infrastructure and incredible engineering to do what they do. To unpack all that and make people aware of how this technology works, you build it!

RCT Ontario is the local branch of the Computers For Schools national program that takes off-lease technology and gives it to schools and others in need. They are all you need to get hands on with digital technology. I've found that building a desktop computer from scratch is a great way to get past the bluster of self-professed computer experts (aka: students who have been told they are digital natives) and let them show what they actually know.

All digital technology follows the same basic foundation of hardware, firmware, operating system, software. The desktop is a modular, relatively easy to assemble example of this architecture, but everything from laptops to smartphones to ATMs to Teslas uses the same stuff in the same way.

By building their own PCs from scratch, students who have some experience fill in gaps and students with no tech background find that they have a clear understanding based on hands-on familiarity. This also does a lot to clear away misconceptions and myths around digital tech (like that digital native one).

Another good resource is PC Part Picker that lets students theorize their perfect PC. Once they have an understanding of the hardware and how it goes together, suddenly customization becomes a possibility and the generic tech that most people live with isn't enough. Many of my grade 9s have built their own PC at home by the time I see them again in grade 10.

Cisco's I.T. Essentials course is available for free on Netacademy and offers media rich, current online learning support for this hands on I.T. exploration. It also makes students aware of the world of industry certifications out there in information technology. Students starting in I.T. Essentials can work towards their CompTIA A+ computer technician certification which is the first step towards moving in many directions in the industry.

Once everyone has their hardware worked out, it's time to get into operating systems. Like I.T. hardware, people have experience with OSes but seldom get under the hood. A good way to expand familiarity and get students interested in OS options is to have them build a multi-boot system on their DIYed PCs.

Our record OS stacks in grade 9 had many operating systems ranging from various versions of Windows (XP, 7, 8, 10, server, etc) along with multiple Linux distributions (an OS most students haven't touched but one that runs behind a lot of the tech we use) all bootable off one desktop. Familiarity with many different operating systems is a powerful step forward from the 'we just use Chromebooks' approach many schools have adopted (Chrome OS is actually a version of Linux).

We can usually do the PC builds and OS stacks in a week of classes (about 6 hours of instructional time). In an intensive course you could get everyone hands-on and familiar with the architecture of computers and operating systems in a day (6-7 hours).

Step 2: Use Your DIY Tech To Scale Down and Explore Electronics & Coding With Arduino

The Arduino micro-controller is a simple digital device that does a great job of showing the basics of how computer code performs with hardware. It also introduces students to circuits and the electronics fundamentals that drive all digital technology.

Arduino is open-source (like Linux) and doesn't usually come in a pre-fabricated activity/kit from your friendly neighborhood edtech for-profit with pre-set lessons and learning outcomes (a sure way to fail at developing real digital fluency).

With relatively small outlay you can collect together Arduino microcontrollers and basic electronics like LEDs and resistors and facilitate a hands-on understanding of the electronics that make the modern world work. Kits with many parts cost less than $80 and if you're crafty, far less). We always used Abra Electronics in Montreal to keep it Canadian.

There are piles of Arduino projects that students can try, but we always worked through the ARDX Arduino circuits to get everyone familiar with how breadboards and circuits work first. The Arduino plugs into the student-built desktops with a USB cable and then runs software that lets students explore both coding and circuit building in a very real way.

This is another area where the bluster gets cleared away by demonstrated mastery. If a student tells me they already know all about electronics, I tell them that they only have to do circuit number five and then can go right into designing their own project. A few can show what they claim to know, but many struggle and then I gently redirect them to doing the circuits as a 'refresher'. By the end of the Arduino unit everyone has tactile knowledge of the basics in circuit building and coding.

Introducing Arduino and running through the basic circuits typically takes about a week of high school classes, so it would be another day (6-7 hours) if students were in focused training to quickly develop these real digital fluencies.

Step 3: Use Your DIY Tech to Scale Up And Explore Connectivity & Networking

To get students the Arduino software and access to circuits on their desktops, you would have to connect them to the internet. After Arduino, students are more comfortable with their PCs and how they work, so it's time to go upstream and tackle networking!

This is another intimate aspect of people's lives that is often misunderstood. By having students build local networks with each other's machines and pass data across, they again benefit from direct, tactile, experiential learning.

We then connect these local networks together into a class-wide network and watch data travel across it in real time, but the favourite part is stress testing the network to see how much data it can handle. Tools like LOIC (low orbit ion canon!) can be used to DDOS machines off the network by overloading them with data. At this point complex, multi-disciplinary specialities in digital technologies (like cybersecurity) start to glimmer in the distance. Anyone trying to teach cyber with none of these foundational understandings in place is going to have trouble.

Another good stress test is to set up an older LAN based game which requires inputting IP addresses and other details. It's not often students have playing a multi-player game as a classroom learning target. You can guess how popular that is.

Tools wise, Cisco offers their Packet Tracer network simulator for free (you can become a Cisco Network Academy at no cost, which makes dozens of introductory ICT, networking and coding courses available). Packet Tracer lets students build complex theoretical networks and then push data through them to see if and how they work.

The networking unit typically takes another week of high school classes, so could be managed in a single 6-7 hour day. By the end of it students are experimenting with their DIY desktops on their DIY networks. The learning doesn't get any more genuine than this and the result is students who are tangibly developing real digital fluency.

Step 4: Use Your DIY Tech to Explore Data Management and Programming 

In the high school junior grades we focus on Javascript and HTML (both common web-focused coding languages). HTML works well as it allows students to quickly understand how the webpages they spend so much time on are displayed. Javascript is helpful because it allows webpages to run executable scripts and hints at the complexity modern webpages are capable of. LIke the other steps, the point here is to get behind the curtain and begin to make students aware of how the technology they are codependent on works.

Students can create and share simple HTML webpages on their network giving them a hands-on introduction to internet architecture. W3 Schools does a great intro to HTML and Javascript (and CSS and HTML5). The point isn't to create a web developer in a day, but to (once again) develop tactile familiarity with digital technologies that have always been hidden.

Coding takes time to develop, but an introduction to web design typically takes about a week to get students to the point where they know enough syntax to build a simple webpage. What's nice about HTML is that it's a tight feedback loop; you put in a command and immediately see the result.

With webpages rattling around your DIY network, you can talk about ports and how they work, and even get into online databases which tears the cover off one of the biggest problems we face: cloud based personal data. Each layer of this learning builds on the previous ones creating a rich ecosystem of interrelated technologies. Getting newly digitally fluent students to actually understand how the online world we all spend our time in works is where you want people if they want to take a run at cybersecurity with anything like the necessary context.

When you've got digital fluency you can chase down
NASA complex projects! Here CyberTitans Vlad &
Wyatt (also a 2x Skills Ontario medalist in IT &
Networking) are building a Beowulf supercomputer
...out of ewaste!

Step 5: PLAY!

I'd run this in adult up-skilling as an intensive week of digital fluency training. The final day would be a student directed mini-project. For those who dug PC building, they can build something to a specific purpose. For those who dug the Arduino and electronics, opportunities to build original circuits and code await, and for those intrepid few who enjoyed networking and data management and programming, they can chase down more complex connectivity or web development.

When I did my A+ training way back during Y2K it was an intensive week which gave me enough context to chase down my certification in a few months of practice and study. I've had a few students manage to get A+ certified as a computer technician while still in high school, but it's a challenge due to the breadth of material. I.T. techs need to be familiar with older tech and emerging tech as well as what's current. That experience takes time, which is why my seniors do in-school I.T. support. Being dropped into real world technology complications helps them hone the skills they need to be effective technicians. The purpose of this as an upskilling course would be to create contextual understandings that are simply missing for the vast majority when it comes to 'tech'.

Why Do this?

This level of hands-on technical familiarity would revolutionize elearning and make it a viable education tool. Digitally fluent staff and students would make us lock-down resilient and capable of keeping learning alive in difficult circumstances instead of giving up and leaving students behind, and it would only take 35-40 instructional hours. Many adults use digital technology habitually and in profound ignorance. An intensive week of hands on learning would end that approach and give everyone the context they need to move with purpose in our digitized society.

When I see Ontario dedicating time to mandatory historical curriculum I shake my head. This kind of digital fluency would enable pretty much every career pathway and give students essential 21st Century life skills (you don't want digitally illiterate people participating in a technology enabled democracy). Instead we cling to mandatory curriculum designed in the age before our digital revolution. We could be producing digitally competent students that close the digital skills gap, and it's not like it's expensive or time consuming. All that it takes to solve this problem is to solve this problem.

For those tackling adult re-skilling, I see a lot of cybersecurity 'bootcamps' that assume much of this digital fluency in their candidates (like K-12 does) and then wonder why their dropout rates are so high. Cybersecurity is a multi-disciplinary specialization within ICT and you can't get to it directly any more than you can expect an illiterate adult to tackle Shakespeare. You need foundational skills and contextual understandings before you take on that kind of complexity. It isn't an impossible ask, but it is one that needs to start from where people are at, which is further back than we think they are.

How to Build Digital Fluency Before Tackling Cybersecurity

Follow Up Links

The Digital Divide is Deep and Wide (2017): https://temkblog.blogspot.com/2017/12/the-digital-divide-is-deep-and-wide.html

How to Pivot Ontario Education to Prepare for The Next Wave (we didn't): https://temkblog.blogspot.com/2020/05/how-to-pivot-ontario-education-to.html

Exceptional Times: Using a Pandemic to Close the Digital Divide (any day now): https://temkblog.blogspot.com/2020/03/exceptional-times.html

Why Canadian Education is so Reluctant to Move on Digital Literacy (hard to teach it when you don't have it either): https://temkblog.blogspot.com/2023/02/why-canadian-education-is-so-reluctant.html

Reframing Digital Literacy: what it is and how to teach it

I did a research piece for Canadian School Libraries last winter that looked at how you might develop the complex, multi-disciplinary digital skills you find in cybersecurity in a relatively short period of time. When I first put it together I found myself spending a lot of the time at the front of the paper trying to define the digital skills we find ourselves lacking. I came to the conclusion that adopting high abstraction digital tools such as those you find in cyber, A.I. and other emerging technologies makes for an impossible leap when we don't have the basics in place.

How we've missed this in education is a good question. Anyone with a background in the field knows that there is no such thing as a 'digital native' and that this myth, which has caused so much damage as it prevents education from building meaningful digital pedagogy, kicked off what has become a multi-generational skills shortage that is doing real damage to both the economy and students' future prospects.

Digital technology has worked its way into everything in 2025, so being unable to make productive use of it damages our ability to compete in a digitally connected world. That we continue to hum and haw about what digital fluency is and how to build it suggests that we're not going to resolve this problem any time soon in Canadian classrooms.

We've seen coding and computational thinking finally worm their way into education curriculums, but this is the tip of a much bigger iceberg when it comes to understanding what digital skills are and how we should approach them.

Originally created for this post on why education is seemingly unwilling to address a persistent digital skills shortage (from 2023).

I've been pushing the boundary of what constitutes digital skills ever since I first got knocked out of digital technology by the compsci grads who had claimed the keys to the kingdom. It took me decades to recover and come around to the approach I have now that nurtures my hacking mindset rather than dismissing it.

A few weeks ago I attended a STEM space technology event put on by a partner of ours in Mississauga. Moonshot was designed to introduce students to the interdisciplinary nature of STEM careers - something we go out of our way to avoid in our departmentalized schools. If you're building space technology as an electronics engineer your job doesn't end where the wires stop, it also involves collaborating with all the other teams to ensure the electronics are working in conjunction with mechanical, communications, logistics and many other systems. Why do schools insist on siloing subjects like they do?

That siloing is also hobbling digital literacy development. The current coding/computational thinking fixation is just the latest in a long line of compsci blinkered approaches to addressing digital technology literacy. What would it look like if we represented the true breadth of digital and taught that wider scope of understanding in our classrooms? We use this technology daily to do everything from operate our schools to deliver learning across all subjects, but then avoid teaching how it all works at all costs.

At the Moonshot event I was introduced to the CEO of MineConnect, an organization that represents and works to promote the mining industry in Ontario. Our chat at Moonshot led to introductions with Science North over their Mine Evolution game. I'm hoping to get a web based version of that running on UBC's Quantum Arcade - perhaps with a quantum add-on as quantum sensing is going to drastically improve s in how we mine in the next decade.

What does this have to do with digital literacy? The fact that you're asking this question shows how little most people understand about where digital technologies come from, and that understanding should be a part of their literacy, don't you think? If you look up 'digital supply chain' you don't get what we need to build digital technologies, instead you only information on how to 'go digital'. Even industry goes out of its way to ignore what digital technology is... except in rare mineral mining, hence my work with Mine Connect and Science North.

It's incredible to me that this late in our adoption of this technology that we still go out of our way not to teach what is needed to make digital happen. The current wholesale adoption of A.I. in education is a great example of this ignorance, as was the rush to the cloud. There is no cloud (it's someone else's computer) and A.I. isn't intelligent, but we'll grasp at digital straws with willful ignorance if we think it'll make our lives easier.

In the CSL research I created a pyramid that showed how I taught digital awareness from the ground up in my rural high school. The assumption is that 'kids nowadays' know all of this, but that simply isn't the case. If you want to disable a 'digital native' it's as easy as flipping a switch they don't usually use. If you want to send a room of them into a panic unplug the Wi-Fi router (assuming you know what that is and where to find it).

Start with the physical substrata and work your way up into the more abstract realms of digital technology; starting digital fluency at coding is like starting literacy at poetry. 

In grade 9 I got a lot of digitally engrossed students who thought they knew it all because adults who lack even basic digital familiarity have been telling them that for years. Revealing that this perceived expertise is merely familiarity with a couple of devices and specific software doesn't take long. In many cases these kids had owned a series of game consoles and phones and that's it. Familiarity with software is limited to games and social media. Very few knew what an operating system was let alone the firmware that kick start it; this is literally how all computers work yet almost no one seems to know it.

Last week I was in Ottawa doing an introduction to OSes on our cyber range. The grade 5s didn't know what an OS was, but by the end of our 90 minutes they certainly did. They also learned the boot process any digital device goes through from firmware start-up to OS loading to where most users think computers start - when the desktop appears. They also got to interact with Linux as well as Windows on their Chromebooks (we use a cloud based cyber range so you're not limited to the restrictive OS on your local device). None of the students knew what Linux was, but they use it everyday because their Chromebook ChromeOS is Linux based. By the end of our afternoon they were navigating the settings in multiple OSes and understood how you could interrupt boot sequences to gain control and interrupt processes.

That we hand students tools like these without any understanding of what they are or how they work is a great failure in modern education, especially as we are only accelerating our use of these machines in classrooms. Considering how widespread their use is now, digital skills have become an ignored foundational literacy.

***

How did I tackle this ever widening digital divide in my program? We started by making our lab DIY. My seniors and I built the first iteration out of e-waste and then kept improving it as we found resources. In 2015 I returned tens of thousands of dollars in board run desktops which then got converted into half a dozen chromebook carts for other classes to use. In that first year our DIY conversion saved the board over tens of thousands of dollars.

In 2016 I contacted AMD and asked if they'd provide CPUs for our next upgrade, and they did! Our board's SHSM program provided additional funding and for a fraction of the cost of a board run computer lab we had significantly better hardware and control over installing our own OSes and software, which allowed us to provide digital learning opportunities others couldn't reach.

By 2018 we had a mix of AMD APUs that could handle the graphic modelling we were doing in our game-dev class. This meant they were also more than capable of running any other software we needed to build digital fluency from scratch. In the process my one teacher department went on to win multiple national awards across a staggering range of digital domains ranging from coding and electronics to IT & Networking, 3d modelling and cybersecurity. DIYing is essential if we're to build digital skills without those compsci coding blinkers on. Even worse is buying a ready-made 'edtech solution' which does it all for you and doesn't teach anyone (staff or students) how technology works. It also tends to trap you in a single brand rather than striving for agnostic digital comprehension.

Having a flexible digital learning environment that we built ourselves allowed us to create unique student projects. In grade 9 that means starting with Arduino micro-controllers. Not only did these open source electronics allow us to develop an understanding of the circuits that all digital technologies depend on, it also offered a tangible approach to programming where the lines of code would produce direct outputs like turning on lights or making music. By the end of the Arduino unit students were confident in building circuits and for many it was also their first opportunity to code in text as opposed to blocks.

As you can see by the gif, getting into Arduino in grade 9 means that by grade 10 students are building customized electronics solutions to everything from the PC temperature system you see to various robotics and digital art installations. One of my seniors worked out an Arduino based fuel management system for his pickup that he then sold to others. Understanding the electronics substrata that digital operates in is imperative for well rounded digital literacy.

From that basis in electronics and introductory coding we moved to information technology and networking - two subjects studiously ignored in schools even though every one of them depends on both to operate every day. We begin I.T. by walking students through PC parts in our recently delivered Computers For Schools desktops. After covering the safety requirements for tools and working with machines that can contain enough electricity to knock you out if you don't treat them with respect, we dug in.

The biggest point I make in PC building is about static management. As long as students respect the delicacy of the electronics (which they already understand thanks to Arduino), they quickly gain confidence and are never again tyrannized by this technology. After this unit no one calls a desktop PC a "CPU", because that's just one part of a much bigger device. Calling a desktop a CPU is like calling a car an engine.

We typically spend a week taking a part desktops and putting them back together. Getting them is no problem because no one wants desktops these days and CFS has piles of them they're aching to give to classrooms. When we wrap up the IT unit anyone who wants to take their computer home can - you'd be surprised how many students (and teachers) don't own a home computer. The best part? If it ever goes wrong they know how to fix it because the built it from the hardware up.

Once we got the hardware figured out we installed operating systems. This involves interrupting boot processes and learning how to navigate BIOSes and other types of firmware. Everyone gets to the point where they have Windows and Linux installed, but some students want to build an epic stack. This can involve adding extra hard drives and going through install processes on up to a dozen OSes. By the end of week two we've got OSes installed and students have explored many more than the one that came on their phone or game system (which are often Linux based). We've even had our share of Hackintoshes in the lab.

Our final step in the IT/Networking unit is to connect the desktops together on a local network and figure out IP addressing and all those other connectivity details most people have no concept of even though they use them daily. Building a network like this takes it out of theory and into tangible practice, as does the PC building. By the end of the week no one is calling connectivity 'WIFI' any more. Ethernet is ethernet and wireless is wireless and everyone knows how to configure and troubleshoot both. The motivation is that once we've got our network up and running on a domain where everyone can see each other we cue up a LAN party and everyone plays networked games on their DIY systems.

Our wide ranging and borderless approach to digital skills created interesting opportunities to mash up different technologies that are typically taught in siloed departments (if at all). In this case a student leveraged Arduino electronics, PC building and networking with robotics to build a whimsical LAN party robotrain.

We do eventually get to coding of course, but starting that far up the tech pyramid is absurd. High level coding languages (the only ones schools teach) are resource heavy because they spell out commands in easy to understand English (easier for humans = harder for machines). We did HTML and associated languages in grade 9 so the internet didn't baffle anyone anymore. In grade 10 it was Python simply because it's in such wide use. In the senior grades students choose their own coding focus, but not before I drag them through an introduction to low level 'machine language' programming so they have an appreciation for all the work those high level languages are doing for them. After you've had to do your own memory addressing, it changes you.

Leveraging this digital literacy, my seniors helped keep the tech in our building running smoothly. This not only saved money but also gave students invaluable public facing support experience. Perhaps the best example of this was our Chromebook graveyard. We would take in broken machines and then repair them with bits from others. After a couple of years of service most high schools in our board had lost over a quarter of their Chromebooks to abuse and accidents - we enjoyed a 90%+ active rate meaning more computers for more students at no extra cost.

The 'that's not your job' thinking that most boards operate under prevents this kind of innovation and cost savings. I always am left wondering to whose benefit.

The other benefit was that our digital fluency made us resilient. When COVID struck and everyone else folded up their classes and went home early, the digitally fluent students in my program didn't want to lose their semester's work and we went online, created our own Discord and landed it remotely. It took a bit of re-culturing because the students needed reminding that this isn't a gaming Discord - you're at school, but they quickly adapted and were sharing 3d models, Unity code snippets, circuit designs and network details back and forth to build complex demonstrations of their skills. In many cases they were doing it on the PCs they'd built when they were in grades 9 or 10 because many parents thinking digital technology is a toy.

So what's stopping us from graduating digitally fluent students with a wide range of skills who are ready to go into any field they choose because every one of them these days involves some kind of digital technology? I come from a time when home computers were brand new and no one had worked out how to 'do them' yet. In that primordial binary goo I hacked my own software and learned how to build my own hardware. My millwright apprenticeship turned to IT because of my familiarity with this new technology but I never came at it as a scientist might, but rather as a mechanic would. Hacking isn't bad, it's humans finding ways to approach digital technology as agents rather than consumers.

If we're going to tackle complex interdisciplinary digital technologies like artificial intelligence with anything other than willful ignorance, we need to start building an understanding of digital from the ground up so students and teachers can see beyond the box tech companies want to keep you in. If we're putting children on it, we should be showing them how it works so that they become more than what most of us are: consumers.

This is from a decade ago. FB has faded from relevance, but every 'tech' we use follows the same approach: your attention is the product being sold.

It might sound counter-intuitive, but cybersecurity offers a unique approach to tech that other subjects lack. Cyber is inherently about edge cases and encourages a 'meta' mindset when approaching digital environments. You're not a component inside the system, you've recognized its limitations and are working beyond it where being human is not only a benefit but essential. With all the 'AI doing it for you' going on these days does being human matter? Other approaches seem easier and wear 'academic credibility' better, but what is academic credibility but another system meant to contain your thinking? If we keep our current status quo we will, at best, produce another generation of passive consumers. We've tried that and it isn't going well. Time to hack this problem by putting students back in control of the technology we are using to control them. It's time to embrace your inner hacker.

The Organization of American States' Caribbean Regional Cybersecurity Symposium DR 2024

*** Simposio de Ciberseguridad de la OEA

Cyber Pirates of the Caribbean.
Sorry, couldn't help myself.

In September I got an invite to sit on a panel at the GFCE's annual meeting. Then the Organization of American States got in touch and asked if I'd sit on their emerging tech panel at the regional pre-meeting. I guess that went well because they then asked if I'd be willing to cover for their quantum cyber specialist who couldn't make a Cybersecurity Symposium in the Dominican Republic at the end of the month. My approach to this sort of thing is to always say yes; that's how I found myself in Ghana last year.

Most Canadians think of Punta Cana and an all inclusive week on a resort when it comes to the Dominican Republic, but I was headed to Santo Domingo which can be a bit rough around the edges. It was an intense week of coming to understand the cybersecurity needs of a region facing the results of climate instability head on while also rapidly developing their digital economy.

Our panel was set to go on the first day, which was good - I like to get them done sooner. Co-panelist Heather happened to be coming in on a flight right behind mine so we met at the airport and shared a cab across the city to the hotel, which felt a bit like the first 20 minutes of Fury Road. Having not eaten since 5am, I sat in the empty hotel restaurant and ate a poor club sandwich that cost an eye watering $30USD while wondering what I was doing here. There is nothing like hunger and exhaustion to make you doubt yourself.

I finally got into the room and collapsed for a couple of hours and awoke feeling more like my usual, confident self; food and rest resolves most anxiety. I went for a wander around the hotel and found Heather on the pool deck watching the sun going down (dramatic sunsets in the DR). She works in AI research and we had a good chat about how it's being used in cybersecurity and both left with enough context to take on the panel in the morning.

Our moderator got switched right before the event but Donavon was agile, knowledgeable and did a great job chasing down themes as they came up rather than following a script. The conversation dove into AI but also left space for IoT and quantum in a cyber context.

I came away from the GFCE event in DC earlier in the month cognisant of the need to keep technical detail out of these kinds of high level talks, especially if you're talking to most of the people in the room through a translator. The technical side of cyber isn't necessarily what you need to focus on because it doesn't really change how most people interact with it. An easier to grasp example might be to ask if you need to have a strong understanding of the metallurgy involved in casting your car's engine in order for you to drive it. This isn't to say you need to simplify the the point of absurdity, but getting into the technical weeds tends to be an academic back-patting exercise rather than being helpful to the audience.

On this panel (as I've done in all of them), I don't pretend I'm something I'm not. I'm a teacher, an I.T. technician and a cyber operations instructor and often refer to anecdotal cyber teaching situations to land a point. People seem to appreciate this approach because presenting material as a teacher is something everyone can relate to, and there is enough intellectual intimidation in cyber as it is. There is also enough marketing misinformation that a clear eyed, education focused approach resonates.

Our talk mainly focused on artificial intelligence but quantum did get some airtime, though many questions (as at the GFCE) orbited the complexities of trying to teach cybersecurity. As mentioned at the Serious Play Conference in August, teaching a subject that few people have the basic digital media literacy to even contextualize is a challenge. The fear that arises from this ignorance is real and makes teaching cyber especially difficult.

I'm always conscious of the Canadian perspective I bring to an international event like this. Canada seldom participates at the international cybersecurity events I've attended. We fund a lot of them (including this one), but finding Canadians willing to make the trip and talk the talk seems difficult. I was the only Canadian on any of the panels at this one too, though I'm hoping to change that. If international cooperation is about relationships, having Canadians talking at events like these is essential.

When asked about IoT threats I brought up two Canadian instances that resonated with the room (I was asked about them repeatedly across the week). One was my visit to the Canadian Institute for Cybersecurity in Fredericton last spring which included a look at their IoT lab. The curiosity this generated has me wondering if an OAS event in Fredericton at UNB wouldn't go amiss. Does Canada ever host these things?

The second Canadian cyber challenge was the rash of car thefts Canada is experiencing. It's tempting to define this under traditional criminal activity but these are new vehicles with 'state of the art' electronics that are being hacked, making this an IoT cyber problem. When you know enough about cybersecurity you start to think differently about how it's integrated into your day to day life. My cunning solution is to drive manual vehicles that are 'pre-smart'. They're unhackable and also undrivable for most thieves. If you don't expect technology to do everything for you, you're not beholden to its weaknesses.

With our panel in the rearview, I made it a point of understanding the context through which Caribbean and Latin American states are tackling cybersecurity. Our very nice hotel provided bottled water because you're not supposed to drink what comes out of the taps. It's astonishing to me that people without available drinking water are going after digital transformation and the cybersecurity that enables it, but if you want to participate in the 21st Century economy that's the price of admission. Perhaps digitization will solve the water problem too.

One of the first speakers at this event did a deep dive into misinformation and how it is generated using the latest in deepfake technology. Extremists are using this tech in propaganda campaigns. The corrosive effect this has on our shared media is interesting. I had a number of chats with Daniel throughout the conference and discovered that his motivating interest is in the nature of online communities and how they work in terms of social norms and expectations. This kind of decentralized, narrow (as opposed to broad) band media transmission is becoming the new norm, yet no one seems to be teaching how it is influencing society in media theory classes. It's something I want to go after in terms of updating digital media education in Canada.

The theme of the symposium was, DisruptX:Redefining the future of cybersecurity in Latin America and the Caribbean", so many of the talks revolved around the impact A.I. is having in cybersecurity. As in most places, it's a force leveller. People writing phishing emails now write with perfect grammar and spelling, and don't use form letters anymore because AI can generate targeted, articulate messages specifically for individuals. This enabling of cyber criminals by automated systems targets our ongoing cyber-illiteracy because that's the easiest target, but that's just the tip of the iceberg. Automated malware as a service can be purchased by anyone who can turn on a computer. The days of technically talented hackers are far behind us as AI serves to elevate anyone looking to create havoc online.

To further complicate the landscape, you've got state actors (including world superpowers) performing offensive cyber operations against governments, businesses and even individuals. At this cost-no-object end of the spectrum you've got cyber militaries operating on budgets in the billions possibly taking aim at your company or government.  If you're a developing economy with minimal digital infrastructure, how do you possibly keep it secure against that? The short answer is you don't, sometimes you just get pwned.

OK, so what do I do, you ask? You've got a couple of options when it comes to protecting your internet facing systems (in this case critical systems that make society work and provide things like electricity):

1) Put money up front building the most secure network you can, but this requires talented people who are in short supply (the cyberskills shortage isn't just happening in Canada). It also means paying up front for something that hasn't happened yet, and can't be guaranteed secure no matter what you throw at it. The case for preemptive cyber capacity building remains a struggle and not just in the Caribbean, it's a problem in Canada too.

2) The other option is to design full backup systems so you can recover when the inevitable happens, but this too requires technical talent, forethought and a willingness to invest in the future - all aspects of cyber that humans everywhere struggle with.

Like the GFCE event in Washington, a lot of time was spent thinking about governance and policy. These frameworks are vital, especially if we want to push back against human nature that isn't likely to invest in anything precautionary. A purely passive/defensive mindset doesn't work in cyber any more than it would in sports. The nature of this one sided game means that some of these limited resources also need to be reserved for active cyber operations, both offensive and defensive. 

I hope there is room in policy and governance to ensure that there are resources left over to support this kind of agility. This 'just-in-time' work often happens in companies and government agencies rather than in university research labs and needs to be more accessible to the people on the ground doing the work. So much of the research funding in Canada is tied to post-secondary institutions and is inaccessible to anyone else. This is an area where developing cyber systems have an advantage.  Agile action research in cyber by practitioners rather than solely by academics is essential if we're to retain the ability to deal with emerging threats.

This confusion around the nature of cybersecurity (is it an apprenticeable skillset or an academic pursuit?) is another one of those evolving understandings still somewhat out of focus as we continue to define what cybersecurity is. It was nice to see one of my favourite cyber graphics come up in one of the RICET education talks reminding everyone that cyber is a complex, multi-modal field of study ranging from apprenticelike hard technical roles through management and logistics to academically intensive legal and human facing work in subjects ranging from policy and HR to education.

Like any other field of study, cybersecurity is full of nuance. We're just not there yet because we're still figuring out what it is.

*** Extracurriculars

Fascinating conversations and an opportunity to network without a schedule or talking points. These 'extracurricular' evening events are often the most informative!

The conference had a couple of extracurricular events where I often hear the most enlightening things. A delegation from the South Pacific was attending this event under the idea that they they are facing many of the same challenges that the Caribbean states are. Tim from the Cook Islands and I had many great talks about the sudden change they are going through. About two weeks before the conference Elon flipped a switch and suddenly everyone on the islands could afford high speed internet for the first time through Starlink. The rest of us have been in the digital pot as the heat has been slowly turned up over the past two decades and don't realize it's boiling. Can you imagine going from 90's dial up to 2024's AI/social media/fake-news cyber-nightmare in one week? Tim's managing the IT there. Someone should be writing a book about this time travelling digital experiment.

The fortress in colonial Santo Domingo at sunset. The DR's relationship with its past, like Canada's, is complicated and unfinished.

On the final evening we got taken out to the colonial tourist area for a look around Fortaleza Ozama. Being me, I found watching the chaos of the evening commute around the castle distracting. Like the social the night before, this was an opportunity to chat with people working in cyber from many different perspectives. I'd run into Franklin from Suriname who I'd met in Ghana last year and we picked up right where we'd left off. Suriname is about to go through some dramatic changes.

When you find yourself having a drink with the head of Mastercard's security division and the entourage from Columbian cyber, you wonder how you got here. Tim from Cook Islands' wife messaged him asking what he was up to expecting another conference update. His response was, 'I'm drinking rum at a castle at sunset!" Indeed.

The tour included a projection onto the fortress of the DR's history. It reminded me of the projection show they were doing on the Houses of Parliament in Ottawa a few years ago and raised some interesting questions about how digital is insinuating itself into island life.

The seemingly incongruous VR experience at the fortress was complimented by animated digital projections throughout, to the point where it was easy to forget you were in a centuries old fortress, which is the point of being there, isn't it?  A few times in the conference the corrosive effect of AI on regional culture was noted (AI's fixation on large datasets tends to stamp out anything but the biggest producers of data). I suspect digitization (itself a byproduct of globalization) has a generally corrosive effect on people's ability to be where they are. We spend an awful lot of our time taking photos to share online instead of being where we are (like the ones in this post? -ed).

*** RICET

The final day switched gears and became RICET, the Regional Initiative for Cybersecurity Education and Training, put on by the OAS and Florida International University. This focus on education and training is essential if we're to establish sustainable and effective cybersecurity. It's also a vital part of both figuring out what cyber is and framing it so the public better understands it.

I've said it before and I'll say it again, the vast majority of cyber incidents are the result of human failure. No matter how you want to frame it, our current cyber woes arise from a multi-generational failure to develop effective digital media literacy of which cybersecurity is perhaps the most interdisciplinary and complex because it's all about the edge cases. You can't hack something you don't fundamentally understand. You can't defend against those hacks without it either.

We've been fixated on coding as a solution to the digital skills crisis, but digital media literacy is about much more than coding. In cyber you need flexible, stochastic approaches with familiarity across a much wider range of digital technology. I've met too many compsci specialists who are sidelined by simple technical issues to believe that this is the epitome of digital literacy. I also heard the dreaded term 'digital native' during some of these talks, but I'm not going to get into that nonsense again here. 

RICET panels talked about the usual worries around the lack of talent, though like everyone else they spent much of the time on bandaid solutions like adult retraining instead of looking at strategic fixes like implementing nationwide cyber skills talent discovery and development in public schools that would not only address the user negligence problem, but would also resolve our cyber-professional shortage.

We'll never resolve this global digital skilling failure with stop gap solutions. We need both short term and long term strategies, but like the funding for seemingly obvious things like network security and data backups, getting anyone to finance the future is a struggle.

Watching these earnest cyber developers working on shoestring budgets trying to make this work while Canadians literally watch drinkable water go down the toilet has me wondering why we face so many of the same challenges they do. On my way back home I messaged a colleague in cyber education and lamented the fact that cyber expertise in Canada seems to be more about marketing than it does cybersecurity. I summarized the problem with genuine cyber-education in simple terms: there's no money in it.  That observation extends to cyber in general. One of the reasons for the high burnout rate is asking the few people who know what they're doing to do it without the necessary resources.

I enjoyed learning about the regional challenges being faced in the Caribbean, but what always surprises me about these glimpses into international cybersecurity is just how similar the problems we all face are. In a discipline where the bad guys only have to get it right once but the defenders have to get it right every time, the only hope for cybersecurity professionals is to develop connections, build international cyber-diplomacy and work together. Circling the wagons and sharing intelligence, tools and best practices is the only advantage we have against the cyber pirates (see what I did there?) that surround us.  This event was a prime example of that kind of networking. I hope to be a part of future ones and not the only Canadian talking.

Winging out of Santo Domingo at sunrise on Delta's A320 Airbus. What a beautiful country. Wish I'd had the opportunity to see more of it...

The Bermuda Triangle on a sunny Friday morning in October.