Chapter 9 — Society Law And Ethics

Introduction

Society, Law and Ethics in the context of computing studies how information technology affects people (society), what legal rules govern IT use (law), and what moral principles guide behaviour (ethics). For Class 11 Computer Science, this topic builds awareness of responsible use of computers, legal obligations and ethical decision‑making in digital environments.

Key Concepts

• Society: A group of people sharing institutions, values and technology. Computing changes social interaction, work, education and privacy.
• Law: Formal rules enacted by the state to regulate conduct; laws relevant to computing include cybercrime statutes, intellectual property law and data protection rules.
• Ethics: Moral principles (right/wrong) that guide individual and professional behaviour beyond legal requirements. Ethics often fill gaps where law is silent or slow to respond.

Why it matters for Computing

Computer professionals and users must understand how software and data affect people’s rights and safety. Design, development and use of technology should respect privacy, avoid harm, and follow applicable laws (for example, handling personal data, avoiding plagiarism, and preventing misuse).

Main Topics Covered

• Digital footprint & privacy: Data created by online activities and how it can be collected, shared or misused.
• Intellectual property: Copyright, software licenses, plagiarism and how to legally use and distribute digital material.
• Cybercrime & security: Types of offences (hacking, phishing, identity theft, malware, cyberbullying) and basic protection measures.
• Legal framework (India): Information Technology Act, 2000 (and amendments) — key provisions cover unauthorized access, data tampering, electronic signatures, and intermediary liability; Copyright Act for creative works; emerging data protection laws.
• Professional ethics: Confidentiality, honesty, accountability, respect for user autonomy and avoiding harm.

Ethical Reasoning & Decision Making

Ethical frameworks help choose actions when law does not give a full answer. Common approaches include utilitarianism (maximise overall good), deontology (follow duties/rules), and virtue ethics (act according to good character traits). In computing, decisions often balance innovation, privacy and safety.

Practical Guidance for Students

• Respect copyrights and software licenses; cite sources and avoid plagiarism.
• Use strong passwords, update software, and be cautious with links and attachments to prevent malware/phishing.
• Think before posting: personal data posted online can persist and affect future opportunities.
• Report cyberbullying, harassment or illegal content to appropriate authorities and platform moderators.

Summary

Society, Law and Ethics teaches students how computing impacts people and how to act responsibly: obey the law, follow ethical principles, and consider social consequences. Understanding these topics helps build safer, fairer and more trustworthy digital systems.

Introduction: Computers have transformed nearly every aspect of modern life — communication, education, business, healthcare, governance and entertainment. Their widespread use raises social, legal and ethical questions covered in the Class 11 topic "Society, Law and Ethics."

Positive impacts

• Education: Digital classrooms, e-learning platforms and simulations expand access and personalize learning.
• Communication & Social Connectivity: Email, social media, video conferencing and instant messaging enable real-time global communication.
• Economy & Productivity: Automation, data analytics and enterprise software increase efficiency and enable new business models (e-commerce, fintech).
• Healthcare: Telemedicine, electronic health records, medical imaging and AI-assisted diagnosis improve care and access.
• Governance & Public Services: E-governance services, digital payments and online grievance systems improve transparency and reach.
• Research & Innovation: High-performance computing, simulations and access to global knowledge accelerate discovery.
• Accessibility: Assistive technologies (screen readers, speech recognition) help people with disabilities.

Negative impacts

• Privacy & Surveillance: Massive data collection risks misuse, profiling and loss of privacy.
• Security & Cybercrime: Hacking, identity theft, ransomware and online fraud threaten individuals and institutions.
• Employment disruption: Automation and AI can displace routine jobs, requiring workforce reskilling.
• Digital Divide: Unequal access to computers and the internet widens social and economic inequalities.
• Misinformation & Social Harm: False information, echo chambers and online harassment can destabilize societies.
• Health & Well-being: Excessive screen time, addiction to online content and ergonomic issues affect physical and mental health.
• Environmental Impact: Data centers and electronic waste consume energy and resources.

Legal and ethical considerations

• Data protection laws, intellectual property rights, cyber laws and regulations aim to limit misuse.
• Ethical principles — privacy, consent, fairness, accountability — guide design and deployment of computing systems.
• Policies are needed for transparency in algorithms, fair AI, and protection of vulnerable groups.

Mitigation & Responsible use

• Digital literacy and education to reduce the digital divide and improve safe use.
• Strong cybersecurity practices (encryption, authentication, regular updates).
• Regulations (data protection acts), privacy-by-design, and ethical review of AI systems.
• Reskilling programs and social safety nets to handle employment transitions.

Conclusion: Computers bring enormous benefits but also significant social, legal and ethical challenges. Balancing innovation with responsibility — through education, law, ethics and technology design — ensures society reaps the benefits while minimizing harm.

Overview
Ethics studies principles that govern right and wrong behaviour. In computing, ethics helps decide how technology should be designed, used and regulated to respect people, society and the law.

Core concepts

• Morality vs Ethics: Morality = personal or cultural beliefs about right/wrong. Ethics = systematic study and justification of those beliefs.
• Values and Norms: Values are what a person/group considers important (privacy, fairness). Norms are behavioural expectations derived from values.
• Rights and Duties: Rights (e.g., privacy, access to information) impose duties on others (e.g., duty to protect user data).
• Responsibility and Accountability: Responsibility is obligation to act; accountability is being answerable for actions and consequences.
• Professional Ethics: Codes (like confidentiality, competence, integrity) that guide practitioners.

Major ethical theories

• Consequentialism / Utilitarianism: Right action maximises overall good (utility). Evaluate actions by their outcomes: greatest good for the greatest number.
• Deontology (Duty-based): Rightness determined by rules or duties (e.g., "do not lie") irrespective of consequences. Kantian ethics emphasizes universalizable maxims and treating people as ends, not means.
• Virtue Ethics: Focuses on moral character and virtues (honesty, courage). Right action expresses a virtuous character.
• Rights-based Ethics: Emphasizes protection of individual rights (speech, privacy); actions violating rights are unethical even if beneficial overall.
• Care Ethics: Emphasizes relationships, empathy and care responsibilities, often prioritising vulnerable parties.
• Ethical Relativism: Claims moral standards depend on culture or individual choice; problematic for universal professional standards.
• Social Contract: Morality arises from implicit agreements in society to secure mutual benefits and co-existence.

Applying theories to computing

• When designing software, consequentialists weigh benefits/harms to stakeholders; deontologists check compliance with duties (privacy laws, no deception); virtue ethicists ask what a responsible developer would do.
• Common dilemmas: privacy vs security, transparency vs intellectual property, automated decisions and bias, software reliability vs deadlines.

Practical decision steps

1. Identify stakeholders and relevant facts.
2. List possible actions/alternatives.
3. Assess harms/benefits and rights/duties for each alternative.
4. Apply ethical theories or a weighted decision model.
5. Choose action, document reasoning, and plan mitigation for harms.

Overview: Computer ethics studies moral rules and professional conduct for computing professionals and users. It asks what is right or wrong when creating, using, sharing and managing digital information and systems. A useful framework is PAPA — Privacy, Accuracy, Property and Accessibility — which highlights common ethical concerns.

PAPA explained:

• Privacy — Concern about personal data collection, consent, storage, sharing and surveillance. Ethically we must minimize collection, obtain informed consent, protect data, and respect user anonymity when required.
• Accuracy — Ensuring information is correct and up-to-date. Inaccurate data can harm people (wrong medical records, credit reports). Ethical duties include verifying, correcting errors and communicating uncertainty.
• Property — Intellectual property (IP), copyrights, patents, trade secrets and software licenses. Ethical behavior means acknowledging creators, following license terms, and avoiding piracy and plagiarism.
• Accessibility — Fair access to information and computing resources. This covers digital divide issues, reasonable accommodations for people with disabilities, and equitable access to education and services.

Related ethical and social issues: cyberbullying, hacking and unauthorized access, identity theft, online harassment, data breaches, surveillance, targeted advertising, deepfakes, algorithmic bias, automated decision impacts, net neutrality, and the digital divide. Professionals must also follow codes of conduct, legal requirements (for example the IT Act, GDPR principles), and institute safeguards (encryption, authentication, auditing).

Principles and best practices: follow the CIA triad (confidentiality, integrity, availability); apply privacy-by-design and data minimization; use secure coding practices; respect copyrights and licenses; be transparent about data use; keep logs and allow redress; and promote inclusive access.

Decision-making approach: Identify stakeholders, list possible actions, evaluate harms/benefits (short- and long-term), check legal and professional rules, prefer least-harmful option, document and review outcomes.

CBSE classroom relevance: Understand PAPA as a mnemonic, relate each element to everyday school-level examples (sharing photos, group project plagiarism, school databases), and know simple technical controls (passwords, backups, permissions) and ethical responses (seek consent, report misuse).

What are Intellectual Property Rights (IPR)?
Intellectual Property Rights are legal rights granted to creators and owners of works that are the result of human intellect — such as inventions, literary and artistic works, symbols, names, images, designs and industrial processes. IPR gives the owner exclusive rights to use, commercialize or authorize others to use their creation for a limited time.

Objectives of IPR

• Encourage innovation and creativity by giving creators a time-limited monopoly.
• Protect investments in research and development.
• Provide a legal framework to resolve disputes and prevent unauthorized use.
• Promote dissemination of knowledge through licensing and publication.

Main types of IPR (with short descriptions)

• Copyright — Protects original literary, musical, artistic works, films and computer programs. It covers expression, not ideas. (In India: Copyright Act, 1957.) Duration: life of author + 60 years (generally).
• Patent — Protects novel, non-obvious and industrially applicable inventions (products or processes). Grants exclusive rights to make, use or sell the invention for a fixed term. (In India: Patents Act, 1970.) Duration: 20 years from filing.
• Trademark — Protects signs, logos, words or combinations that distinguish goods or services of one enterprise from another. Renewable indefinitely (usually 10-year renewal terms). (In India: Trade Marks Act, 1999.)
• Industrial Design — Protects aesthetic or ornamental aspects of an article (shape, pattern, color). Duration varies (in India: initially 10 years + 5 years renewal = up to 15 years).
• Trade Secret — Information (formulas, practices, designs, processes) kept confidential to retain competitive advantage. Protection lasts as long as secrecy is maintained; no registration required.
• Geographical Indication (GI) — Identifies goods originating from a specific place that have a reputation or qualities due to that origin (e.g., Darjeeling tea). Duration: usually 10 years, renewable.

Key features and concepts

• Rights conferred — Exclusive rights to reproduce, sell, adapt, license, or prevent others from exploiting the protected work without permission.
• Registration vs automatic protection — Copyright arises automatically on creation and fixation; registration provides prima facie evidence. Patents, trademarks and designs require formal registration to enforce rights effectively.
• Infringement — Unauthorized use of protected material. Remedies include injunctions, damages, account of profits, and sometimes criminal penalties (depends on jurisdiction and IPR type).
• Limitations and exceptions — Fair dealing/fair use, compulsory licensing (for patents), freedom of expression and research exemptions. Indian law recognizes "fair dealing" for certain purposes like criticism, review, reporting, education and research.

IPR and software

• Computer programs are protected by copyright as literary works (source code and object code). Copyright protects expression of the code, not the underlying ideas or algorithms.
• Software patents are controversial: in India, "mathematical methods, business methods, algorithms per se" are not patentable, but inventions that apply software to a technical effect may be considered.
• Licenses determine use rights: proprietary (closed) licenses vs open-source licenses (GPL, MIT, Apache, Creative Commons). Choose license based on distribution and reuse goals.

How enforcement typically works

• Identify the right (copyright, patent, trademark etc.) and confirm ownership or registration.
• Send a cease-and-desist or take legal action (civil suit, criminal complaint where applicable).
• Courts may issue injunctions, award damages, or order account of profits. Administrative authorities can handle trademark oppositions and patent office proceedings.

Practical tips for students and developers

• Always check licenses before using code, images, music or datasets — attribute and comply with license terms.
• Use open-source software responsibly: follow copyleft terms (GPL) or permissive terms (MIT/Apache) as required.
• Protect your original classroom projects (keep drafts, timestamps) and consider registration for valuable works.

Note: IPR laws differ by country. For India-specific rules refer to the Indian Acts: Copyright Act 1957, Patents Act 1970, Trade Marks Act 1999, Designs Act 2000 and Geographical Indications of Goods (Registration and Protection) Act 1999.

Introduction

Software piracy and plagiarism are violations of intellectual property rights and academic/ professional ethics. Software piracy is the unauthorized copying, distribution, or use of software. Plagiarism is presenting another person's code, documentation, or ideas as your own without correct attribution.

Software Piracy — Types

• End-user piracy: Installing one licensed copy on multiple machines (overuse) or copying from one computer to many (hard-disk loading).
• Internet piracy: Illegal downloads via torrents, file‑sharing, or cracked software sites.
• Counterfeiting: Selling packaged, fake copies that mimic genuine software CDs/boxes.
• OEM and site license violations: Misuse of original equipment manufacturer (OEM) or site licenses beyond permitted terms.
• Bootlegging: Unauthorized copying of live software demonstrations or proprietary builds.

Plagiarism in Computing

• Direct copy: Copying source code or documentation verbatim without credit.
• Source modification: Making small edits to someone else’s code but retaining the structure and logic.
• Self-plagiarism: Reusing your previous work in a new submission without disclosure.

Consequences

• Legal: Copyright law (penalties, fines, civil suits) and license enforcement.
• Economic: Revenue loss for developers and reduced incentive for innovation.
• Academic/professional: Penalties ranging from failed assignments to expulsion or job termination; damage to reputation.

Detection and Tools

Software piracy is tracked by audits, serial-key validation, and telemetry; plagiarism in code is detected by tools like MOSS, JPlag, and general text checkers like Turnitin. Version control history and timestamps also help establish authorship.

Prevention and Best Practices

• Use properly licensed software (FOSS where appropriate) and keep license records.
• Educate users and students about copyrights and citation norms.
• Apply technical measures: license keys, code obfuscation (with caution), update servers, and DRM only when justified.
• For assignments, require code comments, design documents, and repositories (with commit history) to show individual work.
• Always attribute and include license headers in shared code; follow open-source license terms when using third-party code.

Ethical Perspective

Beyond legal risks, piracy and plagiarism undermine trust, fairness, and the incentive structure that allows creators to be rewarded for their work. Respect for intellectual property fosters innovation and learning.

Definition: Cyber crimes are illegal acts committed using computers, networks or the Internet to harm individuals, organisations or society. They exploit digital systems, data and communications.

Types (classification):

• Against persons: cyberstalking, cyberbullying, identity theft, online grooming.
• Against property/finance: online fraud, banking trojans, credit-card fraud, phishing, ransomware.
• Against data and systems: hacking, malware, DoS/DDoS attacks, data breaches, SQL injection.
• Against society/state: cyberterrorism, propaganda, information warfare, distribution of illegal content.

Common techniques / attack vectors: phishing emails and fake websites; malicious attachments; infected downloads; social engineering (manipulating people to reveal secrets); unpatched software exploits; weak or reused passwords; insecure Wi‑Fi or public networks.

Motives: financial gain (most common), political objectives, espionage, revenge, activism, or simply curiosity and notoriety.

Legal framework (India, brief): Information Technology Act, 2000 (IT Act) is the principal law dealing with cyber offences in India, with sections addressing unauthorised access, data tampering, identity theft, electronic forgery and obscene content. Cyber crimes are also tried under relevant sections of the Indian Penal Code (IPC) where applicable. Victims should report incidents to local cyber cells or the National Cyber Crime Portal (cybercrime.gov.in).

Consequences / impact: financial loss, reputational damage, loss of privacy, intellectual property theft, disruption of services, physical harm in critical infrastructure attacks.

Prevention and best practices:

• Use strong, unique passwords and enable two-factor authentication (2FA).
• Keep OS, applications and security software up to date.
• Be cautious with emails, links and attachments; verify senders.
• Use firewalls, antivirus/antimalware and encryption for sensitive data.
• Backup important data regularly and test restoration.
• Limit data sharing on social media; review privacy settings.
• Educate users about social engineering and safe browsing.

Ethical considerations: Responsible use of digital resources, respecting others' privacy and intellectual property, avoiding actions that may harm systems or people, and reporting vulnerabilities rather than exploiting them.

Study tips for Class 11: Learn common attack types and examples, understand legal/ethical implications, practise simple risk calculations (see formulas), and consider real incidents to see how prevention and legislation are applied.

Overview

The legal framework for cyber laws covers statutes, rules and judicial decisions that regulate electronic communication, protect data and punish cybercrime. It balances promoting digital transactions and protecting citizens from misuse of technology. For Class 11 Computer Science, the focus is on basic rights and duties, common offences, relevant laws, investigation and prevention.

Key concepts

• Cyber law: Legal rules that apply to the internet, computers, networks and electronic data.
• Cybercrime: Any criminal activity where computers or networks are used as tools, targets or places of criminal activity (e.g., hacking, phishing, identity theft).
• Cyber security: Practices and technologies to protect confidentiality, integrity and availability of information (CIA triad).

Important elements of the legal framework (India)

• Information Technology Act, 2000: Primary statute dealing with electronic records, digital signatures, admissibility of electronic evidence and many cyber offences. It has been amended to address new threats.
• Intermediary Guidelines and Digital Media Rules: Define due diligence and responsibilities of intermediaries (social media platforms, ISPs).
• Digital Personal Data Protection Act, 2023: Rules for processing personal data, obligations on data fiduciaries and rights of data principals (users).
• Indian Penal Code & Evidence Act: Many cyber offences overlap with traditional crimes (cheating, defamation, criminal intimidation) and rules on electronic evidence were updated for admissibility.
• Cert-In and other agencies: Computer Emergency Response Team (CERT-In) provides cyber security alerts and incident reporting mechanisms.

Common cyber offences

• Unauthorized access/hacking of systems
• Phishing and online fraud
• Identity theft and financial fraud
• Ransomware and malware attacks
• Cyberstalking and cyberbullying
• Online defamation and hate speech
• Copyright and IP violations (piracy)
• Cyber terrorism and attacks on critical infrastructure

Legal concepts students should know

• Electronic contract: Valid if it satisfies offer, acceptance, consideration and consent rules even when done electronically.
• Digital signature & authentication: Ensures authenticity and integrity of electronic documents. Public key infrastructure (PKI) is often used.
• Intermediary liability: Platforms may have limited liability if they follow due diligence rules and remove illegal content when notified.
• Jurisdiction & cross-border issues: Cyber offences often involve multiple countries; international cooperation and mutual legal assistance are important.
• Admissibility of electronic evidence: Electronic records can be produced in court provided proper authentication and chain of custody are maintained.

Investigation and remedies

• Victims should preserve evidence (screenshots, logs) and report to local police or designated cyber cells / CERT-In.
• Complaints can lead to criminal prosecution, monetary compensation, takedown orders or blocking of content.
• Companies must follow breach notification rules and data protection obligations under the applicable law.

Prevention & good practices

• Use strong, unique passwords and two-factor authentication.
• Be cautious with links and attachments to avoid phishing and malware.
• Protect personal data; share only when necessary and on trusted platforms.
• Install updates and antivirus software; backup important data.
• Schools should teach digital citizenship, responsible use and legal consequences of misuse.

Why this matters

Legal protections enable safe electronic commerce, protect privacy and provide remedies when rights are violated. Understanding cyber laws helps students make responsible choices online and recognize when to seek help.

Definition: Data protection and privacy refers to the legal, technical and organizational measures taken to ensure personal and sensitive information is collected, stored, processed and shared in ways that respect individuals' rights and prevent misuse, unauthorized access, loss or disclosure.

Why it matters:

• Protects individuals from identity theft, financial loss, discrimination and reputational harm.
• Builds trust between users and organisations that handle personal data.
• Is required by laws and regulations (e.g., GDPR, DPDP/IT Act in India) — noncompliance can cause heavy penalties.

Core principles (common to most data protection frameworks):

• Lawfulness, fairness and transparency: Collect and use data only with a legal basis and inform data subjects.
• Purpose limitation: Use data only for the purposes specified at collection.
• Data minimization: Collect only the data necessary for the purpose.
• Accuracy: Keep data accurate and up to date.
• Storage limitation: Retain data only as long as needed.
• Integrity and confidentiality: Protect data against unauthorized access and breaches.
• Accountability: Organisations must be able to show compliance.

Technical and organisational safeguards:

• Encryption: Convert data into unreadable form (ciphertext) so only authorised parties can read it.
• Access control: Role-based access, least privilege, strong authentication (passwords + MFA).
• Anonymization and pseudonymization: Remove or mask identifiers to reduce re-identification risk.
• Hashing: Use one-way functions for storing passwords or verifying integrity.
• Secure transmission: Use TLS/HTTPS for data in transit.
• Backups, logging and monitoring: Maintain logs, detect intrusions, and restore data after incidents.
• Policies and training: Clear data-handling policies and employee training to avoid human error (e.g., phishing).

Legal aspects and rights: Data protection laws give rights such as consent, access to one’s data, correction, deletion (right to be forgotten), restriction of processing and data portability. Organisations must often report breaches to authorities and affected individuals.

Common threats and breaches: Identity theft, phishing, ransomware, accidental disclosure (mis-sent emails), insider misuse, insecure third-party services, weak passwords.

Best practices (Individuals): Use strong unique passwords, enable two-factor authentication, limit sharing of personal data, review app permissions, clear cookies and privacy settings.

Best practices (Organisations): Apply privacy-by-design, perform data protection impact assessments, keep software patched, use encryption, limit data retention, appoint a data protection officer where required.

Summary: Data protection and privacy combine legal rights, ethical principles and technical controls to safeguard personal information. Understanding the lifecycle of data, reducing unnecessary collection, and applying strong technical controls are key to protecting individuals and organisations.

Overview

Digital signatures, encryption and related security technologies protect data confidentiality, integrity, authenticity and non-repudiation in digital communication and storage. These techniques are the foundation of secure e-mail, online banking, software distribution, e‑governance and many other services users rely on every day.

Encryption

• Purpose: transform readable data (plaintext) into an unreadable form (ciphertext) so only authorized parties can recover it.
• Symmetric (secret‑key) encryption: same key is used to encrypt and decrypt. Fast and used for bulk data. Examples: AES, DES, 3DES. Use case: encrypting files on a disk or communication within an encrypted channel once a session key is shared.
• Asymmetric (public‑key) encryption: uses a key pair — a public key for encryption (or verification) and a private key for decryption (or signing). Slower, used for key exchange, digital signatures and small payloads. Examples: RSA, ECC.
• Hybrid approach: common practical method: use asymmetric encryption to securely exchange a symmetric session key, then use symmetric encryption (AES) for the data.

Hash functions

• A hash function maps data of arbitrary size to a fixed‑length output (digest). Good cryptographic hashes are one‑way (fast to compute, infeasible to invert), collision resistant (hard to find two inputs with the same digest) and sensitive to input changes.
• Examples: SHA‑256 (secure, widely used), MD5 (broken for collision resistance).

Digital signatures

• Purpose: prove the origin (authenticity) of data, ensure integrity, and provide non‑repudiation (sender cannot deny having signed).
• How it works (high level): the sender hashes the message to create a digest, encrypts (signs) the digest using their private key to produce a signature, and sends message + signature. The receiver hashes the received message and uses the sender's public key to decrypt the signature; if the decrypted signature equals the computed hash, the signature is valid.
• Digital signatures depend on secure key management and trustworthy public key distribution (see PKI below).

Public Key Infrastructure (PKI) and Certificates

• PKI is a system that binds public keys to identities using digital certificates issued by Certificate Authorities (CAs). An X.509 certificate contains a public key, subject identity, validity period and CA signature.
• Web browsers and operating systems trust a set of root CAs. TLS/HTTPS uses certificates so browsers can confirm a website's identity and establish an encrypted connection.

TLS/SSL (example of applied technologies)

• TLS secures web traffic. Simplified handshake: ClientHello → ServerHello + Certificate → (key exchange) → both derive shared session key → encrypted communication. The certificate assures the client it is talking to the real server.

Other security technologies

• Firewalls: filter traffic between networks based on rules.
• Antivirus / anti‑malware: detect and remove malicious software.
• Intrusion Detection/Prevention Systems (IDS/IPS): monitor networks/applications for attacks.
• VPNs: create an encrypted tunnel between endpoints.
• Two‑factor (multi‑factor) authentication (2FA/MFA): combines something you know (password) with something you have (token) or are (biometrics).
• Access control and least privilege: users/processes get only the rights needed.
• Steganography (related): hiding information inside other files (images, audio) — not encryption, but used for covert transfer.

Security properties and best practices

• Use strong, up‑to‑date algorithms (e.g., AES‑256, RSA with sufficiently large keys or ECC) and current protocols (TLS 1.2/1.3).
• Protect private keys (hardware security modules, secure enclaves, encrypted storage).
• Keep software updated, use principle of least privilege and enforce MFA for sensitive accounts.
• Verify certificates and avoid self‑signed certificates in production unless trusted explicitly.

Class‑11 level summary

Encryption ensures confidentiality; hashing ensures integrity; digital signatures ensure authenticity and non‑repudiation. PKI and certificates provide a trust model for public keys. Practical systems combine these technologies to secure everyday services like HTTPS, signed software, and secure e‑mail.

Introduction
Cyber security refers to the practices, technologies, and processes designed to protect networks, devices, programs and data from attack, damage or unauthorized access. For students and organizations, cyber security is essential to protect personal information, academic records, financial data and digital infrastructure.

Core Principles

• Confidentiality – ensuring information is accessible only to authorized users.
• Integrity – ensuring information is accurate and unaltered.
• Availability – ensuring information and resources are available when needed.

Common Threats

• Phishing and social engineering (fraudulent emails/links to steal credentials)
• Malware: viruses, worms, Trojans, ransomware
• Man-in-the-middle attacks and eavesdropping
• Denial-of-Service (DoS) attacks
• Unauthorized access due to weak passwords or misconfigured systems

Practical Security Measures & Best Practices

• Strong, unique passwords – use long passphrases and avoid reuse. Prefer password managers to store credentials securely.
• Multi-factor authentication (MFA) – combine something you know (password) with something you have (OTP, authenticator app) or something you are (biometrics).
• Keep software updated – apply OS, browser, and application patches promptly to fix vulnerabilities.
• Use antivirus/endpoint protection and enable real-time scanning and automatic updates.
• Secure networks – use WPA3/WPA2 on Wi‑Fi, change default router passwords, and avoid public Wi‑Fi for sensitive transactions (or use a VPN).
• Backups – keep regular, offline and offsite backups of important data; test restore procedures.
• Encryption – use HTTPS for websites, enable full-disk encryption on devices, and encrypt sensitive files in transit and at rest.
• Least privilege & access control – give users only the permissions they need; use role-based access control (RBAC).
• Secure development practices – validate inputs, sanitize data to prevent injection attacks, and follow secure coding standards.
• Incident response & reporting – have a plan to detect, contain, eradicate and recover from breaches; report incidents to relevant authorities if required.
• Awareness & training – educate users about phishing, safe browsing, and social engineering tactics.
• Data classification & retention – classify data by sensitivity and apply appropriate controls; dispose of data securely when no longer needed.
• Legal and ethical responsibilities – comply with laws (for example, India’s IT Act provisions and privacy regulations) and respect user privacy and intellectual property.

How these measures work together
Good cyber security is layered (defense-in-depth): technical controls (firewalls, encryption), administrative controls (policies, training), and physical controls (secure premises). Layering reduces the chance that a single failure leads to a major breach.

Student-level practical tips

• Enable MFA on email and social accounts.
• Use a reputable password manager and create unique passwords for each account.
• Don’t click suspicious links; verify senders before sharing personal information.
• Regularly back up school projects and notes to an encrypted cloud or external drive.
• Keep mobile OS and apps updated; only install apps from trusted stores.

Summary
Cyber security is an ongoing process that combines technical tools, secure habits, policy and awareness. Following the best practices above reduces risk of data loss, identity theft and disruption to systems.

What is Cyber Forensics?

Cyber forensics (also called digital forensics) is the practice of identifying, collecting, preserving, analysing and presenting digital evidence in a way that is legally acceptable. It applies scientific and investigative techniques to computers, networks, mobile devices, cloud services and other digital media to discover what happened, who was involved and how to prevent a recurrence.

Why it matters

• Helps solve cybercrimes (hacking, fraud, identity theft, intellectual property theft).
• Supports legal proceedings by preserving admissible evidence.
• Enables organizations to respond to incidents and recover systems safely.

Core phases of a digital forensic investigation

1. Identification: Detect affected systems and sources of potential evidence (computers, phones, logs, cloud accounts).
2. Preservation: Protect evidence from alteration. Use write-blockers, take memory dumps, secure devices.
3. Collection (Acquisition): Create bit‑for‑bit images of storage, capture volatile memory, collect logs and network captures—always document steps.
4. Examination: Use tools to extract files, recover deleted data, parse logs, reconstruct timelines, decode artifacts.
5. Analysis: Interpret findings to determine sequence of events, attribution, and impact. Correlate evidence from different sources.
6. Presentation/Reporting: Produce a clear report and evidence chain for stakeholders and courts. Explain methods, tools and conclusions.

Types of evidence

• Storage data: hard drives, SSDs, USB drives, memory cards.
• Volatile data: RAM, running processes, open network connections.
• Network evidence: packet captures (PCAP), firewall/IDS logs, server logs.
• Mobile and IoT artifacts: app data, SMS, GPS logs, call history.
• Cloud and social media: snapshots of cloud storage, account activity logs, posts and messages.

Key principles and legal/ethical aspects

• Chain of custody: Record who handled evidence, when and why. Without it, admissibility may be lost.
• Integrity: Use cryptographic hashes to prove images are unaltered.
• Authorization: Obtain appropriate warrants or permissions before seizing devices (unless exigent circumstances).
• Minimal handling: Avoid changing evidence; work on copies whenever possible.
• Privacy and ethics: Limit analysis to scope of investigation and respect privacy laws.

Common tools

• Imaging and analysis: Autopsy/Sleuth Kit, EnCase, FTK.
• Memory forensics: Volatility, Rekall.
• Network analysis: Wireshark, tcpdump.
• Mobile forensics: Cellebrite, MSAB, open-source mobile tools.

Practical precautions

• Document every action in a log with timestamps.
• Always work on copies (forensic images) and keep originals secured and sealed.
• Capture volatile data first (RAM, active network connections) because it is lost on shutdown.
• Note time zones and clock skew when building timelines.

Limitations

Forensics cannot always attribute an action to a person beyond reasonable doubt (e.g., shared accounts, spoofing). Encryption, anti-forensic methods and cloud/distributed architectures make investigations harder.

Summary

Cyber forensics combines technical methods and legal procedures to collect, analyse and present digital evidence. Good forensic practice follows strict documentation, uses cryptographic hashes and chain-of-custody procedures, and respects legal limits. It is an essential part of incident response, law enforcement and corporate governance.

What is E‑commerce? E‑commerce means buying and selling goods or services and transferring money and data over electronic networks, primarily the Internet. It includes web stores, mobile apps, online marketplaces, digital services, and electronic payments.

Online transactions are the payment and data exchanges that complete an e‑commerce purchase: product selection, payment authorization, order confirmation, fulfillment and delivery, and after‑sales support. Secure transaction technologies (HTTPS/SSL‑TLS, encryption, tokenization, two‑factor authentication, PCI‑DSS compliance) protect confidentiality and integrity.

Key stakeholders: buyers (consumers), sellers (merchants), payment processors/gateways, banks, delivery/logistics providers, and intermediaries/platforms (marketplaces, hosting providers).

Risks and ethical/legal issues: fraud (phishing, card‑not‑present attacks), identity theft, counterfeit/fake products, misleading advertising, unfair terms (hidden charges), privacy breaches and data misuse, unfair cancellation/return policies, and disputes over refunds or delivery.

Consumer protection framework (India context): Consumer Protection Act, 2019; Consumer Protection (E‑commerce) Rules, 2020; Information Technology Act, 2000 (liability of intermediaries, data aspects); Payment Card Industry Data Security Standard (PCI‑DSS) and RBI/UPI guidelines for payments. E‑commerce rules require display of seller details, return/refund policy, and appointment of a grievance officer with contact details.

Consumer rights in e‑commerce include the right to be informed (accurate product info), right to safety (safe products), right to choose (fair competition), right to be heard (grievance redressal), and right to seek redressal (refund, replacement, compensation). Platforms must provide clear terms, grievance officer contact, and means to file complaints.

Practical protections and good practices: use HTTPS sites, check seller ratings and reviews, prefer reputed payment methods (UPI, trusted wallets, card gateways), enable 2FA and strong passwords, verify return/refund and warranty policies, keep transaction receipts and screenshots, monitor bank statements, and report fraud promptly. Sellers should publish transparent policies, secure user data, and comply with regulations.

Dispute resolution: try first to resolve with the seller/platform (grievance officer). If unresolved, escalate to banking chargeback, file complaint on consumer portals (e.g., National Consumer Helpline), or initiate proceedings in Consumer Dispute Redressal Commissions (district/state/national levels) depending on value and jurisdiction.

Overview
Responsibilities and liabilities in computing describe what users and organisations must do to behave legally and ethically, and what they may be held accountable for if they fail to meet those duties. These concepts cover data privacy, cyber security, intellectual property, ethical behaviour and legal compliance.

Responsibilities of Users

• Lawful and ethical use: Use software, content and services according to licence terms and copyright law. Do not pirate software or plagiarise content.
• Data protection and privacy: Respect other people's personal information — do not share or expose private data without consent.
• Security hygiene: Use strong passwords, enable multi-factor authentication, keep devices and software updated, avoid suspicious links and attachments.
• Reporting incidents: Notify appropriate authorities or organisation security teams when breaches, fraud or suspicious activities are discovered.
• Respecting policies: Follow workplace/school acceptable-use policies, terms of service and internet usage rules.

Responsibilities of Organisations

• Legal compliance: Follow applicable laws (for example, the Information Technology Act, 2000 in India; GDPR in EU) regarding data protection, cybercrime reporting and record-keeping.
• Data protection measures: Implement technical and organisational measures—encryption, access controls, backups, secure development practices—to protect personal and sensitive data.
• Privacy transparency: Publish privacy policies telling users what data is collected, why, how long it is stored and with whom it is shared.
• Employee training: Educate staff on security best practices, phishing, social engineering and legal obligations.
• Incident response: Maintain an incident response plan to detect, contain, remediate and report breaches in defined timelines.
• Third-party management: Ensure vendors and partners meet security and privacy standards (through contracts and audits).

Types of Liability

• Civil liability: Organisations or users may be required to pay compensation for losses caused by negligence, breach of contract, or unauthorized use of data/intellectual property.
• Criminal liability: Certain acts (hacking, identity theft, publishing obscene content, unauthorised access) can attract criminal prosecution and penalties under relevant laws.
• Vicarious liability: An organisation can be held responsible for wrongful acts of its employees carried out in the course of employment.
• Strict liability and regulatory fines: Under some privacy laws, organisations may be fined for data breaches even if negligence is not proven (e.g., large fines under GDPR for inadequate protection).

When Liability Arises — key factors

• Duty of care: Was there an obligation to protect data or prevent harm?
• Breach of duty: Were reasonable steps taken, or was there negligence?
• Causation and damage: Did the breach cause measurable harm (financial loss, privacy invasion, reputation damage)?
• Statutory provisions: Do laws specify penalties or mandatory reporting (e.g., Section 43 of the IT Act covers compensation for damage to computer systems)?

Practical consequences and best practices

• For users: Keep credentials private, respect licences, read privacy notices, report security issues promptly.
• For organisations: Do regular risk assessments, maintain logs, encrypt sensitive data, conduct security audits, create clear contracts with vendors, and follow legal breach-notification timelines.

Summary
Responsibilities are proactive duties: follow laws, protect data, act ethically. Liabilities are the legal and financial consequences if duties aren’t met. Good governance, training and technical controls reduce risk of both breaches and liability.

What is E‑waste?
E‑waste (electronic waste) means discarded electrical and electronic equipment and their components and consumables that are no longer wanted. Examples: mobile phones, laptops, printers, refrigerators, batteries, circuit boards.

Why it matters
E‑waste contains valuable materials (gold, copper, rare earths) and hazardous substances (lead, mercury, cadmium, brominated flame retardants, PCBs). If handled improperly, these toxic elements pollute soil, air and water and cause serious health problems for workers and communities.

Environmental and health impacts

• Soil and water contamination from leached heavy metals.
• Air pollution from open burning of cables and plastics releasing dioxins and furans.
• Direct human exposure to toxic metals causing neurological, respiratory and reproductive harm.
• Resource depletion: lost opportunity to recover valuable metals and reduce mining impacts.

Environmental ethics — the moral questions

• Responsibility: Who is responsible for safe disposal — manufacturers, consumers, governments, or informal recyclers?
• Intergenerational justice: Are we leaving a toxic legacy for future generations?
• Precautionary principle: When a technology may cause harm, precautionary measures should be taken even if full scientific certainty is lacking.
• Polluter‑pays principle: Parties that produce pollution should bear the costs of managing it to prevent damage.
• Right to a healthy environment: Communities (often poor) near informal recycling sites are disproportionately affected.

Solutions and ethical practices

• Reduce and design for longevity: Ethical product design emphasizes durability, repairability and modular upgrades.
• Reuse and refurbishment: Extending device life reduces total e‑waste generated.
• Formal recycling and safe treatment: Certified facilities use mechanical separation, controlled smelting and proper disposal of hazardous fractions.
• Extended Producer Responsibility (EPR): Producers take-back and manage end‑of‑life treatment — shifts responsibility upstream.
• Public awareness and consumer responsibility: Proper drop‑off, data wiping and choosing repairable products.
• Legal frameworks and enforcement: Standards for collection, recycling, export controls and worker safety.

Role of Computer Science students
Students should learn safe disposal practices, support recycling drives, design software/hardware with energy efficiency and upgradability in mind, and understand data privacy issues when discarding digital devices.

Key takeaways
E‑waste is both an environmental and ethical issue. Responsible manufacturing, informed consumer choices, effective laws (like EPR), and safe recycling practices reduce harm and conserve resources.

Overview

Social issues and emerging ethical challenges in computing are concerned with how information technology affects individuals, groups and society, and with the moral questions that arise from designing, deploying and using computing systems. This topic covers privacy, security, intellectual property, digital divide, cybercrime, health and social impacts, and new challenges from AI, big data, surveillance and automation.

Core ethical principles

• Confidentiality – keeping personal and sensitive information private.
• Integrity – ensuring data and systems are accurate and unaltered without authorization.
• Availability – ensuring authorized users can access systems and data when needed.
• Accountability – actors should be responsible for their actions in cyberspace.
• Fairness & non‑discrimination – systems should not produce biased or unjust outcomes.
• Transparency & explainability – users should be able to understand or get reasons for important automated decisions.
• Consent – individuals should be able to choose how their data is collected and used.

Major social issues

• Privacy and surveillance: collection, storage and secondary use of personal data (location, health, biometrics). Concerns include unauthorized access and government or corporate surveillance.
• Cybercrime and security: hacking, identity theft, phishing, ransomware and other malicious activities that harm individuals, businesses and infrastructures.
• Intellectual property (IP): copyright, software piracy, fair use and licensing of digital content and code.
• Digital divide: unequal access to technology and the internet across socio‑economic, geographic and demographic groups, leading to unequal opportunities.
• Social & mental health impacts: cyberbullying, addiction to social media/gaming, misinformation and social polarization.
• Automation and employment: job displacement and skill shifts due to robotics, AI and automated decision systems.

Emerging ethical challenges

• AI bias and fairness: machine learning models can replicate or amplify societal bias when trained on biased data; decisions affecting loan approval, hiring, policing can be unfair.
• Deepfakes and misinformation: realistic synthetic audio/video that can deceive and harm reputations or democratic processes.
• Autonomous systems: ethical design of self‑driving cars, drones and robots — who is responsible in case of harm?
• Data ownership and consent: who owns personal data, and how should individuals control its use?
• Surveillance capitalism: monetization of personal data by platforms that personalise behavior through profiling.
• Cyber warfare and critical infrastructure threats: nation‑level attacks on power grids, hospitals or communication systems raise ethical and legal questions.

Legal & policy context (brief)

Countries have laws and guidelines that address cyber offences, data protection and IP (for example: India’s IT Act, data protection bills and global frameworks like GDPR). These laws define offences, penalties and user rights (consent, right to access, correction).

Practical mitigation & responsible practices

• Adopt security best practices: strong authentication, encryption, regular updates and backups.
• Privacy by design: minimise data collection, anonymise where possible, obtain informed consent.
• Ethical AI: test for bias, maintain transparency, keep human oversight in critical decisions and document datasets and models.
• Digital literacy: educate users on safe behaviour, misinformation detection and responsible online conduct.
• Policy & accountability: clear laws, corporate ethics codes, impact assessments and audit trails.

Classroom links

Students should be able to discuss examples, identify stakeholders, analyse risks and propose technical and social solutions (education, policy, design changes). Case studies and debates help build ethical reasoning.

Overview
Reporting, redressal and awareness mechanisms are the systems and processes that enable individuals, organisations and authorities to (1) report digital incidents (cybercrime, data breaches, harassment, copyright infringement), (2) get the complaint investigated and resolved, and (3) increase public understanding to prevent future incidents. Effective mechanisms reduce harm, preserve evidence, and improve trust in online services.

Key components

• Detection & Preservation: Identify the incident, immediately preserve evidence (screenshots, logs, emails, transaction IDs, timestamps) and avoid modifying affected devices.
• Reporting channels: Platforms’ in‑app/report buttons, Internet Service Provider (ISP) grievance officers, law enforcement cyber cells, national portals (e.g., India’s National Cyber Crime Reporting Portal), CERT teams for security incidents, banking grievance/ombudsman for financial fraud.
• Redressal bodies & roles: Platform/content moderation teams (take down or block), CERT (technical response, advisories), police/cyber cell (criminal investigation), consumer courts/RBI ombudsman (financial disputes), civil courts (injunctions/damages).
• Procedure & lifecycle: Report → Acknowledgement → Triage/Priority assignment → Investigation → Remediation & recovery → Communication & closure → Lessons learned.
• Awareness & prevention: Education campaigns, school curriculum, phishing simulations, community workshops, helplines, easy reporting guides and multi‑lingual materials.

What to include when reporting

• Clear description of the incident (what happened, when, where).
• Evidence (screenshots, chat logs, email headers, transaction IDs, URLs, phone numbers).
• Personal/contact details for follow up (use secure channels if sensitive).
• Actions already taken (passwords changed, bank contacted, device isolated).

Best practices

• Report quickly — prompt reporting improves chances of recovery and evidence integrity.
• Preserve evidence without altering it (take copies, avoid reusing compromised devices).
• Use official portals and keep complaint reference numbers for follow up.
• Escalate if there is no timely response (platform grievance officer → regulator → police/courts).
• Participate in awareness activities and teach safe online habits (strong passwords, two‑factor authentication, cautious clicking).

Why awareness matters
Awareness reduces victimisation and reporting delays. Well‑informed users recognise scams, follow safe practices, and provide higher quality reports that speed redressal.

What this topic covers
Case studies and ethical scenarios teach how to apply legal rules, ethical theories and professional principles to real-world computing problems. They train students to identify facts, stakeholders, legal obligations, likely consequences and defensible courses of action.

How to analyse an ethical scenario (step-by-step)

• Gather facts: What happened, when, where, what systems and data are involved? Distinguish known facts from assumptions.
• Identify stakeholders: Users, company, employees, regulators, third parties, public.
• Identify legal & policy constraints: Applicable laws, organisational policies, contracts and professional codes.
• Identify ethical issues: Privacy, consent, fairness, harm, copyright, accountability.
• Apply ethical theories/principles: Utilitarian (consequences), deontological (duties/rights), justice/fairness, professional duties (confidentiality, integrity).
• List possible actions: For each action, list probable benefits, harms, legal risk and stakeholders affected.
• Weigh options and choose: Use reasoned justification (balancing harms, rights, laws). Consider mitigations and safer alternatives.
• Document & communicate: Record the decision, reasons and follow-up measures; notify affected parties if required.

Common ethical principles used

• Non-maleficence: avoid causing harm.
• Beneficence: act to benefit users/society where reasonable.
• Respect for autonomy: obtain informed consent for data collection/use.
• Justice/fairness: avoid discrimination or unequal treatment by algorithms.
• Accountability & transparency: be able to explain decisions and actions.

Role of law & professional rules
Laws (for example, cybercrime provisions, copyright and data-protection rules) set minimum legal duties; professional codes set higher ethical expectations (confidentiality, competence). An ethical decision should satisfy both legal obligations and professional ethics wherever possible.

Using case studies in learning
A case study gives a concrete story to practise the steps above—students identify facts, list stakeholders and apply principles, then justify a recommended action and note preventive measures (policy changes, technical controls, training).