Skip to content
Study Hall
Lesson 2 of 3Technology, Environment, Society and Careers
Unit 7 · Lesson 2 of 3

Societal Impact, Ethics and Security

Privacy, access, automation, intellectual property, and the security practices that follow from taking them seriously.

5 min read8 practice questionsAsk AI about this →

Key things to remember

  1. 1The digital divide covers access, affordability, connection quality, literacy and accessibility.
  2. 2PIPEDA governs private-sector handling of personal information in Canada.
  3. 3Copyright is automatic on creation; patents must be applied for.
  4. 4Open-source software is licensed, not unowned — MIT is permissive, GPL is copyleft.
  5. 5The CIA triad: Confidentiality, Integrity, Availability.
  6. 6Most successful attacks exploit vulnerabilities that already had patches.
  7. 7Unauthorized access to a computer system is a criminal offence in Canada, regardless of intent.

Technology is not neutral, because the choices made when building it decide who benefits and who does not. A system that requires a fast internet connection works well for some people and excludes others. A face-recognition system trained mostly on one group of faces works less well on everyone else. These are engineering decisions with social consequences, and being able to identify them is part of being a competent technologist rather than just a capable one.

The digital divide

The digital divide is the gap between people with reliable access to technology and those without. It is not only about owning a device. Connection quality matters — much of rural and northern Canada still lacks reliable broadband — as do affordability, digital literacy, and accessibility for people with disabilities. When school, banking, government services and job applications all move online, the divide stops being an inconvenience and starts determining opportunity.

AWhat technology has made better
  • Access to information and education regardless of location
  • Remote work and telemedicine for people far from services
  • Assistive technology: screen readers, speech recognition, captioning
  • Cheap global communication with family anywhere
BWhat it has made worse
  • Pervasive surveillance by companies and governments
  • Jobs eliminated faster than replacements appear for those workers
  • Misinformation spreading faster than corrections
  • Access to opportunity depending on connectivity and income

Privacy and data

Almost every free service is paid for with data. Location history, search queries, contacts, purchase records and time-on-page are collected, combined and used to target advertising or sold to data brokers. The reasonable position is not that this is always wrong, but that it should be visible and consented to. The questions worth asking about any system are: what is collected, who can see it, how long is it kept, and can it be deleted?

Canadian privacy law
PIPEDA governs how private-sector organizations in Canada collect, use and disclose personal information. Its core principles are meaningful consent, collecting only what is needed for a stated purpose, keeping data secure, and giving individuals access to what is held about them. Provincial laws and the federal Privacy Act cover public bodies.

Intellectual property

TypeProtectsNote
CopyrightThe expression of an idea — code, text, images, musicAutomatic on creation; no registration needed
PatentA novel invention or processMust be applied for; grants a time-limited monopoly
TrademarkA name, logo or brand identifierProtects consumers from confusion about origin
Trade secretConfidential business informationProtected only as long as it stays secret
LicenceThe terms under which others may use your workMIT and GPL are open-source licences with different obligations
Open source is not "no rules"
Open-source software is copyrighted and licensed, not public domain. A permissive licence such as MIT lets you do almost anything provided you keep the copyright notice. A copyleft licence such as the GPL requires that anything you distribute built on it is also released under the GPL. Ignoring either is a licence violation, not a technicality.

Security as an ethical obligation

Every defence answers a specific threat.THREATWHAT IT ISDEFENCEMalware / viruscode that runs without consentpatched OS, antivirus, least privilegePhishinga fake message harvesting credentialscheck the sender domain; never click, type the URLRansomwareencrypts your files, demands paymentoffline backups you have actually restored fromMan-in-the-middletraffic read on an open Wi-FiHTTPS everywhere, VPN on public networksWeak / reused passwordone leak unlocks every accountlong passphrases, a manager, 2FAThe CIA triad names what you are protecting: Confidentiality, Integrity, Availability. Ransomware attacks all three at once.
Fig 1Each defence answers a specific threat.

If you build a system that holds other people's data, securing it is not an optional extra. The standard framing is the CIA triad: Confidentiality (only authorized people can read it), Integrity (it cannot be altered undetectably), and Availability (authorized people can actually get to it when needed). Ransomware is instructive because it attacks all three at once — the data is copied out, encrypted in place, and made unavailable.

  • Long passphrases beat complex passwords. Length matters far more than symbol substitution, and a password manager removes the need to reuse anything.
  • Two-factor authentication stops a stolen password from being enough on its own.
  • Patch promptly. The overwhelming majority of successful attacks exploit a vulnerability that already had a fix available.
  • Least privilege. Give every account only the access it genuinely needs, so a compromised account limits the damage.
  • Encrypt sensitive data both at rest and in transit, so an intercepted copy is useless.
  • Tested backups are the only reliable defence against ransomware.
Authorized testing only
Accessing a computer system without authorization is an offence under section 342.1 of the Criminal Code of Canada, regardless of intent, and so is mischief in relation to data. "I was only curious" and "I was testing their security" are not defences. Security testing requires explicit written permission from the system's owner, every time.

Automation and work

Automation genuinely does eliminate jobs, and it also creates them — but rarely the same jobs, in the same places, for the same people. A worker whose role is automated does not automatically become a machine-learning engineer. This is why the honest framing is not "will there be jobs" but "who bears the cost of the transition, and over what timescale". Retraining, income support and the pace of change are political choices, not technical inevitabilities — and engineers who build the systems have a stake in how those choices are made.

The professional's question
Before building something, ask: who benefits, who bears the risk, what happens when it fails, who is excluded by design, and could this be used for something the user did not agree to? You will not always be able to change the answer, but not asking is how systems get built that nobody intended.

Worked examples

Reveal one step at a time and try to beat it to the next line.

Example 1
A free mobile game requests access to contacts, location and the microphone. Evaluate this using privacy principles and state what a user should do.
Example 2
A student finds a school system where changing the number in a URL displays another student's grades. Explain the correct course of action and why the obvious alternatives are wrong.

Where marks get lost

  • Thinking the digital divide is only about owning a device — connection quality, cost, literacy and accessibility all count.
  • Assuming open-source code can be used with no obligations. It is licensed, and some licences have real requirements.
  • Believing "I have nothing to hide" settles the privacy question. Privacy is about control over your information, not about concealment.
  • Treating security as purely technical. Most breaches begin with a person being deceived, not a cipher being broken.
  • Assuming good intentions make unauthorized access legal. Under the Criminal Code they do not.
  • Arguing that automation either destroys all jobs or costs none. The real issue is who bears the transition and how fast it happens.

Flashcards 9

What is the digital divide?
What does PIPEDA govern?
Copyright vs. patent
MIT vs. GPL licence
+ 5 more

Practice

1
Which Canadian law governs how private companies handle personal information?
2
A student finds they can view other students' grades by changing a number in a URL. What should they do?
3
What do the three letters of the CIA triad stand for?
4
Code released under the GPL is used inside a product that the company then sells and distributes. What obligation follows?
5
Which measure most reduces the risk of a successful attack on a typical organization?
6
A rural community has devices and digital skills but only intermittent low-speed internet. Are they affected by the digital divide?
7
Match each form of intellectual property to what it protects.
Copyright
Patent
Trademark
Trade secret
8
Which statement about automation and employment is the most defensible?

Spot a mistake on this page? Let us know