7

I’ve already made the case that ensuring online safety is not the same as teaching digital citizenship, even though they frequently get confused. And while the concepts aren’t interchangeable, the principles of online safety and privacy remain critical competencies of alert digital citizens. I prefer using the term “alert” when talking about online safety because it reminds us that staying safe online requires action and awareness; we keep our kids safe by teaching them to remain alert. Digital citizens not only keep themselves safe online but are also mindful of creating a safe space for others online as well.

I find the analogy of a nuclear power plant to be particularly useful in helping us become alert digital citizens. Nuclear energy is the largest source of clean power in the United States. Nuclear power plants keep 520 million metric tons of carbon from going into the atmosphere each year. That’s the equivalent of removing 111 million cars from the road.1 Yet they also have significant, associated risks, including being a target for terrorist attacks, suffering damage from natural disasters, or dealing with employee mistakes that can cause costly damage or radiation leaks. In spite of these risks, nuclear plants in the United States have an impressive track record for safety, thanks to a range of protective measures in place to keep the plants safe. These safety strategies fall into three buckets. First are technical protections, including motion and temperature sensors, cameras, and alarms on every door that all send alerts when something is out of order. Second are the physical protections—anti-scaling fences around the perimeter, locks on the doors, armed security officers, and so on. Finally, there is training. Everyone who sets foot in a nuclear power plant, from the janitor to the CEO, must have the proper training on appropriate procedures for their job, how to avoid danger in the plant, and how to quickly spot and respond to anything that seems suspicious.

As the father of four children, trying to keep my own kids safe online feels a bit like trying to protect the nuclear power plant. It is much better to protect against potential dangers than try to repair them after the fact. Let’s look at the three categories of nuclear power plant protections and explore how we can adapt each to strategies for keeping our family safe online.

Technical Protections

When it comes to online safety, the most fundamental technical protection is a web-filtering service. A web filter is software that identifies dangerous and inappropriate websites and blocks them from being accessed by computers and mobile devices on the network. A web filter can be added to any home Wi-Fi network so devices that connect to the internet are automatically protected as long as they are using your network. Services like Clean Browsing or OpenDNS are free network-filtering services that screen out the vast majority of violent and sexually explicit content. These services are easy to enable and provide step-by-step instructions on their sites. They require you to log in to your Wi-Fi network settings to enable. If you don’t know how to do that, just give your internet provider a call and tell them you want to set up a web filter, a request they should be very familiar with.

A limitation to a web filter on your home Wi-Fi network is that it doesn’t offer any protection when a device is connecting to the internet via another network (e.g., at friend’s house or with a cell phone data plan). That’s where a device filter comes in. These services allow you to set up an individual filter on each device, no matter what network it is using to connect to the internet. In addition to providing internet filtering, these services also allow you to set a variety of customized controls specific to each device. For example, you can set up blackout times when the device will no longer function (e.g., after bedtime) or receive alerts for activity that could be cyberbullying. There are many device filters available, including Circle (meetcircle.com) or Bark (bark.us). Device filters require paid subscriptions but are generally worth the cost. All of the major US wireless providers offer device-filtering services that can be added on to your existing plan for a few extra dollars a month.

Android and iOS devices have some built-in parental controls that are worth exploring as well. The most useful is the option for parental approval of apps before they are added to the phone. When enabled, a child will see “request” instead of “download” when they are in the device’s app store. This sends the app request to designated approvers on the account to trigger a conversation before accepting or declining. Parental controls can be enabled in settings on Apple and Android devices.

Web filtering is the starting point for creating a safe environment for your family. But there are other technical protections you should also consider before letting your kids wander freely in the virtual world.

Access Is a Process, Not an Event

Another technical protection that can be easily implemented—yet is vastly underused—is the practice of limiting device functionality. Many parents think that device access is an all-or-nothing proposition. As a result, some kids’ first experience with a smartphone comes with full access to all the digital features on their device—far too much responsibility for kids to gain in one shot. Being granted access to a device should be a gradual entrance to the digital world that happens over time. When it comes time to drive a car, we don’t simply hand our kids the keys one day and send them on their way. Typically, they start learning navigation skills by first exploring the town on their bike. Then they practice driving a car in a parking lot. After taking Driver’s Ed, we let them practice on the road, but only with an adult in the car and never after dark. Even once they get their license, it might be a year before we are comfortable allowing them to drive in a city or with friends in the car.

We should think about device access as similar to learning how to drive. In our family, when our kids first get access to devices (usually a hand-me-down phone or tablet of ours), we remove most of the apps on the device. We make it into the device-equivalent of learning to navigate with their bike before practicing driving a car. Our eight-year-old’s “phone” has no data plan, no web browser, no YouTube app, and no social media access. There are a couple of fun games, a calculator, a clock, and the ability to take pictures and message other members of the family when on our home network. And because we have app approval enabled, no other apps can be added without a conversation. It’s a bike, not a Tesla. Even though it may look like the same phone my teenage daughter has, the functionality is significantly limited. Over the course of several years, as our kids develop trust and experience, we gradually add functionality back to the device—turning on a web browser, adding YouTube, signing up for a data plan. The point here is that access to a phone is not a single event but a gradual experience that takes place over many years earned with growing maturity and trust.

Autoplay Is Not Your Friend

One technical protection important enough to deserve additional attention is autoplay. In the physical world, you would never allow a stranger to stop by your house, pick up your child, take them somewhere—anywhere—without knowing who they are or where they are going. Yet we do the virtual equivalent of that when we put our kids in front of an app with autoplay enabled. Yes, I know that I should probably be making organic playdough instead of having them watch Pocoyo in the first place, but there are many times when my sanity and my kid’s safety are both better served if we all take a little movie break. But no matter how much of a break we need, we should never cede control of what our kids are watching to an algorithm that is optimized around the financial gain of the platform.

YouTube is particularly problematic in this regard. Since video creators only make money when their videos are played, many videos are designed to appeal more to YouTube’s autoplay algorithms than to any human who might be watching. The process may use videos that are not even created by humans but by video-generating bots that know how to use the right keywords—videos that your kid would never purposefully choose to watch. This content may be inappropriate and shocking to children. In James Bridle’s TED Talk, he shows how in just ten steps of autoplay, a child can go from a happy cartoon singing the ABCs to a horrible cartoon of sexualized Disney characters. Fortunately, the solution is simple: disable autoplay on any video service. YouTube, Disney+, and Netflix all now offer the ability to disable autoplay (even though Netflix was late to the party). So, take a video break, but don’t hand over the controls for what your kids watch next to a bot. We should be intentional when it comes to the places our children visit online.

The False Security of Technical Protections

Technical protections, like the ones I’ve mentioned, are the easiest tools for keeping kids safe online. But we should be careful not to become overly confident in technical protections. Many parents and school leaders employ technical protections as their only strategy for keeping their kids safe. Every day, nearly 550,000 new websites are created. That’s about 380 new websites per minute.2 Every minute, 300 hours of new videos are uploaded to YouTube. At this staggering scale, even the best web filters can’t possibly keep up with that amount of new digital material. Plus deciding what should be allowed through the filter can be trickier than it might seem. If we attempt to filter all pornographic sites by blocking the word “sex,” we also block access to sites teaching about healthy sexual behavior and our kids’ biology homework as well. If we block all sites with mature language, we inadvertently wipe out access to much literature and even parts of the Bible. When technical protections are so strict that they block reasonable use of the internet, kids are practically encouraged to find ways around the filters. As much as we might not want to admit it, there are always ways to get around even the best technical protections.

But the real danger in relying only on technical protections is that they don’t require any effort on the part of the humans using the networks. We will have done nothing to prepare our kids for how to handle the inevitable moment when they do encounter something inappropriate online. We should never think that adding technical protections absolves us of the responsibility of teaching budding digital citizens the skills they need to be alert online. For those skills, we need to return to the other two parts of the nuclear power plant analogy.

Physical Protections

The second set of strategies for protecting a nuclear power plant are physical protections. These require no tech skills to implement or software to configure. When keeping our kids safe online, the best physical protection is establishing locations where digital device use is appropriate and where it is not. Schools and recreation centers often establish locker rooms as device-free zones for obvious reasons. But there are other physical locations we should add to the list. In our family, we have a simple expectation that when you have a digital device in your room, the door must stay open. We establish this habit from the moment our kids first start using their devices. It is an easy way to teach the concept that moments that require the privacy to shut the door (e.g., changing clothes, etc.) are also moments when devices should feel out of place. By making that connection at an early age, when kids become teenagers, they have a natural instinct to leave the door open if the device is on. This simple habit removes the conditions required for a variety of problematic activities to occur.

Another example of physical protection comes in the placement of computers. A family desktop placed in the back corner of a basement room is as much a recipe for disaster as building a nuclear power plant and not bothering to put a fence around the perimeter. A better place for a family computer might be in a desk area in the kitchen or other well-trafficked location, positioned so the screen faces into the room. If a computer must be in a child’s room for school or because no common area is available, set it up so the screen is facing the door. It’s much harder to have cyberbullying go unnoticed when others can see what is on the screen. A final example of a physical protection is to turn in mobile devices, including laptops, at the end of the day. As I mentioned previously, in our family, all mobile devices sleep on a table in the corner of our bedroom. Keeping devices in another room overnight allows for uninterrupted sleep and also removes conditions for risky activities.

Training Protections

Just like the training workers receive before entering the power plant, training protects members of our family from potential dangers in the virtual world. The most important takeaway from this section is to do our best to establish an open dialogue about the experiences our kids are having online. We should have ongoing conversations about where our kids go and what they do in the physical world. Just as we might ask, “What did you do at James’s house?” when our kids come back from visiting a friend, we might ask, “What’s happening on SnapChat today?” or “What interesting ideas have you added to your Pinterest board recently?” when our kids come back from visiting virtual spaces. Ongoing dialogue provides a channel for addressing a variety of issues that may arise.

Media literacy professor Renee Hobbs suggests that when parents participate with their children in online spaces, it is easier to have a dialogue about what’s happening there. The purpose in going with kids online is not to control their behavior but to develop the context in which to mentor them in navigating those spaces safely and effectively. It becomes a chance to help young people evaluate their virtual presence and determine if it is really what they want it to be.

Joint participation with kids in virtual spaces is also a great learning opportunity for parents who are less familiar with the virtual world. We might ask our kids to teach us how to build something in Minecraft or ask older kids to share the five funniest posts they’ve seen on TikTok. We could have a friendly competition to see who can take the most creative picture in a week or find the most interesting YouTube video. Or we might get advice from our kids about how to use technology to address a problem we’re trying to solve at home or work. And just because we may not consider ourselves tech-savvy doesn’t mean we still don’t have value to add. We should be careful not to conflate our children’s tech skill with tech literacy. Just because a young person knows the logistics of using technology doesn’t mean they know how to conduct themselves appropriately in virtual spaces.

In addition to establishing ongoing conversations with our kids about their activities in the virtual world, there are three ideas that I recommend teaching young people to help them stay alert.

1. Not Everyone Is Trustworthy

A basic training concept that every digital citizen must learn is that not everyone in the virtual world is trustworthy. We already teach this in the physical world—don’t talk to strangers, don’t get into the car of someone you don’t know, and so on. But in the online world, we must also remember to teach about an additional twist. Not being trustworthy can also mean not being truthful about who someone appears to be. A young person can find it difficult to believe that a fifteen-year-old girl from New York posting to Instagram may actually be a forty-five-year-old guy from India. In the physical world, we use a person’s identity as a reliable indication of the level of trust we should have in them. When we use this approach to establish trust online, where it is easy to fabricate an identity, we can easily get into trouble. This also includes the possibility of interacting with someone who we know (a friend from school who we have been texting for years) but has had their profile compromised. We should prepare our kids to be alert for the signs that a friend’s account may have been hacked, such as:

• Asking questions that don’t seem in line with what they would normally ask about (e.g., “remind me of your address” or “remind me how we met”)
• Having an “emergency” and needing money or information sent immediately
• Being unwilling to discuss the issue on another platform (by phone, text, etc.)
• Asking for inappropriate pictures or personal data

In any situation, when our kids have a concern about the trustworthiness or identity of an online individual, we encourage them to come talk to us.

2. Some Virtual Spaces Are Riskier Than Others

The second concept is that just like in the physical world, some places in the virtual world are safer than others. We should arm our kids with some indications to look for to determine whether a virtual space is safe. For websites, this includes looking for the lock icon on the top right of the URL in your browser, which indicates that the site has been verified by a third party. Or, for an app, you might check out a review from Common Sense Media. Some signs indicate that a site or app may be unsafe, including obvious spelling or grammatical errors, a request that you download software or save a file, or the forced opening of multiple browser windows. We should be particularly alert to anything about the URL that seems unusual (e.g., yah00.com or amazon.net).

Some segments of the internet are riskier than others. If you think about the web as an ocean, most of the web that you’ve likely experienced is in the first hundred feet. It’s where familiar websites with URLs ending in .com, .org, and .gov live. This surface web is the part of the internet that Google searches. But below that level, there is another part of the internet known as the deep or dark web. Typically, sites there end in .onion, and you generally have to use a special web browser (like Tor) to get around. That part of the web allows you to buy services like renting a hacker to mess up someone’s online identity or buying knockoff prescription medication. It is also where personal information skimmed from the surface web is sold and traded. Your kids are unlikely to stumble into the dark web by accident but we need to be aware that back alleys exist online; we should teach them that they should avoid any sites that promote sketchy activities. The chief learning officer of the International Society for Technology in Education, Joseph South, recommends teaching our kids to simply ask, “How does the site or app make you feel?” If you’re feeling that something isn’t right, don’t wait around for extra confirmation; just leave.

3. Recognize the Value of Personal Information

Personally identifiable information (or PII, as it’s known) is any data that makes it possible to identify someone individually. PII includes the obvious things like name, address, and phone number. But it can also include information like medical history, online purchases, or school class schedules. Alert digital citizens know to be careful not to share PII with someone who is not trustworthy. We might choose to share some PII when signing up for a new online account. But if we’re not careful, we can share it in unintended ways as well, like posting a photo that happens to have a house number in the background or by using an unsecure Wi-Fi network. There are many ways to trick us into sharing PII, such as taking a seemingly innocuous online personality quiz that includes a question like “What is your mother’s maiden name?” or “What street did you grow up on?” (items that are commonly used as security questions on our online accounts).

PII is extremely valuable to companies in the virtual world, often more so than cash. If a company uses advertising to get us to buy a single product, it will earn a small amount of money. But if a company can get our PII, it can create a customized sales channel optimized to get many sales over the course of many years. In other words, our personal information is a currency that can be exchanged for cash at a very favorable exchange rate. And that’s assuming the intent of the person obtaining our PII is on the up-and-up. On the dark web, PII can be traded and sold for financial gain or for the intent of damaging someone’s reputation.

We need to make sure our children understand that when they enter their personal information to get a “free” app or service, they are still paying for it, but with PII instead of cash. It might be worth the price, but it’s never free. As NYU business professor Scott Galloway points out, “The cost of using Amazon Alexa is the use of your data to make their online store more profitable. Amazon’s customers trust it so much that they’re allowing the company to listen in on their conversations and harvest their consumption data.”3 Alert digital citizens understand the value of their personal data. They know how to evaluate whether the return on investment of the services they are receiving is worth paying with this valuable currency of personal data.

Spotting a Safety Violation

Just as we should be aware of the different types of digital harassment, we should also be aware of the signs indicating dangerous behaviors might be occurring. The following are some common indicators compiled from the Anti-Defamation League and Cyberbullying.org that we should watch for.4 We should pay particular attention anytime a young person:

• Becomes upset, sad, or angry during or after being online or using their phone
• Withdraws from family or friends
• Doesn’t want to participate in activities they previously enjoyed
• Doesn’t want to go to school or a specific class
• Changes screens whenever you walk by or only wants to use the computer in a private place
• Seems nervous or jumpy when they get an instant message, text, or email
• Has changes in eating or sleeping habits

If you suspect that your child is involved in any sort of unhealthy online activity, you might be tempted to freak out, destroy their devices, and lock them in a safe room for the rest of their lives. Unfortunately, that is never the best approach. Resolving inappropriate digital interactions requires maintaining a trusting relationship and open dialogue with your kids. Remain as calm as possible when talking about whether or not dangerous behaviors may be happening. If you address them quickly, you can resolve the vast majority of issues before there are serious consequences. However, if a child is afraid of your reaction and chooses to hide a dangerous behavior, the consequences could become more serious during the months or years that the behavior remains unaddressed. If there is a situation where digital abuse is occurring, don’t respond or retaliate against the offender. That may seem counterintuitive, but often getting that reaction is the very goal of the offender.

There are helpful actions to take if a dangerous digital behavior is happening. If someone is bothering your child in a virtual space, use tools to block them so additional messages don’t come through. If the harassment is happening on a social media platform, you should flag the inappropriate behavior. For information on how to do that for each major media platform, go to cyberbullying.org/report. Save copies of inappropriate messages or posts as evidence, should the situation ever escalate. Talk to your child about anything they may have done that could make them a target, such as posting personal information in a public space, sending compromising pictures, or participating in harassing behaviors themselves. This is not to point the finger at your child but to get a full picture of the situation. If the dangerous behaviors involve other students, alert a school counselor or administrator. Finally, if there are physical threats or illegal behaviors, contact the police.

Training our kids that not everyone in virtual spaces is trustworthy, not every place is safe, and our personal data should be safeguarded are key elements of protecting them from online risks. Combined with technical and physical protections, alert digital citizens can take advantage of the opportunities of the virtual world while keeping themselves and others safe. When something does go wrong, having an open dialogue allows a quick and supportive response. As in the nuclear power plant, errors happen, but with multiple layers of appropriate protections in place, a quick intervention can resolve almost any situation before a serious problem occurs.

Next Steps

Action Items

• Select an internet or device filter depending on what makes most sense for your children. (For younger children who only use the internet at home, an internet filter may be all that is needed. For older children who take their devices outside the home, device filters may make more sense.)
• Start small. Don’t give your child full access to every app or functionality when they first get their own device.
• Set up physical device protections, such as establishing an open-door device rule, placing shared computers in high-traffic spaces, and designating a night-time device-charging station.
• Disable autoplay on any video streaming service, such as YouTube or Netflix.
• Spend some time with your kids becoming more familiar with their favorite virtual activities.
• Keep an eye out for any warning signs that your child may be in danger.

Conversation Starters

• What should you do if you ever feel uncomfortable with something someone was asking you to do online?
• Have you ever seen someone pick on someone else online?
• What might you do when you see someone being mean to someone else online?
• What are some warning signs that a website or app might be unsafe?
• Who are your favorite people to follow on YouTube, TikTok, and so on, and what do you like about them?
• Would you feel comfortable coming to tell me if you felt worried about something you saw online?
• What are some things we should do as a family to protect us during our time online?