Spring 2020

Course Description.

For individuals and organizations involved in political advocacy, cybersecurity threats are an increasingly common reality of operating in the digital world. Civil society has always been under attack from ideological, political, and governmental opponents who seek to silence dissenting opinions, but the widespread adoption of connected technologies by the individuals and organizations that make up civil society creates a new class of vulnerabilities.
Citizen Clinic at the Center for Long-Term Cybersecurity provides students with real-world experience assisting politically vulnerable organizations and persons around the world to develop and implement sound cybersecurity practices. Clinic students will participate in both a classroom and clinic component. In the classroom, students will study the basic theories and practices of digital security, the intricacies of protecting largely under-resourced organizations, and the tools needed to manage risk in complex political, sociological, legal, and ethical contexts. In the clinic component, students will work in teams supervised by the Clinic staff to provide direct cybersecurity assistance to civil society organizations. Students’ clinic responsibilities will include learning about an organization’s mission and context, assessing its vulnerabilities, and ultimately recommending and implementing mitigations to the identified security risks. The emphasis will be on pragmatic, workable solutions that take into account the unique operational needs of each partner organization.Weekly lectures will provide students with the background information and tools they will need to engage with partners. Coursework will focus on partner-facing, hands-on projects. Students will be expected to work an average of 12 hours per week, although the distribution of this workload may fluctuate based upon the availability and needs of the partner.
In the first half of the semester, class meetings will be a mix of lectures & discussions with more technical & project-oriented labs. In the second half of the semester, these class times will be reserved for work with the teaching team and check-ins tailored to the specific needs of your partner organization.
Note: This schedule is tentative and may be adjusted - assignment dates may change, additional readings may be assigned, speakers/lectures may be shuffled, etc. The teaching team will announce when changes are made.

Week 0: Introduction / What is Public-Interest Cybersecurity?

Wednesday 1/22:
Introduction to Public Interest Cybersecurity: We will introduce the content and methods of the course, answer your questions, and everyone will introduce themselves to one another.
  • Due Friday 1/24 6:00PM: Submit application materials to enroll in this course. You will be notified of your enrollment status prior to the next class meeting on January 27th.
  • Due Monday 1/27 before class: Read pages 7 - 21 & 48 - 52 of “An Introduction to Cybersecurity Ethics” (Shannon Vallor, The Markkula Center for Applied Ethics) [https://www.scu.edu/media/ethics-center/technology-ethics/IntroToCybersecurityEthics.pdf] Prepare answers to questions on pages 15 - 17 and page 53 for in-class discussion.
Read (by next week):

Week 1: Code of Conduct and Ethics in Cybersecurity

Monday 1/27:
Ethics and “Rules of the Road”
  • Citizen Clinic Code of Conduct.
  • Ethical Considerations.
  • Security Response Plan.
Wednesday 1/29:
Old School INFOSEC: Basic (& Some Outdated) Controls
Clinic Communications Setup - Steve
Partner Overview - Sean
  • Due 1/27 before class: Prepare answers to questions on pages 15 - 17 and page 53 of “Intro to Cybersecurity Ethics” for in-class discussion. [Individual]
  • Due 1/27 In-Class: Code of Conduct Signed [Individual]
  • Due 1/31 6:00PM: Equipment Setup Completed & Partner Preference Submitted [Individual]
Read (by next week):

Week 2: Assessing Civil Society Organizations

Monday 2/3:
Threat Modeling & Bounding Risk Assessments
Wednesday 2/5:
Contextual & Capacity Research
  • Due 2/5 6:00PM: Internal Collaborative Plan [Team]
  • Due 2/7 6:00PM: Mentor Communications Established [Team]
Read (by next week):

Week 3: Understanding Threats to Civil Society Organizations

Monday 2/10:
Digital Surveillance of PVOs: The Threat Landscape - Bill Marczak, Citizen Lab, Citizen Clinic Resident
Wednesday 2/12:
Contextual Research Recap & Information Gathering
Problem Diagnosis and Reframing
  • Due 2/14 6:00PM: Partner Communications Established [Team]
Read (by next week):

Week 4: OSINT Collection

Monday 2/17: No Class
Wednesday 2/19:
Open Source Research Methods, Safety, and Tools
  • Virtual Networks: VPNs vs TOR
  • Virtual Machines
  • Virtual Identities
  • Manual Searches & Google Hacking
  • Automated Tools
Read (by next week):

Week 5: Changing Security Behaviors

Monday 2/24:
Adversary Persona Development (Adversary Cards)
Threat Scenario Development (Resource Game)
Wednesday 2/26:
Changing Behaviors within PVOs - Steve Weber, Professor, School of Information & Department of Political Science
Read (by next week):

Week 6: Security Control Selection

Monday 3/2:
Social Engineering (Phishing Sim Demonstration)
Wednesday 3/4:
Designing Security Training - Alexis Hancock (Staff Technologist, Electronic Frontier Foundation) & Soraya Okuda (Designer, Security Education Companion, EFF)
  • Due 3/6 6:00PM Draft Work Plan and Partner Report to Teaching Team [Team]
  • Due 3/6 6:00PM Team Evaluation 1 [Individual]
Read (by next week):
Additional Readings To Be Added
Monday, 3/9:
Legal and Policy Factors For Non-Profits’ Cybersecurity - Kristin Berdan, Clinic Fellow, former Google Security Legal Counsel
Wednesday, 3/11:
Midterm Project Presentations with Special Guest(s)
  • 3/13 6:00 PM: Work Plan and Partner Report to Partner [Team]
Read (by next week):

Week 8: Resiliency -- Self and Community Care

Monday, 3/16:
Psychosocial Resilience, Andrea Lampros & Gisela Perez de Acha, Human Rights Center
Wednesday, 3/18:
SAVE THE DATE: Community Service Assignment

Week 9: Spring Break

Monday, 3/23: No Class
Wednesday, 3/25: No Class
Read (by next week):

Week 10: Beyond Hacking -- Disinformation and Harassment

Monday, 3/30:
Organizational Risks of Harmful Information
Wednesday, 4/1:
Mitigations for the Risks of Harmful Information

Week 11: Clinic Work

“Clinic Core Hours” refers to the required student work during official class meeting hours between 12:00PM and 2:00PM. Mondays will usually be reserved for instruction specific to partner needs, feedback and guidance from the teaching team, and ad-hoc lectures. Every Monday, each team will have a 15 to 20-minute check-in with the teaching team. Each team member will provide a ~5 minute update on the progress of their assigned partner-related work. Students will usually be able to schedule team or partner meetings on Wednesdays pending adjustments by the teaching team.
Monday, 4/6: Clinic Core Hours / Team Check-In
Wednesday, 4/8: Clinic Core Hours

Week 12: Clinic Work

Monday, 4/13: Clinic Core Hours / Team Check-in
Wednesday, 4/15: Clinic Core Hours

Week 13: Clinic Work

Monday, 4/20: Clinic Core Hours / Team Check-in
Wednesday, 4/22: Clinic Core Hours

Week 14: Clinic Work

Monday, 4/27: Clinic Core Hours / Team Check-in
Wednesday, 4/29: Clinic Core Hours
  • 5/1 6:00PM: Final Partner Report for Teaching Team Review [Team]

Week 15 (RRR Week): Wrap-up & Project Presentations

Monday, 5/4 - Course Wrap-up:
Feedback on deliverables, submit all final deliverables.
Wednesday, 5/6 - Project Presentations:
An overview of partner work, findings, recommendations delivered to CLTC and stakeholders.
  • 5/5 6:00PM: Final Presentation Slides Submitted [Team]
  • 5/8 6:00PM: Final Partner Report Submitted to Partner [Team]
  • 5/8 6:00PM: Case Study Write-up [Team]
  • 5/8 6:00PM: Team Evaluation 2 [Individual]

Course policies

This is a 4-unit class. Coursework will primarily focus on partner-facing projects while weekly lectures will be used to inform and engage with students’ hands-on experiences. Students are expected to work an average of 12 hours per week on this course, however the distribution of this workload may fluctuate based on the availability and needs of the partner.
Assignments will largely be evaluated on the following rubric that emphasizes (1) sound rationale in assessments, recommendations, and reflections, (2) “partner-ready” work products which reflect professional quality, and (3) completing the instructions of the assignment or the requirements agreed upon work plan with the partner.
General Grading Rubric.
0 points
5 points
10 points
Does not meet partner needs, introduces serious harms to partner, shows limited or inappropriate consideration for context
Addresses most of partner needs, some oversight of potential harms to partner, mostly appropriate for given context.
All partner needs are met, feasible & effective rationale that addresses all major threats, appropriate for given context.
Hard to understand, full of jargon, serious writing/format errors present, tone / design unsuitable for its audience
Writing is mostly understandable; minor writing/format errors (typos), mostly appropriate tone / design
“Partner-ready,” clear and concise writing, almost no writing/formatting errors, appropriate tone & design for its audience
Some requirements in assignment or work plan not met; no insights or connections to readings/lectures; for group work: no evidence of group work
Most requirements met, some evidence for connections with readings/lectures; for group work: some evidence of group work
All requirements met, with clear, thoughtful insights and multiple cited connections to relevant readings/lectures; for group work: full evidence of strong, equitable collaboration
Note: Students taking the course for P/NP or S/U are expected to participate in classes and complete all work to the same level of quality as students taking the course for a letter grade.
1. Partner Deliverables - 60%
The largest portion of graded evaluation will be based upon your team’s work and support for its assigned partner. These deliverables may include assessments, recommendations, and guides, each tailored towards the partner’s needs. Each team will also deliver a final report summarizing work performed with their partner.
2. Individual Assignments - 10%
Two individual assignments will be given:
  • Current Event Topic Leader (5%): Each student will sign up to lead one 15 minute discussion at the beginning of most lectures. Students will be expected to locate and share about a recent, current event relevant to the day’s lecture topic. Topic leaders will emphasize interesting or relevant points while other students are expected to ask questions and comment.
  • Community Service (5%): Students will be expected to participate in a project or event that contributes to assist the security practice of various cross-campus or community partners conducting politically-sensitive work. The teaching team will direct this contribution.
3. Team Case Study - 10%
We want students to be able to discuss and share their experience in the course with others, including future employers. We also want our partners to remain confidential and protected. This being said, each student team will submit a write-up of work performed and takeaways with sensitive information removed. The teaching team will review to ensure your experience is captured in an effective & safe manner.
4. Participation - 10%
We consider “participation” in three major components: participating in regular class discussions, participating in weekly mentor meetings, and participating in team & partner meetings outside of class hours.
  1. 1.
    You are expected to attend each official class meeting and contribute substantially to class discussions. The teaching team should be notified in advance of absences from class meetings (including Clinic Core Hours). You do not need to share the reason for the absence. Not showing up to team check-ins will also negatively impact this grade.
  2. 2.
    You are expected to meet with your mentor team at least once a week. This meeting may take place via teleconference. We will get feedback from mentors if they have not met with you without reasonable cause.
  3. 3.
    As a rule, two people from your team must attend any partner meeting or call. While you may not be able to attend every team meeting and partner engagement outside of normal class hours, you are expected to attend and contribute to your team’s effort as often as possible.
5. Team Evaluations - 10%
Throughout the course, you will submit confidential evaluation forms which ask you to evaluate the contributions of each team member including yourself. Your final course grade will be adjusted, higher or lower, if you are contributing more or less than those within your group. If there are difficulties with any team member, discuss the matter within your team and seek resolution. If you cannot resolve the problem, immediately contact any faculty member, so that we can make an appointment to discuss the situation individually or with the entire group as needed.
Late assignments.
** **As we want to respect the time of our partners and ensure a high level of quality control (the teaching team will review deliverables before it reaches the partner), we expect students to adhere to timelines and due dates. Each day an assignment is late will result in a letter grade deduction. Recognizing that emergencies arise and partners may require schedule adjustments, exceptions will be made on a case-by-case basis.
Code of Conduct.
Each student enrolled in the course must agree in writing to the Citizen Clinic’s Code of Conduct (to be distributed) for maintaining a safe and secure learning experience and partner relationship. This Code of Conduct will be respected by all students, the teaching team, and CLTC staff and it is the responsibility of all personnel to report possible violations of the Code of Conduct to the teaching team.
Additionally, we expect all students to abide by the Berkeley Student Code of Conduct (see https://sa.berkeley.edu/student-code-of-conduct) and act with honesty, integrity, and respect for others. (See also https://diversity.berkeley.edu/principles-community). The consequences for failing to act within these standards may include failing an assignment, a referral to the Center for Student Conduct and Community Standards, a failed grade in the course, and even immediate expulsion. A note on plagiarism: even in the scope of providing a partner with a walkthrough for securing a certain account or system, you are expected not to copy material from another guide, website, article or book (word-for-word or paraphrased) without citing the source - it’s a small community and we should give credit where it is due. Other examples of unacceptable conduct include turning in deliverables created by students not currently in the course, work found on the Internet, or created by a commercial service.
Disability Accommodation.
If you need disability-related accommodations in this class, if you have emergency medical information you wish to share with us, or if you need special arrangements in case the building must be evacuated, please inform us as soon as possible.
Copy link