Characterizing Security and Privacy Teaching Standards for Schools in the United States

Technical Summary: Characterizing Security and Privacy Teaching Standards for Schools in the United States

Problem Statement
Security and privacy (S&P) education is increasingly integrated into K-12 computer science (CS) curricula in the United States, yet there is a lack of empirical understanding regarding what is actually being taught. While individual states and national organizations publish teaching standards to outline student learning expectations, no prior research has systematically examined the scope of these standards. It remains unclear whether the topics covered align with the broader security community's expectations, how content is organized, and whether there is a distinction between education for general end-users versus future technology professionals. This gap hinders the ability to evaluate the effectiveness of current S&P education and to identify necessary improvements.

Methodology
The authors conducted a comprehensive manual analysis of 12,201 CS teaching standards collected from all 50 U.S. states (specifically 47 states with available standards as of June 2024) and eight national organizations, including the Computer Science Teachers Association (CSTA), the International Society for Technology in Education (ISTE), the Cybersecurity and Infrastructure Security Agency (CISA), and various Advanced Placement (AP), International Baccalaureate (IB), and certification exam bodies.

The research followed a two-step coding process:

1. Topic Identification: Using open coding on a subset of standards from four states, the team developed a codebook of S&P-relevant topics. This included technical subjects (e.g., encryption, network security), social subjects (e.g., ethics, laws), and behavioral topics (e.g., online safety).
2. Labeling and Classification: Two researchers labeled the remaining 12,201 standards. Standards were classified as S&P-related or not. S&P standards were further categorized into 109 distinct topics. The team also analyzed the organization of standards (e.g., presence of examples, categorization labels) and classified topics based on their target audience: "general internet/tech users" versus "future technology professionals."

Inter-rater reliability (IRR) was calculated using Kupper-Hafner agreement, with initial agreement at 0.62, rising to full consensus after discussion. The study focused exclusively on CS standards, acknowledging that S&P topics may appear in other subjects (e.g., social studies) but were out of scope for this initial exploratory analysis.

Key Results
The analysis yielded 3,920 standards (32.1% of the total) related to security and privacy, spanning 109 unique topics.

• Topic Coverage: The most common topics included testing code, ethics, credit/intellectual property, and safe online behavior. The least common topics included RSA encryption, web availability, and key management. Even the most popular topics were not universal; 32 states were missing at least one of the 14 most common topics. No single topic was covered by all states or organizations.
• Audience Distinction: Most standards (in all but six states) focused on topics beneficial to general users (e.g., passwords, safe behavior) rather than specialized professional skills. However, specialized topics (e.g., digital forensics, input validation) were present, often in states with dedicated cybersecurity courses (Georgia and Texas).
• Grade Level Variance:
  • Elementary: Focused on fundamentals like acceptable use, general safety, and passwords.
  • Middle School: Emphasized secure data transmission, web security, and foundational technical concepts.
  • High School: Covered technical topics (secure coding, embedded systems), critical thinking regarding trade-offs, and complex attacks.
• Organization and Clarity:
  • Vagueness: Standards often lacked concrete examples. Only 2,841 of the 3,920 S&P standards contained examples or clarification statements.
  • Categorization: Only 29 state standards were explicitly categorized under "Security" or "Privacy." Many S&P topics (e.g., tracking, data permanence) were hidden under broader categories like "Impacts of Computing" or "Digital Citizenship," making them difficult for teachers to locate.
  • Privacy vs. Security: Privacy was significantly less likely to be explicitly categorized than security.

Key Contributions

1. Comprehensive Dataset: The paper provides the first large-scale, systematic characterization of S&P content within U.S. K-12 CS teaching standards, offering a labeled dataset of 3,920 standards across 109 topics.
2. Gap Identification: The study identifies significant inconsistencies in topic coverage across states and a lack of consensus on what constitutes a complete S&P curriculum.
3. Structural Analysis: It highlights structural issues in standards, specifically the lack of explicit categorization for privacy and the scarcity of instructional examples, which may hinder implementation by teachers lacking S&P backgrounds.
4. Audience Differentiation: The work distinguishes between standards intended for general digital citizenship and those for future professionals, noting that current standards often conflate these goals without clear separation.

Significance and Claims
The authors position this work as an initial exploration intended to "shed light" on the current state of S&P education and "begin the process of evaluating their utility." They do not claim to have solved the problem of S&P education but rather to have provided the empirical grounding necessary for future improvements.

The paper argues that the current landscape is characterized by:

• Fragmentation: A lack of universal topics suggests diverging student outcomes depending on their location.
• Implementation Barriers: The vagueness of standards and lack of examples place a heavy burden on teachers, who often lack formal S&P training.
• Accessibility Issues: Since S&P education is largely confined to elective CS courses (enrolled in by only ~6% of high schoolers), many students are excluded from foundational S&P skills.

The authors recommend clearer separation between fundamental S&P concepts (for all students) and specialized content (for future professionals), greater investment in teacher resources and training, and the use of supplementary materials to provide concrete examples without compromising the longevity of the standards themselves. They conclude that while standards provide a point of consistency, they currently lack the specificity and universal consensus required to ensure equitable and effective S&P education across the United States.