📄 social_science

Bridging Knowledge and Behavior: A Mixed-Methods Study of Adolescent Cybersecurity Literacy and Its Implications for Child Protection in Jordan

This mixed-methods study of Jordanian adolescents reveals a significant gap between their cybersecurity knowledge and protective behaviors, highlighting the critical need for training and a storytelling-based intervention model to address prevalent digital threats and overcome cultural barriers to child protection.

Original authors: Mohammed Ghallab, Sahar AlMakhamreh

Published 2026-06-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Mohammed Ghallab, Sahar AlMakhamreh

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: Knowing the Rules vs. Playing the Game

Imagine a group of teenagers in Jordan who have just finished a driving school course. They can recite the traffic laws, know exactly where the stop signs are, and can explain the theory of how to parallel park perfectly. They have high knowledge.

However, when they actually get behind the wheel, they speed, forget to check their mirrors, and park crookedly. They have moderate behavior.

This is exactly what this study found regarding cybersecurity. The researchers looked at 625 teenagers (ages 14–17) to see how well they understand internet safety and how well they actually practice it.

The Main Discovery:
There is a huge gap between what these kids know and what they do.

Knowledge Score: High (They know the rules).
Behavior Score: Moderate (They don't always follow the rules).

The "Digital Storm" They Are Facing

The study asked the teenagers, "What kind of trouble have you seen online?" It's like asking a sailor what kind of storms they've weathered. The most common "storms" were:

Hacking attempts (28%): Someone trying to break into their accounts.
Harmful content (23%): Seeing things that are bad or scary.
Cyberbullying (16%): Being bullied or harassed online.

Interestingly, very few reported "sexual exploitation" or "harassment." The researchers believe this isn't because it doesn't happen, but because of a "Culture of Silence." In this culture, admitting you were hurt by these things feels shameful, or kids are afraid their parents will take away their phones or get angry. So, they stay quiet.

Why Don't They Follow the Rules? (The "Why" Behind the Gap)

The researchers didn't just stop at the numbers; they talked to students, parents, and teachers to understand why the gap exists. They used a theory called Ecological Systems Theory, which is like looking at a set of Russian nesting dolls to see how different layers affect a child.

The Inner Doll (The Kid): Teens are naturally curious and impulsive. Even if they know a link is dangerous, their curiosity says, "Click it anyway!"
The Middle Doll (Family & School): There is a disconnect. Parents often don't talk seriously about safety at home, and schools don't always reinforce the lessons. It's like a coach telling the team to play defense, but the parents at home cheering for them to run wild.
The Outer Doll (Society & Tech): The internet is complicated. Sometimes the "security settings" are hidden or hard to find, making it feel like trying to lock a door with a key you can't find. Plus, society often treats internet safety as a boring technical topic rather than a life skill.

The Magic Key: Training

The study found one thing that changes everything: Training.

Think of training as a shield.

Teens who received training (from school, parents, or self-study) were much more likely to know the rules.
More importantly, they were 2.27 times more likely to speak up and report a problem if they saw one.
About 40% of the teens had zero training. They were walking into a digital storm without an umbrella.

The Proposed Solution: Storytelling

The paper suggests a new way to teach these kids, moving away from boring lectures and PowerPoint slides.

Imagine trying to teach a child about fire safety. You could give them a textbook on combustion, or you could tell them a gripping story about a brave firefighter who saved a cat from a burning building. The story sticks in their mind; the textbook might not.

The researchers propose a "Storytelling Intervention Model":

Co-Create Stories: Get the kids, parents, and teachers to write digital stories together. These stories should feature real-life scenarios (like a phishing email or a cyberbully) that feel authentic to Jordanian teens.
Discuss the Story: After watching or reading the story, have a conversation. "What would you do? Why did that character make a mistake?"
Build a Safety Net: Use these stories to break the "Culture of Silence." If a story shows a character reporting a problem and getting help (instead of getting punished), it changes the social norm. It teaches kids that reporting is brave, not shameful.

Summary of the "Recipe"

The Problem: Kids know the rules but don't follow them, and they are afraid to ask for help when things go wrong.
The Cause: A mix of teenage impulsivity, lack of family/school support, and a culture that shames victims.
The Cure: Training is the most important factor. But the best way to train is through interactive storytelling that makes safety feel personal and relatable, rather than just a list of technical rules.

The paper concludes that to protect children in the digital age, we need to stop just handing them a map (knowledge) and start teaching them how to navigate the terrain together (behavior and support), using stories that resonate with their hearts, not just their heads.

Technical Summary: Bridging Knowledge and Behavior in Adolescent Cybersecurity Literacy

Problem Statement
The rapid digitalization of adolescent life in Jordan has introduced unprecedented child protection challenges, yet there is a scarcity of mixed-methods research examining cybersecurity literacy in the Global South. A critical issue identified is the "knowledge-behavior gap," where adolescents possess theoretical understanding of online safety but fail to translate this into consistent protective behaviors. In the Jordanian context, this is exacerbated by limited cybersecurity education, the intersection of rapid digitalization with cultural norms (such as shame culture), and a lack of integration between digital safety and social work practice. While national strategies like the Jordanian Cybercrime Law No. 17 of 2023 exist, their translation into educational practice remains underdeveloped.

Methodology
The study employed an explanatory sequential mixed-methods design grounded in a pragmatist paradigm.

Quantitative Phase: A validated electronic questionnaire was administered to 625 adolescents (aged 14–17) across Jordan. Sampling utilized a multi-stage stratified random technique based on geographical area (urban, rural, desert/Badia, refugee camp) and school type (public, private, international). Data were analyzed using IBM SPSS Statistics (Version 23) via descriptive statistics, ANOVA, t-tests, and multiple linear regression to identify predictors of literacy and reporting behaviors.
Qualitative Phase: Following the quantitative analysis, 20 participants (7 parents, 6 students, 7 teachers/counselors) were selected via purposive sampling for focus group discussions (FGDs) and semi-structured interviews. Data were analyzed using reflexive thematic analysis (Braun & Clarke, 2006).
Theoretical Framework: The study was guided by Bronfenbrenner's Ecological Systems Theory (analyzing micro, meso, exo, macro, and chronosystems) and Social Construction Theory (examining how risks and identities are socially defined).

Key Results

Literacy Levels and the Knowledge-Behavior Gap:
- Overall cybersecurity literacy was moderate ( $M=3.63$ ).
- A significant gap exists between knowledge ( $M=3.79$ , High) and behavior ( $M=3.49$ , Moderate).
- Adolescents demonstrated high awareness of social-relational risks (e.g., sharing personal info) but lower proficiency in technical-procedural measures (e.g., two-factor authentication).
Demographic Differences:
- No significant differences were found by age or gender.
- Significant differences were found by geographical area (urban adolescents scored higher than rural/desert counterparts) and time spent online (those spending >6 hours online had higher literacy).
Threat Exposure:
- The most prevalent threats were hacking attempts (28.1%), harmful content (23.5%), and cyberbullying (16.7%).
- Reporting of sexual exploitation was extremely low (1.44%), suggesting significant underreporting due to stigma.
Reporting Behaviors:
- 43.2% reported threats to parents; only 1.28% reported to schools.
- 29.12% did not report because they did not perceive the threat as serious.
- Major barriers included fear of punishment, shame culture, and lack of trust in reporting systems.
Predictors:
- Training was the strongest predictor of both cybersecurity literacy ( $B=0.297, p<.001$ ) and threat reporting ( $B=0.820, p<.001$ ).
- 39.36% of adolescents had received no formal or informal cybersecurity training.
- Higher literacy was a significant negative predictor of threat exposure ( $B=-0.127, p=.001$ ).

Key Contributions

Empirical Evidence of the Gap: The study provides quantitative evidence of the knowledge-behavior gap in a Middle Eastern context, confirming that high theoretical knowledge does not guarantee safe online practices.
Identification of Training as a Primary Lever: Regression analysis empirically validates that training is the single most significant factor in improving both literacy and the likelihood of reporting threats.
Cultural Contextualization: The research highlights how cultural factors (shame culture, fear of parental punishment) and systemic issues (lack of school reporting mechanisms) create a "culture of silence" that hinders child protection.
Proposed Intervention Model: Grounded in the findings, the paper proposes a storytelling-based intervention model. This model utilizes co-designed digital stories to bridge the knowledge-behavior gap, moving beyond didactic instruction to foster critical thinking and behavioral change through narrative engagement. It advocates for a multi-level implementation involving schools, families, social workers, and policymakers.

Significance and Claims
The paper claims that protecting children in the digital age is a fundamental challenge of social justice requiring a shift from viewing cybersecurity as a purely technical issue to a behavioral and social one.

For Social Work: It argues that social workers must integrate digital competency into their practice, utilizing ecological assessments that include the digital environment and championing narrative-based interventions.
For Policy: It calls for the mandatory inclusion of behavior-focused, interactive cybersecurity education in national school curricula and the updating of child protection frameworks to explicitly define and address online abuse.
For Practice: The study posits that the proposed storytelling model offers an actionable, evidence-based pathway to enhance online resilience, specifically by addressing the barriers of shame and lack of practical skills identified in the qualitative phase.

The authors maintain modesty regarding their claims, acknowledging limitations such as the cross-sectional design (preventing causal inference), reliance on self-reported data (potential social desirability bias), and sample constraints. They conclude that while the study offers valuable insights, future research requires longitudinal designs and rigorous evaluations (e.g., randomized controlled trials) to assess the proposed intervention models.