On 1 October 2018, Espoo’s upper secondary schools are launching a completely new kind of course even on a national scale called Hack with Espoo. The course will teach upper secondary school students about new information security trends, hacking, its ethics and tools. Towards the end of the course, they will have the opportunity to test the information security of the city’s information system.
Espoo’s co-creation slogan is Make with Espoo, from which the course’s name is derived. We want to involve young people in improving the city’s information security and doing good through hacking.
This kind of course cannot be implemented alone. A key partner in the implementation and organisation is the security company Second Nature Security, 2NS. In addition to the city’s Chief Information Security Officer and 2NS experts, lecturers will include representatives from LähiTapiola, the National Cyber Security Centre of the Finnish Communications Regulatory Authority and the police. LähiTapiola will also sponsor grants for students who find vulnerabilities that could be used for criminal purposes from the city’s systems.
The course’s objectives are very diverse. We want to teach students the principles of ethical hacking. In practice, this means trying to find boundaries between different shades of white, black and grey together with the students; what you can and cannot do online, how various tools work and how to use them in a responsible way.
For the city, the course is a chance to learn. The course experiments with the “crowdsourcing” of information security testing, meaning that part of the system’s security testing is handed over to be hacked and reported by external parties. In addition, the concept of the course differs from ordinary courses. This allows us to also learn how to organise this type of education and whether it can be utilised more widely in the future.
For our partners, this is an opportunity to create new business for the future. A key incentive for all the parties involved is responsibility for young people. It is worth noting that most of today’s cybercriminals would never have been driven to “conventional” crime. A hacker does not mean a cybercriminal, but young hackers may be at risk of slipping into cybercrime if they do not find constructive, lawful and interesting things to do with their hacking skills and desires. This is what we all want to offer: knowledge and opportunities for skilled young people.
The course ends in late November, which is when we will evaluate its benefits for the students, the city, partners and society. We will also assess whether the course could be expanded to comprehensive school, for example, or whether it was appropriate for its purpose.
The content, feedback and other findings of the course will be offered to other organisations. The course is the first of its kind, and there may be a lot of room for development. We would also like to involve other actors in the development.
Chief Information Security Officer
City of Espoo
Please, read also the press release: Espoo teaching upper secondary school students to become white hat hackers (9 April, 2018)