Class notes

1. Cyber warfare and Cambridge Analytica

Can the Cambridge Analytica situation be described as cyber warfare? Is every hack part of cyber war?

Usually no for Analytica, and no for ordinary hacking.

• Cambridge Analytica harvested Facebook profile data and used it for political targeting. That is influence, profiling and unlawful processing, not an armed attack on infrastructure.
• Cyber war language is tighter: typically a state (or its proxy), a threshold of harm, and a link to armed conflict or the law of armed conflict. The Tallinn Manual is the usual reference.
• Lecture 1 groups Analytica with Facebook election manipulation under a later "triality" of privacy risk: harm can hit the person, the organisation, and society (elections, trust).

• Guardian: Cambridge Analytica files
• ICO investigation (UK)
• CCDCOE: Tallinn Manual
• ICRC on cyber warfare

2. Duality, then triality of privacy risk

Older slide: duality of privacy risks (Fritsch and Abie, 2008): risk for the individual and for the organisation.

2023 update in the intro slides: triality. A third pole is society (elections, public debate, "personalised (cyber) war").

• Examples on the slide: Cambridge Analytica / Facebook; Team Jorge (harassment as a service).

Fritsch, L., Abie, H. (2008). Towards a Research Road Map to the Management of Privacy Risks in Information Systems. In: Sicherheit 2008, LNI 128, GI.

3. Team Jorge

Private Israeli outfit led by Tal Hanan. Investigated in 2023 for selling disinformation, hacking and "harassment as a service" around elections. Fits the society pole of triality: not a classic state cyber war, still organised harm at scale.

• Guardian: Team Jorge revealed (2023)
• Haaretz on Tal Hanan

4. Building a data centre in Oslo?

Open lecture prompt, not a finished claim. Use it to ask: who is the controller, which country hosts the servers, and is there a Chapter V transfer if personal data leave the EEA?

• Regjeringen: datasentre
• Green Mountain (Norwegian data centres)
• Datatilsynet: transfers outside the EEA

5. ENISA PIA impact levels

Four levels aimed at harm to the individual (SME guideline, ch. 3):

• Low - minor inconvenience (re-enter data, irritation).
• Medium - significant inconvenience they can still overcome (extra cost, stress, denied service).
• High - serious difficulties (lost job, money taken, health worse, blacklisting).
• Very high - serious or irreversible (cannot work, long-term illness, death).

• ENISA: Guidelines for SMEs on the security of personal data processing (2016)

Quiz card already in the app: "What ENISA SME impact levels are taught for individuals' privacy harm?"

6. GDPR fines tracker, and where the money goes

Lecture 1 points to the public enforcement tracker. Use it to pick an organisation, the business motive, and which GDPR part was broken.

The fine is paid to the state in the country of the supervisory authority (in Norway: the Treasury / statskassen). It does not go to Datatilsynet as pocket money, and it is not automatically paid to the victims. Victims use damages (Art. 82) or other remedies.

• CMS GDPR Enforcement Tracker
• GDPR Art. 83 (administrative fines)
• GDPR Art. 82 (compensation to the person)
• Datatilsynet on administrative fees
• World's Biggest Data Breaches (also on the intro slides)

7. Asymmetric risk and knowledge (ACIT4280)

Your notebook drawings match Lecture 1 fairness framing.

Asymmetric risk

Asymmetric knowledge

Related quiz cards: asymmetric risk, cost, knowledge, profit and control.

8. "Survival capitalism" book

Almost certainly The Age of Surveillance Capitalism (Shoshana Zuboff, 2019). The lecture point: personal data is extracted as a behavioural surplus and sold as prediction. Fits asymmetric knowledge and profit.

• Zuboff: about the book
• Wikipedia overview

10. Flipped classroom (first-day list)

Notebook order for how the course runs:

• prepare
• class
• group presentation
• exam, multiple choice
• Easter break
• remember questions
• form a group; one assignment is a case presentation relevant to the course

Official Canvas wording is a bit fuller: read or watch before class; group of three; written report plus presentation; timed Inspera exam. Use Canvas if the notebook and the course page disagree.

Quiz card already in the app: "How is ACIT4280 taught (format) according to the Aug 13 2026 intro?"

11. Privacy: me, others, state

The drawing is a triangle, not a company-only model. Privacy is a relation between you, other people, and the state.

Next to the drawing: right to be left alone. That is Warren and Brandeis (1890), usually quoted as the right to be let alone. Reaction to a new press and photography, not to Facebook.

Margin note: Siden: (What is Russia). Left as an open prompt from the lecture. Do not invent a finished answer until the next page or slide names it.

• Warren and Brandeis (1890), The Right to Privacy (PDF)

Quiz card already in the app: Warren and Brandeis "to be let alone". New card: the me / others / state triangle.

12. One system, two risk types

The lower drawing splits one system into two kinds of harm:

Same idea as duality: the organisation can lose money or reputation; the person can lose privacy, money or safety. Triality later adds society (elections, trust).

15. Case notes: principles, 72 hours, Ryde

Writing / presentation cluster from the next page. Presentation slot on the page: 20 min, focus what we found.

Notebook "basic principles"

The page lists only three: security, accountability, transparency. That is a first-day subset. Full Art. 5 also has lawfulness, fairness, purpose limitation, data minimisation, accuracy and storage limitation. Integrity and confidentiality is the security principle. Accountability is Art. 5(2): you must be able to show compliance.

If data are lost, is there a time limit?

Yes, but two clocks:

• Art. 33 - tell the supervisory authority without undue delay, and where feasible within 72 hours.
• Art. 34 - tell the people if the breach is likely to mean a high risk to their rights. No 72-hour number here. The duty is without undue delay.

Tracker: search Norway on enforcementtracker.com.

Ryde (live case, Aug 2026)

Ryde Technology AS (Oslo e-scooters) published a customer data breach on 2 August 2026. They say an unauthorised party copied account data: phone, email, date of birth, partial card numbers, payment history. They say ride locations were not taken. They notified Datatilsynet and the police.

Notebook question: where can I bill you if my information is misused? Support mail (support@ryde-technology.com) is customer service, not a damages invoice. Privacy rights: DPO (dpo@ryde-technology.com). Complaint: Datatilsynet. Money: Art. 82 in court, separately from a GDPR fine (the fine still goes to the state).

Lecture nudge on the page: make a stronger statement of what is lost. Name the data types. Do not say only "a breach happened".

First-hand notices on a customer account: in-app notice 5 Aug 2026, 19:42 (lists the data types above; says Datatilsynet and police are notified). Later SMS from "Ryde" (Monday 13:29): no new information since the previous notice. Follow-up goes to the DPO first, not support, and not Datatilsynet until the company has had a chance to answer.

• Ryde: security incident 2 Aug 2026
• Ryde privacy policy (DPO contact)
• GDPR Art. 33 (notify the authority)
• GDPR Art. 34 (notify the person)

Quiz cards already in the app: Art. 5 list; Art. 33-34. New card: support mail is not the legal claim route.

18. Lecture 5 - Privacy and security management

Prep reading: Preparatory reading on managed privacy (local PDF). Lecture 5 covers ISMS/PDCA, risk treatment with privacy controls, incident stages (ISO/IEC 27035), and cases such as the smart-car privacy scenario.

• Horizontal activity: security management cuts across HR, ops, facilities - needs management support and cross-role panel.
• Controls: many are administrative, not only technical - select from ISO 27001 annex / NIST SP 800-53 style catalogues.
• Incident flow: plan/prepare, detect/report, assess, respond (contain/eradicate/recover), lessons learned.
• OASIS PbD-SE: PDCA-style engineering documentation for privacy-by-design in software.

Open ACIT4280 quiz - filter Lecture5 or controls. Smart-car and ISMS cards tagged Lecture5.

13. First-day keywords

• critical thinking
• formulate
• understand research
• every week a new topic
• structure
• all lectures are published

Arrow on the page: next week is a debate (video). That matches the flipped week-2 prep (Toulmin / debate clips before class).

14. Two mandatory exercises, then exam

1. Taxonomy spreadsheet
2. 5 min video

Plus an exam (the crossed-out word on the page is not readable). Canvas is stricter on length and dates: spreadsheet with 10+ scientific papers (due 25 Sep 2026, 12:00); presentation recording; individual essay 5500-6500 words.

Also on the page:

• check in with the teacher if the topic is good
• choose classical or narrative
• choose topic in week 3
• what is IMRAD?

IMRaD = Introduction, Methods, Results, and Discussion. Common in empirical papers. The ACIT4100 essay is not a typical IMRaD review. You still need to know the pattern so you can read papers. Your own text uses classic and/or narrative style.

• Wikipedia: IMRaD
• Open the ACIT4100 quiz

Quiz cards already in the app: IMRaD, classic/narrative style, taxonomy spreadsheet, flipped classroom.

16. References, topic, and what makes text good

For scientific papers the course wants page number and paragraph number (stricter than plain APA7). Overleaf is the course example for how to attach those locators in LaTeX.

• choose a topic close to the master thesis
• read the research papers and the examples
• look at what the exam requires and how it is scored

Text is good

1. Curiosity
2. Metaphor
3. Humour
4. Foreshadowing
5. Visualization
6. Tell a story
7. Conclusion
8. Give the reader a break

These are craft tools for classic / narrative style. They do not replace sources, a claim, or a gradeable research point.

• Canvas: Overleaf / LaTeX referencing example

Quiz cards already in the app: page + paragraph, Overleaf. New card: the eight "text is good" points.

Week 2 Part 2 - The Toulmin model

From the flipped video The model (slides sent 23 Aug 2026). Qualifier now has its own slide. Backing and rebuttal still appear only in the smoking diagrams.

Signs of a good argument

• Persuasive: it is effective in getting support for a claim.
• Uses deliberative rhetoric: focusing on the future and what to do next. Not judicial or epideictic.
• Relevant: relates to the question that is debated.

The Toulmin model

Developed by Stephen Toulmin, an English philosopher interested in what makes everyday arguments successful. The model was based on reviewing court cases.

It is now widely used to construct and de-construct arguments: debate, research, essays, dinner tables and cocktail parties.

Its prime function is not to describe the order of the argument, but that the right components are in place to make it persuasive.

Example: you want your colleague to stop smoking (slide 17, Kyrre Begnum)

• Claim: You should stop smoking.
• Grounds: Smoking leads to severe health risk for yourself. Smoking can affect the people around you.
• Warrant (explicit): You cannot disregard the advice of the medical community.
• Warrant (implicit): You should take health advice from your friends seriously.
• Backing: We know what happens to people who ignore unanimous advice from doctors.
• Qualifier: At least try to reduce it as much as possible and set a goal to stop before a date.
• Rebuttal: I know it is difficult, but there are other products that can help you control the nicotine addiction.

Example: you want your spouse to stop smoking

Same claim and almost the same map. The lecturer contrasts colleague vs spouse to show that the implicit warrant changes with the audience (the warrant-in-context point).

• Claim: You should stop smoking.
• Grounds: Smoking leads to severe health risks for yourself. Smoking can affect people around you.
• Warrant (explicit): You cannot disregard the advice of the medical community.
• Warrant (implicit): You should respect the concerns and advice from those who love you. (Colleague version: take health advice from your friends seriously.)
• Backing: We know what happens to people who ignore unanimous advice from doctors.
• Qualifier: At least try to reduce it as much as possible and set a goal to stop before a date.
• Rebuttal: I know it is difficult, but there are other products that can help you control the nicotine addiction.

Claim

What you want your audience to accept: opinion, action, vote, support and so on. Can be for or against a proposal.

In some cases you may not see a claim even though the rest of the Toulmin model is there, especially in scientific and technical presentations.

Grounds

• Can be evidence, data, statistics, anecdotes.
• Should present the reasoning behind the claim.
• May also contain evidence of expertise or authority.
• Most likely the backbone of the argument, but may affect people differently based on factors like their own emotional investment.
• In research, the results and their analysis provide the core of your grounds.

Warrant

Simply put: Why you should listen to me.

• The warrant can itself be a longer argument.
• Warrants can be data and evidence, or values.
• The warrant helps put the argument in a context. It can help explain why the same claim and grounds work differently in different settings.

Qualifiers (slide 22)

• An unqualified claim would have to be defended for all extreme cases.
• Qualifiers can adjust the guarantee of success: most likely, greatest chance, 90% of ...
• Qualifiers can also provide insurance against insufficient grounds: considering all other options, after careful deliberation, given what we know right now.

Listening as actual listening (slide 23)

• Debaters spend their time keeping track of the debate, instead of thinking about what they want to say next.
• The Toulmin model can be used as a structure by which to categorize what you hear (and do not hear).
• A technique called flow lets them quickly note what is being said in a system that makes line-by-line refutation possible.
• Flows are created through the use of symbols that signify meta-information of the arguments.

• Open the ACIT4100 quiz

Quiz cards: 21 Week 2 Part 2 slide items, plus 11 Canvas self-test cards in the next note.

Week 2 Part 2 self-test (Canvas)

These items come from the Rhetoric Part 2 Canvas self-test (unlimited attempts). The cards keep the Canvas wording so you can drill the exact phrasing. Part 2 is not marked done until you submit the quiz.

• Six Toulmin components: Claim, Qualifiers, Backing, Rebuttals, Grounds, Warrant. Not Argument, Status quo, Agency, Nuance, or Proof.
• Fill-in: Deliberative rhetoric is forward looking and focuses on what to do next (not judicial or epideictic, and not "general").
• Smoking-style match: stop smoking = Claim; medical community = Warrant; proven bad = Grounds; hard but benefit = Rebuttal; stop by a date = Qualifier; stamina improved = Grounds (anecdote); promise to think = Qualifier.
• True/false: "Only provable evidence can function as grounds" is False. Grounds can be evidence, data, statistics, anecdotes, or expertise/authority.

• Open the ACIT4100 quiz

11 new quiz cards tagged Canvas-quiz / week2-part2. Slide cards stay separate so both wordings can be drilled.

Week 2 Part 3 - The affirmative

From the flipped video toulmin_part_3 (34:46, Kyrre Begnum). Case slides now include the composition notice and a Part 4 teaser. About 33:44 of 34:46. The self-test is not done yet.

The affirmative (Roosevelt, man in the arena)

The slide quotes Roosevelt: it is not the critic who counts. Credit belongs to the man who is actually in the arena.

Overlay: Arguing for the affirmative.

Use as: the affirmative takes the risk of proposing change. Critics who only point out stumbles do not get the credit.

Arguing for the affirmative (slide 26)

The affirmative argues for change by offering a proposition.

One needs to cover three aspects to be persuasive:

• Indict the status quo: What is wrong and what harm does it do?
• Demonstrate solvency: Does your proposition actually address the problem and reduce harm?
• Be an example of the proposition: Don't replace evil with evil.

Three factors (slide 27, expanded)

Building a good argument comes from an understanding of three factors:

• The audience: Who do you want to convince? What are their values? What is their situation or context?
• Prior research: Enough relevant data and grounds. Also needed in anticipation of counter arguments. (Background chapter!)
• and Nuance: Use of qualifiers. Correct agency.

The importance of agency 1 (slide 28)

• The agents in an argument are those who should actually DO what you propose, and may not be the same as or all of your audience.
• Having the wrong agents in a proposal may reduce the solvency of the harm. ... and Mexico will pay for it!
• The agents themselves may not feel enabled or empowered to enact on the proposal.
• Unclear agency may also lead to distracting discussions and confusion, which nuance and qualifiers can help avoid.

Qualified / nuanced version of the same claim:

... and Mexico will indirectly pay for it through a negotiation of our agreements which would indirectly create a financial surplus sufficient to cover the cost!

Arguing from the perspective of the agent

• A persuasive argument must highlight how the controversy, harm and cost affects the agents themselves.
• An often overlooked factor is the opportunity cost of a proposal, as committing to an action may limit the ability to respond to future opportunities.

Where to find arguments in scientific papers and thesis (slide 30)

The introduction's claim: Addressing the problem I'm describing is important and worth spending resources on.

• Heavy on indictment and harm. The starting point of the introduction with a narrowing from domain down to the specific issue.
• Must demonstrate solvency. The proposed impact usually right before the problem statement.
• Low on backing and warrant. That's for the background. Implicit warrant: the problem's nature warrants a scientific approach.
• Should have nuance. The operationalization after the problem statement.

Where to find arguments: the approach (slide 31)

The approach's claim: My plan is feasible and presents an adequate scientific approach to answer the problem.

• Grounds, warrant and backing: the research method and its tradition; the amount of work relative to the timeframe.
• Must demonstrate solvency: the data gathered speaks to what we need to uncover; the experiments cover the relevant aspects of interest; the plan is detailed enough to demonstrate control.

Example: using Toulmin when preparing a presentation (slide 32)

Case: your faculty will hold a workshop for teachers on using flipped classroom teaching approaches. You are invited to give an introduction in order to motivate the attendees.

Claim ??? (slide 33)

Draft line on the slide: We should adopt flipped classroom approaches to teaching...?

The claim is still being formulated. The question marks are part of the point: you do not start with a finished claim.

Indictment examples (slides around 19:29 and slide 34)

• Students are digitized and require a high degree of flexibility.
• We don't have sufficient opportunity to engage directly with students when we are most needed.
• Students expect us to deliver teaching that is most beneficial to them.

Highlighted on the slide: Indictment of the status quo!

Identifying harms (slide 35)

• Students are not getting the best education.
• We are not fulfilling our obligation to produce the best outcomes from our tax-based financing.
• We are unable to work in ways that are more motivating and rewarding.

Grounds, including solvency of the harms (slide 36)

• Practical information: What it takes to transition from a traditional to a flipped classroom approach.
• Our values: Making a positive impact on students is profound and meaningful.
• Anecdotal evidence: My own experience.
• Scientific evidence: Published studies.
• New incentives: Becoming a merited educator will lead to a pay raise and status.

These grounds also speak to solvency (how the proposal addresses the harms). They mix anecdotes and published studies.

Warrant (slide 37)

• Explicit: The studies I have presented are similar to our teaching environment and their results are believable.
• Implicit: We should aspire to continuously adjust our practices to those which currently provide the best outcomes.
• Backing: A colleague of mine has done the same and it also provided good results there.

Qualifiers and agency (slide 38)

• Only those who are motivated will prioritize this.
• Some want to work on a different aspect of their career.
• Some feel structurally bound by the system.

The agents: Teachers who are inspired by engaging teaching methods and want to advance their career.

Rebuttals (slide 39)

• Objection: We don't have the skills. Rebuttal: People who teach, usually know how to learn. It's not about what you know right now.
• Objection: There's no real incentive. Rebuttal: No longer true.
• Objection: It's a lot of work. Rebuttal: Yes, but only initially. You'll end up with more flexibility in the long run and can use that on other career aspects.

Claim before vs after (slide 40)

• Before: We should adopt flipped classroom approaches to teaching...?
• After: Moving towards a flipped classroom approach is a good way to teach in a meaningful and engaging way while advancing your career.

The after-claim is already qualified (moving towards), tied to values (meaningful and engaging) and to agency / career (advancing your career).

Notice: The Toulmin model does not prescribe an order or structure of the communication itself. Building a presentation from all pieces is now a matter of composition and rhetoric.

Applying it: arguing against affirmative

Teaser only: this points to Part 4. No Part 4 content here yet.

• Open the ACIT4100 quiz

Quiz cards: 49 Week 2 Part 3 slide items so far. Self-test cards come after the Canvas quiz.

Week 2 Part 4 - The negative

From the flipped video toulmin_part_4 (22:01, Kyrre Begnum). Video slides now include the closing and a Part 5 teaser. The Canvas self-test is not marked done until you submit.

The critic (Churchill, 1939)

The slide quotes Churchill (1939):

Criticism may not be agreeable, but it is necessary. It fulfills the same function as pain in the human body; it calls attention to the development of an unhealthy state of things. If it is heeded in time, danger may be averted; if it is suppressed, a fatal distemper may develop.

Arguing against the affirmative (slide 43)

• Arguing for the negative is often an argument against a proposal made by others.
• The negative can attack from several perspectives, but can risk being motivated by the wrong values, i.e. a personal victory instead of a good debate.
• A good case for the negative has three components:
  • Direct disadvantages of the proposal
  • Counter proposals
  • Critique of assumptions

Direct disadvantages 1: Inherency of the proposal (slide 44)

• Attacks on the inherency of a proposal means pointing out obstacles, previous attempts or even better current efforts. We're doing this already. There's already a better fix.
• Not limited to feasibility, and can be attitudinal. Things are fine right now.
• You're not disagreeing with the problem or grounds, but point out other inherent factors that weaken the proposal.
• Uncovering inherency issues requires research into the proposal and the problem within the status quo.

Direct disadvantages 2: Attacking the harms (slide 45)

• The core of most affirmative proposals is that the status quo is doing a harm. Underlining the magnitude of the harm can be a powerful tool, but may also be tested by the negative. Are we really sure all the worst case harm is realistic? It won't be as bad.
• In some cases, the proposed harm can become a positive in the end. Yes, people loose their jobs, but if we offer them a new career, they would be able to earn more and pay more tax. (Slide spelling: loose. Meaning: lose jobs.)
• One can risk being too cavalier if not combined with other arguments.

Direct disadvantages 3: Solvency of the proposal (slide 46)

• Attacking on the solvency of the proposal means arguing that the proposal will not solve the described problem.
  • It won't play out as you say it will.
  • This will do little to address the core issue.
  • You're fighting the symptom, not the disease.
• Not the same as attacking the feasibility of the proposition.
• Attacks of the solvency will strengthen all other negative attacks, i.e. the possible harm of the proposal outweigh the weak prospect of positives.

Counter proposals (slide 47)

• Offer a variance of the proposal or a completely different proposal.
• Does not need the same scrutiny, but if well prepared can be a devastating blow to the affirmative.
• Counter proposals should always be deliberative, and not interrogative.
• Don't: Why did you not consider shorting the stocks instead?
• Instead: I think shorting the stocks is a better choice, because ....

Attacking the assumptions (slide 48)

• Assumptions can be found in the warrants and grounds: You assume a 50-year old study is relevant today
• Assumptions also exist in the indictment of the status quo: You say unemployment is bad, but unemployment in one sector is a necessary and natural re-adjustment of the markets.
• One can also "flip the warrant" combined with a counter proposal: If we really want students to succeed, then we should have stricter admission requirements and not pretend everyone can get what they want! Do you think they're debating flipped classroom in law school? They don't, because they only have students who really want to be there and accept that it is hard. In fact, they are proud of their achievement in the end for that reason!

Closing: why bother?

The slide asks: Wow, sounds like arguing for any proposal is almost impossible. Why bother?

• Arguing for the affirmative SHOULD be hard!
• Every proposal brings change and change adds risk. NOTE: Canvas Part 4 self-test Q2 does NOT accept that option even though it is the slide wording.
• However, arguing against a proposal should not be confused with being against change. Change may be inevitable, in which case debate could help determine the best proposals. This is why a point of stasis is so important.

Applying it: making decisions based on debate

Teaser only: this points to Part 5. No Part 5 content here yet.

• Open the ACIT4100 quiz

Quiz cards: 41 Week 2 Part 4 slide items, plus 9 Canvas self-test cards in the next note.

Week 2 Part 4 self-test (Canvas)

These items come from the Rhetoric Part 4 Canvas self-test (unlimited attempts). The cards keep the Canvas wording so you can drill the exact phrasing. Part 4 is not marked done until you submit the quiz.

• Three negative strategies: Direct disadvantages, Counter proposals, Critique of assumptions.
• Match: better idea = Counter proposals; problem not as big = Direct disadvantages (harms magnitude); example does not apply = Critique of assumptions; previous job = Direct disadvantages (inherency); wouldn't change much = Direct disadvantages (solvency); want them to succeed / opposite = Critique of assumptions (flip the warrant); call it a problem / quality assurance = Critique of assumptions (indictment flip).
• Why SHOULD affirmative be hard (Q2): slide wording is change/risk (all proposals bring change and change adds risk). Canvas marked that option INCORRECT. Next most lecture-aligned remaining visible option is there are always other proposals you can choose instead (best proposals / stasis). Not the 10% option (not on the slides). That Canvas key is inferred; confirm if you see the official correct mark. Two options showed as No answer text provided.

• Open the ACIT4100 quiz

9 new quiz cards tagged Canvas-quiz / week2-part4. Slide cards stay separate so both wordings can be drilled.

Week 2 Part 5 - Making decisions based on debate

From the flipped video toulmin_part_5 (25:12, Kyrre Begnum). Slides so far include Don't dis dissenters (slide 58) and the Toulmin quote. About 22:46 of 25:12. Part 5 is not marked done.

Let's refocus on the goal: making good decisions (slide 51)

• Leaders and managers have several options to make informed decisions.
• Whenever they want input or advice, they would have informal conversations with trusted employees, organize a meeting / workshop or hearing.
• How would what we have covered until now assist in reaching the goal of good decisions?

When pros vs cons don't work (slide 52)

The participants brainstorm pros and cons which are written on a whiteboard.

Problems:

• Favors strong and verbal personalities
• Has no nuance
• Is not always an aggregate
• No visible value or weight of each point made, and assumes it is the number that counts

When voting doesn't work

Employees are asked to propose actions, which are written on a board. Everyone votes on them.

Problems:

• Favors those who can handle impromptu elections and get the most airtime for their proposal.
• Gives little time to thoroughly prepare proposals, so the old and faithful proposals take center stage.
• If you propose it, you have to defend it, adding risk to looking foolish.
• Sometimes, the best proposal is not the one with the most votes.

When a free discussion doesn't work (slide 54)

The topic is introduced in a meeting and everyone is asked for their opinion.

Problems:

• Dominant personalities prevail.
• No one has adequate time to prepare, so old battle-lines are redrawn.
• If you propose it, you have to defend it, adding risk to looking foolish.

What leaders can do to promote valuable input (slide 55)

• Predefine the propositions and point of stasis.
• Specify the values by which a decision will be made at the end.
• Provide enough time to prepare good arguments.
• Assign designated debaters for propositions.
• Write RDF (Reason For Decision) so employees can understand the reasoning of the leader.

The importance of a positive debate culture

• Does rhetoric and persuasion have a place in science and scientific environments? Yes, if you accept that scientists are humans.
• However, it is the culture of the organization that decides whether persuasion is a tool for manipulation or for informed decisions.
• Debate offers a structure that can protect the individual and bring to light a more nuanced discussion about a proposal.

Debate in informal settings

• Debating an issue is an exciting and entertaining activity, which also strengthens social interactions.
• However, using all available tools in an informal setting, may provoke a sense of aggressiveness.
• Instead of trying to be affirmative or negative, try to move the debate into a discussion.
• Quote (slide spelling: your'e): I see what you're saying, but what do you think about the argument, that ...

Don't dis dissenters (slide 58)

• Being a critic is not always popular. Our society and viewpoints are increasingly polarized. If we view every opposition as hostile, we loose the opportunity to uncover the strengths and weakness of our ideas and to test them against our values. (Slide spelling: loose. Meaning: lose.)
• We should always remember that both the affirmative and the negative are critics in their own right and both need protection.
• CD. Darlington: It is no accident that bacteria was first understood by a canal engineer, that oxygen was isolated by a Unitarian minister, that the theory of infection was established by a chemist, the theory of heredity of a monastic school teacher, and the theory of evolution by a man who was unfitted to be a university instructor in either botany or zoology.
• CD. Darlington: We need a ministry of Disturbance, a regulated source of annoyance; a destroyer of routine; an underminer of complacency.

Toulmin quote

Those who condemn dissenters as dissidents, in truth condemn themselves.

Stephen Toulmin

• Open the ACIT4100 quiz

Quiz cards: 46 Week 2 Part 5 slide items so far. More cards come as later Part 5 slides land. About 22:46 of 25:12. Part 5 is not marked done.

Week 3 - Searching for and sorting literature (08 Sep 2026 class)

Canvas prep: where to find papers, Structure of a research paper (16:14), how to read a review article, self-test Structure of a paper, Safari demos on review vs research papers. In class: build your taxonomy spreadsheet for Assignment 1.

Local PDF: Emner/ACIT4100/00_Course_info/Structure of a paper.pdf. Assignment 1 due Thu 25 Sep 2026 12:00 (submitted 06 Sep).

• Open ACIT4100 quiz - filter week3 or literature

11 quiz cards tagged week3 (IMRaD sections, review vs research, taxonomy, Zotero). Cache lock111.

Week 4 - Philosophy of science (15 Sep 2026 class)

Canvas prep: Philosophy of science part 1 (12:00) and part 2 (14:25). Supplementary Popperian podcast interview with Nicholas Maxwell.

Essay angle: describe the tradition within philosophy of science in your research field - explicit or implicit in how papers argue and choose methods.

• Open ACIT4100 quiz - filter week4 or philosophy

Popper falsification, Kuhn paradigms, scientific criteria - 8 new cards tagged week4. Cache lock111.

Lecture 2 - Phishing (25 Aug 2026)

Slides on Canvas module 2. L03 assignment (Phishing with exploit kits, 10 pts) submitted 31.08. Core topics for the quiz deck (tags Lecture2, phishing, exam):

• Types: mass phishing, spear phishing, whaling, smishing (SMS), vishing (voice / deepfake calls), AI-assisted lures.
• After the click: fake login pages, malicious attachments, exploit kits on compromised sites - stolen credentials or malware give access.
• Why it works: spoofed sender identity, HTML hiding real URLs, tracking pixels, principles of influence (urgency, authority, social proof).
• Gophish: open-source phishing simulation framework (listed with L03 / exploit-kit readings) - send test phish, measure clicks, debrief staff.
• Tracking pixel: tiny remote image in mail; opening downloads it so the sender sees read time and often IP (Gmail proxy reduces location leak).
• Apache phishing kit: paid Dark Web kit cloning fake shops, harvesting card/CVV in an admin panel (Check Point report on Canvas).
• Exploit kit: automated browser exploit delivery after a lure (Mokoena et al. 2020, L03 context).
• Countermeasures: MFA, mail filtering/DMARC, block remote images, report-phish workflow, least privilege, simulated training.

Open ACIT4050 quiz - filter phishing or exam for the eight syllabus exam prompts. See also section 21 below.

Lecture 3 - Networks (01 Sep 2026)

Slides: Networks26.pdf (local under Emner/ACIT4050/Lecture_03/). Topics: Internet protocol stack, encapsulation, IP addressing, subnets, CIDR, ports, NAT, ICMP, IPv6, TCP three-way handshake.

Assignment: Networks (New Quizzes, 100 pts, pass 60+) submitted Mon 07.09.2026 ca. 13:44 (attempt 1). Due Tue 08.09.2026 23:59.

Open ACIT4050 quiz - filter Lecture3 or networks-assign. 38 quiz cards tagged Lecture3 / network (10 mirror the Canvas Networks assignment Q1-Q10). Cache lock143.

Lecture 4 - Intrusion Detection Systems (08 Sep 2026)

Class Tue 08.09 12:30-14:15 PI850. Slides expected on Canvas the same day - quiz cards and detailed notes will land after crawl.

Open ACIT4050 quiz - filter Lecture4 when cards appear. Placeholder in course map until slides are processed.

Lecture 5 - Firewalls (15 Sep 2026)

Class Mon 15.09. Prep cards in the quiz deck (tag Lecture5): packet vs stateful vs application firewalls, default deny, DMZ, egress filtering, WAF, firewall vs IDS.

Open ACIT4050 quiz - filter Lecture5. Slides will refine cards after Canvas crawl.

18. Information security vs cyber security

Notebook arrow: information security points to access control, plus misuse, loss and so on. That matches Peltier in Lecture 1: keep data used properly, and stop unauthorised change, destruction, disclosure, loss or access. Paper files count. Legal barriers count.

Next line: cyber security involves all info on your computer. Official wording is tighter: cyber security is the subset for information stored on computers or sent between computers. Information security is the umbrella.

Quiz cards already in the app: info vs cyber (Peltier); info vs cyber relationship.

19. Hierarchy of trust

Each layer trusts the layer below it. A higher layer, a user, an admin, or crypto has to impose any other trust.

Notebook stack (short). Transitions on the page is transistors:

Lecture 1 exam list is eight layers, top to bottom:

1. Application
2. Operating system
3. Hardware adaptation layer (HAL)
4. Instruction set
5. Integrated circuits (memory, processing, communication)
6. Logic gates
7. Transistors
8. Physical phenomena

Device drivers sit across OS and HAL. They are not their own numbered layer. Learn the eight-layer list for the quiz.

Quiz cards already in the app: trust rule, full stack, who maintains software vs hardware, drivers, upper vs lower.

20. TASK page: names and frameworks, not a build list

The page is headed TASK and mixes defender words (scan) with attacker examples (virus, rootkit, bot, botnet, DDoS). Treat it as a map of Lecture 1 terms. Do not write or run a virus, rootkit, bot or DDoS. The course wants you to name the class, place it on NIST / Kill Chain / ATT&CK, and know how a defender would detect or stop it.

What the lines mean

• Scan for virus, trojan and so on - defender side. NIST Detect. Virus / worm / Trojan are how malware spreads. Spyware, ransomware, bot and rootkit are intent classes. The same sample can sit on both axes.
• Rootkit / hide - intent class: hide malware, often with admin rights, so normal tools may look clean. Exam point: hard to detect, not harmless.
• Bot / botnet / DDoS - a bot is remote control; a botnet is many bots; DDoS hits availability by flooding from many machines. C2 is Kill Chain stage 6. Blocking C2 can stop the attack after install.
• Build on NIST - CSF 2.0 six functions: Identify, Protect, Detect, Respond, Recover, Govern.
• Use MITRE ATT&CK - finer kill-chain knowledge base (tactics, techniques, mitigations, detection). Site: attack.mitre.org.
• Lockheed Kill Chain - seven stages: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and control, Action on objectives. The page only wrote 1 and 2 plus "and so on".
• Example: cafe Wi-Fi, then work Wi-Fi - a trust-boundary story. An untrusted network, then a trusted one. Place it as recon / delivery risk, or as a user who carries a dirty laptop across the hierarchy of trust. Not a how-to.
• TODO: Wi-Fi card holder - lab hardware reminder (adapter in a holder). Not an attack step.

Practice the seven stages in order in the app (Kill Chain drag).

• Open NIST / Kill Chain practice
• Lockheed Martin: Cyber Kill Chain
• NIST Cybersecurity Framework

Quiz cards already in the app: rootkit, bot/botnet, DDoS, NIST six, Kill Chain seven, MITRE ATT&CK.

21. Examples of possible exam questions (Lecture 2 phishing)

Canvas page: Examples of possible exam questions. These are sample questions from the syllabus, not a graded assignment. Same eight prompts are in the ACIT4050 quiz deck (tag: exam).

1. What is the purpose of phishing attacks?
2. What is the difference between phishing, spear phishing and whaling?
3. After successfully sending phishing messages to the victim - how does the phishing attack compromise the victim's information security? How does the attacker gain access to the target systems?
4. Name the principles of influence that get exploited in phishing messages!
5. What are the technological causes that enable phishing attacks in messaging and communication?
6. How will artificial intelligence support phishing?
7. Name four countermeasures that when deployed in an organization are effective against phishing attacks.
8. How does a phishing training platform get used for raising employee awareness in an organization?

Local copy: Examples_of_possible_exam_questions.md. Practice answers in ACIT4050 quiz (filter tag exam or phishing).