Societal Impact

Every time you use the internet you leave data behind. That trail is your digital footprint. It is not one neat file sitting in one place. It is scattered across the servers of every app, website, network and advertiser your device touched, plus the backups those servers keep.

There are two kinds, and the difference is exactly what board questions test.

• Active digital footprint — data you deliberately put out. A reel you upload, a comment under a YouTube video, a review on Zomato, a form you fill on IRCTC, a resume uploaded to a job portal, a WhatsApp status, a Google Form for a school event.
• Passive digital footprint — data collected about you without any deliberate act on your part. The IP address and browser details a news site logs the instant the page opens, cookies, location from your phone, which links you clicked and how long you stayed on each page, the Wi-Fi networks your phone tried to join.

Why a footprint is so hard to erase. The internet does not move data, it copies it. When you "send" a photo, your copy stays and a new copy lands on a server, which then replicates to backup machines, caches and content delivery nodes. Anyone who saw it can screenshot it. So deleting your copy removes your copy only. This is a consequence of how the network is built, not a setting you can switch off. Assume that anything you post can outlive your account.

Worked example — one evening of Riya's phone. Riya, a Class 11 student in Nagpur, spends an hour online. Classify each trace.

One row deserves care, because it is the row examiners use to separate careful students from careless ones. The search Riya typed is active — she composed it and pressed enter. What the search engine then quietly records around that query — which results she hovered over, which link she clicked, how long she stayed before coming back — is passive. A single episode routinely produces both kinds of trace at once, so classify the individual action, not the whole event.

Notice that Riya's passive footprint is larger than her active one, and she did not consent to most of it in any meaningful way. That asymmetry is the whole reason data-protection law exists.

Digital society and the netizen. A digital society is one where a large part of ordinary life — banking through UPI, school work, ticket booking, ration and scholarship applications, entertainment, friendships — runs through digital technology. A person who takes part in it is a netizen (net + citizen). Being a netizen is not just about having a data pack; it means carrying the same duties online that you have offline. Those duties are collected under netiquette.

Net etiquette — the general rules:

• Be ethical. Do not pirate software, films or books. Do not access someone else's account, even if you happen to know the password. Give credit when you use someone's work.
• Be respectful. Respect privacy — do not forward a private chat, photo or phone number without permission. Respect diversity of religion, region, caste, gender and ability; a "joke" that targets a group is not a joke online any more than it is in class.
• Be responsible. Do not feed a troll. Do not take part in bullying, even by staying in the group and laughing. Verify before you forward — a forwarded rumour is your message once you send it.

Communication etiquette — for email, chat and video calls:

• Be precise. Do not waste the reader's time. One clear subject line, the point in the first two lines, no ten-message chat where one message would do, no huge attachments when a link will do.
• Be polite. No abuse, no sarcasm that cannot be read in text, no ALL CAPS (it reads as shouting). Match the register to the reader — the way you message a friend is not the way you write to a teacher or a college admissions office.
• Be credible. Say true things, do not exaggerate, and do not send an email under someone else's name. Think before you press Reply All.

Social media etiquette: choose your connections carefully, keep profiles private if you do not need them public, do not overshare (live location, travel plans, school name and section, exam roll numbers), never post someone else's photo without asking, check whether a shocking claim is fake before you share it, and think about how a post will read in five years to a college or an employer.

A workable rule: post only what you would be comfortable seeing pinned on the school notice board with your name on it.

Ideas are expensive to create and almost free to copy. If anyone could copy a program, a song or a textbook the moment it appeared, very few people would fund making them. Intellectual Property Rights (IPR) fix this by giving a creator a legal monopoly over their creation for a defined period. The bargain has two sides: the creator gets exclusive control, and in exchange the work is disclosed and — for copyright and patents — eventually becomes free for everyone to use. A trademark is the exception to that second half: it can be renewed for as long as it is genuinely in use, because its job is to stop customers being misled rather than to reward creation.

The three you must know.

Two points students get wrong. First, copyright protects the expression, not the idea — you may write your own sorting tutorial, you may not copy someone else's tutorial. Second, in India software is protected as a literary work under copyright, not by a patent — a computer program by itself is not patentable here — which is why the licence text bundled with a program matters so much.

Violation of IPR.

• Plagiarism — presenting someone else's work, words or ideas as your own without acknowledgement. It is primarily an ethical and academic offence, and it can happen even with material that is completely free to use.
• Copyright infringement — reproducing, distributing, performing or adapting a protected work without permission and without a valid exception. It is a legal offence, and it can happen even when you give full credit.
• Trademark infringement — using a mark identical or deceptively similar to a registered mark for similar goods or services, so that an ordinary buyer could be confused about who is selling it. The harm being prevented is confusion, not copying as such.

The plagiarism-versus-infringement pair is the most repeated question in this unit, so hold the two axes separately: credit and permission.

Indian copyright law does allow limited fair dealing — for private study, research, criticism, review and reporting current events — but that is a narrow exception, not a licence to lift a whole chapter into a project.

Open source software and licensing. Without a licence, the default position for any work is "all rights reserved" — you may not copy it. An open licence is the author saying yes in advance, on stated conditions. Note that "free software" means free as in freedom (to run, study, modify and redistribute), not free of cost; the terms FOSS and FLOSS are used to make that clear.

• GPL (GNU General Public License) — a copyleft licence. You may use, study, modify and redistribute, but if you distribute a modified version it must also be released under the GPL with its source code available. The freedom is forced to travel down the chain. The Linux kernel is released under version 2 of the GPL.
• Apache License 2.0 — a permissive licence. You may use, modify and redistribute the code, including inside a closed-source commercial product. You must keep the copyright and licence notices and state the changes you made. It also includes an express patent grant from the contributors, which is why companies like it.
• Creative Commons (CC) — meant for creative content (text, photographs, music, courseware) rather than code. It is built from four blocks: BY (give attribution), SA (share alike — your version must carry the same licence), NC (non-commercial use only) and ND (no derivatives — do not modify). These combine into six licences, from the very permissive CC BY to the very restrictive CC BY-NC-ND. CC0 is the separate tool by which an author waives rights and places a work as close to the public domain as the law allows. Wikipedia's text, for instance, is available under a Creative Commons Attribution-ShareAlike licence.

Worked example — Ananya builds a school website. Ananya, in Class 11, makes a site for her school's science club. Judge each of her five choices.

A cyber crime is any criminal offence in which a computer, a computer network or a computer resource is the target of the crime, the tool used to commit it, or the place where it happens. In India these are handled mainly under the Information Technology Act, 2000 (heavily amended in 2008), read together with the general criminal law — the Bharatiya Nyaya Sanhita, which replaced the Indian Penal Code from 1 July 2024.

Hacking. Gaining access to a computer system, network or data without authorisation. The colour labels are worth knowing:

• White hat — tests security with written permission from the owner and reports the flaws. This is a legitimate profession.
• Black hat (also called a cracker in older textbooks) — breaks in to steal, damage or extort.
• Grey hat — breaks in without permission but without malicious intent, often to show off a flaw. Well-meaning or not, it is still unauthorised access and still an offence.

The line is permission, not skill. Logging into a friend's account because you happened to see the password is unauthorised access, even though nothing was "hacked" in a technical sense.

Eavesdropping. Secretly intercepting a communication while it is in transit — reading data that was never meant for you. The everyday routes are open or fake "Free Wi-Fi" hotspots at a railway station or mall, packet sniffing on an unsecured network, and a keylogger quietly installed on a shared computer, which captures your keystrokes before they are ever encrypted. Its lowest-tech relative is shoulder surfing — simply watching over your shoulder as you type a UPI PIN in a queue. Nothing is intercepted on the wire there, but the attacker ends up with the same secret. The defences are encryption (HTTPS everywhere), not entering passwords on untrusted networks, and covering the keypad.

Phishing and fraud emails. A message that impersonates a trusted party — your bank, the income tax department, IRCTC, a courier company, even your own school — to trick you into handing over credentials or clicking a malicious link. Variants: spear phishing (aimed at one named person, using details about them), vishing (a phone call: "I am calling from your bank, kindly confirm the OTP") and smishing (SMS). The recurring signs are:

• Manufactured urgency and threat — "your account will be blocked in 2 hours".
• A lookalike domain that is not the real one.
• A generic greeting, odd grammar, or a logo that is slightly wrong.
• An unexpected attachment, or a link whose visible text differs from where it actually goes.
• Any request for OTP, PIN, CVV or password. No Indian bank, no UPI app and no government office ever asks for these.

Worked example — reading a suspicious link with Python. Aditya gets an SMS: "Your IRCTC refund of Rs 1,240 is pending, claim here." Instead of tapping, he pulls the link apart.

link = "http://irctc-refund-status.co.in/login"
print(link.startswith("https://"))
host = link.split("/")[2]
print(host)
print(host.endswith("irctc.co.in"))
print(host.count("-"))

Output:

False
irctc-refund-status.co.in
False
2

Three red flags in four lines: the link is plain http, the real host is irctc-refund-status.co.in which does not end with irctc.co.in, and the brand name has been padded with hyphens so it merely looks familiar. The trick is always the same — the genuine brand name is placed where you read first, while the part that actually decides the destination sits at the end of the host name.

Ransomware. Malware that encrypts your files and demands a payment, usually in cryptocurrency, for the decryption key. It typically arrives through an infected attachment, pirated or cracked software, or an unpatched system exposed to the network. The WannaCry outbreak of May 2017 disrupted organisations across many countries, including in India. Two rules: keep offline backups (ransomware encrypts the connected backup too), and understand that paying guarantees nothing — many victims pay and still do not get their files back, and payment funds the next attack.

Cyber trolling. Deliberately posting provocative, insulting or off-topic messages to upset people or derail a discussion. A troll usually wants a reaction from anyone. The correct response is to not feed it: do not reply, report the account and block.

Cyber bullying. Repeated harassment, threatening, humiliating or targeting of a specific person using digital means — abusive messages, spreading rumours in a class group, circulating morphed photographs, creating a fake profile in someone's name, deliberate exclusion from groups. Because it follows the victim home through the phone, it does not stop at the school gate. It is a crime, not a joke, and silently staying in the group makes a person part of it. Warning signs in a victim: sudden withdrawal, avoiding the phone or school, falling marks, changed sleep.

How to report it in India.

• cybercrime.gov.in — the National Cyber Crime Reporting Portal. Complaints relating to women and children can be filed there anonymously.
• 1930 — the national helpline for cyber financial fraud. Call it immediately; the sooner a fraudulent transaction is reported, the better the chance of stopping the money before it is withdrawn.
• Your local police cyber cell, which can register an FIR.
• CERT-In (Indian Computer Emergency Response Team), created under Section 70B of the IT Act and working under MeitY, is the national nodal agency for cyber security incidents — it issues advisories and coordinates response, mainly for organisations.

Before reporting anything, preserve evidence: screenshots with date and time, the sender's number or account handle, the full message, transaction IDs. Do not delete the messages in anger.

Cyber safety is the set of habits that keep you, your data and your device out of trouble. It is mostly boring and mostly effective.

Safely browsing the web.

• Read the address bar, not the padlock. HTTPS and a padlock mean only that the connection to that server is encrypted. They do not mean the site is honest — criminals obtain certificates too. What matters is the domain name itself, read carefully, letter by letter, from the right-hand end.
• For anything involving money, type the address yourself or use a saved bookmark or the official app. Never reach your bank through a link in a message.
• Keep the browser and the operating system on automatic updates. Most successful attacks use a hole that was patched months earlier.
• Avoid pirated software, "cracked" versions and free-download mirror sites. That is the single most common way home computers get infected.
• On a shared or school computer: log out, do not save passwords, and clear history and cookies afterwards.
• Cookies are small files a site stores in your browser to remember you. First-party cookies are useful (they keep you logged in). Third-party cookies mostly exist to follow you between sites.
• Incognito / private mode hides history on that device only. The website, the school network, your employer and your ISP can all still see the visit. It is a privacy tool against the next person using the same computer, nothing more.

Identity protection. Identity theft happens when someone collects enough of your personal data to pretend to be you — open an account, take a loan, or post in your name. Reduce what is available to collect:

• Use a long passphrase rather than a short complicated password, and never reuse one password across sites. One leaked site then cannot unlock the rest.
• Turn on two-factor authentication wherever it is offered.
• Never share an OTP, PIN, CVV or password — not with a caller, not with a "bank official", not with a friend.
• Share the minimum. Do not post your full date of birth, address, school section, Aadhaar number or a photo of a ticket with a PNR on it. UIDAI offers a masked Aadhaar and a Virtual ID precisely so you can prove identity without handing over the full number.
• Check what an app asks for. A torch app that wants your contacts and SMS is not a torch app.
• Review privacy settings on social accounts, and search for your own name occasionally to see what is public.

Confidentiality of information means keeping private data private — your own and other people's. In practice: strong authentication, encryption of sensitive files, access control (only the people who need the data can see it), careful sharing, and secure disposal. That last one is easy to forget: a "deleted" file is usually still recoverable, so an old phone or hard disk must be wiped properly or physically destroyed before it leaves your hands.

Worked example — what should actually appear on screen. A school notice board app displays a student's payment status. Meera checks how much of her data is exposed, and whether her password would survive a leak.

upi_id = "meera.nair@okhdfcbank"
card = "5241 7788 0043 1290"

print("Shown on screen:", upi_id.split("@")[0][:2] + "*****@" + upi_id.split("@")[1])
print("Shown on screen:", "**** **** **** " + card[-4:])

pwd = "meera2010"
weak = ["password", "123456", "meera2010", "qwerty"]
print("In leaked list?", pwd in weak)
print("Has uppercase?", pwd.lower() != pwd)
print("Length:", len(pwd))

Output:

Shown on screen: me*****@okhdfcbank
Shown on screen: **** **** **** 1290
In leaked list? True
Has uppercase? False
Length: 9

Two lessons. First, a well-built system shows only what is needed to recognise a record — the last four digits — and never the whole number; this is data minimisation. Second, Meera's password is her name plus her birth year, it is short, it has no uppercase character, and a pattern like it already appears on public leaked-password lists. Anyone who knows her can guess it in a few tries.

Malware is the umbrella term for malicious software. The types differ mainly in how they spread, and that is what the exam asks.

The key contrast: a virus needs a carrier and normally a human action (opening the file, running the program) to travel, while a worm needs neither and can cross a whole network on its own. A trojan spreads because you chose to install it — it looked like a free game, a cracked app or a PDF reader. Closely related are spyware and keyloggers, which quietly record what you do and what you type, and ransomware, covered in the previous section.

Defences that actually work: a reputed antivirus with up-to-date definitions, a firewall to filter network traffic, automatic operating system and application updates, regular offline backups, installing only from official stores and official sites, scanning pen drives before opening them, and disabling autorun on removable media.

E-waste is discarded electrical and electronic equipment and its parts — phones, laptops, monitors, printers, keyboards, televisions, routers, chargers, batteries and lamps. Electronics are replaced faster than almost anything else in a house, so the pile grows quickly.

Why it cannot go in the ordinary dustbin. Electronics contain lead (older CRT monitors, solder), mercury (some lamps and older backlights), cadmium, hexavalent chromium and brominated flame retardants in the plastic. In informal recycling, cables are burnt in the open to recover copper and boards are dipped in acid to recover gold. That releases toxic fumes, injures the workers — often including children — and leaves heavy metals in the soil and groundwater.

The same devices are also valuable: they contain gold, silver, copper, palladium and aluminium. Recovering metal from discarded electronics, sometimes called urban mining, is cheaper and far less damaging than digging fresh ore. So e-waste is a hazard and a resource at the same time, which is exactly why it must be routed to people equipped to handle it.

Proper disposal, in order of preference:

1. Reduce — buy what you need, buy durable and repairable equipment, and resist replacing a working device every year.
2. Reuse — a laptop too slow for you is perfectly good for a junior, a school, or an NGO. Sell or donate it.
3. Repair or refurbish — a battery or a screen replacement is cheaper than a new device and produces no waste.
4. Recycle through an authorised recycler or dismantler, or through the manufacturer's take-back or exchange programme. Do not hand it to an informal roadside dealer who will burn it.
5. Dispose safely — batteries and lamps go to designated collection points, never into household waste.

Before you pass on any device: back up, then wipe. Sign out of every account, remove the SIM and memory card, do a factory reset, and for a computer wipe the drive properly. This is where e-waste meets confidentiality — an unwiped phone handed to a stranger is a data leak, not just a disposal.

India's rules. Electronic waste is regulated by the E-Waste (Management) Rules, 2022, which came into force on 1 April 2023 and replaced the 2016 Rules; they are administered by the Central Pollution Control Board. The central idea is Extended Producer Responsibility (EPR): the producer, not just the consumer, is responsible for collecting back and recycling a target quantity of what it sold, and producers, recyclers and refurbishers must register with the CPCB. Internationally, the Basel Convention, to which India is a party, restricts the movement of hazardous waste across borders so that rich countries cannot simply dump it elsewhere.

Worked example — a class e-waste drive. Class 11-B collects old items for a school collection day and records them.

import statistics
items = ["monitor", "keyboard", "mouse", "CFL bulb", "old phone"]
weight = [4.2, 0.9, 0.1, 0.2, 0.18]

print("Items collected:", len(items))
print("Total weight (kg):", round(sum(weight), 2))
print("Average per item:", round(statistics.mean(weight), 3))
print("Heaviest:", items[weight.index(max(weight))])
print("Lightest:", items[weight.index(min(weight))])

Output:

Items collected: 5
Total weight (kg): 5.58
Average per item: 1.116
Heaviest: monitor
Lightest: mouse

Weight is not the same as hazard. The CFL bulb weighs 0.2 kg and the mouse 0.1 kg, but the bulb contains mercury and must go to a designated collection point, while the old phone at 0.18 kg must be wiped before it leaves the building. A disposal plan is decided by what is inside, not by what the scale says.

The Information Technology Act, 2000. Before it, an email had no clear legal standing in India, so an electronic contract could not be relied on. The IT Act, 2000 — modelled on the UNCITRAL Model Law on Electronic Commerce and in force from 17 October 2000 — gave legal recognition to electronic records and digital signatures, which is what made e-governance, e-filing and e-commerce possible here. It also created the first set of offences and penalties for misuse of computer resources.

The Information Technology (Amendment) Act, 2008 substantially widened it. Among the provisions it introduced or reshaped:

• Section 43A — a body corporate handling sensitive personal data must maintain reasonable security practices, and pays compensation if negligence causes wrongful loss.
• Sections 66C and 66D — identity theft, and cheating by personation using a computer resource. This is the pair that covers most phishing and OTP frauds.
• Section 66E — violation of privacy by capturing or publishing images of a private area without consent.
• Section 66F — cyber terrorism.
• Sections 67A and 67B — publishing sexually explicit material, and child sexual abuse material.
• Section 69 — powers of interception, monitoring and decryption in defined circumstances.
• Section 70B — CERT-In as the national nodal agency for cyber security incidents.
• Section 79 — the "safe harbour" framework limiting an intermediary's liability for content posted by users, subject to due diligence.
• It also made electronic signatures technology-neutral rather than tying the law to one method.

One case is worth remembering because it shows a law being tested against the Constitution: Section 66A, which punished sending "offensive" messages, was struck down by the Supreme Court in Shreya Singhal v. Union of India (2015) for being vague and violating freedom of speech. It is no longer valid law. (Separately, India's dedicated personal-data statute is the Digital Personal Data Protection Act, 2023, which is beyond this syllabus.)

Technology and society: gender issues. Access to a computer is not the same as being allowed to use one comfortably. The gaps commonly seen while teaching and using computers are:

• Preconceived notions — the assumption that boys are naturally better with machines, which girls then absorb.
• Fewer role models — if every engineer in the textbook examples and every senior in the lab is male, the subject looks like it belongs to someone else.
• Less encouragement at home and in class, and less unstructured time to tinker and break things.
• Unequal hands-on time — in a shared lab, a few confident students take the keyboard and the rest end up watching or writing notes.
• Unequal access to devices at home, where the one family phone or laptop is often allotted by seniority or gender.
• Online harassment, which pushes some students out of public participation altogether.

What a school can actually do: rotate roles so everyone types, forms mixed groups, allots lab time by turn rather than by who reaches the machine first, uses examples that name women in computing, lends devices, treats teasing in the lab as a discipline matter, and provides a safe way to report harassment.

Disability issues. The standard barriers are unavailability of suitable teaching material and aids, a shortage of trained or special educators, a curriculum that assumes a mouse-and-screen user, and locomotor difficulties that make the lab itself hard to reach or use.

Assistive technology answers much of this: screen readers (NVDA is free and open source, JAWS is commercial), screen magnifiers, high-contrast and large-text modes, refreshable braille displays and braille printers, text-to-speech and speech-to-text, on-screen keyboards, sticky keys and switch access for students who cannot use a standard keyboard, captions and sign-language video, and alternative pointing devices. In India, the Rights of Persons with Disabilities Act, 2016 requires accessibility, and government websites are expected to follow the Guidelines for Indian Government Websites (GIGW).

Accessibility is also something a Class 11 student can practise while making anything: write alternative text for images, add captions to video, keep colour contrast high, never convey meaning by colour alone, make everything reachable with the keyboard, and avoid flashing content. A page built this way is easier for everyone to use, not only for the people who need it.