Cybersecurity Detectives: Strong Passwords and Spotting Scams
Grade 5 · Cybersecurity & AI Education · NYS 4-6.CY.1 · 45 Minutes
NYS-Aligned Standard
4-6.CY.1 — Explain why different types of information might need to be protected. NYS Computer Science and Digital Fluency Learning Standards (2020)
Learning Objectives — “I Can” Statements
- I can explain why different kinds of information (passwords, money info, identity) need protection.
- I can judge whether a password is strong or weak and improve a weak one.
- I can spot warning signs of an online scam or phishing message.
Essential Question
What makes information worth protecting, and how do detectives spot a scam?
Station Rotation (3 stations · ~12 min each + 9 min debrief)
Station 1 — Password Lab
Students rank five sample passwords from weakest to strongest using a rubric (length, mix of letters/numbers/symbols, not a real word, not personal info). They then rewrite the weakest one into a strong passphrase.
Station 2 — Spot the Scam
Students examine three original messages (a “you won a prize” text, a “your account is locked, click here” email, a friend message asking for a gift-card code) and circle the red flags: urgency, links, requests for personal info or money, misspellings, unknown sender.
Station 3 — Protect or Share?
Students sort information cards into Protect (password, home address, family bank info, full birth date) and Okay to share with friends (favorite team, hobby) and write why the protected items matter.
Debrief (9 min)
Each group reports one red flag and one reason a type of information must be protected.
SDI & Differentiation Block
Supports for MLLs/ELLs
Entering/Emerging (NYSESLAT Levels 1–2):
- Icon-supported rubric (lock = strong; open lock = weak); highlighter for red flags.
- Sentence frame: “This password is weak because ___ .”
Transitioning/Expanding (NYSESLAT Levels 3–4):
- Pre-teach: protect, private, password, passphrase, scam, phishing, urgent.
- Sentence frame: “A red flag in this message is ___ , so I would ___ .”
Supports for Students with IEPs
SDI Adaptation Dimensions: content, methodology
- Content: Reduce to 3 passwords and 2 scam messages.
- Methodology: Provide a checklist of red flags students tally rather than generate.
Suggested Placement: ICT, Resource Room
Answer Key / Model Responses
Station 1: Weakest = a short real word or “password123”; strongest = a long passphrase mixing unrelated words, numbers, and a symbol. Sample upgrade: “cat” → “Blue7Turtle!Garden”.
Station 2 red flags: urgent threat/prize, click-here link, request for a code/money, unknown sender, misspellings.
Station 3: Protect — password, home address, family bank info, full birth date (can be used for identity theft or to access accounts/money). Okay to share — favorite team, hobby.
Alignment Record
| Field | Value |
|---|---|
| Standard Code | 4-6.CY.1 |
| Standard Text | Explain why different types of information might need to be protected. |
| Framework | NYS Computer Science and Digital Fluency Learning Standards (2020) |
| Source | nysed.gov — NYS CS & Digital Fluency Learning Standards (2020) |
| Confidence | High Confidence |
| Validation Notes | Code 4-6.CY.1 confirmed; CY = Cybersecurity, grade band 4–6, Risks sub-concept. Stations require students to explain why specific information types need protection. All passwords, messages, and cards are original; no real personal data is used. |