Oswego

Karla Lellis is an Adjunct Professor at SUNY Oswego and an expert in cybersecurity law, data privacy and compliance. She is pursuing a Doctor of Juridical Science (S.J.D.) at Syracuse University, focusing on cybersecurity class actions and holds an LL.M. from the same institution. Karla combines academic excellence with over 20 years of professional experience as a compliance lawyer.

Karla has developed innovative curricula in cybersecurity and privacy law, integrating real-world applications such as GDPR, HIPAA and CCPA into her teaching. She also mentors’ startups through the "Make Data Safe" program at Syracuse University’s LaunchPad, helping businesses achieve privacy compliance. A published author and sought-after speaker, Karla is dedicated to advancing knowledge and inspiring future leaders in cybersecurity and data privacy.

Teaching Cybersecurity Law to the Social Media Generation

Teaching cybersecurity law to today's college students, often called the "Social Media Generation," presents a unique opportunity to cultivate a generation of secure, ethical and informed digital citizens. These students are highly adept at using technology, yet many lack awareness of the legal and ethical complexities surrounding data privacy, cybersecurity and digital rights. Educators must adopt innovative strategies that align with their digital habits, preferences and aspirations to connect effectively with this audience.

Understanding the Audience

The Social Media Generation is fluent in digital tools but often unaware of cybersecurity risks and the impact of laws like the GDPR and CCPA on their daily activities. This gap offers educators a chance to teach cybersecurity law in ways that empower students to apply their knowledge meaningfully. Students thrive in interactive and technology-rich environments, favoring exploratory learning (Prensky, 2001). Mishra and Koehler's TPACK Framework emphasizes integrating technological, pedagogical and content knowledge to design effective curricula for digital-age learners (Mishra & Koehler, 2006).

Integrating Interactive Technologies

Interactive tools such as online quizzes, collaborative brainstorming platforms and real-time feedback systems make complex legal concepts more accessible. Simulating legal scenarios where students analyze the implications of data breaches or privacy violations bridges the gap between theoretical understanding and practical application, engaging students in active problem-solving.

Case Studies from Social Media

Case-based learning (CBL) connects theoretical knowledge to real-world scenarios, fostering critical thinking and contextual understanding (Herreid, 2011). High-profile cases involving platforms like TikTok and Facebook engage students by linking legal principles to their digital interactions. For instance, analyzing the Facebook–Cambridge Analytica scandal allows students to explore data breaches, privacy law violations and legal remedies while sparking debates on social media companies' ethical and legal responsibilities. These discussions make abstract concepts tangible and relevant.

“Integrating technology in cybersecurity law education is both essential and an opportunity to inspire ethical leaders equipped to shape the digital future.”

Real-World Projects

Project-based learning (PBL) fosters deeper learning by encouraging students to tackle complex, real-world challenges (Bell, 2010). One example is the HIPAA Guidebook project, where students collaborated to help small healthcare businesses achieve compliance. This project included writing articles explaining HIPAA regulations and creating actionable checklists. Students also drafted privacy policies for hypothetical startups, ensuring compliance with HIPAA and CCPA and presented their policies in simulated legal consultations. Such projects bridge the gap between theory and practice while fostering critical thinking, collaboration and communication skills (Blumenfeld et al., 1991).

Gamifying Cybersecurity Law

Gamification enhances engagement and problem-solving skills in cybersecurity law education (Deterding et al., 2011). Capture-the-Flag (CTF) challenges, for instance, allow students to engage in simulated cybersecurity incidents, identify vulnerabilities and propose legal strategies. Simulated data breach exercises help students apply theoretical knowledge in practical contexts, preparing them for real-world challenges. This approach makes learning interactive and equips students with essential skills for the evolving cybersecurity landscape.

The Role of Social Media in Learning

Social media can serve as a valuable teaching tool, encouraging creativity and engagement. Assignments like creating TikTok videos or Instagram posts summarizing cybersecurity laws enable students to internalize complex concepts effectively. Greenhow and Lewin (2016) highlight social media's potential as a participatory learning platform that fosters collaboration and critical thinking. For example, short Instagram Reels explaining the CCPA allow students to disseminate legal knowledge in accessible formats. However, institutions should discuss the academic use of social media to align with policies. JMIR Mental Health (2024) emphasizes fostering emotion regulation skills to help students navigate online environments effectively rather than imposing bans.

Bringing Ethics into the Conversation

Cybersecurity law is not just about regulations but also about understanding technology's ethical implications. Socratic questioning encourages students to critically analyze privacy and data protection scenarios. Questions such as, "What are the ethical obligations of companies collecting biometric data?" challenge students to explore multiple perspectives, nurturing empathy and ethical reasoning.

The Positive Outcomes of Learning Cybersecurity Law

Teaching cybersecurity law offers significant benefits for students and society. For students, it develops critical skills like analytical thinking, problem-solving and adaptability—qualities highly valued in the job market. Educators play a crucial role in this process, preparing students for diverse career paths in legal practice, data protection and public policy. For society, it creates informed individuals equipped to navigate and influence the digital world responsibly. Moreover, the interdisciplinary nature of cybersecurity law—bridging technology, law, ethics and communication—prepares students for diverse career paths in legal practice, data protection and public policy.

Looking Ahead

Educators must adapt to the evolving digital landscape by using methodologies like the SAMR Model, TPACK Framework and case-based learning to create engaging educational experiences. Interactive, real-world approaches to cybersecurity law make the subject accessible while preparing students for legal challenges in a connected world. Integrating technology in cybersecurity law education is both essential and an opportunity to inspire ethical leaders equipped to shape the digital future.