Lesson 6 of 6
Lesson 6 — Ethics, Law and the AI Arms Race
Bias in security AI, surveillance limits, GDPR and the AI Act, and where the line sits between research and crime.
Learn it
Security AI watches people, so it must be judged on fairness and privacy as well as accuracy.
Testing security on systems you do not own, without written permission, is a crime in most countries.
Laws now cover both sides: data protection rules for what you collect, and AI rules for high-risk systems.
Key terms
- Algorithmic bias
- Systematically different error rates across groups of people.
- DPIA
- Data Protection Impact Assessment — a required risk review for intrusive processing.
- Data minimisation
- Collect only the personal data you actually need.
- Responsible disclosure
- Reporting a vulnerability privately to the owner and giving time to fix it.
- Authorised testing
- Security testing with written permission and an agreed scope.
- Human oversight
- A legal and design requirement that a person can review and override AI decisions.
Try it
Legal and ethical or not? Decide for each scenario.
Running a password cracker against your own lab VM built for the lesson.
Scanning the school network for open ports 'to help', without asking.
Reporting a bug you found in a website through its security.txt contact.
Building a face-matching model from classmates' photos taken without consent.
Publishing a working deepfake tool aimed at bypassing bank voice checks.
Challenge
Practical exam: write an AI Security Policy for a school deploying an AI-powered monitoring tool on student devices. Cover purpose, data collected, fairness testing, human oversight, retention and appeal.
Pick whichever way suits you — every mode earns the same bonus XP.
Write at least 40 more characters to submit.
Mark your own work
Guided walkthrough — 0/3 clues revealed
- Clue 1 locked — reveal it only if you get stuck.
- Clue 2 locked — reveal it only if you get stuck.
- Clue 3 locked — reveal it only if you get stuck.
Each clue costs 7 XP (never below 33 XP). You'd earn 65 XP right now.
Extension: Add a section on what the school does if the vendor's model is found to be poisoned or breached.