Cyberbullying and Social Engineering

Cyberbullying and Social Engineering: A Complete CIPT Guide to Privacy Risk Management

Introduction
Cyberbullying and social engineering appear in the IAPP Certified Information Privacy Technologist (CIPT) Body of Knowledge under privacy risk management, alongside other privacy harms and threats. They are where the human side of technology meets privacy risk. One is about harm to individuals: cyberbullying. The other is about deceiving people to get access to data or systems: social engineering. Both show that privacy can fail even when the technical controls are strong, because people, platforms and design choices can be exploited.

Why It Is Important
1. People are the weakest link. Many industry breach reports find that most breaches involve a human element, such as phishing, pretexting, credential misuse or simple error. A privacy technologist who only thinks about encryption and access control will miss the most common way attacks start.
2. Privacy harms go beyond data breaches. Cyberbullying can cause emotional distress, damage to reputation, loss of employment and even physical danger. Frameworks such as Daniel Solove's Taxonomy of Privacy and Ryan Calo's subjective and objective harms show that privacy violations include more than unauthorised disclosure. They also include intrusion, exposure, distortion, appropriation and increased accessibility.
3. Legal and regulatory exposure. Organisations that host user content or process personal data may face legal obligations. Examples include:
- GDPR Article 32 requires appropriate security.
- GDPR Article 25 requires data protection by design.
- COPPA protects children online.
- The EU Digital Services Act, the UK Online Safety Act, and various state anti-cyberbullying and anti-doxxing laws impose content and safety duties.
4. Design responsibility. Technologists build the features that bullies and social engineers exploit. Examples include public profiles, location sharing, search, tagging, messaging, password reset flows and help desk procedures. Privacy by design means anticipating misuse.
5. Trust and reputation. Platforms seen as unsafe lose users. Companies whose staff are easily tricked lose customer confidence.

What Is Cyberbullying?
Cyberbullying is the use of electronic communication (social media, messaging apps, gaming platforms, email, forums) to harass, intimidate, humiliate, threaten or target an individual, usually repeatedly. It is a privacy issue because it often depends on the exposure, misuse or manipulation of personal information.

Common forms of cyberbullying:
- Harassment: repeated offensive or threatening messages.
- Doxxing: gathering a person's private information (home address, phone number, employer, family details) and publishing it online to enable harassment. This relates to Solove's aggregation and disclosure harms.
- Outing: revealing someone's secrets or sensitive information, such as sexual orientation or health status, without consent.
- Impersonation and catfishing: creating fake accounts or hijacking real ones to damage someone's reputation. This relates to appropriation and distortion.
- Non-consensual intimate imagery (sometimes called revenge porn): sharing private sexual images without consent.
- Exclusion: deliberately excluding someone from online groups.
- Cyberstalking: persistent monitoring and threatening behaviour, sometimes using location data, stalkerware or tracking devices.
- Flaming and trolling: hostile or inflammatory exchanges designed to provoke.
- Deepfakes and manipulated media: fabricated images, audio or video used to humiliate or defame.

Privacy dimensions of cyberbullying:
- Increased accessibility: information that was technically public but hard to find becomes easy to reach through search and aggregation.
- Persistence: online content is hard to remove, which links to the right to erasure and the right to be forgotten.
- Anonymity: it protects legitimate speech but also shields abusers.
- Scale and virality: harm spreads quickly to large audiences.
- Vulnerable groups: children, teens and marginalised communities are disproportionately affected.

What Is Social Engineering?
Social engineering is the psychological manipulation of people into performing actions or revealing confidential information. It exploits human traits such as trust, fear, urgency, curiosity, helpfulness and respect for authority. Instead of breaking technology, it bypasses technology by targeting people.

Common social engineering techniques:
- Phishing: fraudulent emails that impersonate trusted entities to steal credentials or deliver malware.
- Spear phishing: targeted phishing aimed at a specific person, built from researched personal details.
- Whaling: spear phishing aimed at senior executives.
- Business Email Compromise (BEC): impersonating executives or vendors to redirect payments or obtain data such as W-2 forms.
- Vishing: voice phishing over the phone, increasingly using AI voice cloning.
- Smishing: phishing by SMS or text message.
- Pretexting: inventing a scenario, such as posing as IT support or an auditor, to obtain information.
- Baiting: leaving infected USB drives or offering free downloads to lure victims.
- Quid pro quo: offering a service or benefit in exchange for information.
- Tailgating or piggybacking: following an authorised person into a secured area.
- Watering hole attacks: compromising websites that a target group frequently visits.
- Shoulder surfing: observing screens or keyboards to capture information.
- Dumpster diving: retrieving discarded documents or devices.
- SIM swapping: tricking mobile carriers into transferring a victim's phone number, which defeats SMS-based multi-factor authentication.

Psychological principles exploited (Robert Cialdini's principles of influence are often cited):
- authority
- urgency or scarcity
- social proof
- liking
- reciprocity
- commitment or consistency
- fear

How It Works: The Attack Lifecycle
Social engineering lifecycle:
1. Reconnaissance: the attacker collects open source intelligence (OSINT) from social media, corporate websites, LinkedIn, data broker files and breached datasets. This is where oversharing and poor data minimisation become a risk.
2. Hook and pretext development: the attacker builds a believable story using the gathered data.
3. Engagement: the attacker contacts the target and builds rapport or creates urgency.
4. Exploitation: the victim reveals credentials, transfers money, installs malware or grants access.
5. Exit: the attacker covers their tracks, often leading to a further breach or account takeover.

Cyberbullying lifecycle:
1. Identification of a target.
2. Collection of personal information, sometimes through social engineering itself.
3. Publication or targeted harassment, often amplified by others (a pile-on).
4. Persistence and escalation.

Overlap: social engineering is often a tool of cyberbullies. For example, a bully might trick a platform's support team into revealing account details, or impersonate a victim to reset their password. Both threats rely on the availability of personal data and on platform features that can be abused.

Controls and Mitigations
Against social engineering:
- Security awareness training: regular, role-based training and simulated phishing campaigns.
- Technical email defences: SPF, DKIM and DMARC, spam filtering, banners flagging external senders, and link sandboxing.
- Strong authentication: phishing-resistant multi-factor authentication such as FIDO2 or WebAuthn security keys and passkeys, rather than SMS codes.
- Verification procedures: out-of-band callback verification for payment changes, dual authorisation for financial transfers, and identity verification at help desks.
- Least privilege and need to know: limit what any single tricked employee can expose.
- Data minimisation: reduce what is publicly available about staff and systems.
- Physical security: badges, mantraps, visitor logs, clean desk policies and secure disposal (shredding, media sanitisation).
- Incident reporting culture: easy reporting buttons and a no-blame environment.
- Endpoint protection and USB device control.

Against cyberbullying (platform and design controls):
- Privacy by default: private profiles by default, especially for minors, as in the UK Age Appropriate Design Code.
- Granular audience controls: who can view, comment, tag, message or find a user by phone number or email.
- Blocking, muting, restricting and reporting tools that are easy to find and use.
- Content moderation: a mix of automated detection (machine learning classifiers, hash matching such as PhotoDNA for known abusive imagery) and human review, with transparent appeals.
- Location protections: location sharing off by default, EXIF and metadata stripping from uploaded images, and approximate rather than precise location.
- Friction and nudges: prompts asking a user to reconsider before posting potentially offensive content.
- Age assurance and parental controls where appropriate, balanced against the privacy cost of collecting more data.
- Takedown and erasure processes: support for right-to-erasure requests and removal of non-consensual imagery.
- Account security: to prevent impersonation and takeover, including verification badges and login alerts.
- Data minimisation in search and discovery: limit how easily people can be found or profiled.
- Anti-stalkerware measures: alerts about unknown tracking devices and permission dashboards.

Organisational controls:
- Acceptable use policies.
- Workplace anti-harassment policies covering digital conduct.
- Privacy impact assessments (PIAs/DPIAs) that explicitly consider misuse and abuse cases.
- Threat modelling that includes abuser personas. This is sometimes called abusability testing, or misuse case analysis alongside use cases.

Link to Privacy Risk Frameworks
- Solove's Taxonomy:
- Surveillance and interrogation relate to stalking.
- Aggregation and identification relate to doxxing.
- Disclosure and exposure relate to outing and intimate images.
- Appropriation and distortion relate to impersonation and deepfakes.
- Intrusion relates to harassment.
- Increased accessibility relates to making data easier to find.
- Calo's Harms: subjective harm (the fear and anxiety of being watched or targeted) and objective harm (actual misuse of information against a person).
- Contextual Integrity (Nissenbaum): information moved out of its original context into a hostile one, as happens in doxxing.
- NIST Privacy Framework and FIPPs: data minimisation, security safeguards, purpose limitation and individual participation.
- Risk formula: Risk = Likelihood x Impact. Social engineering raises likelihood. Cyberbullying often has a severe impact on the individual.

How to Answer Exam Questions on Cyberbullying and Social Engineering
CIPT questions are usually scenario-based. You may be asked to identify the type of attack or harm, choose the best control, or decide what a privacy technologist should do first.

Step 1: Identify the threat category. Ask yourself:
- Is someone being manipulated into giving access or information? That is social engineering.
- Is someone being harassed, exposed or humiliated? That is cyberbullying.

Step 2: Name the specific technique. Distinguish carefully:
- Phishing vs spear phishing vs whaling: generic, targeted, or executive-targeted.
- Pretexting vs baiting: a fabricated story versus a lure.
- Vishing vs smishing: voice versus text.
- Doxxing vs outing: aggregating and publishing identifying information versus revealing a secret or sensitive attribute.

Step 3: Map to the privacy harm. Use Solove's taxonomy terms if the question asks what type of privacy violation occurred.

Step 4: Select the most effective, root-cause control. Prefer controls that address the underlying weakness. For phishing-driven credential theft, phishing-resistant multi-factor authentication is stronger than SMS codes. For BEC payment fraud, out-of-band verification and dual authorisation are the key controls. For doxxing on a platform, privacy-by-default settings and metadata stripping beat relying on users to change settings.

Step 5: Consider the layered approach. The best answer often combines people (training), process (verification procedures) and technology (MFA, filtering).

Exam Tips: Answering Questions on Cyberbullying and Social Engineering
Tip 1: Remember that social engineering targets people, not systems. If an answer option is purely technical, such as installing a firewall, it is usually not the best answer for a pure manipulation scenario. Look for training, verification procedures or phishing-resistant authentication.

Tip 2: Watch for keywords:
- Urgent request from the CEO to wire money points to BEC or whaling.
- Caller claiming to be IT support points to pretexting or vishing.
- USB found in the parking lot points to baiting.
- Followed an employee through the door points to tailgating.
- Home address posted online points to doxxing.
- Fake profile using the victim's photos points to impersonation or appropriation.

Tip 3: Security awareness training is important but rarely sufficient on its own. If an option combines training with a technical or procedural safeguard, it is often the stronger choice.

Tip 4: Know that SMS-based MFA is vulnerable to SIM swapping and real-time phishing. FIDO2 security keys and passkeys are considered phishing-resistant.

Tip 5: For platform design questions, favour privacy by design and by default. Protective settings should be on by default, especially for children. Do not rely on users opting in to protection.

Tip 6: Remember that data minimisation reduces the attack surface for both threats. Less publicly exposed personal data means less material for OSINT reconnaissance and doxxing.

Tip 7: When asked about the first step after a social engineering incident, think incident response. That means containing the damage (reset credentials, freeze transactions), then assessing whether personal data was compromised and whether breach notification obligations apply. Examples include GDPR's 72-hour notification to the supervisory authority and US state breach laws.

Tip 8: Recognise the balancing act. Anonymity supports free expression and protects whistleblowers, but it can enable abuse. Age verification protects children but collects more data. The best exam answers acknowledge proportionality and use the least privacy-invasive effective control.

Tip 9: Link threats to frameworks when the question uses framework language. Words such as aggregation, exposure, appropriation, distortion or increased accessibility signal Solove's taxonomy.

Tip 10: Include abuse cases in PIAs and DPIAs and in threat modelling. If a question asks how to prevent a new feature from being misused for stalking or harassment, the answer often involves assessing misuse scenarios before launch.

Tip 11: Eliminate extreme or unrealistic options. Answers like ban all social media or terminate the employee immediately are rarely correct. CIPT favours practical, proportionate and layered controls.

Tip 12: Read the role in the question. As a privacy technologist, your answer should focus on technical and design measures and on cooperation with security, legal and HR, not on acting as law enforcement.

Sample Question Walkthrough
Scenario: An employee in accounts payable receives an email that appears to be from a known supplier, asking to update bank details for future invoices. The email domain differs by one character. What is the BEST control to prevent loss?

Work through the steps:
- Identify: this is social engineering, specifically BEC with a lookalike domain.
- Options: (A) stronger antivirus, (B) out-of-band verification of payment changes using known contact details, (C) encrypting email, (D) annual security training.
- Best answer: B. It is a process control that directly breaks the attack, even if the email gets through. Training (D) helps but is not the best single control. Antivirus and encryption do not address deception.

Summary
Both threats exploit human trust and the availability of personal data. Cyberbullying is a privacy harm that uses technology to harass, expose or impersonate individuals. Social engineering manipulates people into revealing information or granting access. Privacy technologists reduce both through:
- data minimisation
- privacy by design and by default
- strong, phishing-resistant authentication
- verification procedures
- user safety tools
- moderation
- awareness training
- misuse-aware risk assessments

In the exam, identify the technique, map it to the harm, and choose the proportionate, layered, root-cause control.