Unit 5: Impact of Computing

Unit 5 asks what computing does to people, not how programs work. It covers computing innovations and their beneficial and harmful effects, the digital divide, bias in computing, crowdsourcing, legal and ethical concerns including intellectual property and Creative Commons, and safe computing practices for protecting your data.

5.1 Beneficial and Harmful Effects

A computing innovation is an advance in computing that changes how people live, work, or interact. It always includes a program as an integral part of how it works. It can be a physical device such as a self-driving car or a fitness tracker, a piece of software such as a photo editor or a ride-sharing app, or a computing concept put into practice such as online shopping or streaming video.

Every innovation can be described by its purpose and its function, and the two are not the same. The purpose is the reason it was built. The function is what it actually does. The purpose of a fitness tracker might be to help people exercise more. Its function is to record movement, heart rate, and sleep using sensors and software. When a question asks you to describe an innovation, state both.

Computing innovations are usually designed for a specific purpose, but they produce effects the designer did not plan. Effects can be beneficial or harmful, and the same innovation can be both at once. A ride-sharing app makes transportation more convenient, which is beneficial, and adds traffic and emissions in busy areas, which is harmful. Judge effects in the three areas the exam names: society, economy, and culture. A social media platform changes how society communicates, creates jobs in advertising and content moderation, and spreads trends and languages across borders.

Intended effects are the ones the designer planned. Unintended effects are everything else, good or bad. Responsible design means considering possible unintended effects before release. When a question asks for an unintended effect, look for the consequence nobody built the product to produce.

5.2 Digital Divide

The digital divide is the gap between people who have access to computing innovations and people who do not. Access means more than owning a device. It includes a reliable internet connection, the skills to use technology, and technology designed for your needs.

The divide runs along three dimensions the exam names. Socioeconomic: lower-income households are less likely to afford devices or monthly service. Geographic: rural and remote areas often lack broadband infrastructure, so even families who can pay have no service to buy. Demographic: older adults, people with less formal education, and some racial and ethnic groups have lower rates of access and use. One person can sit on several of these at once.

The divide matters because computing innovations now control access to school, work, and civic life. A student without home internet cannot complete online assignments or join video classes. A job seeker without access cannot apply to jobs posted only online. An access gap becomes an opportunity gap.

Efforts to close the divide target each dimension. Infrastructure projects extend broadband to rural areas. Subsidy programs lower the cost of service and devices for low-income households. Digital literacy programs teach skills to people who own devices but cannot use them fully. Libraries and schools provide public access points. When a question asks which effort fits a situation, match the effort to the dimension that is actually blocking access.

5.3 Computing Bias

Computing bias happens when a computing system produces unfair outcomes for some group of people. The most common source is the training data. Machine learning models learn patterns from the data they are trained on, so if that data reflects past unfairness or underrepresents a group, the model learns the unfairness too.

The pattern to recognize is biased data in, biased decisions out. A hiring tool trained on a company's past hires favors the groups the company used to hire. A facial recognition system trained mostly on light-skinned faces identifies dark-skinned faces less accurately. A lending model trained on historical loan approvals can reproduce the discrimination of earlier decades. The algorithm did not invent the bias. It automated it.

5.4 Crowdsourcing

Crowdsourcing enlists a large group of people, usually volunteers online, to gather data or solve a problem that would be slow or expensive for one team. Citizen science is the research version of this idea: volunteers classify galaxy images, count birds, or donate idle computer time to fold proteins. The shared idea is that many small contributions add up to something no individual could produce alone.

The benefit is scale. Thousands of volunteers can label millions of images in weeks. The limits are quality and bias. Volunteers vary in skill, so results need checking, and contributors are self-selected, so the sample may not represent everyone. Crowdsourced data can be valuable, but only when someone validates it.

5.5 Intellectual Property and Creative Commons

Intellectual property is the set of legal rights that protect creations of the mind. Material created on a computer is the intellectual property of its creator or the creator's organization. The ease of copying and sharing digital work is exactly why these protections exist.

Creative Commons is a public copyright license that a creator applies voluntarily. It keeps the copyright but grants the public permission in advance to share, use, and build on the work under stated conditions. It is how a creator says you may use this work without answering every request individually. The six licenses are built from four conditions.

Attribution is the one condition you can never skip. Every Creative Commons license requires crediting the creator, naming the work, and stating the license. CC0 is separate from the six licenses. It is a public domain dedication in which the creator waives all rights, so no attribution is legally required.

5.5 Open Source, Plagiarism, and Fair Use

Open source software is made freely available. Anyone may view the code, and the license permits redistributing and modifying it. Proprietary software is owned by a company or person and distributed with restrictions, such as no copying or no viewing the source. The difference is the license terms, not the price. Some open source software is sold, and some proprietary software costs nothing.

Plagiarism is using material created by someone else without permission and presenting it as your own. It can have legal consequences, and you should always cite material you did not create. Citation fixes the honesty problem. It does not fix the legal problem. Citing a source does not give you the right to copy it.

Fair use is the legal rule that allows limited use of copyrighted material without permission for purposes such as criticism, comment, news reporting, teaching, scholarship, or research. Courts weigh four factors: the purpose and character of the use, where nonprofit educational use is favored; the nature of the copyrighted work; the amount used relative to the whole work; and the effect of the use on the market for the original. No single factor decides a case, and no fixed percentage of a work is automatically safe.

5.6 How Your Data Is Collected and Used

Personally identifiable information, or PII, is any data that can identify a specific person: full name, home address, phone number, email address, Social Security number, or biometric data. Data that seems harmless can become identifying in combination. A zip code plus a birth date plus a gender can be enough to single out most people in the United States.

Websites and apps collect data about you constantly. Cookies are small files a site stores on your device to remember you, track what you click, and keep you signed in. Third-party cookies follow you across different sites. Location tracking records where your phone goes. Search and purchase histories build a record of your interests. Much of this collection happens under privacy policies that few people read.

Data mining analyzes large collections of data to find patterns. A store can mine purchase histories and learn that buyers of one product often buy another. Data mining itself is neutral. The same techniques that recommend a movie also flag fraudulent charges.

Targeted advertising uses mined data to show you ads matched to your inferred interests. It is the business model behind most free online services. The service is free because advertisers pay to reach you. The trade is your data for their content, and the exam expects you to name that trade.

5.6 Protecting Yourself: Safe Computing

Safe computing is a set of habits that protect your devices and information from unauthorized access. The exam tests four practices by name. The next sections go deeper on how encryption works, who verifies a site's identity, how authentication layers protection, and which attacks these practices defend against.

Encryption protects data in two states, and the exam tests whether you match the protection to the threat. Data in transit is data moving across a network, such as a message traveling to a server. Data at rest is data sitting in storage, such as files on your laptop.

5.6 Encryption: Symmetric and Asymmetric

The safe computing table said that encryption makes data unreadable without the key. There are two kinds, and the exam tests the trade-off between them. Symmetric encryption uses one shared secret key to both encrypt and decrypt, so both sides must hold the same key. It is fast, which makes it the right tool for large amounts of data. Its weakness is the key-distribution problem: sharing the key without anyone intercepting it.

Asymmetric encryption, also called public-key encryption, uses a key pair instead of a shared key. The public key is shared openly and can only encrypt. The private key stays secret and is the only key that can decrypt, so anyone can lock a message with your public key but only you can unlock it. The key-distribution problem disappears. The trade-off is speed. Asymmetric encryption is much slower, so it is a poor choice for bulk data.

HTTPS uses both, in a sequence the exam expects you to know. During the handshake that opens a secure connection, the browser and server use asymmetric encryption to agree on a shared secret over the insecure network. That secret becomes the session key, and everything after that is encrypted symmetrically with it, which is fast enough to keep up.

5.6 Digital Certificates and Certificate Authorities

A public key on its own does not prove who it belongs to. An attacker could hand you their public key while claiming to be your bank. A digital certificate closes that gap by binding a public key to a verified identity, such as a domain name, and carrying the issuer's digital signature and an expiration date. Before the handshake finishes, your browser checks the certificate: a trusted issuer's signature, a matching site name, and a date that has not expired.

A certificate authority, or CA, is the trusted organization that verifies the identity and signs the certificate. When a site owner requests one, the CA confirms the requester controls the domain, then issues the signed certificate that the site sends to every visitor. Your device ships with a list of CAs it trusts, and that list is what makes the whole chain work.

5.6 Authentication: Strong Passwords and Multi-Factor Authentication

The safe computing table listed strong passwords and multi-factor authentication as separate practices because they defend an account in different ways. A strong password is long and unique to each account. Length matters more than clever substitutions, and uniqueness matters because breaches happen: when one site leaks its password database, attackers try those same passwords everywhere else. A password manager generates and stores a different long password for each account, so you only need to remember one.

Even a strong password is still a single kind of proof, something you know. Multi-factor authentication requires two or more different kinds of proof: something you know such as a password or PIN, something you have such as your phone or a hardware key, and something you are such as a fingerprint or face scan. The common second factor is a code from an authenticator app or text message. With MFA turned on, a stolen password alone cannot open the account, which is why the exam treats it as the defense that survives a password breach.

5.6 Cybersecurity Threats

Safe computing habits exist because specific attacks target your devices and accounts. Each attack below works by a distinct method, and the exam expects you to tell them apart.

Confusions That Cost Points

Practice Questions

Original questions written for this guide in the style of the AP exam. Answers and explanations are on the next page, so complete the questions before checking them.

Answer Key

1. D. The handshake uses public-key encryption only to agree on the shared secret, because that solves the key-distribution problem. The bulk data is then encrypted symmetrically because symmetric encryption is fast. A is wrong because symmetric encryption is faster than asymmetric encryption, not slower. B is wrong because the shared secret is used: it becomes the session key that encrypts all the page data. C is the trap: a method being harder to break does not mean it is used for everything, and asymmetric encryption is too slow for bulk data.

2. B. This is the geographic dimension of the digital divide: the student cannot buy service that does not reach her area. A is about preference, not access. C describes someone who has access and chooses not to use it. D is about device use habits after access was provided, not about a gap in access.

3. A. The model learned the discrimination present in its training data and reproduced it. This is the standard bias pattern: biased data in, biased decisions out. B assumes programmer intent, which the scenario never mentions. C is wrong because the model had decades of data; the problem is what the data contains, not how much there is. D blames the applicants instead of the training data.

4. C. The deceptive email impersonating a trusted office to steal credentials is phishing. A is wrong because keylogging silently records keystrokes; this attack tricks the victim into volunteering credentials through a fake page, which is a different method. B is wrong because ransomware encrypts files and demands payment; nothing here is encrypted or held for ransom. D is wrong because a virus is malware that needs a host file and a person to run it; this attack is social deception, not a spreading program.

5. D. NC means noncommercial, and a blog that runs ads is a commercial use, so this use is blocked. A is wrong because every Creative Commons license requires attribution, including for school use. B is wrong because the ND licenses block adaptations; not every license allows them. C is the classic trap: Creative Commons always carries conditions.

6. A. Open source code is still copyrighted, and its license sets conditions such as attribution or sharing modifications. B is the open source vs public domain trap: the library is licensed, not rights-free. C is wrong because open source code has an owner who chose the license. D is wrong because open source licenses permit use without payment; price is not the issue.

7. C. Fair use is decided by weighing the four factors: purpose and character of the use, nature of the work, amount used, and effect on the market. A is wrong because no length of clip is automatically fair and citation is about plagiarism, not fair use. B is wrong because fair use is exactly the exception to permission. D is wrong because citing a source avoids plagiarism but does not grant legal permission.

8. B. The notes are in transit across the coffee shop network, and an encrypted connection such as a VPN or HTTPS protects data in transit from interception. A protects access to the laptop, not data on the network. C protects data at rest on the hard drive, which is the wrong state. D does nothing to protect data while it travels.

One-Page Recall Check

Say each answer out loud before you look back, and mark the ones you cannot finish. Anything you cannot say out loud yet belongs in your flashcard deck. In Rycal, add those items to the Impact of Computing deck and let spaced review bring them back over the next few days.

• Define a computing innovation and give one example each of a physical innovation, a software innovation, and a computing concept.
• Explain the difference between an innovation's purpose and its function.
• Describe one beneficial and one harmful effect of the same innovation, naming whether each affects society, the economy, or culture.
• Distinguish an intended effect from an unintended effect.
• Explain the difference between an innovation causing a change and enabling it.
• Define the digital divide and name its three dimensions, with an example of each.
• Name two efforts to close the digital divide and the dimension each one addresses.
• Explain how biased training data produces biased outcomes, using the hiring or lending pattern.
• Define crowdsourcing and give one citizen science example, plus one benefit and one limit.
• State what copyright, patents, and trademarks each protect.
• List the four Creative Commons license conditions and explain what each one restricts.
• Explain why open source software is not public domain.
• Distinguish plagiarism from copyright infringement and from fair use.
• Define PII and name three ways websites and apps collect data about you.
• Explain how data mining leads to targeted advertising.
• Name the four safe computing practices and what each one protects.
• Distinguish threats to data in transit from threats to data at rest, and name the protection for each.
• Explain the difference between symmetric and asymmetric encryption, and describe the role each one plays in an HTTPS connection.
• Explain what a digital certificate binds together, and state what a certificate authority does and does not vouch for.
• Describe how phishing, keylogging, ransomware, and a DDoS attack each work, and explain how they differ from one another.
• Explain what makes a password strong, and describe how multi-factor authentication protects an account even when the password is stolen.

Key terms for this unit

Computing innovation, Purpose and function, Intended and unintended effects, Society, economy, and culture, Digital divide, Computing bias, Training data, Crowdsourcing, Citizen science, Volunteer computing, Intellectual property, Copyright, Patent, Trademark, Creative Commons, Attribution, CC BY, CC BY-SA, CC BY-NC, CC BY-NC-SA, CC BY-ND, CC BY-NC-ND, CC0, Open source, Proprietary software, Public domain, Open access, Plagiarism, Fair use, Personally identifiable information (PII), Cookies, Location tracking, Data mining, Targeted advertising, Strong password, Multi-factor authentication (MFA), Encryption, Symmetric encryption, Asymmetric (public-key) encryption, Session key, Digital certificate, Certificate authority, Phishing, Keylogging, Malware, Computer virus, Ransomware, Distributed denial-of-service (DDoS), Software update, Data in transit, Data at rest.

About this guide. Written for Rycal and aligned to the College Board AP Computer Science Principles course framework, Unit 5. All questions and explanations are original Rycal writing. Rycal is independent and is not affiliated with or endorsed by the College Board.