Twists and Turns: A Non-linear Lecture

You are the cybersecurity analyst at CyberTech Inc. It is Tuesday morning and your mood is as dark as your coffee." This is the introduction to the last lecture before the exam for Introduction to Security and Privacy. The date of the exam is written at the bottom of the website. Above it, the fresh blue link invites the students to start their journey through the non-linear story that is today’s lecture.

The room’s mood is neither dark nor light. It is surprisingly similar to the atmosphere of any other lecture. Some students are eager to learn, but they don’t show it. Some are tired. Some are disinterested. There is no excited buzz. No crowd gathered to witness the event. Just a murmur of student conversation. No difference from a normal lecture, it seems. Except there is.

Dominik asks the first student to make a choice: “What do you want to do? Investigate this security alert or ignore it”. The student wants to ignore it and instead check the mailbox. Four emails sound important. Dominik asks another student to choose one. Each mail contains a problem to be solved. To do so, the students need to know the course content and apply their knowledge.

The murmur stops. The mood shifts. The students focus their attention.

They would be hard pressed otherwise. They may have to make the next decision. Or solve the next problem. Tension fills the room. But also curiosity.

The solutions are not easy to find here. In other lectures, students are presented with fact after fact, solution after solution. Here, they have to work through the problems to find the solution. “I tried to think through the questions and if I got the answer, I was happy”, one of them says after the lecture. “And if not, I was even more happy after hearing the solution.”

In the story, the protagonist’s colleague enters the room.

“Rena asks whether the following code that displays the comments is subject to an SQL injection.”

It is just a side branch of the story. A few lines of code. But what Dominik did not anticipate when he built this part of the story is that his students are not as familiar with SQL as he thinks they are. And what they don’t know is that he has chosen a tricky scenario to avoid making the problem too easy to solve.

A guessing game begins. “One could put the command in a string and pass it as input.”

“Okay”, says Dominik. “What command?”

Suggestions are made. Dominik tries them all and explains why they don’t work. This interaction is what he wanted. Why he created the non-linear story in the first place. “You can’t create this dynamic by standing there and saying: what questions do you have today? Because then nobody has any questions.” So you have to provide some kind of bait to bring curiosity to the surface.

Eventually the suggestions run out. Maybe the code is safe? Nobody really believes that.

But when Dominik tries to help, he finds that the solution has slipped his mind.

“Whenever you’re not sure whether such a code is secure, the best thing to do is to assume that it’s not,” he advises to dispel any doubts about the general approach. “Because … often, it isn’t.”

A great piece of advice. Something the students will remember, all the more so because it is so difficult to find the current issue. But not enough for anyone to leave the lecture with.

“So let’s check the documentation”, says Dominik.

This was his worry before starting. “I don’t always know what’s coming, so what if I don’t know the answer?” There are no slides to help him, and he does not want to spoil the fun by looking at his notes. “I’ll have to deal with it somehow”.

And so he does. He is now looking for the solution along with his students. Everyone in the classroom is leaning in.

“What if …?”

“And if …”

In the end, he finds the answer. The students sit back. The mystery is solved. But wait, there’s more time. More choices to be made.

Returning to the story gives a sense of control and curiosity. None of the students are bored or sleepy, on the contrary. “This lecture is much more fun than others”, says one of them. “I don’t fall asleep as I would during a normal lecture!”, says another. Some of them have stopped going to other lectures altogether because they see no benefit for themselves. But they come here.

Of course, not everyone enjoys this level of interactivity. There is no one-size-fits-all solution. Nor would Dominik use this kind of storytelling in every lecture. In fact, it’s not even a real story. “It looks like a story, but if you are honest, it is not a story at all”, he says. It is a collection of events with a stereotypical IT security analyst and a bunch of stereotypical antagonists, meant to give an impression of what it is like to work in such an environment. Of the conflicts that exist and the attitudes that can arise.

“This can’t really be the subject of a lecture, but I think it’s a really important – how do you say – social skill, which ideally you’ve at least heard about before you graduate.”

Does it matter that it is not a real story?

For one student it does: “I’d suggest to design the storyline in a way where in the end some goal is attained, like in a classic story. Otherwise it feels a bit unfulfilling.”

Something to improve for the next version. This time, “a bit unfulfilling” is acceptable if it goes hand in hand with students realising that lectures “don’t have to be boring”.

At the end of the lecture, everyone is exhausted but happy, even Dominik. “Except for that professor-can’t-do-it-either moment”, he says. “Which is perhaps also agreeable.” And except for the fact that he would have liked to spend less time on SQL, which is not the main subject of the course. Then again, as he says, “privacy and security is at the heart of everything.”

The students don’t mind at all. One of them says: “it was the first lecture where I understood something.” “The lecture showed me ways to consider things in a way I wouldn’t have thought about on my own,” says another. And a third adds: “I wasn’t as engaged with the ideas before.”

They say that “the small scenario is really efficient to capture the students’ attention” and that it is “more interesting to follow than basic question/answer sessions.” One claims “it made the material appear less daunting and more fun.”

It wasn’t a perfect lecture. It wasn’t a real story. But it served its purpose: to give the students something worth coming for.

The lecture that this story is based on was given in early 2024. Dominik has shared more recent reflections on storytelling and uncertainty in the short article When the Story Isn’t the Story.