Being safe online is just as important as being safe walking down the street - Interview with Heather Dahl , Co-founder of The Cynja LLC

Dear Readers and Subscribers,

We are proud to finally share with you a long awaited interview with Heather Dahl from The Cynja! They are building an app to help our children navigate cyberspace safely with security and privacy features customized to inspire and educate. CynjaSpace is not just a game or tutorial but a
full immersive cyber-environment designed for kids. Enjoy reading!

[eForensics Magazine]: There is a story and a big idea behind your company. Can you tell us something more about it?

[Heather Dahl]: Once upon a time, I found my nephew, Grant, fighting some dragons, which—to be honest—struck me as pretty useless. No disrespect to dragons—or dragon slayers—but they’re old-school. So I said, “C’mon Grant, why don’t you fight the real bad guys—the ones that live in our computers?”

He had no idea what I was talking about.

This was frustrating because fighting bad guys is his passion. And there are lots of bad guys in cyberspace.

So I decided to buy him a book that would explain the wild cyber world of worms and zombies and Trojans and show him how awesome this world—the world I work in—really is. It would also introduce him to an important life lesson: We now live in an era of digital crime.

Nada—Zilch—Zip

There was nothing cool, nothing awesome—nothing that truly captured this dynamic virtual world. So I had no choice, I had to write this book myself.

The first step was to email my friend Chase Cunningham, who fights cyber bad guys for real. “Why don’t we write a way cool book for kids about cybersecurity?” I said. And Chase replied— “Dude, yeah!”

We both agreed—we live in a digital world that is continually under threat, and there wasn’t anything for kids that connected them to this world. We wanted to write a cool story about cyberspace that would grab a kid’s imagination, teach them about being safe online—and possibly even inspire the next generation of security professionals!

In just two years, The Cynja has grown into a book series published in English and Dutch, a regular comic strip, activity books, blog, subscription newsletter and children's workshops all designed to help families make smart digital choices. This fall we will be releasing Code of The Cynja® Volume 2, offering a Spanish translation of Volume 1, and launching a new app to help protect kids online called CynjaSpace™!

[eFM]: What is the target market for Cynja’s game and comics?

[HD]: PC Magazine did some independent testing and found The Cynja made kids go “Cool!” The kids loved it and their little reader test base is “eagerly anticipating the next issue.” And they’re not the only ones we’ve heard from. We’ve received fan mail from young Cynjas all over the world, including photos of homemade Cynja costumes, as well as hearing about an eight-year old reader holding a Cynja party that included a Cynja swag bag for all his guests.

While we initially thought our story would appeal to kids ages five to eight years old, we were surprised to find the story resonating with “kids of all ages”. Parents often learn about information security while reading along with their kids. The news headlines we all hear–the Sony compromise or the Target breach—are, sadly, all too real and devastating, even though it’s hard to visualize the way they happen and their impact. Visualizing this virtual world is an important step toward cybersecurity being taken seriously by everyone everyday.

It’s important for kids and parents to understand together that being safe online is just as important as being safe walking down the street.

[eFM]: Cybersecurity is quite a difficult topic. Do you think kids are ready? Will they understand it and learn form it?

[HD]: As cybersecurity professionals, we know first-hand how the cyber world is filled with battles between good and evil. And if your child is using connected devices, it’s important they know that too. The fact is as our children live digital lives, we must become digital parents.

You’d think that would come easily, given that we work in tech, but I’m continually surprised to hear how many of my colleagues don’t talk about the dangers they see on their screens at work back at home with their kids. Often they say their kids won't understand since it’s hard enough to explain our jobs to most adults. At The Cynja, we say it’s never too early to talk infosec with kids: you simply need the right story.

If we are to make an impact, we must remember that children need to be taught about technology on their terms. And what were those terms? Well, there is nothing more basic to a child’s understanding of the world than the struggle between good and evil: it’s the basis for so much of children’s literature and entertainment.

We all know better than anyone that the cyber world is filled with just these kinds of struggles – and a whole pantheon of new monsters and villains. If you’re creative with your storytelling, you’ll quickly see our work world is as thrilling as any adventure book. Our industry is more relevant to kids future careers than perhaps their aspirations to become dragon slayers or learn wizardry that traditional kids stories focus on.

Telling kids simple stories that spark their imagination, yet explain the key concepts of a digital life is an important educational step. We live in an amazing digital world that has brought enormous benefits: But as many of us in this profession know, just as you can do good or bad in the real world, so you can do good or bad in cyberspace. There’s a whole new world of digital crime out there – but you can and should do something about it. That’s the kind of conversation we need to start having with the children in our lives.

[eFM]: What about adults? How many people in the USA are aware of cyber threats? Shouldn’t we start from educating them?

[HD]: What we’ve found since writing our first book is that a parent’s concern about their children’s digital lives unites families across all nationalities, languages and socio-economic backgrounds. It’s why our book series is now available in English, Dutch and Spanish with more translations on the way. An adult might not necessarily be concerned as to whether their personal data will be compromised in the next large breach but they are very, very concerned about their child becoming a victim to online dangers.

Cyberspace isn’t the Magic Kingdom. It’s the Wild West—only worse, as it’s a place where it’s really difficult to observe people as they make choices and experience the consequences. At The Cynja, we focus on teaching the technology to kids. And for the adults—we help inspire them to become role models for kids both in their daily lives and virtual worlds. And to do that, an adult doesn’t need a deep technical knowledge they simply need to be transparent with all the children in their lives about how they make choices online. Who do our kids aspire to be in their digital world if they don’t get to watch us live ours?

Being a cyber role model is more than being a successful Internet entrepreneur. It’s living a smart and ethical life online. It’s treating people and data with respect. Sounds straightforward, no? But here’s the problem: It’s hard for many kids to see their parents as digital role models because their parents don’t open up their online lives to their kids. In email, social media, online shopping or web surfing, parents operate in virtual isolation to their children. Our kids aren’t riding tandem as we drive our digital lives; but that’s the view of the cyber world that kids need to experience. Just like daily life, it’s not a fairytale; it’s a place where there are real consequences.

I’m here to tell you, all adults—techies or not—are the role models for all the children in our lives. If we are concerned about our children’s digital welfare then we are the ones who must fill this void. We are the ones who have the power to change the direction of our kids’ digital futures.

At The Cynja, we offer parents multiple resources from our books, web comics to our Cynsei’s Connection newsletter and our Birds, Bees & The Botmaster columns to arm adults with common sense digital expertise. But more importantly, each of us must live transparent digital lives, where kids can see how we make smart choices online. In this digital era, we must transform ourselves into super cyber role models and it doesn’t necessarily require formal techincal education as it does teaching kids about respect and smart choices whether they are on a playground or using social media.

[eFM]: You build a whole new world for Cynja to inhabit. Where did the idea come from? Who is the Cynsei?

[HD]: We’re so proud that PBS NewsHour described our book as “geekily accurate”. Chase and I set out to write a kids adventure story rooted in real technology. In fact, Chase and what he does at work, is our inspiration for the Cynja character.

Chase provided insight into what it was like to fight real battles in cyberspace—in all their glorious, geeky detail. But we then had to turn this into something a kid would relate to—and so I spent a lot of time with my nephew trying to see the world through a six-year old’s imagination—and what it’s like to be the hero of your own magical battles against bad guys.

We wanted to illustrate The Cynja in a way that readers could understand the gravity of being stuck in an infected network or encountering malicious malware. Shirow Di Rosso, our illustrator, who we call the Artmaster, was an IT engineer, so he knew exactly what this world looked like and how to visualize it in an imaginative yet accurate way. We were dazzled by the results.

Rodney Joffe is the inspiration for The Cynesi, the wise mentor of cyberspace who teaches the Cynja how to defend the Internet from the Botmaster. Rodney’s one of the nation’s top cyber experts and Chase and I were fortunate to work and learn from him. His passion for cybersecurity is contagious and it fueled our passion for teaching others about this new world. That’s what brought us together to write this book. Rodney is the kind of noble warrior we hope the next generation will look to for inspiration.

[eFM]: Heather, you are a journalist by trade, so why take interest in cyber security?

[HD]: Because if you aren’t practicing online safety while practicing journalism you are putting your sources, colleagues and newsroom at serious risk. Our pledge as reporters is to protect those who allow us to tell the stories that shape our world has moved into the digital realm, yet not all journalists recognize the additional ethical responsibility new technologies have placed on the practice of our craft.

From a recent survey of investigative journalists by the Pew Research Center in in association with Columbia University’s Tow Center for Digital Journalism: “Just 21 percent say their organization has taken steps or implemented policies in the past year to protect journalists and their sources, while 36 percent say their organization has not, and 42 percent do not know. About half (54 percent) report getting no formal training or instruction on electronic security issues from professional sources such as journalism associations, news organizations or journalism schools.” While this survey primarily focused on government surveillance of reporters, what we do know is that digital crime has grown exponentially in recent years -- to think some of that malicious activity hasn’t been directed at journalists is naïve.

In the past year, I’ve had one too many conversations with journalists who don’t actively consider digital safety to be a serious part of their job. It’s more of a “nice-to-have” rather than a requirement of our work. I’ve met reporters who brag about disabling their antivirus program, seen photographs of sources in a manner that exposes the person’s sensitive data in the background, learned of news managers using the same passwords on all their accounts, and so many journalists who don’t lock their mobile phones with four-digit pins or thumb prints that it boggles my mind. I’ve had a Congressional reporter brag that he who would fight in court before disclosing his sources to authorities but didn’t consider the theft of his unlocked device as a risk to his sources’ identities…even though all communications with these individuals are easily accessible with the swipe of a screen!

And so I write about practicing journalism and cybersecurity for The National Press Foundation. I write because as our newsrooms continually transition into the digital era so to do our responsibilities as journalists. We must not only write stories for multi-platform organizations, we must also practice safety as reporters spanning both the real and virtual worlds.

Our sources, the people we rely on to help tell our stories, should have trust that we as journalists practice the highest standards of smart digital hygiene. But indicators have shown this might not be the case. Sources have the right to demand that you, as a journalist, will keep their data as safe as possible—starting by locking your devices containing their contacts and communications. We must understand these cyber crimes and their impact on our industry and how we practice our craft because the future of journalism depends on our digital safety.

My work today places me squarely at the intersection of journalism and online security. And so if just over half of the respondents in the Pew survey say they aren’t receiving any formal instruction on security issues from their employers or journalism organizations, I’ve made it my personal mission to help my peers learn about the real virtual world, so to speak.

[eFM]: What are your company’s plans? What’s your goal?

[HD]: We’re building cyberspace with training wheels for kids! It’s called CynjaSpace™—a digital experience that educates kids on making smart choices by interacting with our original comic characters and expert storylines. Behind the scenes it’s providing parental activity controls, protections and guidance on digital parenting.

In the real world, we ease kids into adulthood. But in the digital world, they are thrown full-force into the wild. As parents, teachers, and organizational leaders we struggle to be proper digital guardians and role models. With CynjaSpace, you get a safe environment where kids can learn to be responsible digital citizens. CynjaSpace gives families:

Cybersecurity protections such as spam blockers, malware detection, malicious site tracking & warnings, antivirus.

Controlled data sharing with trusted connections through parental approvals, cyber privacy protection, ad blockers, purchase blockers, and protections against data collection & mining, secure storage.

Granular parental controls & activity reports providing age & subject appropriate content blocking, predator & cyberbully reporting, and Internet usage reports.

Kids learn how to safely navigate online through trust and respect and built upon the Respect Network

Our goal at The Cynja is to become the destination where kids begin their digital lives—the place where kids become cyberheroes!

[eFM]: Do you predict any major obstacles coming your way?

[HD]: Let me ask you this—are these words too difficult for you? Basilisk, snuffleupagus, supercalifragilisticexpialidocious, Quidditch, Oompa Loompa. I hope not! They’re all part of the magical world of children’s literature.

However, give many adults these words: Darknet, cipher, binary, encryption, proxy server. All of a sudden, I hear a different story…these words are too hard and complicated.

The difference is we approach Dr. Seuss and children’s literature with an open mind, prepared to let our imaginations absorb all sorts of meanings. And we learned that a fizza-ma-wizza-ma-dill is a bird that eats only pine trees and spits out the bark.

Hand an adult a children’s story about technology—well, they get a bit freaked out. Why? Because they’ve already decided the digital world is too difficult to comprehend—no matter how simple the concept. And what’s funny is, that same adult is often more than happy to help their child figure out how Quidditch is played.

Sometimes we’ll see a child really immersed in our books but then when their parent flips through the pages they decide the content is too challenging based on their own perceptions. It’s sad to see a child’s budding interest in tech get immediately quashed because the adult in their life doesn’t want to understand the digital world. I’d argue that a child’s understanding of a darknet is more valuable to their future than learning the diet of an imaginary bird or the rules of a sport played on flying broomsticks. In today’s era of digital crime, kids need to know that a darknet is what cyber criminals often use to hide their illegal activities.

So we decided not allow an adult’s uncertainty about technology taint a child’s motivation to learn about their future. And that’s why we decided to focus our efforts on encouraging young minds to absorb what an Oompa Loompa is as well as a proxy server because their futures depend on an understanding of technology in a way that ours didn’t.

[eFM]: What do you think about the recent hot topics in cybersecurity world? Do you think educating kids can help prevent such problems in the future?

[HD]: Child identity theft is considered to be one of the fastest-growing crimes. Kids’ identities are stolen over 50 times more than those of adults! We’re often so focused protecting our kids from so many threats in the real world; we forget that in cyberspace bad guys are stealing children’s identities to open credit cards, apply for loans, rent homes and even receive health care. Bad guys make money by selling and reselling the same child’s identity over and over. And they get away with it because parents don’t think about monitoring their son or daughter’s identity.

Why is this important? Children could potentially lose out on future jobs, internships and loans that require a clean background check or credit report—all because they were victims of identity theft as kids. Growing up in the real world is difficult enough that I don’t want children’s digital lives to hold them back.

If we truly want a secure future, we must ask ourselves—what are we doing to protect all the kids in our lives? One place cybersecurity professionals can begin protecting our most vulnerable assets is by safeguarding the identities of the kids in our own lives— our children, nieces, nephews, grandkids, neighbors, our children’s friends—by protecting those we can and educating those we talk with. And we must teach kids to understand that their identities are to be protected online just as they do in their daily lives.

Many parents outside of security circles don't consider their children’s identities until later in life. But as we know that’s too late. So let’s start by teaching kids the value of their identity and parents the warning signs that their child’s identity might be in jeopardy.

Have you shared your name, birthday, address or identification number with someone you don’t know online?

When you share information about yourself on a website, do you look for the SSL lock?

Has the government sent a notice saying your child didn't pay income taxes or that your child’s identification number is being used on other people’s files?

Are you getting collection calls or bills in your child’s name for services you didn’t receive?

Did you get declined for government benefits because the benefit is getting paid into another account using your child’s identification?

If your wallet was stolen—were you carrying information about your children inside?

If the answer is yes to any of these questions, it’s time to act! Or if you're a child, tell your parents!

And as infosec professionals, we can encourage parents to do the following:

1. Check whether your child has a credit report by asking each reporting company.

2. Consider purchasing a service that will monitor your child’s identity for signs of identity fraud. This is a gift I’m giving the kids in my life for the upcoming holiday season.

3. Every “Sweet 16” birthday celebration shouldn’t be considered complete until you’ve checked your son or daughter’s credit report. That way if you find any evidence of fraud or misuse, you have time to correct it before they apply for a job, school or car loan, or a new apartment—when they, or you, are ready to move out of the nest.

Remember treat your kid’s personal information like you treat your own. Be a cyber role model. It seems these days everyone wants information on all of us that they don’t really need. So be especially guarded when it comes to sharing your child’s identity because you might be putting their future at risk. And make sure your kids know when to say no to sharing online. Because in my life—my young nephew is the most valuable asset of all.

[eFM]: What advice do you have to share with our readers? How about with their kids?

[HD]: Magic! It’s the basis for countless children’s stories filled with adventure and excitement. It’s also how many kids think cyberspace works. There’s nothing like seeing our child’s reaction when the slight of a magician’s hand produces marvelous results. However, as cyber professionals we know the Internet is no illusion. A technical understanding of their digital lives is a crucial life lesson for today’s young generation.

If your kids are like my nephew, they ask a lot of questions. I mean a lot. Some I can answer and others require a search using my smartphone. Yet, when it comes to their questions about technology it’s often easy to just say, “It’s magic!” Which is a fun and exciting answer, however my nephew is at an age where I realize that explaining the wonders of their world is crucial to developing his critical thinking skills and build a foundation of knowledge which will span their lifetimes.

After talking with my InfoSec peers, I believe many of us often feel that our kids don’t truly know what Mom or Dad or their Aunt or Uncle does on the job because we find it difficult to explain our work to most adults, sometimes even our bosses. Or we think that our kids won’t understand because we decide it’s too complicated for them. Maybe it’s easier to let kids think that in tech we wave our magic wands at code or pull rabbits out of servers. Except, we all know that’s not an accurate reflection of our industry.

Yet, we continually worry about our kids experiencing the not so nice side of cyberspace. But we’ve never explained to them how it really works. One has to ask, how can a child consider a cyber threat to be real when they believe in cyber magic?

It’s time we move our conversations with kids beyond training dragons or learning wizardry. It’s time we begin explaining cyberspace for what it is—a place that’s anything but a fairytale, a place with real consequences instead of predictable happy endings, and a place that’s based on actual systems and programs developed by real people. We can do this by using our professional expertise to explain how the Internet works. We are in a position to teach our kids a basic technical vocabulary that will deliver benefits for the rest of their lives. While technology may seem like magic, it is not. That’s the distinction we in Infosec must help children understand.