If your phone were able to talk, what would it say about you? It knows who your friends are, how they are connected to one another, where you live, what you buy - perhaps even your blood pressure or how distinct your thumbprint is. It knows what you like and what you look like.

But how many 12-year-olds see that accumulation of information as a risk, as opposed to a convenience? How many worry about that data being compromised and used in ways they never intended?

Not many at all, say Clare Duffy and Rupert Goodwins, the duo behind an immersive theatrical experience billed as “part digital magic show, part history of hacking”, which is aiming to explore cybersecurity and data citizenship with students in the early years of secondary later this year.

The pair have been trialling the show and workshops (see box, below) in Scottish schools, and one conclusion they have drawn is that the security of students in this age group is often “atrocious”.

Duffy says it is relatively common for young people to share their usernames and passwords with friends. One reason is to keep up their performance on multimedia messaging app Snapchat if they are offline for some reason, such as a family holiday. This is because Snapchat rewards users for sending “snaps” back and forth with a friend for several consecutive days - known as a streak - and the longer you go without breaking the chain of communication, the longer your streak is. It is an extreme example, but a student at one workshop was maintaining streaks with an astonishing 250 people.

Parents may have held off buying their children phones in primary school, but S1 is often the point at which they finally acquiesce, so children need to be more savvy at this age, says Duffy, a playwright and director. And neither she nor Goodwins, a technology journalist, have yet come across a student who is aware that their data is being sold to third parties.

Teenagers are not alone in their ignorance. Research carried out by Which? in 2018 found that consumers generally have “little awareness of what is done with their data, including that these data points can be combined with data collected by other organisations, and that a detailed profile of behaviours and preferences could be potentially made of them”.

However, Duffy and Goodwins maintain that because the technology children are growing up with today is so pervasive and advanced, they have less insight into how their devices work than previous generations. Goodwins points out that computers were so expensive when he was 16 that the only way he could get his hands on one was to build his own from a kit. By contrast, the sleek, smooth exterior of a smartphone reveals nothing about how it works.

“The trouble with being a digital native is it’s all completely natural and they don’t see their devices as anything other than what they appear to be: enormous fun and part of life,” he says. “Older people like me who have seen the evolution - who have seen Google created and Facebook happen - know what’s going on because we’ve been watching it happen.”

An ‘ethical hack’

Through the Big Data Show, Duffy and Goodwins are determined to open students’ eyes and shock them into realising the power of the devices in their pockets. The event will open in Perth in June before moving to Edinburgh, and there are also plans to tour the North of England. Students who go to the show and take part in the workshops will gain a qualification in cyber resilience and digital citizenship.

The show tells the true story of four hackers who accessed Prince Philip’s email account in the 1980s. It was an “ethical hack” - they were not stealing anything but simply wanted to highlight how vulnerable people’s information was on the pre-internet service Prestel. It was the first time hacking hit the headlines and it is Goodwins’ own story. He was one of the four hackers, although not one of the two who were arrested for the stunt.

The performance is then brought into the present, with students encouraged to use their own devices, sometimes in structured gaps and sometimes in parallel, for gaming and to dictate the actions of the actors on stage.

“In today’s world, you might be on Facebook, watching a programme and having a conversation all at the same time,” says Duffy. “It’s about using that typical way of being to tell stories in the theatre.”

By connecting to the show’s hotspot to gain internet access, the students unwittingly give the creators of the experience access to their devices. So, when the hackers are about to be arrested, the sound of the police knocking on the door is played through every device in the auditorium.

At the beginning of the show, the audience is asked if it’s anyone’s birthday (which it always is - more on that later), and all the phones play Happy Birthday. The creators can also send text messages to the audience, make their phones ring and, perhaps most menacingly, make the phones whisper “I know your secrets”.

Students are asked to download an app a few weeks before coming along to the performance that gives them access to a game called Swipe. This involves sending different-coloured balls into the corresponding colour of goal, with the level of difficulty gradually increasing.

Swipe has been devised specifically to resemble the simplistic but addictive games that are popular on smartphones. But during the show, it is revealed that every time students play the game, information on their location is being collected; a map showing all the places they have played appears on their devices. When the map popped up on one boy’s screen, one location was on a family holiday in the Greek islands. He was so taken aback, he shouted out: “That’s me, in my bedroom in Corfu!”

Kate Farrell, a former computing teacher who now works on the £2.4 million Data Education in Schools project and who saw the show last year, describes this as “a great ‘aha’ moment”,

“They get reassured that the data is not leaving their device, but it’s a great learning experience,” she says. “It teaches the kids they have to trust these people they are downloading apps from. So, even though they have downloaded a fancy game, it teaches them to ask ‘What else is it doing?’ ”

It is a question well worth asking given the recent revelations about the app ToTok, which was billed as an easy way to chat with friends and family, but has since been alleged by The New York Times to be a spying tool for the United Arab Emirates. The majority of ToTok users are based in the Emirates and the paper claimed the app was a surveillance device used by the government to track every conversation, movement, relationship, appointment, sound and image of those who installed it on their phones. The only hint that the app discloses user data is buried in the privacy policy: “We may share your personal data with group companies.”

Duffy and Goodwins say it can take quite a lot to make students sit up and pay attention. They performed the show for families at the Edinburgh International Science Festival and found that while children were amused when their phones started misbehaving, the response of their parents was quite different: they tended to be instantly concerned.

“Sometimes we have been really surprised at how unsurprised the pupils are at the things we are making their phones do,” says Duffy. “What we are trying to do is provoke them into thinking about how the technology in their pocket is working.”

Goodwins adds: “It’s a recontextualisation of what these devices are. They just see the phone as part of their life, where their friends are, where their videos are, and then it starts to misbehave and they realise it’s quite a powerful thing and it has potential to go astray. They will not look at it in the same way again.”

Pizza the action

The big reveal in the show, therefore, has to be dramatic enough to have an impact. It comes three-quarters of the way through the one and a half hour performance when an announcement is made that the student whose birthday it is has won a month’s worth of free pizza at their favourite restaurant.

They say they know it’s her favourite restaurant because she has been going there for the past three months with a boy from her school. Both the boy and girl are named. But when the boy’s girlfriend - who is also in the audience and watching the show - hears this news, she makes her displeasure known and a scuffle kicks off in the theatre. Next comes an announcement that there has been a data breach and the show has had to be cancelled.

It is a set-up. Senior students from the schools attending the show are trained to take on the role of birthday girl, cheating boyfriend and scorned girlfriend. The point is, of course, to show that while we might flippantly say we have nothing to hide, as Goodwins points out, most of us have some secrets that we would rather keep.

“It depends how happy you are for all your secrets to be out there,” he says. “You could be living the life of a blameless monk and you don’t care tuppence who knows what about you, but that’s not most of us and the more information there is out there, the more vulnerable you are. But if you put in place safeguards, there’s a better chance of you not being the person they attack.”

Duffy adds: “There are set rules that you can follow that will make you a lot safer - like protecting your usernames and passwords - but nobody really wants to hear it. It’s not convenient and it’s hard to understand why you should bother when nothing seems to happen. But if they come to see this project, they get a sense of why this matters.”

Importantly, everything in the show is theatre - so, while some things might look quite scary, like your device being taken over by an invisible force, in reality they are not. Like all good theatre, this is about illusion. And an ethics committee, chaired by Professor Ewan Klein from the School of Informatics at the University of Edinburgh, has vetted all the tricks in the show.

Farrell agrees that the balance is right. “You do not come away thinking ‘data sharing, I must stop it’ - more that you have to be aware of it,” she says.

Lorna Hollas, a drama teacher at Perth Academy, which was involved in developing the show, also agrees that the shock moments are enough to get the students’ attention but don’t go too far.

“I would say the pupils were not so much scared about the ideas presented in the show, more surprised, really, as they just have no concept about what happens in the background of the apps they use,” she explains. “The show did raise their awareness of this and did shock the pupils into at least thinking about the personal data they are giving voluntarily in order to access these apps, free or not.

“There’s just not that much transparent, plain-speaking information open to them out there. So, the show did make them stop and think about what data is being gathered behind the scenes when [for example] clicking a seemingly innocent ‘yes’ while downloading an app.”

Demystifying how apps and devices work also allows students to understand that these are things they could be involved in creating, says Goodwins. This will be the focus of the workshops due to take place before the show in the spring, when students will get the chance to experiment with gathering data themselves and to see that even distinctly human qualities such as facial expressions can be turned into data.

However, Hollas stresses that more needs to be done to educate young people about how to cope in the digital world, and urges those who set the agenda in Scottish education to be brought on board. “As we plan our curriculum around benchmarks set out by Education Scotland, then this is who needs to be targeted and convinced that this area of understanding and knowledge should be on every school’s curriculum,” she says.

Emma Seith is a reporter at Tes Scotland. She tweets @Emma_Seith

This article originally appeared in the 17 January 2020 issue under the headline “Dramatic data”