Impacts of Computing
What to know
Impacts questions ask you to reason about how computing changes people, institutions, and environments-not just whether a tool works. Know the digital divide (access, affordability, skills, and broadband quality), accessibility and universal design, automation and job displacement/creation, gig work, surveillance, privacy, misinformation, algorithmic bias, filter bubbles, e-waste, energy consumption, intellectual property, open source, and digital citizenship. Consider stakeholders: users, workers, businesses, governments, and communities. Strong answers separate intended benefits from unintended consequences and recognize that adoption is uneven.
Traps
Do not equate correlation with causation, or more technology with more equity. A laptop program may raise access while leaving broadband, technical support, and teacher training gaps. Avoid techno-solutionism-assuming a new app solves a social problem without institutional change. Also watch for sampling bias in data: a model trained on one population may fail another. Questions may ask who is excluded, not only who benefits.
Worked example
A district gives every student a tablet. Evaluate with four questions: Who benefits? Students gain a device. Who bears costs? The district pays for devices, maintenance, and training. Who is excluded? Students without home broadband or quiet study space. What assumptions? That devices alone improve learning. A stronger evaluation measures outcomes such as assignment completion and analyzes results by income and disability status. Rule of thumb: impact analysis = benefits + costs + exclusions + assumptions.
Ethics and Security
What to know
Ethics and security questions combine professional responsibility with technical controls. Know ethical frameworks-utilitarian (outcomes), deontological (duties/rules), and virtue (character)-and apply professional codes such as ACM/IEEE principles: do no harm, be honest, respect privacy, and avoid conflicts of interest. Security rests on the CIA triad: confidentiality, integrity, availability. Authentication verifies identity; authorization grants permissions; accounting/auditing records actions. Know least privilege, defense in depth, risk assessment, incident response, encryption (symmetric and asymmetric), hashing, digital signatures, TLS, malware, phishing, social engineering, SQL injection, and cross-site scripting. Legal rules may include FERPA, HIPAA, COPPA, and GDPR, but legality is not the same as ethics.
Traps
Encryption is reversible with a key; hashing is one-way and used for integrity and password storage. Authentication is not authorization. Phishing exploits people, not software bugs. Symmetric encryption is fast but needs key distribution; asymmetric encryption helps with key exchange and signatures but is slower. Confidentiality protects secrecy; integrity protects against tampering. A legal action can still be unethical, and an ethical choice can exceed legal minimums.
Worked example
A team stores user passwords. Encrypting them is risky because the key can be stolen and decryption reveals passwords. Better: generate a unique salt per password, hash with a slow password-hashing function such as bcrypt, scrypt, or Argon2, and store the salt and hash. Verify by rehashing the entered password with the stored salt. Rule of thumb: use the CIA triad to classify a control, then ask what threat it addresses and what residual risk remains.