Privacy and accuracy limits of behaviour monitoring

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. An organisation uses user behaviour analytics to monitor staff activity. Which statement is a privacy concern?

A Monitoring means staff can no longer access any data

B Monitoring can intrude on employee privacy by tracking what staff do

2. What is a false positive in behaviour monitoring?

A An alert raised for normal, legitimate activity that looks unusual

B A real attack that the system failed to notice

3. A system flags a manager for logging in from interstate while on a work trip. What should happen next?

A A person reviews the alert before taking action

B The account is deleted automatically with no checks

4. Which approach to monitoring is more transparent?

A Telling staff what is monitored and why in a policy

B Monitoring staff secretly so they behave naturally

5. Which statement about automated behaviour monitoring is correct?

A It is always accurate, so alerts never need checking

B It helps protect data but can still produce false alarms

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1alert: login at 3am from new device, risk score 82		AA behaviour monitoring alert that flags unusual activity but may be a false positive until a person reviews it
2policy: "Staff are told what activity is logged and why"		BMonitoring is hidden from staff and accounts are suspended automatically, with no transparency and no human review of the alert
3A false positive is a harmless action wrongly flagged as a threat, which wastes time and may unfairly target staff		CTransparency about monitoring so employees know how their behaviour is tracked
4Alerts should be checked by a person before action is taken against an employee		DThis collects and keeps far more employee data than needed, which intrudes on privacy
5monitor_staff(secret = TRUE) and suspend_account(on_alert)		Eif alert = TRUE then analyst_review() before action
6log(all_private_messages) -> keep_forever		Fif flagged = TRUE AND attack = FALSE then false_positive

Definitions

Behaviour monitoring limits

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF score _ threshold THEN flagAlert() END IF

IF alert = TRUE AND threat = FALSE THEN fpCount = fpCount + _ END IF

IF alert = TRUE ___ reviewed = FALSE THEN sendToAnalyst(alert) END IF

IF ___ staffNotified THEN sendNotice() END IF

FOR EACH alert __ alerts DO humanReview(alert) END FOR

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF activity > baseline THEN

B DELETE user account

C analyst REVIEWS alert

D END IF

Question 2

A INPUT employee

B SHOW monitoring_policy

C GET acknowledgement

D START hidden_monitoring

Question 3

A alerts ← 50

B real ← 4

C false_pos ← alerts + real

D OUTPUT false_pos

Question 4

A FOR EACH event IN work_logs

B STORE event.personal_chats

C END FOR

Question 5

A usual ← AVERAGE(past_logins)

B today ← COUNT(todays_logins)

C IF today < usual * 3 THEN

D RAISE alert

Answer Key

Privacy and accuracy limits of behaviour monitoring

Section A: Quick Questions

B — Monitoring can intrude on employee privacy by tracking what staff do

A — An alert raised for normal, legitimate activity that looks unusual

A — A person reviews the alert before taking action

A — Telling staff what is monitored and why in a policy

B — It helps protect data but can still produce false alarms

Section B: Match the Pairs

alert: login at 3am from new device, risk score 82 → A behaviour monitoring alert that flags unusual activity but may be a false positive until a person reviews it

policy: "Staff are told what activity is logged and why" → Transparency about monitoring so employees know how their behaviour is tracked

A false positive is a harmless action wrongly flagged as a threat, which wastes time and may unfairly target staff → if flagged = TRUE AND attack = FALSE then false_positive

Alerts should be checked by a person before action is taken against an employee → if alert = TRUE then analyst_review() before action

monitor_staff(secret = TRUE) and suspend_account(on_alert) → Monitoring is hidden from staff and accounts are suspended automatically, with no transparency and no human review of the alert

log(all_private_messages) -> keep_forever → This collects and keeps far more employee data than needed, which intrudes on privacy

Section C: Definitions

Behaviour monitoring limits — Monitoring user behaviour protects data but can intrude on employee privacy and raise false positives, so staff should be told about it and people must review alerts.

Section D: Fill in the Blanks

IF score > threshold THEN
  flagAlert()
END IF

IF alert = TRUE AND threat = FALSE THEN
  fpCount = fpCount + 1
END IF

IF alert = TRUE AND reviewed = FALSE THEN
  sendToAnalyst(alert)
END IF

IF NOT staffNotified THEN
  sendNotice()
END IF

FOR EACH alert IN alerts DO
  humanReview(alert)
END FOR

Section E: Spot the Error

B — An unusual activity could be a false positive, so the system should send an alert to an analyst for human review. It should not take drastic action on its own. Line 2 should be SEND alert TO analyst.

D — Staff should be told about monitoring, so transparency is needed. Monitoring should start openly after staff have seen the policy. Line 4 should be START monitoring, not hidden monitoring.

C — False positives are alerts that were not real threats, so you subtract the real threats from the total alerts. Line 3 should use - not +.

B — Monitoring should respect employee privacy by collecting only work activity data such as user and time. Storing personal chats is excessive and intrusive. Line 2 should store event.user, event.time.

C — An anomaly is activity well above the user's normal baseline. The test should use > so unusually high activity raises the alert. Line 3 used < by mistake.