Cybersecurity Foundations (Grades 6–8) · lesson 32 of 48 · 8 min
Misinformation as a Cybersecurity Threat
Misinformation is not just a social problem — it is a cybersecurity threat. Attackers use fake news stories, fabricated screenshots, and AI-generated content to manipulate people into clicking malicious links, downloading malware, or handing over credentials. A convincing fake story about a bank security breach can drive thousands of people to a phishing site.
Recognising misinformation is a core digital literacy skill that directly supports your cybersecurity defences. The same critical thinking that helps you spot a fake news story helps you spot a phishing email.
By the end of this lesson you will be able to distinguish misinformation, disinformation, and malinformation, apply the SIFT method to evaluate online content, identify red flags in online articles and social media posts, and use verification tools to check claims.
Why this is a cybersecurity topic
A common phishing technique is to create a fake news story (“Your bank account has been compromised — click here to verify”) that looks credible. Deepfake videos are used in CEO fraud attacks. Fake security alerts (“Your computer has a virus — call this number”) are a multi-billion dollar scam industry. The ability to evaluate sources and claims is a direct defence against social engineering.
What Is Misinformation?
Misinformation is false or inaccurate information — regardless of whether the person sharing it intended to deceive. Disinformation is false information spread deliberately to mislead. Both are serious problems online, and cybersecurity professionals care about them because they are used in social engineering attacks, phishing campaigns, and influence operations.
Recognising misinformation is a core digital literacy skill. Attackers exploit it to manipulate people into clicking malicious links, downloading malware, or handing over credentials.
Types of False Information
The SIFT Method
The SIFT method is a four-step framework for evaluating online information quickly:
Red Flags in Online Content
Verification Tools
Knowledge Check
Recognizing Misinformation
What is the difference between misinformation and disinformation?
- They are the same thing
- Misinformation is false; disinformation is true but harmful
- Misinformation is unintentional; disinformation is deliberately spread to deceive
- Disinformation only applies to governments
Answer: Misinformation is unintentional; disinformation is deliberately spread to deceive
Misinformation can be spread by well-meaning people who believe it. Disinformation is intentional deception.
In the SIFT method, what does the “F” stand for?
- Fact-check the headline
- Find better coverage from multiple independent sources
- Follow the original author
- Filter out emotional content
Answer: Find better coverage from multiple independent sources
Finding better coverage means searching for the same story across multiple independent outlets. If only one source reports it, be sceptical.
A video appears to show a politician saying something shocking. What tool would help verify whether the video is real?
- A password manager
- Reverse image search and deepfake detection tools
- An antivirus scanner
- A VPN
Answer: Reverse image search and deepfake detection tools
AI-generated deepfake videos are increasingly convincing. Reverse image search can find the original footage, and deepfake detection tools analyse video authenticity.
If a story is shared widely on social media, it is probably true.
- True
- False
Answer: False
Misinformation spreads faster than accurate information on social media because it is designed to trigger emotional reactions that prompt sharing.
AI-generated video or audio that makes someone appear to say something they did not is called a _____.
Answer: deepfake
Deepfakes use machine learning to synthesise realistic video and audio. They are increasingly used in disinformation campaigns and fraud.
Real-World Case Studies
Case 1: The 2016 US Election — Disinformation at Scale
During the 2016 US presidential election, the Internet Research Agency (a Russian state-linked organisation) ran a coordinated disinformation campaign on Facebook, Twitter, and Instagram. They created fake American personas, ran divisive political ads, and organised real-world events — all to sow discord. Facebook estimated 126 million Americans saw IRA content. The campaign cost approximately $1.25 million per month. The lesson: disinformation campaigns are sophisticated, well-funded operations — not just random trolls. The SIFT method and source verification are your primary defences.
Case 2: COVID-19 Infodemic — When Misinformation Costs Lives
During the COVID-19 pandemic, the WHO declared an “infodemic” — an overabundance of information, including misinformation, that made it hard for people to find trustworthy guidance. False claims about cures (drinking bleach, taking horse dewormer) led to real hospitalisations and deaths. A study found that COVID-19 misinformation was responsible for approximately 800 deaths and 5,800 hospitalisations in the US alone in the first three months of the pandemic. The lesson: misinformation is not harmless — it has real-world consequences. Verifying health information from authoritative sources (WHO, CDC) before acting on it is critical.
Previous lesson: Safe downloads and extensions
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Reporting suspicious content