Homework & course rules

Written homework

We will give out three sets of questions during the semester such that each set of questions is focused on the corresponding group of topics that are covered in the lectures. However, some of the practical homework tasks are solved in the labs. The homework tasks will be made public when we start to teach the corresponding topics. Three sets of homework tasks can give up to 35 points.

First homework covers the following topics: data protection, symmetric encryption, smart devices, privacy and anonymity. Second homework covers public key cryptography, HTTPS, end-to-end encryption, smart cards, e-voting, blockchain and payment systems. Third homework is mostly about authentication and attacks.

Deadlines are strict. There is a penalty for late submissions, which increases by each day being late. More information can be found from the section about submission policy and Plagiarism and Collaboration policy. In order to avoid issues with the homework submissions, please read the aforementioned sections at the beginning of the semester.

• 1. Homework (deadline: 12th of October) (not published)
• 2. Homework (deadline: 9th of November) (not published)
• 3. Homework (deadline: 23rd of December) (not published)

Aggregated results: Link will be provided in the middle of the semester, once the first homework has been graded.

Tests

After each lecture, there will be an online Moodle test to check if the most important ideas or facts were understood. The tests will give up to 20 points during the whole semester, and a single test will give either 1.25 or 2.5 points.

The students have one attempt per test, and the time limit is 15 minutes. Once the test is opened, the timer starts, and in 15 minutes, the test is closed. Thus, we recommend first to attend the lecture and then read the lecture materials before taking the test. There are 5-10 questions in one test.

The tests must be completed in Moodle (https://moodle.ut.ee) before the next lecture, which gives around two weeks to complete the test. Exact deadlines can be found from Moodle. The deadlines for the tests follow the local timezone, i.e., GMT+2.

It is not possible to retake the Moodle tests as two weeks should give enough time to plan your time. As an exception, it is possible to retake the test in case of a medical emergency, but for that, a written proof by the doctor or hospital is needed.

Essay

In addition to the homework tasks, each student should write one essay. The essay can give up to ten points, and we have the option to grant up to 2.5 bonus points for exceptionally good essays. In case an essay is not submitted, it will not be possible to get an A. We do not give replacement tasks instead of the essay, which means that the student will have to collect the necessary 40 points in order to attend the exam.

Some example topics for the essays are posted below. We encourage students to propose their own topics! If you are unsure if your own topic is relevant, we can approve it before you start to write.

Each student has to write one essay during the semester. However, different topics have different deadlines, as shown below. For example, if a student wants to write on a topic belonging to the first group (privacy, anonymity, encryption), he or she will have to submit it by October 19th. After this deadline, these topics are no longer available.

Topics for the essays will be announced here:

• First group: privacy, anonymity, encryption (deadline: 19th of October)
  • National security and privacy – finding the balance
  • The price of online anonymity
  • Anonymisation vs pseudonymisation
  • Can democracy function in a world with no privacy?
  • Providing Tor relay in <enter country here> -- legal aspects
  • Will contact tracing destroy privacy?
  • <Your own topic>
• Second group: public key encryption, TLS, smart cards, cryptocurrencies, blockchain, e-voting (due on the 16th of November)
  • E-voting and democracy
  • E-ID, democracy, surveillance
  • Can end-to-end encryption be stopped?
  • <Your own topic>
• Third group: authentication, social engineering, malware, cyber attacks, web attacks, wireless attacks (due on the 30rd of November for authentication, social engineering, malware, cyber attacks, IoT. For web attacks and wireless attacks (wifi, bluetooth, mobile network) topics the deadline is on the 7th of December.).
  • Fake news and online trolls - can information security help?
  • Are zero-days a real threat?
  • Is cyber war a fiction or a real possibility?
  • Privacy in the age of IoT
  • IoT and security
  • <Your own topic>

The requirements for the essay:

• 2 - 3 pages on content (A4, 1.5 line spacing) + references in addition to the content
• It has to be an argumentative essay (not a summary/overview of something):
  • Helpful information about the structure of an essay
  • Strategies for Essay Writing
• You will have to show the ability to discuss on the stated topic. If a significant part of the essay is descriptive, then it is not an argumentative essay. We want to see how you form and defend your opinion.
• The essay should have the following structure:
  • introduction - the aim is to get the attention of the reader, give background information and to state the problem
  • content - claims / opinion, discussion, counterexamples, the viewpoint of the opposing side, references to facts to back up the claims
  • conclusion - why the topic is relevant, etc.
• The topic and content has to be relevant to the information security course, keeping in mind that this is a somewhat technical course
• The essay can be written either in English or in Estonian
• The language used in the essay has to be formal and correct
• Important non-trivial factual claims have to be backed up with references
• It not allowed to copy text. If you want to use citations, these have to be short (one-two sentences) and you will have to explicitly highlight the citations by placing the citation between quotes and clearly stating who was the author of the citation. This holds for all kinds of text, also text from the course web page. Using copied text without citing will be considered as plagiarism.
• Essay has to be submitted as a PDF file

Grading of the essay:

• How points are awarded:
  • topic, relevancy of the content - 2p
  • language, style, structure - 2p
  • problem statement and discussion - 6p
• When points are automatically deducted:
  • the content does not match the topic = 0p
  • text is copied without using citation, see the section about plagiarism = 0p
  • text is generated with AI/LLM, see the section about plagiarism = 0p
  • an invalid reference is used (for example, false reference generated by AI/LLM), which does not contain the claimed information = -5p
  • it is not an argumentative essay = -5p
  • for each significant typo / issue with grammar (commas are not included) = -0.2p
  • an important factual claim is provided without reference = -1p
  • incorrect factual claim = up to -2.5p
  • missing introduction = -2p
  • missing conclusion = -2p
  • content of the essay is too short, ~1.5 pages = -2.5p
  • content of the essay is too short, ~1 page = -5p
  • content of the essay is too short, less than 1 full page of content = 0p
  • essay is too long, more than 3.5 pages of content = -2.5p
  • essay is too long, more than 4 pages of content = -5p
  • essay consists mainly of the opinions of third parties (cited discussion), original discussion by the student is missing or very limited = -5p
  • essay consists only of the opinions of third parties (cited discussion) or it is just a summary of a topic without any original disucssion by the student = -10p

The essay has to be submitted through the following form.

Submission policy

Homework solutions and essays have to be submitted before midnight of the deadline (a delay of up to 15 minutes is not considered a late submission). The deadline is fixed to be in the time zone GMT+2. There is a penalty for late submissions. Each extra day will lower the maximum result by 10%.

• 1 day late - homework result is multiplied by 0.9
• 2 days late - homework result is multiplied by 0.8
• 3 days late - homework result is multiplied by 0.7
• etc.

If the homework submission is done more than nine days after the deadline, then the solution will automatically get 0 points.

We allow one submission (either homework or essay) to be submitted for up to 3 hours after the deadline (00:16 - 03:00 GMT+2) without the penalty being applied. This exception is activated automatically for the first late submission that falls into the suitable time range. The rule only holds for the first late submission (non-negotiable).

The lecturer should be informed as early as possible if the submission will be late due to a medical reason or due to an important upcoming event. If there is a valid reason for not being able to submit the homework, then in agreement with the lecturer, it might be possible to get an extension or an alternate task. This only applies when the lecturer is informed before the deadline (at least two days in advance, except in the case of a medical emergency).

The same policy applies to essays.

Plagiarism and Collaboration policy

In case you are using someone else's ideas, non-trivial facts or information, then a reference must be added (e.g., as a footnote). A reference is not required if the fact or information is common knowledge or when it was covered in the lectures. In case important facts or information is provided without using references then the task can be graded with 0 points.

Rules for using references: References have to be clear enough such that the reader can easily find the source of the claim or information. The reader must be able to check the reference to validate the information. The referenced source has to be either publicly available or available via Tartu University Library (scientific papers that can be accessed from the university network are ok).

• For web pages the reference has to contain the title and a link to the web page where the information is provided. Exact URL to the paper/news/claim has to be provided. In addition, the date when the website was visited must be included. If the web page contain a longer piece of text, which has subtitles/section then the reference has to clarify which section contains the information. If AI/LLM generated incorrect reference is detected the student may be assigned 0 points.
• For scientific papers the reference has to contain the title, names of the authors, year it was published, URL/DOI. The referenced paper has to be either public or accessible via the Tartu University Library. If the paper is not public and not accessible via Tartu University Library, the student may have to prove that the information is present in the paper (the student must provide the information by the request of the lecturer). If AI/LLM generated incorrect reference is detected the student may be assigned 0 points.
• For books the reference has to contain names of the authors, title, year it was published, page number on which the information is present. If the reference is to a personal book, which is not available in the Tartu University Library, the student may have to prove that the information is present in the book. If AI/LLM generated incorrect reference is detected the student may be assigned 0 points.

When a solution contains text from other authors, then citation has to be used. This also applies when the information is copied from the course web page, although we strongly suggest avoiding copying text in homework solutions. When citing (copying text), it must be explicitly stated who is the author of the text and a reference has to be provided. The cited text has to be highlighted so that it is clearly visible, which part of the text is not written by you. Usually cited text is placed between quotes.

Missing citation is considered as plagiarism and this results in the homework being graded with 0 points. In addition, such cases will be handled according to the study regulations (chapter VII.9. Good academic practice), and the case is forwarded to the faculty or institute committe.

 147. If academic fraud or other improper behaviour is ascertained, the committee proposes

  147.1. the teaching staff member to warn the student, or
  147.2. the vice dean for academic affairs to reprimand the student, or
  147.3. the vice dean for academic affairs to make a proposal to the vice rector for academic affairs
to exmatriculate the student.

It is not allowed to submit a solution that was created by a third party. It is not allowed to use a solution created by another student. In case a copied solution is found, all involved students will get 0 points. However, it is allowed to discuss the problems in the homework tasks with other students, but the solutions have to be written independently. In this case, the names of the students involved in the discussion have to be mentioned in the solution. If this is not done or even part of the solution is copied then we consider it to be a case of plagiarism.

In addition, it is not allowed to show the solutions of written homework to other students while they have not submitted their final version of the same homework. In case this rule is violated such that it leads to a plagiarism case, then both students are held responsible.

Rules for the use of AI/LLMs

If the solution or part of the solution is generated by AI/LLM and there is no reference to the usage of AI/LLM, it is considered a case of plagiarism. If the solution contains an invalid reference generated by an AI/LLM, the solution can be graded with 0 points. The following rules should clarify how AI/LLM can be used in the information security course. Clarifications can be asked from the lecturers.

In the information security course students are allowed to use AI/LLMs to:

• refine their texts in order to improve style and fix issues with grammar. The use of AI/LLM has to be described in the comments fields or in the solution.
• find relevant information, but the solution has to be written by the student. Copying the text provided by AI/LLM is not allowed. It is the responsibility of the student to verify that the information provided by the AI/LLM is correct. The use of AI/LLM has to be described in the comments fields or in the solution.
• find references, but the student has to be extra careful to validate the sources. AI/LLM tends to provide invalid sources. The use of AI/LLM has to be described in the comments fields or in the solution. If the lecturer identifies invalid references, minus points can be assigned for the task!

In the information security course students are NOT allowed to use AI/LLMs to:

• copy solutions or text generated by AI/LLMs. The task is to write the solutions & the essay yourself. Part of the task is to let you try express your thoughts (this is also required in the exam).
• without providing a description of how AI/LLMs were used.