In Part 1 you met misuse that is mostly about people and content. This post covers misuse that attacks systems and data: malware, phishing, identity theft, denial of service, data theft, eavesdropping and industrial espionage. For each one, think about the impact on individuals, organisations and government.

Build on what you learned in Forms 1–3

These Lower School ICT posts cover the basics of this topic:

• Threats to Computer and Data Security – viruses, hackers and other threats
• Information Protection and Misuse – keeping personal information safe

In this post:

• Malware: viruses, worms, Trojans, spyware and ransomware
• Phishing
• Identity theft
• Denial of service (DoS and DDoS)
• Data theft
• Electronic eavesdropping
• Industrial espionage
• Who is affected and how

Malware

Malware (malicious software) is any program designed to harm a computer or steal data. Types you should know:

• Virus – attaches itself to files and spreads when they are opened or shared.
• Worm – spreads by itself across networks without needing a file to be opened.
• Trojan horse – pretends to be useful software (e.g. a “free” game) but does something harmful.
• Spyware / keylogger – secretly records what you do, including passwords.
• Ransomware – locks or encrypts your files and demands payment to unlock them.

Video: What is Malware? – https://www.youtube.com/watch?v=NMYbkzjI5EY

Phishing

Phishing is tricking people into giving away passwords, card numbers or other personal information by pretending to be a trusted organisation – for example a fake email or text that looks like it is from your bank, telling you to “verify your account” at a fake website. Warning signs: urgent threats, spelling mistakes, unexpected attachments, and links whose address does not match the real website.

Video: What is Phishing? – https://www.youtube.com/watch?v=BnmneAjVrM4

Video: Funny Animation Video(Phishing Attack ) | Pencil animation | Short animated films – https://www.youtube.com/watch?v=sS3mZVCARZg

Identity theft

Identity theft is stealing someone’s personal details (name, date of birth, ID number, bank details) and using them to pretend to be that person – for example to open accounts, take loans or make purchases in their name. Phishing and data theft are common ways identities are stolen.

Video: What is Identity Theft? – https://www.youtube.com/watch?v=kDFeSUUwRnA

Denial of service (DoS and DDoS)

A denial of service (DoS) attack floods a website or server with so much fake traffic that real users cannot reach it. In a distributed denial of service (DDoS) attack, the traffic comes from thousands of infected computers (a “botnet”) at the same time. Imagine thousands of people crowding the entrance of a supermarket so real customers cannot get in.

Video: DDoS Attack Explained – https://www.youtube.com/watch?v=ilhGh9CEIwM

Data theft

Data theft is copying or taking data without permission – for example a hacker stealing a company’s customer database, or an employee leaving with files on a flash drive. The stolen data may be sold, used for identity theft or used to blackmail the organisation.

Electronic eavesdropping

Electronic eavesdropping is secretly listening to or intercepting communications – phone calls, messages or data travelling over a network. For example, someone on the same unsecured public Wi-Fi at a café could capture data that is not encrypted.

Video: What is an eavesdropping attack? – https://www.youtube.com/watch?v=SRBXcbCZPUw

Industrial espionage

Industrial espionage is spying on a business to steal its secrets – product designs, recipes, customer lists or plans – usually to help a competitor. It may be done by hacking, by planting spyware, or by a dishonest employee.

Video: Industrial Espionage: The War on Information – https://www.youtube.com/watch?v=EI6_-Vy-wok

Summary: who is affected?

Misuse	Individuals	Organisations	Government
Malware	Lost files, stolen passwords, ransom demands	Systems shut down, lost data, cost of recovery	Public services disrupted; national security risk
Phishing / identity theft	Money stolen, damaged credit, stress	Customers defrauded; loss of trust	Must investigate fraud; fake documents in citizens’ names
Denial of service	Cannot reach online banking or services	Lost sales and reputation while offline	Government websites and services unavailable
Data theft / eavesdropping	Personal details exposed	Fines, lawsuits, lost trust	Secret or citizen data exposed
Industrial espionage	Workers may lose jobs if the company fails	Lost competitive advantage and income	Weaker economy; lost investment

Related

Related: Videos: Computer Misuse

Paper 1 practice (multiple choice)

Choose the best answer for each question. Try them all before you check.

1. Malware that pretends to be a useful program but does something harmful is a
(A) worm
(B) Trojan horse
(C) firewall
(D) cookie

2. An attack that floods a website with traffic so real users cannot reach it is
(A) phishing
(B) denial of service
(C) piracy
(D) eavesdropping

3. Which is a typical sign of a phishing email?
(A) It is addressed to you by your full name from your teacher
(B) It urgently asks you to click a link and enter your password
(C) It contains your class timetable
(D) It comes from a known friend with no links

4. Ransomware is malware that
(A) speeds up a computer
(B) encrypts files and demands payment
(C) blocks spam
(D) backs up data

5. Secretly intercepting messages travelling over a network is called
(A) electronic eavesdropping
(B) copyright infringement
(C) propaganda
(D) automation

Show answers

1. B
2. B
3. B
4. B
5. A

Paper 2 practice (structured question)

A hardware store in Kingston sells goods online. Customers report receiving emails that look like they came from the store asking them to “update their card details”. A week later the store’s website is flooded with traffic and is offline for two days.

(a) Identify the type of misuse in EACH case:

(i) the emails (1 mark)

(ii) the website flood (1 mark)

(b) Explain how the emails could lead to identity theft. (2 marks)

(c) Describe TWO ways the website attack affects the store. (2 marks)

(d) Distinguish between a virus and a worm. (2 marks)

Total: 8 marks

Show answers

(a)

(i) Phishing (1 mark)

(ii) Denial of service/DDoS attack (1 mark)

(b) Customers may enter their personal/card details on a fake site (1); criminals then use those details to pretend to be the customer, e.g. make purchases or open accounts (1).

(c) Any two (1 each):
• lost online sales
• damaged reputation/customer trust
• cost of fixing/protecting the website
• staff time lost

(d) A virus attaches to a file and spreads when the file is opened/shared (1); a worm spreads by itself across a network without user action (1).

Next: Protecting Computers and Data: Physical, Software and Personal Security Countermeasures

Syllabus link: This post is relevant to the CSEC® Information Technology Syllabus (CXC 30/G/SYLL 17), Section 3: Social and Economic Impact of Information and Communications Technology (ICT), Specific Objective 2 (“assess the potential impact of computer systems misuse based on the main entities impacted”).

Attributions to media used in this post:

No third-party images are used in this post. Embedded videos are credited on YouTube to their channels.

© 2026 Vedesh Kungebeharry. All rights reserved.