Lesson 2: Digital Citizenship & Online Safety
What follows you from a post, what you actually control, and what to do when it happens to someone else.
Ngā Whāinga Akoranga — Learning Intentions
WALT: I can explain what follows me from a post, and what I control.
WILF: You can trace one piece of content to three places its author did not put it, name two things you genuinely control and two you do not, and describe one useful thing a bystander can do.
Whakataukī | Traditional Wisdom
“Kia mau ki te kupu; ka whati te kupu, e kore e hoki mai.”
Hold fast to your word; once a word is broken, it does not come back.
Te Whakatakotoranga | Run of show
Tirohanga Whānui | What this lesson is doing
Students have had online safety lessons before, usually built on fear, and they have learned to sit through them. The reason those lessons stop working around Year 9 is that they are mostly untrue at the edges: you cannot in fact delete everything, a private account is not private, and "just do not post anything you would not show your grandmother" is advice nobody follows and everybody nods at.
This lesson replaces the fear with a mechanism. Content is copyable, and copies do not obey the original. Once a student understands why deletion does not work, the practical advice stops needing to be enforced — it follows from the mechanism. Then it spends the last third on the part that actually changes outcomes, which is not what victims do. It is what everyone else does.
You'll need
- Nothing digital is required. This lesson works entirely on paper and is arguably better that way — devices out means half the room is somewhere else.
- Paper for the Act 1 tracing diagram, one sheet per group.
- Your school's actual reporting process, and the name of the person who handles it.
- Know where Netsafe sits in your school's process before you teach — see Sources.
Before you teach this
Assume at least one student in the room has had something happen to them, and that you do not know who. Nothing in this lesson asks anyone to describe a personal experience, and the scenarios are all third-person and invented. Keep it that way even if the discussion is going well.
Do Now — Where did it go? 8 min
What it is: A tracing puzzle that makes the copy problem obvious before anyone is told about it.
Run it
- Give the scenario (1 min): "Someone posts a photo to their story. It is up for four hours, then they delete it." Ask: is it gone?
- List the routes (4 min): in pairs, list every way that photo could still exist somewhere. Students generate these fast and accurately — screenshots, someone else's re-post, a group chat, a saved copy, a friend who showed someone.
- Count them (2 min): take a show of hands for how many routes each pair found. The number is always higher than people expect, and it came from the room, not from you.
- Name it (1 min): deleting removes your copy. It does nothing to anybody else's. Write that on the board.
Act 1 — The copy problem 15 min
What it is: Groups diagram how one piece of content spreads, and find where it leaves the author's reach.
Run it
- Draw the spread (6 min): start with one post in the middle of the page. Draw arrows outward for every way it travels — a screenshot, a share, a group chat, a repost, someone describing it to someone else. Keep going for two more layers.
- Draw the line (4 min): now draw a circle around everything the original author can still delete. It is one dot in the middle. Everything outside the circle is the point.
- Try to reverse it (3 min): "What would it take to get every copy back?" Groups work out that you would have to identify and persuade every person who holds one — which is not possible, and gets harder the further out it goes.
- The useful conclusion (2 min): the decision that matters is the one before posting, not the one after. Not because posting is dangerous, but because it is the last moment you have any control at all.
Where students push back, correctly
Someone will point out that most posts spread to nobody and vanish, and they are right. Agree with it. The claim is not that everything goes viral — it is that you do not get to choose which ones do, and you find out afterwards. That is a more honest and more persuasive argument than pretending every post is a landmine.
Act 2 — Control and no control 15 min
What it is: Sorting the genuinely controllable from the things students are wrongly told they control.
Run it
- Sort the cards (6 min): use the table below. Two columns — I control this and I do not. Groups will disagree; the arguing is the learning.
- Take the contested ones (5 min): "my account is private" is the big one. Private means the platform limits who sees it first. It does not stop a screenshot, and it does not apply to anyone already inside.
- Note what is in the left column (2 min): it is short but it is real — what you make, when you make it, who you give access to, and whether you pass on someone else's. Small list, large effect.
- One correction (2 min): "delete it and it is gone" belongs in the right-hand column, and most students arrive believing otherwise. Make sure it lands.
| Statement | Why it lands where it lands |
|---|---|
| What I choose to post | Genuinely yours. The main lever you have. |
| Whether I pass on someone else's post | Yours, and it is the decision this lesson most wants to change. |
| Who follows my account | Partly — you can approve, but not control what an approved person does. |
| Whether someone screenshots it | Not yours. No setting prevents a second device photographing a screen. |
| Whether it stays deleted | Not yours. Deleting removes your copy only. |
| What someone writes about me | Not yours — but reporting and asking for help are, and Act 3 is about that. |
| Whether a future employer sees it | Not reliably. Assume searchable rather than assume safe. |
Act 3 — The bystander's move 15 min
What it is: The part that actually changes outcomes. Most online-safety teaching addresses victims; this addresses the other twenty-eight people.
Run it
- The scenario (2 min): something unkind about a Year 9 is circulating in a group chat. You are in the chat. You did not make it and you did not share it.
- Rank the options (6 min): groups rank these by how much they would actually help: say nothing; leave the chat; screenshot it and report it; message the person privately; tell an adult; reply in the chat telling people to stop. Ranking forces honesty in a way that "what should you do?" does not.
- Compare rankings (4 min): groups usually rank message the person privately higher than adults expect, and they are right — it costs the sender almost nothing and it is the thing victims most often say mattered.
- Make it concrete (3 min): write the actual message. Six words is enough. "Saw that. Not okay. You good?" Students who have written it once are far more likely to send it.
Then give the process: how reporting works at your school, who handles it, and what happens afterwards. Be specific and unglamorous about it. A student who knows the process is a student who can use it.
Synthesise — Two questions before you post 8 min
Run it
- Build the test together (4 min): ask the class for two questions worth asking before posting or forwarding. Steer toward: am I fine with this existing after I stop controlling it? and is this mine to pass on?
- Check it against the whakataukī (2 min): a word once broken does not come back. That is not a metaphor here — it is a literal description of the copy problem in Act 1.
- Forward link (2 min): "You have worked out today how to tell what is really true about a post. Next lesson: how to turn a question into one you can actually answer."
Exit ticket 4 min
Private, on paper: write the six-word message you would send to someone this happened to.
No name required. You are checking that every student in the room has composed one once — which is the difference between knowing what to do and being able to do it.
Ngā Huarahi Ako | Differentiation
Tautoko / Support
- Give the Act 1 diagram with the first layer of arrows already drawn.
- Cut the Act 2 table to four rows, keeping "whether it stays deleted" and "whether someone screenshots it" — those two carry the lesson.
- Offer three pre-written options for the exit ticket message; choosing one is a complete answer.
Toitoi / Extension
- Find the actual terms of service for a platform students use and locate what it says about who owns what you post. It is usually shorter and blunter than expected.
- The Harmful Digital Communications Act 2015 exists in New Zealand. Find out what it covers and what it does not, and what a person can actually do under it.
- Argue the hard case: when is passing something on the right thing to do? Evidence of harm, warning someone. Where is the line, and who decides?
Te reo Māori
- Kupu: mana · whakamā (shame, embarrassment) · tautoko (support) · kupu (word) · tapu.
- Whakamā is the more precise word for what this lesson is actually about, and it has no clean English equivalent. Worth teaching properly rather than translating.
Mātauranga Māori | Mana is not only yours to hold
The usual framing of online harm is individual: a person is hurt, a person is responsible. A useful addition is that mana is relational — it is held between people, and an attack on one person's mana affects the group they belong to, including the group doing the attacking.
That is why Act 3 is the important part of this lesson. If harm is only individual, the bystander is uninvolved. If mana is relational, the bystander is already involved and the only question is what they do about it. Students recognise this immediately from experience — they know a group chat where something happened changes the group, not just the target.
Say it once, clearly, and let Act 3 do the work. This is not a lesson that benefits from a long kōrero about values; it benefits from thirty students having drafted a six-word message.
Hononga Marautanga | Curriculum
Ethical use of media and digital texts involves respecting intellectual property, recognising bias, representing diverse perspectives, and participating responsibly in online environments.
Te Mātaiaho (2025) · English · Phase 4 · Language Studies · statement id 15878
The statement's last clause — participating responsibly in online environments — is usually taught as a rule to be agreed with. This lesson derives it instead. Act 1 establishes the mechanism (content copies, copies do not obey the author), and responsible participation falls out of it as the only sensible response rather than as an instruction. The clause about respecting what is not yours is Act 2's "is this mine to pass on?"
Sources and checking
- No statistics appear in this lesson. Figures about online harm are quoted constantly without sources and vary hugely by how the question was asked. The lesson does not need one — Act 1 is a mechanism students can verify from their own experience, which is more persuasive than a number they cannot check.
- Netsafe (netsafe.org.nz) is the approved agency for reporting online harm in New Zealand. Know how it fits your school's own process before teaching, so Act 3 gives students one path, not two competing ones.
- The Harmful Digital Communications Act 2015 is real and is the basis of the extension task. Let students find what it covers rather than summarising it here; the scope is the interesting part and this page would age badly.
- Platform settings change constantly. Nothing in this lesson depends on a current setting or menu location, deliberately. The copy problem in Act 1 is true regardless of which app students are using this year.