# Nicolas Cage is the Center of the Cybersecurity Universe

Luca Viganò

## ► To cite this version:

Luca Viganò. Nicolas Cage is the Center of the Cybersecurity Universe. 18th IFIP Conference on Human-Computer Interaction (INTERACT), Aug 2021, Bari, Italy. pp.14-33, 10.1007/978-3-030-85623-6_3. hal-04329898

HAL Id: hal-04329898

https://inria.hal.science/hal-04329898v1

Submitted on 7 Dec 2023

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Nicolas Cage is the Center of the Cybersecurity Universe

Luca Vigano$^{[0000-0001-9916-271X]}$

Department of Informatics, King's College London, London, UK
luca.vigano@kcl.ac.uk

**Abstract.** Nicolas Cage, prolific actor, Oscar winner but also master of ham acting, star of many excellent films and of at least as many really bad ones. A conspicuous number of these films directly revolve around cybersecurity or can be used to explain cybersecurity notions in such a way that they can be understood by non-experts. This paper is part of a research program that I have been carrying out on how to use films and other artworks to explain cybersecurity notions, and thus provide a form of “cybesecurity show and tell” (in which telling, i.e., explaining notions in a formal, technical way, can be paired with showing through visual storytelling or other forms of storytelling). Here, I focus on 15 of Cage’s films in which he has played a wide variety of roles: a stunt motorcyclist, a paroled ex-con and former U.S. Ranger, a U.S. Marine in World War II, an agent of an authoritarian agency, a retired master car thief, a criminal mastermind, an illegal arms dealer, a master sorcerer, a treasure hunter historian, a Batman-like superhero, Spider-Man Noir, Superman, an NSA employee, and a hacker star-nosed mole.

# 1 Introduction

## 1.1 “Kevin Bacon Is the Center of the Entertainment Universe”

In 1994, Craig Fass, Mike Ginelli and Brian Turtle, three students of Albright College in Reading, Pennsylvania, invented a game they called “Six Degrees of Kevin Bacon” [21]. The game quickly became very popular on the Usenet newsgroup rec.artsold, the forerunner of the Internet Movie Database IMDB, and the three authors were invited to “The John Stewart Show”, a late night talk show on MTV, where they proposed the game as a proof of concept for their theory that “Kevin Bacon is the center of the entertainment universe”.

As explained by the authors in 1994, the basic idea of the game was that every single Hollywood actor of the previous 15 years or so could be connected to the actor Kevin Bacon (b. 1958) through six or fewer “hops”, where a hop is defined as having worked in the same film. The game has since been expanded to include actors and other cast members (in particular, directors and producers) of any movie and any year, although it is quite obvious that more than six hops might be required to connect Kevin Bacon to, say, an international actor of a non-Hollywood movie of the beginning of the 20th century. The game can be
played online at “The Oracle of Bacon” (https://oracleofbacon.org) or one
can simply use Google’s search engine to compute an actor’s “Bacon number”:

– Kevin Bacon himself has a Bacon number of 0;

– those actors who have worked directly with Kevin Bacon have a Bacon num-
ber of 1;

– if the lowest Bacon number of any actor with whom actor A has appeared
in any movie is *n*, then A's Bacon number is *n* + 1.

The Six Degrees of Kevin Bacon game is centered around the *six degrees of separation* theory, which postulates that all people are, on average, six, or fewer, social connections away from each other: any two people can be connected in a maximum of six steps by a chain of acquaintances, i.e., a chain of “friend of a friend” statements, which is sometimes also referred to as a chain of “hand-shakes”. As described in detail at [83], the concept was originally set out in the 1929 short story “Chains” (a.k.a. “Chain-Links”) by Frigyes Karinthy, where a group of people play a game trying to connect any person in the world to themselves by a chain of five others, and it was popularized in John Guare’s 1990 play “Six Degrees of Separation” [27] and the subsequent film adaptation [59].

The six degrees of separation theory is connected to results in *network theory* [80], including the *small-world experiments* lead by Stanley Milgram in the 1960s [45]. Milgram and colleagues carried out a number of studies to examine the average path length for social networks of people in the United States. The studies suggest that human society is a small-world-type network characterized by short path-lengths.<fnref n="1" />

Computer scientists and mathematicians working in cybersecurity might not be familiar with the Six Degrees of Kevin Bacon game and the Bacon number<fnref n="2" />, but many of them will likely have heard of the “Erdös number”, which measures the collaboration distance with the great and very prolific mathematician Paul Erdős, where two persons are linked if they are coauthors of an article. A small number of people are connected to both Erdős and Bacon and thus have an “Erdős–Bacon number”, which combines the two numbers by taking their sum, and an even smaller number of people have an “Erdős–Bacon–Sabbath number”, which is the sum of the Erdős–Bacon number and the collaboration distance to the band Black Sabbath in terms of singing in public [23].<fnref n="3" />

<footnote n="1">¹ Interestingly, Kevin Bacon was initially horrified by the Six Degrees of Kevin Bacon game because he believed it was ridiculing him, but he then quickly embraced it, so much so that he wrote the introduction of the book [21] and then, inspired by the game and in the spirit of the “small-world” idea, he created a nonprofit charity called sixdegrees.org “aimed at using everyday activities to connect people and causes” since “at the end of the day, we’re all just six degrees from someone who really needs our help, and when we work together, we really can do a great deal of good”.</footnote>

<footnote n="2">² Similarly, younger readers might not be familiar with the Usenet and its newsgroups, and MTV is likely not so popular anymore, but I am confident that they do know who Kevin Bacon is given that he is still very active as a film and TV actor, and as a musician in the “The Bacon Brothers” together with his brother Michael.</footnote>

<footnote n="3">³ There are also a few other similar numbers, such as the “Morphy number”, which measures how closely a chess player is connected to the great Paul Morphy (1837–</footnote>
If you have an Erdös–Bacon–Sabbath number, you probably indeed are one of the centers of our universe, embodying the spirit of a true “Renaissance man” as advocated by Leon Battista Alberti, who in the 15th century coined the ideal of a “Universal Man” (“Uomo Universale”, in Italian) as “a man who can do all things if he will’. However, it actually turns out that Kevin Bacon is not really the center of the entertainment universe: every few weeks, the Oracle of Bacon algorithm recomputes the list of the “1,000 centers of the Hollywood Universe” that includes the actors that can be linked in the smallest number of hops to all other actors, and at the time of writing (June 2001) Kevin Bacon was number 543 in that list, with Christopher Lee, Harvey Keitel and Christopher Plummer in the top three places. Still, for us movie geeks nothing, not even reality, can dethrone Kevin Bacon from the center of the entertainment universe.

## 1.2 Is Nicolas Cage the Center of the Cybersecurity Universe?

Nicolas Cage, born Nicolas Kim Coppola in 1964, is one of the most prolific actors of his generation (at the time of writing, he had 106 acting credits on IMDB) and, although he never shared the screen with Kevin Bacon, he has a Bacon number of 2. He is an Oscar winner but also a master of ham acting, and has starred in many excellent films and in at least as many really bad ones, ranging from comedy to drama, from action to animation. A conspicuous number of these films directly revolve around cybersecurity or can be used to explain cybersecurity notions in such a way that they can be understood by non-experts, so, in my view, he is definitely a contender for the title of the center of cybersecurity universe. Let me clarify what I mean.

In my papers “Explaining Cybersecurity with Films and the Arts” [76] and “Don’t Tell me the Cybersecurity Moon is Shining... (Cybersecurity Show and Tell)” [77], I discussed how, in the context of research in *Explainable Security (XSec)* [79], popular film and other artworks can be used to explain a number of basic and advanced cybersecurity notions, ranging from security properties (such as anonymity, authentication, confidentiality, integrity and availability) to the algorithms, protocols and systems that have been developed to achieve such properties, and to the vulnerabilities and attacks that they suffer from.

In [76,77], I provided a number of concrete examples of cybersecurity notions and films and other artworks, including a handful of films with Nicolas Cage. In this paper, I will provide even more examples by considering 15 of Cage’s films that are related to cybersecurity. I will do so following the structure identified in [77], namely that when using existing films to explain cybersecurity notions there are essentially four sub-categories, from films about hackers, codebreakers and cybersecurity experts, to films about detectives or spies, to films about ordinary people confronted with cybersecurity, to films that are not explicitly about cybersecurity but can be used to explain cybersecurity notions. Before I give examples of all four sub-categories taken from Nicolas Cage’s filmography,

<footnote n="1884">1884) by way of playing chess games, or the “Shusaku number”, which similarly measures the distance of Go players to the invincible Honinbo Shusaku (1829–1862).</footnote>
<figure><img src="image_3.png" /><figcaption>Fig. 1: The Six Ws of Explainable Security (from [79])</figcaption></figure>

let me provide a more detailed summary of the main points of [76, 77] as this
paper is their natural continuation.

## 2 Cybersecurity Show and Tell

In [79], Daniele Magazzeni and I introduced XSec and discussed its “Six Ws”: Who? What? Where? When? Why? and How?, which are summarized in Fig. 1. We argued that XSec has unique and complex characteristics: XSec involves several different stakeholders (i.e., system’s developers, analysts, users and attackers) and is multi-faceted by nature, as it requires reasoning about system model, threat model and properties of security, privacy and trust as well as concrete attacks, vulnerabilities and countermeasures.

The recipients of the explanations might be so varied, ranging from experts to laypersons, that they require quite radically different explanations, formulated using different languages. Experts typically only accept detailed technical explanations, whereas laypersons are often scared off by explanations of cybersecurity (say, how to interact with a system or an app) that are detailed but too technical. Such an explanation might even repulse the laypersons and make them lose all trust in the explanation and, ultimately, in the cybersecurity of the system that is being explained. This repulsion and lack of trust might lead to users interacting with systems in ways that, unbeknownst to the users and possibly even to the developers and administrators of the systems, are vulnerable to attacks (to the systems and to the users themselves). In practice, however, laypersons are rarely given explanations that are tailored to their needs and their ability to understand.
On the other hand, a clear and simple explanation, with something that laypersons can immediately relate to or perhaps are even already familiar with, such as popular films, TV shows, novels or other artworks, will help make laypersons less irritated, stressed and annoyed. It will allow experts to target the laypersons, reducing the mental and temporal effort required of them and increasing their understanding, and ultimately their willingness to engage with cybersecurity systems. This is what I have called *Cybersecurity Show and Tell* [77]: the added power of telling (i.e., explaining notions in a technical way) and showing (via visual storytelling or other forms of storytelling) can help experts to convey the intuition in addition to the technical definition.

Storytelling has been used widely, and very successfully, as a pedagogical device in textbooks and science outreach endeavors, e.g., [12, 18, 89] to name a few. In particular, in their book "Teaching Mathematics as Storytelling" [89], Rina Zazkis and Peter Liljedahl distinguish a number of categories of stories for the teaching of mathematics, ranging from stories that introduce to stories that accompany and intertwine with a mathematical activity.

For what concerns cybersecurity, without limiting the discussion to teaching, but considering all kinds of learning experiences, including scientific communications and public engagement or outreach activities, in [77] I divided the use of artworks to explain cybersecurity into two broad categories:

- Using *existing artworks*.

- Using *new artworks that have been created on purpose*.

My work so far has focused on the first category, but together with a multidisciplinary team we have begun tackling also the second category. I will return to this in the conclusions, but for now let me focus on the first category, which can be further divided into the following 4 sub-categories:

1. *Artworks about hackers, codebreakers and cybersecurity experts*, who make for very interesting hero(ine) or anti-hero(in)es. Notable examples include [1–3, 5, 10, 11, 14, 19, 24, 30, 37, 41, 49, 54, 55, 63, 65–68, 73, 84]. Some of these artworks are quite realistic in their depiction of cybersecurity, few are real, most are inventive, giving black/white-hat hackers and codebreakers almost superhero-like abilities, but all of them make for a good “show” companion of the technical telling, as a speaker can discuss how faithfully or not cybersecurity has been portrayed. In fact, bad portrayals can be particularly useful to discuss misconceptions and correct possible prejudices.

2. *Artworks about detectives or spies who use or are confronted with cybersecurity problems and solutions*. This category is closely connected to the previous one and in many cases there are some overlaps, e.g., [20, 22, 81]. Other notable examples include [8, 9, 15, 16, 31–33, 40, 52, 53, 58, 70, 71]. Also these professional and dilettante detectives are typically given abilities that border on the fantastic as they “see” the solutions of the cryptographic riddles in a matter of minutes, if not seconds. They picture them in their head before anyone can and often when nobody else does. This is “showing” in a way that is exclusive rather than inclusive. Similar to the characters of the
first category, this facility for cryptography and cybersecurity creates a clear
distinction from ordinary people and turns them into true hero(in)es and
anti-hero(in)es. This is, however, quite understandable, as the story would
then otherwise risk being quite dull. Still, using such characters and their
stories for *showing* can be very effective also thanks to their worldwide pop-
ularity.

3. Artworks about ordinary people confronted with cybersecurity or artworks with references to cybersecurity. There are in general less examples in this category than the previous two, but still several interesting ones, such as [4, 6, 25, 28, 38, 39, 64, 69, 85, 86]. This category requires substantial work of the presenter to make the connections between *show* and *tell* but, trust me, it can be lots of fun, especially if one shows excerpts of the animated films.

4. Artworks that are not explicitly about cybersecurity but can be used to explain cybersecurity notions. This is, in my view, the most interesting category, but also the most difficult one to populate, as the artworks in this case are symbols or rather allegories of the cybersecurity notions. As an example, consider the famous "I'm Spartacus" scene in the film "Spartacus" [36], which I already discussed in [76]. When the captured rebels all stand up and claim to be Spartacus, so that the Roman soldiers cannot identify (and execute and make an example of) the real Spartacus, they are not only showing friendship and respect to their leader Spartacus, but they are actually also creating what in the context of cybersecurity is called an *anonymity set*. One can of course give a formal definition of *anonymity* [51] — and this is what one would do in front of an expert audience, say in a talk at a conference or in a university lecture on cybersecurity — but the point here is that even non-specialists immediately understand what the rebels are doing and why: they are protecting Spartacus so that he cannot be identified, they are making him anonymous in a crowd. Did Howard Fast, the author of the original novel, or Dalton Trumbo, the author of the screenplay, write the scene in order to explain what an anonymity set is? No, of course not. They probably didn't even have the slightest clue about anonymity sets, but they intuitively knew that anonymity cannot exist in a vacuum (one cannot be anonymous by oneself) but rather requires a large enough set of similar "things", a large enough set of similar people, actions, messages, etc. so that one's identity, actions or messages are not distinguishable from those of the others and thus not identifiable. In fact, I dare say that we all share this intuitive knowledge, which is why that scene is a powerful allegory.

I have been able to identify a number of other examples, such as [17, 26, 43, 44, 87] as well as the stories of authentication and identity that occur extensively in the mythology and fairy-tale literature of most cultures, from Greece to Norway to India to China to Africa (e.g., the “Iliad”, the “Odyssey”, Ovid’s “Metamorphoses”, the “Epic of Gilgamesh”, “The Arthurian cycle”, “The Wolf and the Seven Young Goats”, “Ali Baba and the Forty Thieves”).

In [77], I give more examples for each category and describe the specific
artworks and their relevance and use in detail. Now, it is time to focus on Cage.
## 3 Nicolas Cage and Cybersecurity

In Fig. 2, I have singled out 15 of Cage’s films that are related to cybersecurity notions; there are more, of course, but these 15 provide a good start and cover a wide spectrum. The cells of the table contain keywords that highlight the notions that the films exemplify and the sub-category they belong to. As expected, the number of entries decrease as we move from hackers to allegories. In the following, I discuss each of these films in detail, providing brief plot summaries (mostly taken from IMDB) and discussing the scenes in which cybersecurity plays a role.

**Con Air** [81]: newly paroled ex-con and former U.S. Ranger Cameron Poe (Nicolas Cage) finds himself trapped in a convict transport plane when the convicts seize control.

- *Steganography*: U.S. Marshal Vince Larkin searches the prison cell of criminal mastermind Cyrus "The Virus" Grissom. He finds a letter from a Colombian law firm, written in Spanish, and a picture of Leonardo Da Vinci's painting "Last Supper" in which the eyes of Jesus Christ and the 12 Apostles have been cut out. Larkin discovers that the letter contains a message in English that can be retrieved by laying the picture over the letter and reading the characters that appear in the holes.

- *Authentication/Deception*: The convicts know that the plane that they have hijacked is tracked by means of a transponder. Hence, they remove it and hide it on another plane so that the FBI and police chase that other plane.

**Face/Off** [85]: The FBI agent Sean Archer undergoes facial transplant surgery to swap his face (and voice, by means of an implanted microchip) with that of a criminal mastermind Castor Troy (Cage) in order to go "undercover" by assuming Troy's identity and thus find out where Troy has planted a bomb that will destroy the city of Los Angeles. Troy was supposed to be kept sedated in the hospital in the meantime, but he wakes up prematurely and can now pretend to be Archer (as he has Archer's face and voice, after all).

- *Multi-factor authentication* and *Biometrics*: Archer wants to prove to his wife that it is indeed him even though he has Troy's face and voice, but of course she does not believe him. So, what does he do to prove his real identity? He authenticates himself using another biometrics factor, namely his blood type. Moreover, his wife and daughter also recognize him by a specific gesture that he always used to do.

**G-Force** [88]: A team of very special secret agents, comprising of guinea pigs, flies and the star-nosed mole Speckles (voiced by Cage) is dispatched to stop an evil billionaire from taking over the world by means of the household appliances that he has been selling worldwide and that are all connected with each other over the Internet.
<table><caption>Fig. 2: Films with Nicolas Cage in the four categories</caption><thead><tr><th>Film title</th><th>Keywords</th><th>Category</th></tr></thead><tbody><tr><td>G-Force</td><td>Hacking; Password cracking; Worm; Virus; IoT attack</td><td rowspan="4">Hackers and cryptologists</td></tr><tr><td>Kick-Ass</td><td>Anonymity; Tracing</td></tr><tr><td>National Treasure</td><td>Steganography; Multiple-stage attack; Masquerading attack; Forging; Pseudonym; Social engineering; Invisible ink; Hacking; Sensor attack; Biometrics; Integrity; Password guessing; Background knowledge; Indistinguishability; Swapping; Tracing; Ottendorf cipher</td></tr><tr><td>National Treasure: Book of Secrets</td><td>Playfair cipher; Password guessing; Device cloning; Hacking; Denial of service; Social engineering; Surveillance system; Codes</td></tr><tr><td>Snowden</td><td>Cipher machines; Algorithms; Attacks; Malware; Surveillance; Trojan horse; Password protection</td><td rowspan="4">Detectives and spies</td></tr><tr><td>Windtalkers</td><td>Codes</td></tr><tr><td>Con Air</td><td>Steganography; Authentication/ Deception</td></tr><tr><td>Face/Off</td><td>Multi-factor authentication Biometrics</td></tr><tr><td>Gone in 60 Seconds</td><td>Steganography; Codes; Insider attack</td><td rowspan="3">Ordinary people</td></tr><tr><td>Teen Titans GO! To the Movies</td><td>Pseudonyms; Multi-factor authentication; Biometrics; Masquerading attack; Social engineering</td></tr><tr><td>Lord of War</td><td>Identity/Authentication; Confidentiality; Integrity; Social Engineering</td></tr><tr><td>Spider-Man: Into the Spider-Verse</td><td>Pseudonyms; Identity; Accountability</td><td rowspan="3">Allegory</td></tr><tr><td>The Humanity Bureau</td><td>Stolen identity</td></tr><tr><td>Ghost Rider</td><td>Biometrics<br/>Anonymous</td></tr><tr><td>The Sorcerer's Apprentice</td><td>Authentication</td><td></td></tr></tbody></table>

- *Hacking, Password cracking, Worm, Virus, IoT attack:* Speckles the Mole is a true hacker: he hacks into the evil billionaire's house, cracks the password of his laptop, deploys a worm to decrypt an encrypted file, and deploys a
virus to attempt to thwart the Internet of Things (IoT) attack that is taking
place via the Internet-connected devices in households worldwide.

**Ghost Rider [34]:** When motorcycle rider Johnny Blaze (Cage) sells his soul to the Devil to save his father's life, he is transformed into the Ghost Rider, the Devil's own bounty hunter, and is sent to hunt down sinners.

- *Biometrics*: The contract with the Devil is signed with blood rather than with a proper signature.

- *Anonymous*: The demon Blackheart says: "My name is Legion. For we are many.", which is a quote from both the "Gospel according to Mark" and the "Gospel according to Luke" (and there is a similar sentence in the "Gospel according to Matthew"). On January 23, 2008, the international hacktivist collective "Anonymous" outlined what they called a "War on Scientology" by releasing a video on YouTube in which they stated "If you want another name for your opponent, then call us Legion, for we are many."

**Gone in 60 Seconds [62]:** Reformed master car thief Memphis Raines (Cage) must steal fifty cars with his crew in one night to save his brother's life.

- *Steganography*: The thieves write the list of cars to be stolen on a wall of their warehouse using an ultraviolet-sensitive paint that only becomes visible when a blacklight lamp is shone on it. When the police raid the warehouse, the thieves escape and break the lamp, but a detective finds the shards and has them analyzed by the forensics team. The team tell him that the shards are part of a blacklight lamp, so he deduces that that lamp must have been used to read something written somewhere in the warehouse. He gets another blacklight lamp and shines it on the walls of the warehouse until he can finally read the hidden message.

- *Codes*: Memphis Raines and his crew of car thieves, instead, use female codenames to refer to the cars to be stolen: "Why do you call them girls' names?" asks one of the thieves and Raines answers: "It's code. You say Jane, you say Shirley, Lucy, Edna, and nobody listening in on the waves is the wiser."

- *Insider attack*: Two detectives talk about one of the cars that was stolen:

**Detective 1:** This is one of three brand-new Mercedes, a car they say is unstealable.

**Detective 2:** Yeah, unless you get the laser-cut transponder key sent directly to the US dealer from Hamburg.

**Detective 1:** They got somebody working on the inside.

**Kick-Ass [75]:** Ordinary teenager and comic-book fan Dave Lizewski sets out to become a real-life superhero, calling himself "Kick-Ass", even though he has no powers, training or meaningful reason to do so. Dave gets caught up in a bigger fight when he meets Big Daddy (Cage), a former cop who, in his quest
to bring down a crime boss, has trained his eleven-year-old daughter to be the ruthless vigilante Hit-Girl.

- *Anonymity and Tracing*: Big Daddy and Hit-Girl pay Dave/Kick-Ass a visit at his home. Dave is surprised that they have been able to find out where he lives, so Big Daddy tells him that if you are a wannabe superhero, it is not a great idea to set up a webpage: "I rerouted your IP address. Finding you was way too easy."

**Lord of War [48]:** Illegal arms dealer Yuri Orlov (Cage) confronts the morality of his work as he is being chased by an Interpol Agent.

- *Identity/Authentication*: Orlov's container ship is being chased by the Interpol and before they are boarded, they quickly swap their ensign with that of another country and change the ship's name by repainting it.

- *Confidentiality*: One of the containers on the ship contains boxes of guns, but they are covered (encrypted) with potatoes, so that when the Interpol open the container's door, the potatoes fall out and they don't spot the boxes.

- *Integrity*: Orlov convinces his uncle, a former Soviet general overseeing a newly independent Ukrainian Army arsenal, to alter the official documents to state that the warehouse contains only 10,000 guns instead of the 40,000 guns it really contains.

- *Social engineering*: Orlov's wife suspects that he is an illegal arms dealer and tries to open one of his containers to find proof. She successfully guesses that the pin that opens the lock is their son's birthday.

**National Treasure [70]:** Historian and treasure hunter Benjamin Franklin Gates (Cage) races to find the legendary Templar Treasure before a team of mercenaries.

- *Steganography*: The premise of the film is that on the back of the Declaration of Independence, signed on July 4, 1776, by 55 Founding Fathers (at least nine of whom were Freemasons) hides a coded, unseen map that points to the secret location of the fabled and massive Templar Treasure that was discovered by the Knights Templar and later protected by the Freemasons. This film is a real cybersecurity goldmine, covering a large number of cybersecurity notions in addition to steganography, so let me provide a detailed description. Please, try to stay with me as the plot thickens.

- *Multiple-stage attack, Masquerading attack, Forging, Pseudonym, Social engineering, Invisible ink, Hacking, Sensor attack, Biometrics, Integrity, Password guessing and Background knowledge*: In order to protect the Declaration of Independence from the mercenaries and read the hidden message, Gates decides to steal the Declaration himself. To that end, he carries out a multiple-stage attack with the help of his sidekick Riley Poole. First, Gates, pretending to be a tourist shooting some photos while visiting the National Archives, takes a picture of an ID badge of one of the Archive's custodians.
and then creates a fake ID with his own face. He then smears a rare George Washington's campaign button with invisible ink and sends it to Abigail Chase, an archivist at the National Archives whom he had tried to warn about the impending threat. When he visited Chase in her office, introducing himself with the pseudonym Paul Brown, Gates noticed that she was missing this button from her collection, so he knows that she will open the gift box he sent her and touch the button to put it in her display case. Poole, in the meantime, has hacked into the network of the Archives and uses a laser hidden in a camera to attack the sensor of the cage that protects the Declaration to raise the temperature over the threshold. The archivists therefore remove the Declaration from display and take it to the Preservation Room for tests. Chase goes to the Room too for a check and types the password on a keyboard, thus unknowingly smearing the keys with the invisible ink that was on the button that Gates sent her. Later that evening, there is a gala at the Archives. Gates masquerades as a custodian using the fake ID badge and, once inside, changes clothes into a Black Tie, the semi-formal Western dress code for evening events, so as to mingle with the other guests. He briefly meets Chase and, with an excuse, takes a glass that she has been drinking from, from which, using a chemical reagent, he reconstructs her fingerprints and puts them on a glove, which he uses to open a door controlled by the fingerprint reader (while the mercenaries, who are also trying to get to the Preservation Room, knock a security guard out and drag him to another reader to open the door with the guard's actual finger). Gates needs now to walk through a corridor, so Poole turns off the surveillance cameras and replaces the feed with an earlier one, so that the security guards watching the monitors see only an empty corridor. There is one final biometric access control device left for Gates: the keyboard that Chase used earlier that day. He shines a blacklight lamp on the keys to see that the ones smeared with the invisible ink are: A E F G L O R V Y. Poole uses an automatic anagram generator to create a list of possible anagrams, but Gates uses background knowledge about Chase, an historian herself, to correctly guess that Chase pressed E and L twice and the password is "Valley forge", the location where the American Continental Army made camp during the winter of 1777-1778 and which is nowadays often called the birthplace of the American Army. Gates can now enter the Preservation Room and take the Declaration.

- *Indistinguishability, Swapping and Tracing:* With the Declaration of Independence folded and tucked under his arm, Gates has to go through the shop, which sells actual-size reproductions of the Declaration. A cashier, seeing the real Declaration tucked under Gates' arm, thinks that he is trying to steal one of the reproductions, so he is forced to pay for it. What we the viewers don't know yet, but will soon find out, is that he actually pays both for the real Declaration and for a reproduction, so that when the bad guys catch up with him, he swaps the two declarations and gives them the replica without them noticing at first, and he can get away. "I thought it would be a good idea to have a duplicate. It turned out I was right." Unfortunately, in the shop he did not have enough cash, so he paid with his credit card, which
means that the FBI can trace the payment and find out that he is not Paul Brown but discover his real identity and where he lives.

- *Ottendorf cipher*: As a consequence, Gates and Poole cannot use the clean-room environment that they had set up, so, together with Gates' father and with Chase, who in the meantime has semi-willingly joined them, they use more artisanal methods to reveal the message hidden on the back of the Declaration. Using lemon juice and their own breaths as heat sources, Gates and Chase expose the message, which is constituted by a series of triples of numbers. It is an Ottendorf cipher and the following dialogue takes place to provide a useful explanation for the non-expert viewers:

**Poole:** Will somebody please explain to me what these magic numbers are?

**Chase:** It's an Ottendorf cipher.

**Gates' father:** That's right.

**Poole:** Oh, OK. What's an Ottendorf cipher?

**Gates' father:** They're just codes.

**Gates:** Each of these three numbers corresponds to a word in a key.

**Chase:** Usually a random book or a newspaper article.

**Gates:** In this case, the Silence Dogood letters. So it's like [*Pointing to the numbers in a triple, ed*] the page number of the key text, the line on the page, and the letter in that line.

As mentioned earlier in the film, Silence Dogood was the pseudonym that 16 year old Benjamin Franklin used to get his letters published in the "New-England Courant", a newspaper founded and published by his brother James Franklin. Gates and his allies use the cipher (and some additional knowledge they have on the history of the Liberty Bell and on the design of the $100 banknote) to find the hidden message in the letters. This proves to be another clue that allows them to find a special pair of spectacles invented by Benjamin Franklin, which in turn allows them to read another invisible message on the back of the Declaration of Independence, which eventually, after some additional hunting, allows them to find the location of the treasure.

Interestingly, the film also contains a reference to the famous *Monty Hall problem* that originates from the game show "Let's Make a Deal" [61].

**National Treasure: Book of Secrets [71]:** Benjamin Franklin Gates (Cage) must follow a clue left in John Wilkes Booth's diary to prove his ancestor's innocence in the assassination of Abraham Lincoln.

Like the first National Treasure, this film contains a profusion of cybersecurity references, ranging from hacking, to device cloning and to translating a dead language that thus acts as a code (cf. Fig. 2). Let me discuss three of them.

- *Playfair cipher*: The cipher occurs twice. First, in 1865, Gates' ancestor is asked to decipher a message written with a Playfair cipher and he clarifies that "Cipher's impossible to decode without the key". Then, later in the film, it's the turn of Gates, his father and Poole. They have a fragment
of the ciphertext and, after solving a riddle, Gates successfully guesses the cipher's keyword, so that they are able to recover the plaintext with the help of an online "Playfair decoder". In doing so, they quickly explain how the cipher works, although it is imprecisely referred to as a code and they wrongly state that the keyword must be a five-letter word, which is in general not the case as the keyword can actually be of any length.

- *Hacking, Denial of Service attack* and *Social Engineering*: In a deleted scene, we get to know how Poole has actually been able to get access to the Buckingham Palace computers, which will be crucial later on. Poole is in the waiting room of the Palace's Curator's Office, while Gates is talking to the curator. Poole uses a device to jam the desktop of the curator's secretary. When she, after having learned in casual conversation that he is a computer expert, asks for his help, Poole ducks under the desk pretending to fix the problem but instead plugs in a small connection device that will later allow him to connect to the network and then simply stops jamming with his other device so that the secretary thinks that he has indeed solved the problem.

- *Hacking and Surveillance*: Gates, Chase and Poole have retrieved a wooden plank that contains a clue and a car chase ensues: the bad guys want the plank and the only way out is to give it to them. But first Gates ingeniously creates a copy of the plank: he runs a red right holding the plank in front of his face so that the speed camera on the traffic light takes his and the plank's picture, which Poole is then able to retrieve by hacking into the London Police database to get a copy of the picture. Interestingly, we are not shown, not even in a deleted scene, how Poole does this, but there is a brief dialogue that makes up for this from a dramatic point of view, ensuring that the viewers don't feel the absence of an explanation:

**Gates:** Hack into the London Police database and get a copy of the picture from that traffic cam.

**Poole:** Okey-dokey.

**Gates:** You can't do it?

**Poole:** No, I can do it. I just don't like that you assume that I can do it.

**Snowden [68]:** The NSA's illegal surveillance techniques are leaked to the public by one of the agency's employees, Edward Snowden, in the form of thousands of classified documents distributed to the press.

- *Cipher machines, Algorithms, Attacks, Malware, Surveillance, Trojan horse and Password protection:* Given the subject of the film, this is a must-see for everyone interested in cybersecurity and one could easily write a whole paper about it. However, this also makes it perhaps one of the less interesting films for cybersecurity show and tell, so let me only focus here on Hank Forrester, the character played by Nicolas Cage. Inspired by real-life NSA whistleblower William Binney, who appears briefly in news footage in the film, Forrester is a disillusioned NSA employee who acts as an instructor and mentor to Snowden, showing to him, and us viewers, an Enigma machine, its
sequel SIGABA, the first hot line between Washington and Moscow, and a
Cray 1, the world's first supercomputer. Forrester warns Snowden about the
unpleasant realities of intelligence work, which Snowden will then experience
throughout the years until he finally decides to reach out to the press.

**Spider-Man: Into the Spider-Verse [50]:** Teenager Miles Morales becomes the Spider-Man of his universe and must join with five spider-powered individuals from other dimensions to stop a threat for all realities.

- *Pseudonyms and Identity:* Thanks to the multiverse, there are actually seven different beings that use the Spidey pseudonym in this Oscar-winner animated film: Peter Parker, Peter B. Parker, Miles Morales, Peni Parker, Peter Porker (Spider-Ham), Gwen Stacy (Spider-Gwen) and Spider-Man Noir (voiced by Cage). Please, see the discussion about superheroes and pseudonyms under “Teen Titans GO! To the Movies” below and in [76].

- *Accountability:* According to NIST, accountability can be defined as “a property that ensures that the actions of an entity may be traced uniquely to that entity. This supports non-repudiation, deterrence, fault isolation, intrusion detection and prevention, and after-action recovery and legal action.” In my own experience of teaching cybersecurity, students often struggle to understand what accountability and the other properties it entails really mean. It helps to show them the scene at the beginning of the film that contains the following dialogue between the teenager (and future Spider-Man) Miles Morales and his father Jefferson Davies, a cop who does not like that Spider-Man wears a mask and is thus not accountable for his actions:

**Jefferson:** Spider-Man. I mean, this guy swings in once a day, zip-zap-zop in his little mask and answers to no one. Right?

**Miles:** Yeah, Dad. Yeah.

**Jefferson:** Meanwhile, my guys are out there, lives on the line, no masks.

**Miles:** Uh-huh.

**Jefferson:** We show our faces. ... With great ability comes great accountability.

**Miles:** That's not even how the saying goes, dad.

**Teen Titans GO! To the Movies [29]:** The maniacal plan for world domination of the villain Slade sidetracks five teenage superheroes who dream of Hollywood stardom like for the adult superheroes.

- *Pseudonyms:* In this animated film, Cage voices Superman, which must have felt for him like a dream finally come true as he had been slated to portray Superman in Tim Burton's canceled Superman film in the 1990s. He even named one of his sons Kal-El, after Superman's birth name. A lifelong comic-book fan, to avoid the appearance of nepotism as Francis Ford Coppola's nephew, Nicolas Coppola changed his name early in his career to Nicolas
Cage, inspired by the Marvel Comics superhero Luke Cage. See [76] for more details on pseudonyms and pseudonym resolution in the superhero universes.

- *Multifactor authentication, Biometrics, Masquerading attack and Social engineering:* Slade aims to steal a crystal that would give him the power to control the superheroes, but the Teen Titans initially foil Slade's evil plan by seizing the crystal and safely storing it in the Titan Tower's vault, where access is controlled by a facial scan and a pin. Then, later in the movie, Slade masquerades as the director Jade Wilson, who is responsible for all the Superhero films being made, and tricks the teen titan Robin into opening the vault for him: Jade is finally shooting his own movie and as he is acting in the final scene and interacts with a prop version of the Titan Tower vault panel, a light falls and knocks him out. He awakens and finishes the scene by opening the vault, but Jade reveals that they are now in the tower for real and that she is actually Slade himself in disguise.<fnref n="4" /> Slade steals the crystal but at the end the Teen Titans of course save the day.

**The Humanity Bureau [35]:** In the future, war, climate and political agendas have robbed the United States of America of their resources. Noah Kross (Cage) is an agent of the authoritarian agency called “The Humanity Bureau”, which ensures citizens are productive and deports unproductive citizens to a city called New Eden, which is in reality an extermination camp.

- *Stolen Identity:* Kross learns the truth about New Eden and helps an unproductive single mother, Rachel Weller, and her son, Lucas, escape. During their escape. Kross reveals that he knows the real Rachel Weller, and this woman is not her. Years ago on a Bureau investigation, Kross and the real Rachel conceived a child, who is Lucas. When the famine struck, Rachel tried to sell Lucas. Amanda, her neighbor, got into an argument over this and the resulting fight ended in Rachel's death. Amanda then assumed Rachel's identity and raised Lucas as her own.

**The Sorcerer's Apprentice [72]:** Balthazar Blake (Cage), an apprentice of the legendary Merlin, must train his old teacher's successor (an introverted but resourceful physics prodigy) in the art of sorcery to defeat Morgana le Fay.

- *Authentication:* In 740 AD, the evil sorceress Morgana le Fay mortally wounds the mighty magician Merlin, but before dying, Merlin gives Balthazar a dragon figurine that will identify the Prime Merlinean, Merlin's descendant and the only one who will be able to defeat Morgana. Balthazar searches for the descendant throughout history, until, at the beginning of the 21st century, he encounters Dave Stutler. When Balthazar gives Dave Merlin's dragon figurine, the statue comes to life and wraps itself around the boy's finger to form a ring, thereby authenticating him as the Prime Merlinean. The

<footnote n="4">⁴ A similar “fake room” attack takes place against phobic con artist Roy Waller (Cage) in “Matchstick Men” [60], which I did not add to the table only for the sake of space.</footnote>
authentication process that started 14 centuries earlier, in a pre-technology
world, is finally completed when Dave, the film's hero, is able to bring the
dragon figurine to life (in fact, it is the figurine that authenticates him). This
authentication mode is not surprising if one considers the presence of Merlin
in this film as well as in the Arthurian cycle, where Arthur is the only one
able to pull out the sword Excalibur from a stone, thereby proving to be
the rightful king of Britain. As I already briefly mentioned above, mytholo-
gies and fairy tales worldwide have similar allegories of authentication and
identity, and I point to [77] for a more detailed discussion.

**Windtalkers [86]:** Two U.S. Marines in World War II are assigned to protect Navajo Marines, who use their native language as an unbreakable radio code.

- *Codes:* During the Pacific War, the U.S. Marine Corps recruited approximately 500 bilingual Navajo speakers to transmit secret tactical messages over military telephone or radio communications nets using formally or informally developed codes built upon their native language. Code talking was actually pioneered by the Cherokee and Choctaw peoples during World War I, and other Native American codetalkers were deployed by the U.S.A. during World War II in the Pacific, North Africa, and Europe, including Lakota, Meskwaki, Mohawk, Comanche, Tlingit, Hopi, Cree, and Crow soldiers [82]. There are a few scenes in the film that show how the Navajo code worked and why it was crucial to protect it. In particular, we are told that the Japanese were unable to decode the messages when a Japanese radio operator listening to one of the communications says "It sounds like they are under water. Is it English at all?". What do you need to do when your enemy has a code that is virtually unbreakable? You need to get hold of the codebook (that maps Navajo expressions to English), in this case you need to capture one of the codetalkers and torture him until he revels the codebook that he has memorized! Corporal Joe Enders (Cage) is tasked with protecting a codetalker. As Ender's commanding officer tells him "Under no circumstances can you allow your codetalker to fall into enemy hands. Your mission is to protect the code... at all costs." The film's epilogue states that the Navajo code was crucial to the U.S.A.'s success against Japan and that, during the war, like all other Native American codes, the Navajo code was never broken.

## 4 Conclusions

So, is Nicolas Cage the center of the cybersecurity universe? To provide a
definitive answer to this question, one would need to go beyond hop zero (the
cybersecurity-related films in which Cage starred) and consider the full "Six
Cybersecurity-Degrees of Nicolas Cage" — the database of artworks that I have
been collecting for showing and telling cybersecurity will be helpful to that ex-
tent. But Cage's 15 films considered here (plus the one in Footnote 4 and other
entries in his filmography that could be considered as well) already make a good case for his central position.

This paper completes my personal trilogy on how to use films and other art-
works to carry out a cybersecurity show and tell. Such “popular” explanations,
which have been explored also for other disciplines (see, e.g., [13,42,47,56,57,74]
as well as [7]), are not meant to replace but rather complement the technical
definitions and explanations. The synergy of telling and showing via these exam-
ples can help go beyond the mere facts and skills by making them more intuitive
for the laypersons, more accessible, more interesting, more rewarding.

There is one important stream of research that I have not considered in
this paper, namely how to extend and generalize cybersecurity show and tell
by means of user studies that will help to support the claims I have made and,
possibly, to identify novel research questions. I have been carrying out two such
studies together with Diego Sempreboni (a cybersecurity researcher), Sally Mar-
low (a broadcaster and a researcher in the relationships between mental health
and the arts), Hannah Redler Hawes (a contemporary art curator specialized in
the intersection between art, data, science and technology) and Alistair Gentry
(a writer and artist who makes live art, performance lectures, interventions and
live role-playing games). We are currently writing up the results of our two stud-
ies, a first one with existing artworks and a second one with an artwork created
on purpose, and I can anticipate here that they certify the very positive impact
that artworks can have to explain cybersecurity to different kinds of people.

References

1. Daniel Alfredson (directed by). *The Girl Who Kicked the Hornet's Nest*, 2009. Screenplay by Jonas Frykberg based on the novel by Stieg Larsson, https://www.imdb.com/title/tt1343097/.

2. Daniel Alfredson (directed by). *The Girl Who Played with Fire*, 2009. Screenplay by Jonas Frykberg based on the novel by Stieg Larsson, https://www.imdb.com/title/tt1216487/.

3. Michael Apted (directed by). *Enigma*, 2001. Screenplay by Tom Stoppard based on the novel by Robert Harris, https://www.imdb.com/title/tt0157583/.

4. Neville Astley and Mark Baker (created by). Peppa Pig, Series 3, Episode 38, "The Secret Club", 2010. 7 seasons, 302 episodes, https://www.imdb.com/title/tt0426769/.

5. John Badham (directed by). *Wargames*, 1983. Screenplay by Lawrence Lasker and Walter F. Parkes, https://www.imdb.com/title/tt0086567/.

6. Brad Bird (directed by). *Incredibles 2*, 2018. Screenplay by Brad Bird, https://www.imdb.com/title/tt3606756/.

7. Jorge Blasco and Elizabeth A. Quaglia. InfoSec Cinema: Using Films for Information Security Teaching. In *2018 USENIX Workshop on Advances in Security Education, ASE 2018*. USENIX Association, 2018.

8. Raymond T. Bond, editor. *Famous Stories of Code and Cipher*. Rinehart, 1947.

9. Harry Bradbeer (directed by). *Enola Holmes*, 2020. Screenplay by Jack Thorne based on the novel "The Case of the Missing Marquess: An Enola Holmes Mystery" by Nancy Springer, https://www.imdb.com/title/tt7846844/.
10. Dan Brown. *Digital Fortress*. St. Martin's Press, 1998.

11. Guy Burt (created by). *The Bletchley Circle*, 2012–2014. 2 seasons, 7 episodes, https://www.imdb.com/title/tt2275990/.

12. Andrea Capozucca. *Comunicare la matematica*. Egea, 2018.

13. Joseph E. Champoux. *Management: Using Film to Visualize Principles and Practice*. South-Western, 2000.

14. Ann Donahue, Carol Mendelsohn, and Anthony E. Zuiker (created by). *CSI: Cyber*, 2015–2016. 2 seasons, 31 episodes, https://www.imdb.com/title/tt3560060/.

15. John F. Dooley. *Codes and Villains and Mystery: The Best Stories with Codes and Ciphers 1843–1920*. CreateSpace Independent Publishing Platform, 2016. See also the "Cryptology in Fiction" document at https://www.johnfdooley.com.

16. Arthur Conan Doyle. *The Adventure of the Dancing Men*. *The Strand Magazine*, 1903.

17. Alexandre Dumas père (avec la collaboration d'Auguste Maquet). *Les Trois Mousquetaires*. Le Siècle, 1844.

18. Martin Erwig. *Once Upon an Algorithm: How Stories Explain Computing*. MIT Press, 2011.

19. Sam Esmail (created by). *Mr. Robot*, 2015–2019. 4 seasons, 45 episodes, https://www.imdb.com/title/tt4158110/.

20. Nicolas Falacci and Cheryl Heuton (created by). *NUMB3RS*, 2005–2010. 6 seasons, 119 episodes, https://www.imdb.com/title/tt0433309/.

21. Craig Fass, Brian Turtle, and Mike Ginelli. *Six Degrees of Kevin Bacon*. Plume, 1996.

22. David Fincher (directed by). *Zodiac*, 2007. Screenplay by James Vanderbilt based on the book by Robert Graysmith, https://www.imdb.com/title/tt0443706/.

23. Len Fisher. What's your Erdös-Bacon-Sabbath number?, 2016. https://www.timeshighereducation.com/blog/whats-your-erdos-bacon-sabbath-number, last accessed June 2021.

24. William Gibson. *Sprawl trilogy: Neuromancer, Count Zero, Mona Lisa Overdrive*. Victor Gollancz Ltd, 1984–1988.

25. Seth Gordon (directed by). *Identity Thief*, 2013. Screenplay by Craig Mazin, https://www.imdb.com/title/tt2024432/.

26. Jacob Grimm and Wilhelm Grimm. *Kinder- und Hausmärchen*. 1812–1858.

27. John Guare. *Six Degrees of Separation: A Play*. Random House, 1990.

28. David Hartman (directed by). *Tigger & Pooh and a Musical Too*, 2009. Screenplay by Nicole Dubuc, Brian Hohlfeld and Dean Stefan, "Password Song" written by Andy Sturmer and Brian Hohlfeld, https://www.imdb.com/title/tt1415904/.

29. Aaron Horvath and Peter Rida Michail (directed by). Teen Titans GO! To the Movies, 2018. Screenplay by Michael Jelenic and Aaron Horvath, https://www.imdb.com/title/tt7424200/.

30. Ron Howard (directed by). *A Beautiful Mind*, 2001. Screenplay by Akiva Goldsman based on the book by Sylvia Nasar, https://www.imdb.com/title/tt0268978/.

31. Ron Howard (directed by). *The Da Vinci Code*, 2006. Screenplay by Akiva Goldsman based on the novel by Dan Brown, https://www.imdb.com/title/tt0382625/.

32. Ron Howard (directed by). *Angels & Demons*, 2009. Screenplay by David Koepp and Akiva Goldsman based on the novel by Dan Brown, https://www.imdb.com/title/tt0808151/.

33. Ron Howard (directed by). *Inferno*, 2016. Screenplay by David Koepp based on the novel by Dan Brown, https://www.imdb.com/title/tt3062096/.
34. Mark Steven Johnson (directed by). *Ghost Rider*, 2007. Screenplay by Mark Steven Johnson, https://www.imdb.com/title/tt0259324/.

35. Rob W. King (directed by). *The Humanity Bureau*, 2017. Screenplay by Dave Schultz, https://www.imdb.com/title/tt6143568/.

36. Stanley Kubrick (directed by). *Spartacus*, 1960. Screenplay by Dalton Trumbo based on the novel by Howard Fast, https://www.imdb.com/title/tt0054331/.

37. Stieg Larsson. *Millennium Trilogy: The Girl with the Dragon Tattoo, The Girl Who Played with Fire, The Girl Who Kicked the Hornet's Nest*. Knopf, 2008.

38. Rob Letterman and Conrad Vernon (directed by). *Monsters vs. Aliens*, 2009. Screenplay by Maya Forbes, Wallace Wolodarsky, Rob Letterman, Jonathan Aibel and Glenn Berger, https://www.imdb.com/title/tt0892782/.

39. Richard Loncraine (directed by). *Firewall*, 2006. Screenplay by Joe Forte, https://www.imdb.com/title/tt0408345/.

40. Robert Ludlum. *Bourne series: The Bourne Identity, The Bourne Supremacy, The Bourne Ultimatum*. Richard Marek, Random House, Random House, 1980, 1986, 1990.

41. Michael Mann (directed by). *Blackhat*, 2015. Screenplay by Morgan Davis Foehl, https://www.imdb.com/title/tt2717822/.

42. Alan S. Marcus, Scott Alan Metzger, Richard J. Paxton, and Jeremy D. Stoddard, editors. *Teaching History With Film: Strategies for Secondary Social Studies*. Routledge, 2 edition, 2018.

43. James McTeigue (directed by). V for Vendetta, 2005. Screenplay by Lilly Wachowski and Lana Wachowski based on [46], https://www.imdb.com/title/tt0434409/.

44. John McTiernan (directed by). *The Thomas Crown Affair*, 1999. Screenplay by Leslie Dixon and Kurt Wimmer, story by Alan R. Trustman, https://www.imdb.com/title/tt0155267/.

45. Stanley Milgram. The Small World Problem. *Psychology Today*, 1967.

46. Alan Moore and David Lloyd. *V for Vendetta*. Vertigo (DC Comics), 1982–1989.

47. Roberto Mordacci, editor. *Come fare filosofia con i film*. Carocci editore, 2017.

48. Andrew Niccol (directed by). Lord of War, 2005. Screenplay by Andrew Niccol, https://www.imdb.com/title/tt0399295/.

49. Niels Arden Oplev (directed by). *The Girl with the Dragon Tattoo*, 2009. Screenplay by Nikolaj Arcel and Rasmus Heisterberg based on the novel by Stieg Larsson, https://www.imdb.com/title/tt1132620/.

50. Bob Persichetti, Peter Ramsey, and Rodney Rothman (directed by). Spider-Man: Into the Spider-Verse, 2018. Screenplay by Phil Lord and Rodney Rothman, https://www.imdb.com/title/tt4633694/.

51. Andreas Pfitzmann and Marit Hansen. A terminology for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management (Version v0.34), Aug. 10, 2010. https://dud.inf.tu-dresden.de/literatur/Anon\_Terminology\_v0.34.pdf.

52. Edgar Allan Poe. *A Few Words on Secret Writing*, 1841.

53. Edgar Allan Poe. *The Gold Bug*. *The Dollar*, 1843.

54. Tim Price. *Teh Internet Is Serious Business*. Bloomsbury Methuen Drama, 2014.

55. Phil Alden Robinson (directed by). *Sneakers*, 1992. Screenplay by Phil Alden Robinson, Lawrence Lasker and Walter F. Parkes, https://www.imdb.com/title/tt0105435/.

56. Lawrence C. Rubin, editor. *Mental Illness in Popular Media: Essays on the Representation of Disorders*. McFarland & Co, 2012.
57. William B. Russell III. The Art of Teaching Social Studies with Film. *The Clearing House: A Journal of Educational Strategies, Issues and Ideas*, 85(4):157–164, 2012.

58. Dorothy L. Sayers. *Have His Carcase*. Victor Gollancz, 1932.

59. Fred Schepisi (directed by). Six Degrees of Separation, 1993. Screenplay by John Guare, https://www.imdb.com/title/tt0122241/.

60. Ridley Scott (directed by). Matchstick Men, 2003. Screenplay by Nicholas Griffin based on the book by Eric Garcia, https://www.imdb.com/title/tt0325805/.

61. Steve Selvin. On the Monty Hall problem (letter to the editor). *The American Statistician*, 29(3), 1975.

62. Dominic Sena (directed by). Gone in 60 Seconds, 2000. Screenplay by H.B. Halicki and Scott Rosenberg, https://www.imdb.com/title/tt0187078/.

63. Dominic Sena (directed by). *Swordfish*, 2001. Screenplay by Skip Woods, https://www.imdb.com/title/tt0244244/.

64. Simon Singh. *The Simpsons and Their Mathematical Secrets*. Bloomsbury, 2013.

65. Iain Softley (directed by). *Hackers*, 1995. Screenplay by Rafael Moreu, https://www.imdb.com/title/tt0113243/.

66. Neal Stephenson. *Snow Crash*. Bantam Books, 1992.

67. Neal Stephenson. *Cryptonomicon*. Avon, 1999.

68. Oliver Stone (directed by). Snowden, 2016. Screenplay by Kieran Fitzgerald and Oliver Stone based on the book by Luke Harding and Anatoly Kucherena, https://www.imdb.com/title/tt3774114/.

69. The Pierces. *Secret*, 2007. First track of the album *Thirteen Tales of Love and Revenge*.

70. Jon Turteltaub (directed by). *National Treasure*, 2004. Screenplay by Jim Kouf, Cormac Wibberley and Marianne Wibberley, https://www.imdb.com/title/tt0368891/.

71. Jon Turteltaub (directed by). *National Treasure: Book of Secrets*, 2007. Screenplay by Marianne Wibberley and Cormac Wibberley, https://www.imdb.com/title/tt0465234/.

72. Jon Turteltaub (directed by). The Sorcerer's Apprentice, 2010. Screenplay by Matt Lopez, Doug Miro and Carlo Bernard based on a screen story by Lawrence Konner, Mark Rosenthal and Matt Lopez, https://www.imdb.com/title/tt0963966/.

73. Morten Tyldum (directed by). *The Imitation Game*, 2014. Screenplay by Graham Moore based on the book by Andrew Hodges, https://www.imdb.com/title/tt2084970/.

74. Brandon Valeriano. Teaching Introduction to International Politics with Film. *Journal of Political Science Education*, 9:52–72, 2013.

75. Matthew Vaughn (directed by). Kick-Ass, 2010. Screenplay by Jane Goldman and Matthew Vaughn based on the comic book by Mark Millar and John Romita Jr., https://www.imdb.com/title/tt1250777/.

76. Luca Viganò. Explaining Cybersecurity with Films and the Arts. In Michele Emmer and Marco Abate, editors, *Imagine Math 7*, pages 297–309. Springer, Cham, 2020.

77. Luca Viganò. Don't Tell Me the Cybersecurity Moon is Shining... (Cybersecurity Show and Tell). In Michele Emmer, editor, *Imagine Math 8*. Springer, Cham, to appear.

78. Luca Viganò and Daniele Magazzeni. Explainable Security. CoRR, 2018. http://arxiv.org/abs/1807.04178.

79. Luca Viganò and Daniele Magazzeni. Explainable Security. In *IEEE European Symposium on Security and Privacy Workshops, EuroS&P Workshops 2020*, pages 293–300. IEEE, 2020. A preliminary version appeared as [78].
80. Duncan J. Watts. *Six Degrees: The Science of a Connected Age*. William Heine-mann, 2003.

81. Simon West (directed by). *Con Air*, 1997. Screenplay by Scott Rosenberg, https://www.imdb.com/title/tt0118880/.

82. Wikipedia. Code Talker. https://en.wikipedia.org/wiki/Code_talker, last accessed June 2021.

83. Wikipedia. Six degrees of separation. https://en.wikipedia.org/wiki/SixDegrees_of_separation, last accessed June 2021.

84. Len Wiseman (directed by). *Live Free or Die Hard*, 2007. Screenplay by Mark Bomback based on a story by Mark Bomback and David Marconi, on an article by John Carlin and on characters by Roderick Thorp, https://www.imdb.com/title/tt0337978/.

85. John Woo (directed by). *Face/Off*, 1997. Screenplay by Joe Forte, https://www.imdb.com/title/tt0119094/.

86. John Woo (directed by). *Windtalkers*, 2002. Screenplay by John Rice and Joe Batteer, https://www.imdb.com/title/tt0245562/.

87. Edgar Wright (directed by). *Baby Driver*, 2017. Screenplay by Edgar Wright, https://www.imdb.com/title/tt3890160/.

88. Hoyt Yeatman (directed by). G-Force, 2009. Screenplay by The Wibberleys (Cor-mac Wibberley and Marianne Wibberley) based on a story by Hoyt Yeatman and David P.I. James, https://www.imdb.com/title/tt0436339/.

89. Rina Zazkis and Peter Liljedahl. *Teaching Mathematics As Storytelling*. Sense Publishers, 2009.