# ECU-IoFT: A Dataset for Analysing Cyber-Attacks on Internet of Flying Things
## 2 IoFT within the Education Domain
### Cyber Risk to Students  
We identified three potential risks to students, staff, and the school community that exist if a cyber-attack was executed against a UAV used within an educational institution. Firstly, a total loss of an asset (UAV), secondly the safety to students, teachers, and community. Thirdly, the potential consequences for a breach in students' (Persons Under 18) privacy. The loss of an asset in the context discussed within this paper can refer to physical damage or total loss of the UAV. Given the low cost of most UAV's used within the education sector, such as the Ryze Tello costing less than two hundred Australian dollars (as of 21 September 2021) from DJI's Online Store ([[https://m.dji.com/au/product/tello](https://m.dji.com/au/product/tello)]([https://m.dji.com/au/product/tello](https://m.dji.com/au/product/tello)) (accessed on 18 January 2022)), the loss of a single UAV due to a cyber-attack poses minimal financial loss to an educational institution. This loss could be considered more as an inconvenience than a major financial risk to students or staff. However, due to the swarming capabilities of many of these education-based UAV's [18], the cost incurred by the loss of assets could exponentially grow.  
Under the Duty of Care Policy dictated by the Western Australian Department of Education, staff members of a school (teachers and administration) are responsible for protecting students from unreasonable risk or harm. As such, identifying the physical risks UAVs pose to students is essential. For example, if a student or staff member was to lose control of a UAV due to a cyber-attack. The potential to cause significant injury to a student,staff member, or the wider community exists. In addition to the physical harm to humans, there also exists the risk to the education institute's reputation. Reputational damage has the potential to jeopardize future enrolments, plans, and goals the education institute may have [19].  
The final concern relates to a breach of a student's privacy. If an attacker was able to access the video feed of the UAV or stored images on internal storage or accessed via the memory of the device an attacker may compromise the privacy of the students using the UAV. Under the Privacy Act 1998 [20], the act places the responsibility for privacy on a guardian of that child. As such, the school would be responsible to protect the student's privacy while under the school's care. In addition, many schools have school photograph policies dictating what students' photographs can be published in the community, breaches to this policy could result in legal consequences or loss of reputation [21].  
In this paper, two different hypothetical scenarios of potential cyber-attacks are considered that could be launched against UAV's used within the education sector. The first is that the student or teacher loses control of the UAV due to a cyberattack, resulting in the UAVs flying into the student, endangering their safety. The second attack would be that student's privacy may be breached by a cyber attacker accessing the camera of the UAV while under the control of students or the attacker takes control of the drone and flying it, out of the operators reach and into the cyber attacker's possession, where they can extract images of the students forensically [22; 23]. Each of these attacks contains a different motive; The first motive would be to place the student in harm's way. The second hypothetical motive would be to breach the privacy of students using the UAVs.