# Don’t Tell Me The Cybersecurity Moon
Is Shining…
(Cybersecurity Show And Tell)

Luca Viganò
Department of Informatics
King’s College London, London, UK
<EMAIL_ADDRESS>
###### Abstract

“Show, don’t tell” has become the literary commandment for any writer. It
applies to all forms of fiction, and to non-fiction, including scientific
writing, where it lies at the heart of many scientific communication and
storytelling approaches. In this paper, I discuss how “show _and_ tell” is
actually often the best approach when one wants to present, teach or explain
complicated ideas such as those underlying notions and results in mathematics
and science, and in particular in cybersecurity. I discuss how different kinds
of artworks can be used to explain cybersecurity and I illustrate how telling
(i.e., explaining notions in a formal, technical way) can be paired with
showing through visual storytelling or other forms of storytelling. I also
discuss four categories of artworks and the explanations they help provide.

##  1 Show, don’t tell!

In May 1886, the Russian playwright and short-story writer Anton Chekhov wrote
a letter to his brother Alexander, who too had literary ambitions, providing
him with the following advice:

> In descriptions of Nature one must seize on small details, grouping them so
> that when the reader closes his eyes he gets a picture. For instance, you’ll
> have a moonlit night if you write that on the mill dam a piece of glass from
> a broken bottle glittered like a bright little star, and that the black
> shadow of a dog or a wolf rolled past like a ball. [132]

This is often misquoted as

> Don’t tell me the moon is shining; show me the glint of light on broken
> glass.

but the misquote is understandable: it is crisper and, essentially, preserves
the intended meaning. It is a concise injunction that has become the literary
commandment for any writer: _show, don’t tell_!

The distinction between telling and showing was popularized by the literary
scholar Percy Lubbock in his 1921 book “The Craft of Fiction” [75]. _Show,
don’t tell_ is a writing technique in which story and characters are related
to the reader through action, words, dialogues, thoughts, senses, and feelings
rather than through the author’s exposition and description. In a nutshell:
telling states, showing illustrates.

Several other literary scholars and writers have since then discussed the
_show, don’t tell_ style of writing, including Ernest Hemingway and Stephen
King, two of the style’s most prominent proponents. For instance, in his
memoir “On Writing: A Memoir of the Craft”, Stephen King writes:

> Description is what makes the reader a sensory participant in the story. […]
> Description begins with visualization of what it is you want the reader to
> experience. It ends with your translating what you see in your mind into
> words on the page. It’s far from easy. […] Thin description leaves the
> reader feeling bewildered and nearsighted. Overdescription buries him or her
> in details and images. The trick is to find a happy medium. [68, pp.
> 173–174]

_Show, don’t tell_ applies also to all forms of fiction (including poetry,
scriptwriting and playwriting) and to non-fiction (including speech writing
and blogging). Does it apply also to scientific writing? Of course it does. In
fact, even though I am not aware of any explicit theoretical (or practical,
for that matter) investigation of the use of _show, don’t tell_ in scientific
writing, the _show, don’t tell_ spirit lies at the heart of many successful
scientific communication and storytelling approaches, such as those discussed
in John Brockman’s “The Third Culture: Beyond the Scientific Revolution”
[17]111See also Edge.org, the website of the Edge Foundation, Inc., which was
launched in 1996 as the online version of “The Reality Club” to display the
activities of “The Third Culture.”. Storytelling has been used widely, and
very successfully, as a pedagogical device in textbooks and science outreach
endeavors, e.g., [24, 41, 56, 60, 82] to name a few. Rina Zazkis and Peter
Liljedahl, in particular, have been instrumental in promoting storytelling in
the mathematics classroom. They begin their book “Teaching Mathematics as
Storytelling” by writing:

> We like to tell stories. We tell stories about mathematics, about
> mathematicians, and about doing mathematics. We do this firstly because we
> enjoy it. We do it secondly because the students like it. And we do it
> thirdly because we believe that it is an effective instructional tool in the
> teaching of mathematics. We are not alone in this. There is ample literature
> to support the enjoyment of storytelling on the part of both the story
> teller and the story listener. There is also an abundance of anecdotal data
> that suggest “telling a story creates more vivid, powerful and memorable
> images in a listener’s mind than does any other means of delivery of the
> same material” [62, p. xvii]. Aside from the educational value, however,
> there is also beauty. There is beauty in a story well told, and there is
> beauty of a story that can move a listener to think, to imagine, and to
> learn. [133, p. ix]

I find this remark about beauty particularly fascinating, especially since my
colleague Giampaolo Bella and I have been reflecting about beauty in security
[10], which has led us to work with Karen Renaud and Diego Sempreboni to
investigate the beautification of security ceremonies (i.e., protocols that
are executed by machines and human users) [9]. We are currently working on a
deeper analysis of the role that beauty plays in security, but I am digressing
from the main topic of this paper, so let me return to Zazkis and Liljedahl,
who, a few lines after the quote above, discuss the purpose of telling stories
in the classroom:

> We tell stories in the mathematics classroom to achieve an environment of
> imagination, emotion, and thinking. We tell stories in the mathematics
> classroom to make mathematics more enjoyable and more memorable. We tell
> stories in the mathematics classroom to engage students in a mathematical
> activity, to make them think and explore, and to help them understand
> concepts and ideas. [133, p. ix]

They quote Egan:

> Telling a story is a way of establishing meaning. [38, p. 37]

and then talk about the power of images:

> One result of the development of language was the discovery that words can
> be used to evoke images in the minds of their hearers, and that these images
> can have as powerful emotional effects as reality might, and in some cases
> even more. [133, p. 15]

In fact, when Egan, Haven, Zazkis and Liljedahl, as well as many others, speak
of telling, and then, more concretely, of storytelling, they invoke images and
imagery. One would be tempted to cite the old adage “A picture is worth a
thousand words.”222In 1921, the advertising trade journal “Printer’s Ink”
published an article by Frederick R. Barnard titled “One Look is Worth a
Thousand Words” in which Barnard claims that the phrase has Japanese origin.
But in 1927, “Printer’s Ink” published an advert by Barnard with the phrase
“One Picture Worth Ten Thousand Words,” where it is labeled a Chinese proverb.
The Japanese and Chinese attributions were meant to give it more credibility,
a sense of gravitas and a touch of mystery and philosophy, so much so that the
proverb is nowadays commonly, and wrongly, attributed to the Chinese
philosopher and politician Confucius. So, if storytelling is powerful, and
images and pictures even more so, why not combine them? Why not tell _and_
show? Or, better, _show and tell_?

##  2 Show and tell

Dan Roam has written a number of books, including “The Back of the Napkin”
[94] and ”Show and Tell” [95], in which he has been proposing visual thinking
and storytelling for problem solving.333“Show and tell” is also the name of a
common classroom activity in elementary schools, especially in English-
speaking countries, in which a child brings an item from home and explains to
the class why he/she chose that item and other relevant information. This
activity is useful also for adults [86], but it is quite different from the
_show and tell_ that Roam champions and the one that I discuss here. Roam is
also an engaging speaker and some of his presentations are available online.
In particular, when he presented “The Back of the Napkin” at Google [93], he
said:

> Any problem can be clarified significantly, if not outright solved, through
> the use of a picture.

Drawing on his collaborations with visual scientists and neurobiologists, he
added:

> If we can take the time to use these simple pictures to help us figure out
> what we’re talking about, we now have this incredibly powerful tool to use
> to share with other people when we meet them, and the beauty of it is that
> they’re not going to forget what we told them. […] When we draw in front of
> someone at the same time that we’re talking, […] we are actually activating
> processing centers in the brain that are really, really excited. Our brain
> wants to get information visually as well as verbally […] when we draw the
> picture at the same time that we’re talking, they get it and it’s like manna
> for the person’s brain. This is the way the brain wants to process
> information. […] The picture is something that is archival and can be taken
> along, and we essentially guarantee that the person we gave it to, that we
> drew this picture for, really does understand what we were talking about […]
> almost invariably we can guarantee that they understood it in exactly the
> way we meant because we created the picture with them.

In this talk, and in his books, Roam proposes to draw pictures in real time
when presenting an idea, when addressing a problem and pitching its possible
solution. This is one of the possible ways in which one can realize _show and
tell_. In this paper, I will mainly explore another way, namely the use of
existing artworks (films, in particular, but not only). The idea is that while
_show, don’t tell_ is the commandment for fiction, in the case of non-fiction,
_show and tell_ is often the best approach when one wants to present, teach or
explain complicated ideas such as those underlying notions and results in
mathematics and science. Or in cryptography and cybersecurity, which is my own
discipline.

In my paper “Explaining Cybersecurity with Films and the Arts” in “Imagine
Math 7” [120], I discussed how, in the context of research in _Explainable
Security (XSec)_ [122], popular movies and other artworks can be used to
explain a number of basic and advanced cybersecurity notions, ranging from
security properties (such as anonymity, pseudonymity and authentication) to
the algorithms, protocols and systems that have been developed to achieve such
properties, and to the vulnerabilities and attacks that they suffer from. As
this paper is a natural continuation of [120], let me repeat some text that I
wrote there and then expand on it:

> In [122], we discussed the “Six Ws” of XSec (Who? What? Where? When? Why?
> and How?, as summarized in Fig. 1) and argued that XSec has unique and
> complex characteristics: XSec involves several different stakeholders (i.e.,
> system’s developers, analysts, users and attackers) and is multi-faceted by
> nature, as it requires reasoning about system model, threat model and
> properties of security, privacy and trust as well as concrete attacks,
> vulnerabilities and countermeasures.

This paper, like [120], is mainly about the “Who?” and the “How?”. As pointed
out in [122], the recipients of the explanations might be so varied, ranging
from experts to laypersons, that they require quite radically different
explanations, formulated using different languages. Experts typically only
accept detailed technical explanations, whereas laypersons are often scared
off by explanations of cybersecurity (say, how to interact with a system or an
app) that are detailed but too technical. Such an explanation might even
repulse the laypersons and make them lose all trust in the explanation and,
ultimately, in the cybersecurity of the system that is being explained. This
repulsion and lack of trust might lead to users interacting with systems in
ways that, unbeknownst to the users and possibly even to the developers and
administrators of the systems, are vulnerable to attacks (to the systems and
to the users themselves). In practice, however, laypersons are rarely given
explanations that are tailored to their needs and their ability to understand.

Figure 1: The Six Ws of Explainable Security (from [122])

As discussed in [120], clear and simple explanations with popular films and
the arts allow experts to target the laypersons, reducing the mental and
temporal effort required of them and increasing their understanding, and
ultimately their willingness to engage with cybersecurity systems. In other
words, with reference to the research roadmap for XSec that was laid out in
[122], this paper and [120] focus on

  * •

Who? The experts (the system developers but possibly also independent third
parties) provide explanations to the laypersons.

  * •

How? Using popular films and the arts. (It would also be interesting to
consider “inventing” new artworks, possibly in real time, like Roam’s
drawings, and I will return to this in the concluding remarks.)

The other “Ws” should, of course, be considered too:

  * •

What? Everything that pertains to cybersecurity, such as properties,
algorithms and protocols, threats, vulnerabilities and attacks. Paraphrasing
Roam’s assertion quoted above, the problem that we want to tackle, and in some
cases hopefully outright solve, is the clarification of cybersecurity notions
through the use of static or moving pictures (i.e., films) and other artworks.

  * •

Where? These explanations could actually be anywhere, either co-located with
the system or detached from it.

  * •

When? As these explanations mainly target the system users, the explanations
will be given when (or after) the system is deployed, but it will also be
useful for the system developers to start working on the explanations at
system design time (unless the explanation is provided by a third party,
independent of the developers). Such explanations are also an effective
instructional tool in the teaching of mathematics, as advocated by Zazkis and
Liljedahl [133] and as I have been doing for 20 odd years, using films and
artworks during lectures and in public engagement talks on cybersecurity.

  * •

Why? To increase the laypersons’ understanding, confidence, trust (and more)
in cybersecurity.

There is also a second “Why?”, namely why use popular films and artworks to
explain cybersecurity? Because the added power of telling (i.e., explaining
notions in a technical way) _and_ showing (via visual storytelling or other
forms of storytelling) can help experts to convey the intuition in addition to
the technical definition.

I have given some examples in [120] considering security properties such as
authentication, anonymity, unobservability and untraceability and some
algorithms and mechanisms to achieve them (or to attack them). Let me give
here another example about anonymous communication, or, more specifically,
unobservability of message exchanges and untraceability of messages.

Example 1.  Assume that Alice wants to send a message to Bob but she does not
want the attacker Charlie to trace the communication, i.e., Alice (and
possibly Bob too) does not want Charlie to observe that Alice sends the
message and that the message is received by Bob. The point here is not to keep
the contents of the message confidential (that can be achieved by encryption,
if needed) but rather that the communication Alice—Bob is confidential, i.e.,
that Charlie is not able to trace the message and observe that the
communication is taking place. There might be plenty of reasons to keep a
communication confidential. For instance, Alice might be an employee of
Charlie’s company and would not want Charlie to know that she has applied for
a job at Bob’s company, or Charlie might be a crime lord, Alice a snitch and
Bob the Police. In such cases, and many others, it is therefore in Charlie’s
interest to monitor the network over which messages are sent and received (say
it is the Internet) and trace messages as they move from one machine to the
other in the network, from sender to receiver. And it is in Alice’s interest
(and possibly Bob’s too) to find a security solution to impede Charlie to
carry out such tracing, even when it is assumed that Charlie is able to
monitor the whole network, as is typically assumed in security analysis, where
one considers the most powerful attacker possible, e.g., one who is able to
monitor the whole Internet. If the adopted security solution is able to
withstand the attacks of such most powerful attacker, then it will for sure be
able to withstand also the attacks of a real, and thus less powerful,
attacker.

Some security solutions for anonymous communication over a network (and
unobservability and untraceability of messages) have been implemented, such as
_Mix Networks_ [27] and _Onion Routing_ [92], but they are among the security
solutions that are most difficult to explain from a technical point of view.
Similarly, one can give a natural-language definition of untraceability,

> Untraceability of an object during a process under observation of an
> attacker is the property that the attacker cannot follow the trace of the
> object as it moves from one participant or location to another. [14]

and then refine this initial definition by providing a more formal one, a
mathematical one, but I am fairly certain that some readers have already found
the natural-language definition to be quite difficult to digest, and they
would find the technical definition and the solutions even more impenetrable.

The intuition behind the property and the solution is, however, quite simple.
So, rather than _telling_ you that the Mix-Network moon is shining, let me
first _show_ you the glint of light on untraceable communications. Once you
get the intuition, the technical explanation will hopefully be much more
understandable (if you are, say, a cybersecurity student learning how Mix
Networks work) or maybe not needed at all (if you are a layperson interested
in understanding why you should trust Mix Networks but not so much in their
inner workings). In fact, I will not tell you the technical explanation in
this paper, but only show how and why it works.

Consider the network delimited by the dotted line in Fig. 2, where the squares
represent machines that distribute messages in the network, and meet Alice
and Bob . I don’t show the attacker Charlie explicitly, but you can picture
him at bird’s-eye view, observing the whole network. If Charlie is able to
ensure Alice’s message is the only one in the network, as in Fig. 3, then
tracing the communication is a trivial task. It is as if the police were
chasing a car on a highway, and that car is the only one on that highway.

In fact, to _show_ this, consider the photo in Fig. 4. On June 17, 1994,
former NFL player O.J. Simpson was formally charged with the murders of his
ex-wife, Nicole Brown Simpson, and her friend Ron Goldman. Instead of turning
himself in, Simpson drove off into a white 1993 Ford Bronco SUV and became a
fugitive of the law. The low-speed car-chase that ensued was watched live by
an estimated 95 million people and indeed the police closed the highways so
that they could easily follow the car for about 60 miles until Simpson’s home.

The car-chase would have been more challenging had there been other cars on
the highway (instead of having been forced to pull over as shown in the
photo). So, let’s add some more agents who send and receive messages alongside
Alice and Bob (the machines in the network are also allowed to send messages),
as shown in Fig. 5. Charlie’s task is now more complex, but still feasible: if
he wishes to find out who Alice is communicating with, Charlie just needs to
follow the messages that are sent by Alice to the first machines in the
network, and then follow the messages that are sent by these machines, and so
on, until he has identified all possible traces from Alice to the possible
recipients. Basically, this means dispatching one police car for every suspect
car. A powerful attacker would certainly have enough police cars at his
disposal. Hence, to achieve untraceability, we need suspect cars, lots of
suspect cars. That is, we need many more agents sending and receiving many
more messages as shown in Fig. 6. Charlie would now need to follow all of the
messages, and the more there are, the harder Charlie’s task as Alice’s message
could be any one of the messages that are circulating in the network. In
technical terms, this set of messages is called the _anonymity set_ : Alice’s
communication with Bob is anonymous as Alice’s message is not identifiable
within the set of messages. Of course, the larger the set, the higher the
level of anonymity.

Figure 2: Alice, Bob and the network Figure 3: Alice sends a message to Bob…
but it is the only message in the network and thus can be easily traced Figure
4: The police chasing O.J. Simpson’s white Ford Bronco (It was impossible to
trace the author of this photo even though many newspapers online have used
it.) Figure 5: Some more agents, some more messages Figure 6: Towards
untraceability

I have already discussed anonymity sets in [120] using the “I’m Spartacus!”
scene in Stanley Kubrick’s “Spartacus” [69] and the climatic museum scene in
“The Thomas Crown Affair” [81] (and more). As I observed in [120], the main
idea underlying the way in which Mix Networks realize untraceability of
messages is that there are plenty of messages circulating in a network and
that such messages all look alike (in the sense that they are all plausible
messages). But Mix Networks do more than that. The machines in the network are
called “Mixes” since they receive a batch of messages in input, mix them and
then output them in different order, so that an attacker who is observing the
input and output of each Mix, but cannot open the Mixes to look at the inner
working, cannot associate output messages with input messages. There is no
first-in/first-out or last-in/last-out association (nor any other association
such as first-in/last-out). The first message that is output by a Mix could
correspond to any of the messages that the Mix received in input. Moreover,
Mixes also ensure that there is always enough traffic in the network by
sending “dummy messages” (i.e., fake messages that are then discarded) and
they require that all messages have the same size.

How can we “show” that? For instance, by using a scene from the movie “Baby
Driver” [131]. The movie begins with a bank heist and the ensuing car chase:
three bank robbers are escaping in a red sedan car (a 2006 Subaru WRX STI in
San Remo Red) chased by several police cars and a helicopter. Baby, the
robber’s getaway driver, has a brilliant idea: he enters a highway by going
the wrong way into oncoming traffic444This is an homage to another great car
chase, the one in “To Live and Die in L.A.” [51]. and then performs a u-turn
to merge into normal traffic when he spots two other similar red sedan cars
proceeding side by side. Aerial shot from the helicopter: three red cars side
by side, with Baby’s car in the middle. But when the cars enter a short
tunnel, Baby performs a mix: he drives in front of the car on his left and
breaks suddenly, forcing that car to take Baby’s place in the middle of three,
so that, when they exit the tunnel, the helicopter continues to chase the car
in the middle and Baby’s car can safely escape by taking the next exit.
Traffic, an anonymity set consisting of similar, if not identical, cars and a
mix changing the order of the “messages”: Baby gets away using a small Mix
Network. $\Box$

This lengthy example has hopefully demonstrated that even challenging concepts
such as untraceability and Mix Networks can benefit from the _show and tell_
treatment. I urge you to watch the movie scenes that I have referenced above
(and the ones I will mention below) as doing so will bear witness to the fact
that the synergy between showing and telling adds another dimension to what is
told, a sensory one based on visual storytelling.555This is reminiscent of the
way in which a musical score adds an emotional layer to the images of a film,
thus contributing in a fundamental way to the storytelling. This has been
explained brilliantly by Stewart Copeland in the second episode, aptly titled
“Telling Tales”, of the documentary [124], in which Copeland discusses music
in films with composer Danny Elfman:  Copeland: Why do the directors need
this? They’re telling a perfectly good story, with a perfectly terrifying
antagonist, a handsome protagonist, a beautiful love interest. Why do they
need music? Elfman: Because music does something they learned very early on,
that the pictures couldn’t do. Copeland: Take the decidedly lukewarm chills of
early horror movies, for example. Elfman: In the very first Frankenstein and
the first Dracula, no music. All music was, in the first films, was opening
and closing, like a play, and then they figured out a few years later, 1933
and 1935, “Why don’t we take it up a level?” If you put this dramatic music,
it really raises the stakes. Copeland: As shown in in the pioneering movie
King Kong. Elfman: And if you put something heartbreaking when, you know, your
hero or heroine is going to die, it really raises the stakes. […] It goes
straight to the heart. In addition to “Frankenstein” [126], “Dracula” [21] and
“King Kong” [30], Copeland and Elfman then also discuss on how Bernard
Herrmann’s score punctuates and amplifies Alfred Hitchcock’s images in the
movie “Vertigo”.

As discussed in [120] and above, a clear and simple explanation, with
something that they are already familiar with, such as a non-security related
movie or novel, will help make laypersons less irritated, stressed and
annoyed, and thus more receptive. Different from [120], in the remainder of
this paper I take a more systematic approach, mapping different approaches to
cybersecurity _show and tell_.

Zazkis and Liljedahl consider stories that frame or provide the background for
a mathematical activity, and they distinguish between stories that introduce,
and stories that accompany and intertwine with mathematical activity. In
particular, they discuss the following categories of stories for the teaching
of mathematics:

  * •

_Stories that set a frame or a background_ , i.e., stories in which hero(in)es
have to overcome obstacles to reach their goal (e.g., Oedipus solving the
riddle of the Sphinx), stories of secret codes (e.g., stories in which
decoding a message can save lives, or point to a treasure, win a princess’
heart, or ensure fame and glory), and stories of treaties or contracts (e.g.,
the “contract” that Multiplication and Division shall be performed before
Addition and Subtraction, but in the order in which they appear in any
calculation).

  * •

_Stories that accompany the content_ (e.g., derived from the history of
mathematics and the lives of mathematicians) and _stories that intertwine with
the content_ in which mathematical content emerges through the story, at times
leaving the story behind and at times staying with the story. Zazkis and
Liljedahl point out that the latter are harder to find, but still they are
able to provide some interesting examples (e.g., using true and apocryphal
stories about the Syracusan mathematician Archimedes).666I have also some
experience with this: in the early Noughties I wrote a play about the French
mathematician Évariste Galois, who was killed in a duel at age 20 in 1832
[117, 116, 118]. The Teatro Stabile di Genova, which produced the play, had
the brilliant idea to schedule morning performances for middle and high school
students, and I have been told by many of them that they had never thought
that mathematics could be thrilling and moving.

  * •

_Stories that introduce_ , i.e., stories that serve well to introduce
concepts, ideas or a mathematical activity (e.g., introducing exponential
growth through the classical story of grains of rice and the chessboard).

  * •

_Stories that explain_ , e.g., riddles such as the “missing dollar” or “ If a
hen-and-a-half lays an egg-and-a-half in a day-and-a-half, how many days does
it take one hen to lay one egg?” Zaskis and Liljedahl support this kind of
stories by writing

> Mathematics is often perceived by learners as a collection of facts and
> skills; facts and skills that are sometimes seen as counterintuitive. When
> this happens a common reaction is to seek refuge in the meaningless
> memorization of rules. Experienced teachers can easily point to such places,
> places in which encounters with mathematics are most puzzling and rules are
> most prevalent. Instead of reciting rules, however, we suggest explaining
> these rules with stories. [133, p. 51]

which reinforces the point that I tried to make above when discussing the
benefits of explaining cybersecurity through artworks, and to which I will
return below.

  * •

_Stories that ask a question_ and encourage the students to engage with the
story to arrive at the answer.

  * •

_Stories that tell a joke_ , since humor can enhance both the telling and the
hearing of a story, and thereby indirectly influence learning. Two notable
examples about arithmetic and logic are “Mathematics is made of 50 percent
formulas, 50 percent proofs, and 50 percent imagination.” and “Hofstadter’s
Law: It always takes longer than you expect, even when you take into account
Hofstadter’s Law.” [63, p. 152]

Zazkis and Liljedahl then also discuss how teachers can create a story and
they provide a “planning framework” demonstrating how instruction of specific
mathematical topics or concepts can be planned and implemented.

##  3 Cybersecurity show and tell

So, what about cybersecurity? Without limiting the discussion to teaching, but
considering all kinds of learning experiences, including scientific
communications and public engagement or outreach activities, we can first of
all divide the use of artworks to explain cybersecurity into two broad
categories:

  * •

_Using existing artworks_.

  * •

_Using new artworks that have been created on purpose_.

My work so far has focused on the first category, but together with colleagues
in computer science and psychology and with artists and curators we have begun
tackling also the second category, so let me focus on the first and conclude
by providing a few more details about the second. The existing artworks can be
divided into the following 4 sub-categories, for which I provide lists of
examples that are by no means exhaustive:

  * •

_Artworks about hackers, codebreakers and cybersecurity experts_.

  * •

_Artworks about detectives or spies who use or are confronted with
cybersecurity problems and solutions_.

  * •

_Artworks about ordinary people confronted with cybersecurity or artworks with
references to cybersecurity_.

  * •

_Artworks that are not explicitly about cybersecurity but can be used to
explain cybersecurity notions_.

###  3.1 “Yes, I am a criminal. My crime is that of curiosity. I am a hacker,
and this is my manifesto.” [104]

This category includes _artworks about hackers, codebreakers and cybersecurity
experts_ , who make for very interesting hero(ine) or anti-hero(in)es. In May
2021, a search on the Internet Movie Database (www.imdb.com) with the keyword
“hacker” returned 558 titles of films and TV series, many of which were
adapted from novels. Notable examples range from faithful or apocryphal
biographies of famous codebreakers and cryptologists like Alan Turing [113, 5]
and John Nash [64] or less famous or even made-up ones [12, 57], to stories of
bad “black-hat” hackers who carry out cyberattacks or of good “white-hat”
hackers who save the day such as in the film “Hackers” [104] quoted in the
title of this category777That quote was inspired by the article “The
Conscience of a Hacker” written by the real-life hacker “The Mentor” shortly
after his arrest [83]. The article ends with the following words:  This is our
world now… the world of the electron and the switch, the beauty of the baud.
We make use of a service already existing without paying for what could be
dirt-cheap if it wasn’t run by profiteering gluttons, and you call us
criminals. We explore… and you call us criminals. We seek after knowledge… and
you call us criminals. We exist without skin color, without nationality,
without religious bias… and you call us criminals. You build atomic bombs, you
wage wars, you murder, cheat, and lie to us and try to make us believe it’s
for our own good, yet we’re the criminals. Yes, I am a criminal. My crime is
that of curiosity. My crime is that of judging people by what they say and
think, not what they look like. My crime is that of outsmarting you, something
that you will never forgive me for. I am a hacker, and this is my manifesto.
You may stop this individual, but you can’t stop us all… after all, we’re all
alike. as well as in [96, 8, 102, 127, 55, 128, 42, 22, 53, 32, 77, 108]. Some
are quite realistic in their depiction of cybersecurity, few are real, most
are inventive, giving black/white-hat hackers and codebreakers almost
superhero-like abilities, but all of them make for a good _show_ companion, as
a speaker can discuss how faithfully or not cybersecurity has been portrayed.
In fact, bad portrayals can be particularly useful to discuss misconceptions
and correct possible prejudices.

In addition to films and TV series, there are also a few plays about
cybersecurity, such as “Teh Internet Is Serious Business” (sic!), which
provides a fictional account of the hacktivism of the collectives Anonymous
and LulzSec and in which coding is ingeniously and amusingly symbolized by
means of interpretive dance [91], as well as “Hackers” [39] and “The Nether”
[59]. There are also many novels, such as, to name just the works of some of
the most influential authors, the “Sprawl trilogy” [52] by William Gibson, the
cyberpunk writer who coined the word “cyberspace” in the short story “Burning
Chrome”, Neal Stephenson’s “Snow Crash” [106] and “Cryptonomicon” [107], Dan
Brown’s “Digital Fortress” [19], as well as Stieg Larson’s “Millennium”
trilogy [71] (and the film adaptations that have been filmed in Sweden and the
USA [87, 2, 1, 48]), and the sequel by David Lagercrantz [70] (which too has
been filmed [3]). _Showing_ with plays and novels might be less immediate and
thus more challenging, but that does not mean that it will be less effective.

###  3.2 “I have said enough to convince you that ciphers of this nature are
readily soluble.” [90]

This category includes _artworks about detectives or spies who use or are
confronted with cybersecurity problems and solutions_. This category is
closely connected to the previous one and in many cases there are some
overlaps, e.g., serial killers writing in code such as the “Zodiac Killer”
[47], criminal masterminds using steganography to hide their messages [125],
or the mathematics prodigy who helps his FBI-agent brother solve crimes in the
TV series “NUM3ERS” [44].

As pointed out by John F. Dooley, codes and ciphers have a long history in
fiction. In addition to his publications [33, 34], Dooley has been collecting
a list of pieces of fiction (short stories, novels, chapters in novels, etc.)
that contain cryptographic riddles of one sort or another as part of the story
line.888See also the collection of stories of code and ciphers edited by
Raymond T. Bond [15]. In fact, several fictional detectives who have had to
solve cryptographic riddles, starting with the short story “The Gold Bug” by
Edgar Allan Poe [90], who is generally considered the inventor of the
detective fiction genre, but who also had a keen interest in cryptography and
in 1841 wrote an essay about secret writing [89]. The most famous private
detective of all, Arthur Conan Doyle’s Sherlock Holmes, also had to solve
several cryptographic riddles, in particular in “The Adventure of the Dancing
Men” and “The Valley of Fear” [35, 36], and so had his doubly-fictional sister
Enola in Nancy Springer’s “The Enola Holmes Mysteries” series [105] (all of
these have also received film and TV adaptations, e.g., [49, 16, 110]).
Dilettante detectives have also been tackling cryptographic riddles, e.g.,
Lord Peter Wimsey in [99], the historian and amateur cryptologist Benjamin
Franklin Gates [111, 112], and Robert Langdon, the Harvard professor of
history of art and religious symbology999There is no such things as a
professor of symbology in real life, but it is tightly connected to the actual
discipline of semiotics, which in turn has been investigated also in the
context of cryptography [79]. created by Dan Brown [20, 65, 66, 67].

Also these professional and dilettante detectives are typically given
abilities that border on the fantastic as they “see” the solutions of the
cryptographic riddles in a matter of minutes, if not seconds. They picture
them in their head before anyone can and often when nobody else does. This is
“showing” in a way that is exclusive rather than inclusive. Similar to the
characters of the first category, this facility for cryptography and
cybersecurity creates a clear distinction from ordinary people and turns them
into true hero(in)es and anti-hero(in)es. Portrayals of spies and secret
agents (such as Jason Bourne, the former CIA agent who is the hero of a series
of novels, written by Robert Ludlum [76] and then inherited by Eric Van
Lustbader and then by Brian Freeman, and of the subsequent film adaptations
directed by Doug Liman, Paul Greengrass and Tony Gilroy) are instead sometimes
slightly more realistic, at least in terms of their cryptographic and
cybersecurity abilities although maybe not so much in terms of their physical
powers, but still almost inevitably go beyond portraying them as simply
experts in their field. This is, however, quite understandable, as the story
would then otherwise risk being quite dull. Still, using such characters and
their stories for _showing_ can be very effective also thanks to their
worldwide popularity.

###  3.3 “I’m in a Secret Club.” [7]

This category includes _artworks about ordinary people confronted with
cybersecurity and artworks with references to cybersecurity_. There are less
examples in this category than the previous two, but still several interesting
ones, such as: two U.S. Marines in World War II assigned to protect Navajo
Marines as their native language was used as an unbreakable radio code [130],
a businessman whose identity is stolen after he gets a nice call confirming
his name and other identifying information [54], an FBI agent undergoing
facial transplant surgery to assume the identity of the criminal mastermind
who murdered his only son [129]101010“Con Air”, “National Treasure”,
“Windtalkers”, “Face/Off”… Nicolas Cage has starred in so many cybersecurity-
related movies that he would deserve a dedicated paper, perhaps titled
“Explaining Cybersecurity with Nicolas Cage” or even better “Nicolas Cage is
the Center of the Cybersecurity Universe.”, a security specialist forced into
robbing a bank to protect his family [74], a computer geek inadvertently
downloads critical government secrets into his brain and is then recruited by
CIA and NSA to help thwart assassins and international terrorists [45] (the
latter two partially belong also in the first category). There are also
several animated movies in which cybersecurity features prominently, which
suggests that kids, even small children such as those watching “Peppa Pig”,
are probably much less scared by it than adults; for example: multi-factor
authentication through biometrics111111 _Multi-factor authentication (MFA)_ is
an authentication solution that aims to augment the security of the basic
username-password authentication by exploiting two or more authentication
factors. In [43], MFA is for instance defined as:  a procedure based on the
use of two or more of the following elements — categorised as knowledge,
ownership and inherence: i) something only the user knows, e.g., static
password, code, personal identification number; ii) something only the user
possesses, e.g., token, smart card, mobile phone; iii) something the user is,
e.g. a biometric characteristic, such as a fingerprint. In addition, the
elements selected must be mutually independent […] at least one of the
elements should be non-reusable and non-replicable. The underlying idea is
that the more factors are used during the authentication process, the more
confidence a service has that the user is correctly identified. is used both
in “Incredibles 2” [11] and “Monsters vs. Aliens” [72], a guessing/dictionary
attack against a password is attempted by Winnie the Pooh’s friend Tigger in
[61] by singing the “Password Song” with lyrics consisting of every word that
Tigger knows, Peppa Pig and their friends use one-time passwords in an episode
titled “The Secret Club” [7].

Codes and ciphers (such as the hash function SHA-256, cryptocurrencies and
several different ciphers) feature also in animated series for more adult
viewers, in particular in Matt Groening’s “The Simpsons” [18] and “Futurama”
[29]; many of these examples are discussed by Simon Singh in his book [103] in
which he unravels the mathematical secrets of these two series up until 2013.

But it is not just films, TV series and novels. Although examples are more
difficult to find, there are also some songs that relate to cybersecurity,
such as the song “Secret” by The Pierces [109], which references Benjamin
Franklyn’s famous saying “Three may keep a secret if two of them are dead”
(which, I believe, in turn references the line “Two may keep counsel when the
third’s away”, which is uttered by the villainous Aaron before murdering a
nurse to preserve his secret, in William Shakespeare’s “Titus Andronicus”, Act
IV, Scene 2):

> Got a secret
> Can you keep it?
> Swear, this one you’ll save
> Better lock it in your pocket
> Takin’ this one to the grave
> If I show you, then I know you
> Won’t tell what I said
> ’Cause two can keep a secret
> If one of them is dead …

This category requires substantial work of the presenter to make the
connections between _show_ and _tell_ but, trust me, it can be lots of fun,
especially if one shows excerpts of the animated films.

###  3.4 “I’m Spartacus!” [69]

This category includes _artworks that are not explicitly about cybersecurity
but can be used to explain cybersecurity notions_. This is, in my view, the
most interesting category. I have already mentioned above how the “Baby
Driver” [131], “Spartacus” [69] and “The Thomas Crown Affair” [81] as well as
Alan Moore’s graphic novel “V for Vendetta” [84, 80] can be used for
explaining anonymity and untraceability. Other popular films and artworks can
be used as metaphors for cybersecurity and in [120] I discussed how a man-in-
the-middle attack can be explained by analogy with the _carte blanche_ issued
to Milady De Winter by Cardinal Richelieu in “The Three Musketeers” by
Alexandre Dumas père [37].

Let me give here some more examples by considering authentication and multi-
factor authentication (cf. Footnote 11). Questions of authentication and
identity occur extensively in the mythology and fairy-tale literature of most
cultures, from Greece to India to China. In some cases, authentication occurs
by means of passwords, such as the “Open Sesame” that opens the mouth of a
cave in which Ali Baba and the forty thieves have hidden their treasure in the
story “Ali Baba and the Forty Thieves,” which first appeared in Antoine
Galland’s version of “One Thousand and One Nights.” In most cases, however,
authentication occurs by biometric traits and also by some form of multi-
factor authentication, even in a pre-technology world. For instance, when the
hero is (or proves to be or reveals to be) the only one able to do something
or to have something:

  * •

When the disguised Odysseus returns home to Ithaca after 20 long years, his
faithful dog Argos recognizes him by his smell and his old wet-nurse Eurycleia
by a scar he received during a boar hunt, and he finally proves his identity
to his wife Penelope by being the only one able to string Odysseus’ rigid bow
and shoot an arrow through twelve axe shafts. Similar stories exist in Hindu
mythology.

  * •

Thor is the only one able to lift and wield the Mjọllnir hammer in Norse
mythology (as well as in Marvel Comics and in Marvel Cinematic Universe).

  * •

Arthur is the only one able to pull out the sword Excalibur from a stone,
thereby proving to be the rightful king of Britain.

Similarly, mythologies and fairy tales also contain examples of _masquerading
attacks_ , in which the attacker poses as an authorized user. In the Internet,
this would occur by the attacker using stolen logon ids or passwords, in
mythology it occurs by the attacker magically or divinely shape-shifting into
somebody or something else (e.g., in the “Epic of Gilgamesh”, in the “Iliad”
or in Ovid’s “Metamorphoses”), whereas in fairy tales it often occurs via
simpler means, e.g., the wolf pretends to be mother goat by eating honey to
soften his voice and by smearing flour over his feet to turn them white in
“The Wolf and the Seven Young Goats”, a story published by the Brothers Grimm
in the first edition of “Kinder- und Hausmärchen” in 1812 [58]. Similar tales
have been told in other parts of Europe and in the Middle East.

Finally, there are also examples of cases in which authentication fails not
because the attacker is actively trying to deceive his victims, but rather
because the victims (consciously or not) want to be deceived, as in the story
of Martin Guerre, a French peasant who, in the 1540s, was at the center of a
famous case of imposture: several years after Martin Guerre had left his wife
and village, a man claiming to be him appeared in the village and lived with
Guerre’s wife and son for three years, before eventually being accused of the
impersonation. The case of Martin Guerre has been popularized in literature
[73, 101], film [123, 4], musical [28], as well as in plays and operas, and
has also been the subject of scholar investigations [31]. Many of these works
portray how, for different reasons, some people, including his wife,
authenticated the stranger to be Martin Guerre even though they suspected him
to be an impostor or even knew him to be one. A similar case happened in Italy
in the late 1920s: the Bruneri-Canella case concerned an amnesiac patient of
the Mental Hospital of Collegno121212Collegno is a small town in the North-
West of Italy and the case is known in Italy more colloquially as the
“Smemorato di Collegno”, i.e., the amnesiac of Collegno., who was identified
first by the Canella family as the professor Giulio Canella, who had gone
missing in action during World War I, and then by the Bruneri family as the
fugitive petty criminal Mario Bruneri. After several inquiries and trials, the
court found that he was indeed Bruneri, but the Canella family kept claiming
he was Giulio Canella and he lived with Canella’s wife, Giulia Canella, in
exile in Brazil until his death in 1941. Also in this case there were people
who wanted to (wrongly) authenticate the amnesiac: some newspapers stated that
actually Giulia Canella herself was ultimately convinced that the amnesiac was
not her husband, but she had to keep pretending otherwise to avoid a major
scandal. And this case too inspired literature [100], plays [88] and films
[50, 46], which can be used to explain authentication and related attacks.

Such “popular” explanations are not meant to replace the mathematical
definitions and explanations, nor the facts and skills mentioned in the above
quote of by Zazkis and Liljedahl. Although finding such popular artwork
examples is challenging, the synergy of telling and showing via these
examples, which laypersons will likely be already familiar with, can help go
beyond the mere facts and skills by making them more intuitive, more
accessible, more interesting, more rewarding.

##  4 Conclusions

Films have been used to explain and teach different disciplines such as
philosophy [6, 23, 85], history [78], social sciences [98], management and
organizational behavior [25, 26], international relations and politics [40,
114], and mental health [97]. In addition to my own research, initial
investigations have also been carried out for cybersecurity in [13], but more
work is needed to explore the full potential of popular films and artworks for
cybersecurity.

I have described four categories of such artworks and provided some examples
for each of them. I have been collecting a database that includes many more
examples and has benefited not only from the help of colleagues and friends
(such as Diego Sempreboni, Sally Marlow and Gabriele Costa), but also from the
lists in [15, 34] as well the entries in the Internet Movie Database IMDB. I
am keen to include examples from less considered artworks such as plays and
music, and to investigate the use of new artworks that have been created on
purpose or that are created live during a presentation. The collaboration that
I have initiated with artists and curators (such as Hannah Redler Hawes and
Alistair Gentry) will be very fruitful to that end.

## Acknowledgements

This work was supported by the King’s Together Multi and Interdisciplinary
Research Scheme, King’s College London, UK. Thanks to Giampaolo Bella,
Gabriele Costa, Alistair Gentry, Sally Marlow, Hannah Redler Hawes and Diego
Sempreboni for their invaluable contributions, and to Michele Emmer, Ashwin
Mathew, Alessandra Di Pierro and Aldo and Claudia Viganò for many useful
suggestions.

## References

  * [1] Daniel Alfredson (directed by).  _The Girl Who Kicked the Hornet’s Nest_ , 2009.  Screenplay by Jonas Frykberg based on the novel by Stieg Larsson, https://www.imdb.com/title/tt1343097/.
  * [2] Daniel Alfredson (directed by).  _The Girl Who Played with Fire_ , 2009.  Screenplay by Jonas Frykberg based on the novel by Stieg Larsson, https://www.imdb.com/title/tt1216487/.
  * [3] Fede Alvarez (directed by).  _The Girl in the Spider’s Web_ , 2018.  Screenplay by Jay Basu, Fede Alvarez and Steven Knight based on the novel by David Lagercrantz, with characters introduced in the Millenium series by Stieg Larsson, https://www.imdb.com/title/tt1568346/.
  * [4] Jon Amiel (directed by).  Sommersby, 1993.  Screenplay by Nicholas Meyer and Sarah Kernochan based on the screenplay of [123], https://www.imdb.com/title/tt0108185/.
  * [5] Michael Apted (directed by).  _Enigma_ , 2001.  Screenplay by Tom Stoppard based on the novel by Robert Harris, https://www.imdb.com/title/tt0157583/.
  * [6] Tommaso Ariemma.  La filosofia spiegata con le serie TV.  Mondadori, 2017.
  * [7] Neville Astley and Mark Baker (created by).  Peppa Pig, Series 3, Episode 38, “The Secret Club”, 2010.  7 seasons, 302 episodes, https://www.imdb.com/title/tt0426769/.
  * [8] John Badham (directed by).  _Wargames_ , 1983.  Screenplay by Lawrence Lasker and Walter F. Parkes, https://www.imdb.com/title/tt0086567/.
  * [9] Giampaolo Bella, Karen Renaud, Diego Sempreboni, and Luca Viganò.  An Investigation into the ”Beautification” of Security Ceremonies.  In Proceedings of the 16th International Joint Conference on e-Business and Telecommunications, ICETE 2019 - Volume 2: SECRYPT, 16th International Conference on Security and Cryptography, pages 125–136. Scitepress Digital Library, 2019.
  * [10] Giampaolo Bella and Luca Viganò.  Security is Beautiful.  In Security Protocols XXIII, Revised Selected Papers, LNCS 9379, pages 247–250. Springer, 2015.
  * [11] Brad Bird (directed by).  _Incredibles 2_ , 2018.  Screenplay by Brad Bird, https://www.imdb.com/title/tt3606756/.
  * [12] George Blair (directed by).  _Secrets of Scotland Yard_ , 1944.  Screenplay by Denison Clift adapted from the novel “Room 40, O.B.”, https://www.imdb.com/title/tt0037255/.
  * [13] Jorge Blasco and Elizabeth A. Quaglia.  InfoSec Cinema: Using Films for Information Security Teaching.  In 2018 USENIX Workshop on Advances in Security Education, ASE 2018. USENIX Association, 2018.
  * [14] Gerrit Bleumer.  Untraceability.  In Henk C.A. Van Tilborg and Sushil Jajodia, editors, Encyclopedia of Cryptography and Security. Springer, 2011.
  * [15] Raymond T. Bond, editor.  Famous Stories of Code and Cipher.  Rinehart, 1947.
  * [16] Harry Bradbeer (directed by).  _Enola Holmes_ , 2020.  Screenplay by Jack Thorne based on the novel “The Case of the Missing Marquess: An Enola Holmes Mystery” by Nancy Springer, https://www.imdb.com/title/tt7846844/.
  * [17] John Brockman.  The Third Culture: Beyond the Scientific Revolution.  Simon & Schuster, 1995.  See also the website of the Edge Foundation, Inc. at https://www.edge.org.
  * [18] James L. Brooks, Matt Groening, and Sam Simon (created by).  _The Simpsons_ , 1989–.  32 seasons, 707 episodes, https://www.imdb.com/title/tt0096697/.
  * [19] Dan Brown.  Digital Fortress.  St. Martin’s Press, 1998.
  * [20] Dan Brown.  Robert Langdon series: Angels & Demons, The Da Vinci Code, The Lost Symbol, Inferno, Origin.  Doubleday, 2000–2017.
  * [21] Tod Browning (directed by) and Karl Freund (uncredited).  _Dracula_ , 1931.  Written by Garrett Fort, from the play by Hamilton Deane and John L. Balderston, based on the novel by Bram Stoker, https://www.imdb.com/title/tt0021814/.
  * [22] Guy Burt (created by).  _The Bletchley Circle_ , 2012–2014.  2 seasons, 7 episodes, https://www.imdb.com/title/tt2275990/.
  * [23] Julio Cabrera.  Da Aristotele a Spielberg. Capire la filosofia attraverso i film.  Bruno Mondadori editore, 2007.
  * [24] Andrea Capozucca.  Comunicare la matematica.  Egea, 2018.
  * [25] Joseph E. Champoux.  Management: Using Film to Visualize Principles and Practice.  South-Western, 2000.
  * [26] Joseph E. Champoux.  Organizational Behavior: Using Film to Visualize Principles and Practices.  South-Western, 2000.
  * [27] David Chaum.  Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms.  Communications of the ACM, 24(2):84–88, 1981.
  * [28] Claude-Michel Schönberg and Alain Boublil (Book), Alain Boublil, Edward Hardy and Stephen Clark (Lyrics), Claude-Michel Schönberg (Music).  Martin guerre (a musical love story), 1996.
  * [29] David X. Cohen and Matt Groening (created by).  _Futurama_ , 1999–2013.  10 seasons, 140 episodes, https://www.imdb.com/title/tt0149460/.
  * [30] Merian C. Cooper and Ernest B. Schoedsack (directed by).  _King Kong_ , 1933.  Screenplay by James Creelman and Ruth Rose, https://www.imdb.com/title/tt0024216/.
  * [31] Natalie Zemon Davis.  The Return of Martin Guerre.  Harvard University Press, 1983.
  * [32] Ann Donahue, Carol Mendelsohn, and Anthony E. Zuiker (created by).  _CSI: Cyber_ , 2015–2016.  2 seasons, 31 episodes, https://www.imdb.com/title/tt3560060/.
  * [33] John F. Dooley.  Codes and Ciphers in Fiction: an Overview.  Cryptologia, 29:290–328, 2005.
  * [34] John F. Dooley.  Codes and Villains and Mystery: The Best Stories with Codes and Ciphers 1843–1920.  CreateSpace Independent Publishing Platform, 2016.  See also the “Cryptology in Fiction” document at https://www.johnfdooley.com.
  * [35] Arthur Conan Doyle.  The Adventure of the Dancing Men.  The Strand Magazine, 1903.
  * [36] Arthur Conan Doyle.  The Valley of Fear.  The Strand Magazine, 1914–1915.
  * [37] Alexandre Dumas père (avec la collaboration d’Auguste Maquet).  Les Trois Mousquetaires.  Le Siècle, 1844.
  * [38] Kieran Egan.  Teaching as Story Telling: An Alternative Approach to Teaching and Curriculum in the Elementary School.  University of Chicago Press, 1986.
  * [39] Mike Eisenberg.  Hackers.  Samuel French, 1999.
  * [40] Stefan Engert and Alexander Spencer.  International Relations at the Movies: Teaching and Learning about International Politics through Film.  Perspectives, 17(1):83–104, 2009.
  * [41] Martin Erwig.  Once Upon an Algorithm: How Stories Explain Computing.  MIT Press, 2011.
  * [42] Sam Esmail (created by).  _Mr. Robot_ , 2015–2019.  4 seasons, 45 episodes, https://www.imdb.com/title/tt4158110/.
  * [43] European Central Bank.  Final guidelines on the security of Internet payments, 2014.
  * [44] Nicolas Falacci and Cheryl Heuton (created by).  _NUMB3RS_ , 2005–2010.  6 seasons, 119 episodes, https://www.imdb.com/title/tt0433309/.
  * [45] Chris Fedak and Josh Schwartz (created by).  _Chuck_ , 2007–2012.  5 seasons, 91 episodes, https://www.imdb.com/title/tt0934814/.
  * [46] Pasquale Festa Campanile (directed by).  _Uno scandalo perbene (A Proper Scandal)_ , 1984.  Screenplay by Suso Cecchi D’Amico and Pasquale Festa Campanile, https://www.imdb.com/title/tt0122241/.
  * [47] David Fincher (directed by).  _Zodiac_ , 2007.  Screenplay by James Vanderbilt from the book by Robert Graysmith, https://www.imdb.com/title/tt0443706/.
  * [48] David Fincher (directed by).  _The Girl with the Dragon Tattoo_ , 2011.  Screenplay by Steven Zaillian based on the novel by Stieg Larsson, https://www.imdb.com/title/tt1568346/.
  * [49] Terence Fisher (directed by).  _Sherlock Holmes and the Deadly Necklace_ , 1962.  Screenplay by Curt Siodmak based on the novel [36] by Arthur Conan Coyle, https://www.imdb.com/title/tt0056480/.
  * [50] George Fitzmaurice (directed by).  _As You Desire Me_ , 1932.  Screenplay by Gene Markey based on the play [88], https://www.imdb.com/title/tt0022641/.
  * [51] William Friedkin (directed by).  _To Live and Die in L.A._ , 1985.  Screenplay by William Friedkin and Gerald Petievich based on the novel by Gerald Petievich, https://www.imdb.com/title/tt0090180/.
  * [52] William Gibson.  Sprawl trilogy: Neuromancer, Count Zero, Mona Lisa Overdrive.  Victor Gollancz Ltd, 1984–1988.
  * [53] Laura Good (created by).  _The Bletchley Circle: San Francisco_ , 2018.  1 season, 8 episodes, https://www.imdb.com/title/tt7978912/.
  * [54] Seth Gordon (directed by).  _Identity Thief_ , 2013.  Screenplay by Craig Mazin, https://www.imdb.com/title/tt2024432/.
  * [55] Stuart Gordon (directed by).  _Fortress_ , 1992.  Screenplay by Troy Neighbors, Steven Feinberg, David Venable and Terry Curtis Fox, https://www.imdb.com/title/tt0106950/.
  * [56] Daniele Gouthier.  Scrivere di scienza.  Codice, 2019.
  * [57] David Greene (directed by).  _Sebastian_ , 1968.  Screenplay by Gerald Vaughan-Hughes, original story by Leo Marks, https://www.imdb.com/title/tt0063570/.
  * [58] Jacob Grimm and Wilhelm Grimm.  Kinder- und Hausmärchen.  1812–1858.
  * [59] Jennifer Haley.  The Nether.  Faber & Faber, 2014.
  * [60] Ansie Harding.  Storytelling for tertiary mathematics students.  In Invited Lectures from the 13th International Congress on Mathematical Education, pages 195–207. Springer, 2018.
  * [61] David Hartman (directed by).  _Tigger & Pooh and a Musical Too_, 2009.  Screenplay by Nicole Dubuc, Brian Hohlfeld and Dean Stefan, “Password Song” written by Andy Sturmer and Brian Hohlfeld, https://www.imdb.com/title/tt1415904/.
  * [62] Kendall F. Haven.  Super simple storytelling: A can-do guide for every classroom.  Teacher Ideas Pr, 2000.
  * [63] Douglas Hofstadter.  Gödel, Escher, Bach: An Eternal Golden Braid.  Basic Books, 1980.
  * [64] Ron Howard (directed by).  _A Beautiful Mind_ , 2001.  Screenplay by Akiva Goldsman based on the book by Sylvia Nasar, https://www.imdb.com/title/tt0268978/.
  * [65] Ron Howard (directed by).  _The Da Vinci Code_ , 2006.  Screenplay by Akiva Goldsman based on the novel by Dan Brown, https://www.imdb.com/title/tt0382625/.
  * [66] Ron Howard (directed by).  _Angels & Demons_, 2009.  Screenplay by David Koepp and Akiva Goldsman based on the novel by Dan Brown, https://www.imdb.com/title/tt0808151/.
  * [67] Ron Howard (directed by).  _Inferno_ , 2016.  Screenplay by David Koepp based on the novel by Dan Brown, https://www.imdb.com/title/tt3062096/.
  * [68] Stephen King.  On Writing: A Memoir of the Craft.  Scribner’s, 2000.
  * [69] Stanley Kubrick (directed by).  _Spartacus_ , 1960.  Screenplay by Dalton Trumbo based on the novel by Howard Fast, https://www.imdb.com/title/tt0054331/.
  * [70] David Lagercrantz.  The Girl in the Spider’s Web.  MacLehose Press, 2015.
  * [71] Stieg Larsson.  Millennium Trilogy: The Girl with the Dragon Tattoo, The Girl Who Played with Fire, The Girl Who Kicked the Hornet’s Nest.  Knopf, 2008.
  * [72] Rob Letterman and Conrad Vernon (directed by).  _Monsters vs. Aliens_ , 2009.  Screenplay by Maya Forbes, Wallace Wolodarsky, Rob Letterman, Jonathan Aibel and Glenn Berger, https://www.imdb.com/title/tt0892782/.
  * [73] Janet Lewis.  The Wife Of Martin Guerre.  Swallow Press, 1967.
  * [74] Richard Loncraine (directed by).  _Firewall_ , 2006.  Screenplay by Joe Forte, https://www.imdb.com/title/tt0408345/.
  * [75] Percy Lubbock.  The Craft of Fiction.  Jonathan Cape, 1921.
  * [76] Robert Ludlum.  Bourne series: The Bourne Identity, The Bourne Supremacy, The Bourne Ultimatum.  Richard Marek, Randum House, Randum House, 1980, 1986, 1990.
  * [77] Michael Mann (directed by).  _Blackhat_ , 2015.  Screenplay by Morgan Davis Foehl, https://www.imdb.com/title/tt2717822/.
  * [78] Alan S. Marcus, Scott Alan Metzger, Richard J. Paxton, and Jeremy D. Stoddard, editors.  Teaching History With Film: Strategies for Secondary Social Studies.  Routledge, 2 edition, 2018.
  * [79] Caterina Marrone.  I Segni Dell’Inganno – Semiotica della Crittografia.  Stampa Alternativa, 2010.
  * [80] James McTeigue (directed by).  V for Vendetta, 2005.  Screenplay by Lilly Wachowski and Lana Wachowski based on [84], https://www.imdb.com/title/tt0434409/.
  * [81] John McTiernan (directed by).  _The Thomas Crown Affair_ , 1999.  Screenplay by Leslie Dixon and Kurt Wimmer, story by Alan R. Trustman, https://www.imdb.com/title/tt0155267/.
  * [82] Alexander Mehlmann.  The Game’s Afoot!: Game Theory in Myth and Paradox.  American Mathematical Society, 2000.
  * [83] The Mentor.  The conscience of a hacker.  Phrack Inc., Volume One, Issue 7, Phile 3 of 10, http://phrack.org/issues/7/3.html (last accessed May 2021), January 8, 1986\.
  * [84] Alan Moore and David Lloyd.  V for Vendetta.  Vertigo (DC Comics), 1982–1989.
  * [85] Roberto Mordacci, editor.  Come fare filosofia con i film.  Carocci editore, 2017.
  * [86] Dorothy H. Nelson.  D. and E.: Show and Tell, Grown Up.  Language Arts, 53:203–205, 1976.
  * [87] Niels Arden Oplev (directed by).  _The Girl with the Dragon Tattoo_ , 2009.  Screenplay by Nikolaj Arcel and Rasmus Heisterberg based on the novel by Stieg Larsson, https://www.imdb.com/title/tt1132620/.
  * [88] Luigi Pirandello.  Come tu mi vuoi.  1929\.
  * [89] Edgar Allan Poe.  A Few Words on Secret Writing, 1841.
  * [90] Edgar Allan Poe.  The Gold Bug.  The Dollar, 1843.
  * [91] Tim Price.  Teh Internet Is Serious Business.  Bloomsbury Methuen Drama, 2014.
  * [92] Michael G. Reed, Paul F. Syverson, and David M. Goldschlag.  Anonymous Connections and Onion Routing.  IEEE Journal on Selected Areas in Communications, 16(4):482–494, 1998.
  * [93] Dan Roam.  Authors$@$Google presents Dan Roam: The Back of the Napkin.  https://www.youtube.com/watch?v=kuA\\_yz7aTo0, 2008.  Last accessed February 28, 2021.
  * [94] Dan Roam.  The Back of the Napkin: Solving Problems and Selling Ideas With Pictures.  Portfolio Hardcover, 2008.
  * [95] Dan Roam.  Show and Tell: How Everybody Can Make Remarkable Presentations.  Portfolio Hardcover, 2014.
  * [96] Phil Alden Robinson (directed by).  _Sneakers_ , 1992.  Screenplay by Phil Alden Robinson, Lawrence Lasker and Walter F. Parkes, https://www.imdb.com/title/tt0105435/.
  * [97] Lawrence C. Rubin, editor.  Mental Illness in Popular Media: Essays on the Representation of Disorders.  McFarland & Co, 2012.
  * [98] William B. Russell III.  The Art of Teaching Social Studies with Film.  The Clearing House: A Journal of Educational Strategies, Issues and Ideas, 85(4):157–164, 2012.
  * [99] Dorothy L. Sayers.  Have His Carcase.  Victor Gollancz, 1932.
  * [100] Leonardo Sciascia.  Il teatro della memoria.  Einaudi, 1981.
  * [101] Leonardo Sciascia.  La sentenza memorabile.  Sellerio, 1982.
  * [102] Dominic Sena (directed by).  _Swordfish_ , 2001.  Screenplay by Skip Woods, https://www.imdb.com/title/tt0244244/.
  * [103] Simon Singh.  The Simpsons and Their Mathematical Secrets.  Bloomsbury, 2013.
  * [104] Iain Softley (directed by).  _Hackers_ , 1995.  Screenplay by Rafael Moreu, https://www.imdb.com/title/tt0113243/.
  * [105] Nancy Springer.  The Enola Holmes Mysteries.  Penguin Young Readers, 2006–2010.
  * [106] Neal Stephenson.  Snow Crash.  Bantam Books, 1992.
  * [107] Neal Stephenson.  Cryptonomicon.  Avon, 1999.
  * [108] Oliver Stone (directed by).  _Snowden_ , 2016.  Screenplay by Kieran Fitzgerald and Oliver Stone based on the book by Luke Harding and Anatoly Kucherena, https://www.imdb.com/title/tt3774114/.
  * [109] The Pierces.  _Secret_ , 2007.  First track of the album _Thirteen Tales of Love and Revenge_.
  * [110] Steve Thompson (episode written by) and Mark Gatiss and Steven Moffat (“Sherlock” series created by).  _The Blind Banker_ , 2015–2019.  https://www.imdb.com/title/tt1664529/.
  * [111] Jon Turteltaub (directed by).  _National Treasure_ , 2004.  Screenplay by Jim Kouf, Cormac Wibberley and Marianne Wibberley, https://www.imdb.com/title/tt0368891/.
  * [112] Jon Turteltaub (directed by).  _National Treasure: Book of Secrets_ , 2007.  Screenplay by Marianne Wibberley and Cormac Wibberley, https://www.imdb.com/title/tt0465234/.
  * [113] Morten Tyldum (directed by).  _The Imitation Game_ , 2014.  Screenplay by Graham Moore based on the book by Andrew Hodges, https://www.imdb.com/title/tt2084970/.
  * [114] Brandon Valeriano.  Teaching Introduction to International Politics with Film.  Journal of Political Science Education, 9:52–72, 2013.
  * [115] Luca Viganò.  Il mio Galois.  In Michele Emmer, editor, Matematica e Cultura 2004, pages 171–178. Springer, 2004.
  * [116] Luca Viganò.  Évariste Galois: Un tragico eroe romantico.  In Mirella Manaresi, editor, Matematica e cultura in Europa, pages 339–348. Springer, 2005.  Extended version of [115].
  * [117] Luca Viganò.  Galois.  Il Nuovo Melangolo, 2005.
  * [118] Luca Viganò.  Évariste Galois: a tragic romantic hero.  In Mirella Manaresi, editor, Mathematics and Culture in Europe, pages 333–344. Springer, 2007.  English translation of [116] and extended version of [119].
  * [119] Luca Viganò.  My Galois.  In Michele Emmer, editor, Mathematics and Culture IV, pages 171–178. Springer, 2007.  English translation of [115].
  * [120] Luca Viganò.  Explaining Cybersecurity with Films and the Arts.  In Michele Emmer and Marco Abate, editors, Imagine Math 7, pages 297–309. Springer, Cham, 2020.
  * [121] Luca Viganò and Daniele Magazzeni.  Explainable Security.  CoRR, 2018.  http://arxiv.org/abs/1807.04178.
  * [122] Luca Viganò and Daniele Magazzeni.  Explainable Security.  In IEEE European Symposium on Security and Privacy Workshops, EuroS&P Workshops 2020, pages 293–300. IEEE, 2020.  A preliminary version appeared as [121].
  * [123] Daniel Vigne (directed by).  Le retour de Martin Guerre, 1982.  Screenplay by Jean-Claude Carrière, Daniel Vigne and Natalie Zemon Davis based on the novel by Janet Lewis [73], https://www.imdb.com/title/tt0084589/.
  * [124] Nico Wasserman (directed by).  _Stewart Copeland’s Adventures in Music — Episode 2: “Telling Tales”_ , 2020.  Written by Stewart Copeland, https://www.imdb.com/title/tt11676040/.
  * [125] Simon West (directed by).  _Con Air_ , 1997.  Screenplay by Scott Rosenberg, https://www.imdb.com/title/tt0118880/.
  * [126] James Whale (directed by).  _Frankenstein_ , 1931.  Screenplay by Garrett Fort and Francis Edward Faragoh, from the play by Peggy Webling and John L. Balderston, based on the novel by Mary Shelley, https://www.imdb.com/title/tt0021884/.
  * [127] Irwin Winkler (directed by).  _The Net_ , 1995.  Screenplay by John Brancato and Michael Ferris, https://www.imdb.com/title/tt0113957/.
  * [128] Len Wiseman (directed by).  _Live Free or Die Hard_ , 2007.  Screenplay by Mark Bomback based on a story by Mark Bomback and David Marconi, on an article by John Carlin and on characters by Roderick Thorp, https://www.imdb.com/title/tt0337978/.
  * [129] John Woo (directed by).  _Face/Off_ , 1997.  Screenplay by Joe Forte, https://www.imdb.com/title/tt0119094/.
  * [130] John Woo (directed by).  _Windtalkers_ , 2002.  Screenplay by John Rice and Joe Batteer, https://www.imdb.com/title/tt0245562/.
  * [131] Edgar Wright (directed by).  _Baby Driver_ , 2017.  Screenplay by Edgar Wright, https://www.imdb.com/title/tt3890160/.
  * [132] Avrahm Yarmolinsky.  The Unknown Chekhov: Stories and Other Writings Hitherto Untranslated.  Noonday Press, 1954.
  * [133] Rina Zazkis and Peter Liljedahl.  Teaching Mathematics As Storytelling.  Sense Publishers, 2009.