PADM 710 Research Paper: Challenges and Biblical Principles in Managing Information (Example)

PADM 710 Research Paper: Challenges and Biblical Principles in Managing Information

Uses of technology raise legal, ethical, and cybersecurity risks and malevolent uses along with its benefits. Wise public administrators need to know the applicable Biblical principles, laws, and cybersecurity challenges—and constantly be vigilant to prevent misuse/abuse of information by themselves, their organizations, or external forces.

The paper consists of 3 main sections plus an introduction, summary, and references: 8–10 pages of content, double-spaced, current APA format, citations from all readings, videos, and presentations for the assigned Module: Week plus additional relevant scholarly articles, news, blogs, etc. (preferably published within the last year), for a total of 8–10 sources.

• Introduction: overview of the topic and its relevance to public administration; preview of the paper.
• Section 1: Ethical/Legal Issues and Challenges: major ethical and legal challenges and risks for abuse in collecting, managing and using information (FERPA, HIPAA, GDPR, CIPA…; privacy, confidentiality…); guidelines to prevent unethical uses of data, especially in the public sector.
• Section 2: Technology-related Threats and Challenges, e.g., Cybersecurity: ransomware, spear phishing, DDoS, social engineering, threats to SCADA infrastructure; external vs. internal threats (latest Gallup polls on employee engagement); the dark web, cybercrime as a business, cyberwarfare, cyber-terror, trafficking; threats to personal/family and organizational use; best/next cybersecurity practices.
• Section 3: Applicable Biblical Principles: which principles shape the ethical collection, management and use of information; how you will help others prevent misuse and use information wisely for the benefit of all.
• Summary: key learnings and how you will apply them personally and with family.

Original example for study purposes (about 3,000 words, roughly 9–10 double-spaced pages).

Challenges and Biblical Principles in Managing Information

Introduction

Governments run on information. City clerks keep property and voter records, school districts store student files, health departments track disease and immunization data, police agencies manage criminal justice databases and utilities monitor water and power through networked control systems. Digital tools have made public services faster and more transparent, but they have also concentrated large amounts of sensitive data in systems that can be misused by insiders, exposed by carelessness or attacked by criminals and hostile nations. The scale of the problem is growing. The FBI’s Internet Crime Complaint Center (IC3) received more than one million complaints in 2025, with reported losses of almost $21 billion, up from a record $16.6 billion in 2024 (Alder, 2026). Health care and public health reported more cyber threats than any other critical infrastructure sector.

For public administrators, managing information is not only a technical task but a matter of public trust, legal compliance and moral responsibility. Citizens cannot opt out of giving data to their government in the way they can stop using a private app, so public agencies carry a heightened duty of care. This paper examines that duty in three parts. Section 1 discusses the major ethical and legal challenges in collecting, managing and using information, with attention to laws such as FERPA, HIPAA, GDPR and CIPA, and proposes guidelines to prevent unethical uses of data. Section 2 describes the major technology-related threats, including ransomware, phishing, distributed denial of service, social engineering, attacks on industrial control systems, insider threats and the dark web economy, and recommends current cybersecurity practices. Section 3 identifies Biblical principles that can shape the ethical use of information and describes how I will apply them. A summary closes with personal and family action steps.

Section 1: Ethical/Legal Issues and Challenges

Major Ethical Challenges

Privacy and surveillance. Governments collect data to deliver services, but the same data can be used to monitor people. License plate readers, facial recognition, social media monitoring and data purchased from commercial brokers allow agencies to build detailed profiles without a warrant. The ethical question is not only whether a use is legal but whether it is necessary, proportionate and transparent. Function creep, in which data collected for one purpose is quietly used for another, is a persistent risk in the public sector [Course reading].

Confidentiality and access control. Employees often have access to far more records than their jobs require. Curiosity browsing, such as looking up a celebrity’s, neighbor’s or former partner’s records, is a common and serious breach of trust. The principle of least privilege, giving each user only the access needed for the task, is both an ethical and security safeguard.

Informed consent and transparency. Citizens often do not know what data an agency holds, how long it is kept or with whom it is shared. Clear privacy notices, open data policies that protect personal information and accessible records request procedures support accountability.

Fairness and algorithmic bias. Agencies increasingly use predictive analytics and artificial intelligence to flag benefit fraud, allocate inspections, set bail or prioritize child welfare investigations. If the underlying data reflect past discrimination, the algorithm can repeat it at scale. Public administrators must ask who could be harmed, test tools for disparate impact and keep a human accountable for consequential decisions.

Data accuracy and integrity. Inaccurate records can deny someone a job, a benefit or their liberty. Ethical information management includes processes to correct errors and to explain decisions to the people affected.

Security as an ethical obligation. Failing to protect data is itself an ethical failure, because the people harmed by a breach did not choose the risk. In 2024, 663 large health data breaches were reported to the U.S. Department of Health and Human Services, affecting the protected health information of more than 242 million individuals; hacking and IT incidents accounted for 81% of these breaches (Paubox, 2025).

Key Laws

Other important laws include the Children’s Online Privacy Protection Act, state data breach notification laws and the Cyber Incident Reporting for Critical Infrastructure Act of 2022, which directs the Cybersecurity and Infrastructure Security Agency (CISA) to require reporting of significant cyber incidents by critical infrastructure entities. A challenge for administrators is that these laws form a patchwork. The United States has no single comprehensive federal privacy law, so agencies must track sector-specific and state requirements [Course reading].

Risks for Abuse

Abuse can come from three directions. Individuals may snoop, sell data or alter records. Organizations may collect more data than needed, share it without authority or use it to target political opponents or vulnerable groups. External forces such as criminals and foreign governments may steal or manipulate data. Large public databases are especially attractive because they combine identity, financial and health details in one place.

Guidelines to Prevent Unethical Uses of Data

1. Collect only what is needed (data minimization) and set retention schedules so data are deleted when no longer required.
2. Specify and limit purposes. Document why data are collected and require approval before data are used for a new purpose.
3. Apply least-privilege access, role-based permissions and audit logs, and review access logs routinely for inappropriate browsing.
4. Conduct privacy impact assessments before launching new systems, especially surveillance or AI tools, and publish summaries for public comment.
5. Test algorithms for bias, keep humans accountable for consequential decisions and give people a way to appeal.
6. Train every employee on privacy law, ethics and security, with clear consequences for violations.
7. Be transparent. Publish privacy notices, data inventories and annual reports on data sharing and breaches.
8. Appoint accountable leaders, such as a chief privacy officer and chief information security officer, who report to senior leadership.

Section 2: Technology-related Threats and Challenges

Major Threats

Ransomware. Criminals encrypt an organization’s systems and demand payment, often after stealing data to threaten public release (“double extortion”). Cities, counties, school districts and hospitals are frequent targets because they cannot tolerate downtime. The 2021 Colonial Pipeline attack, which disrupted fuel supplies on the East Coast, showed how ransomware against one company can affect millions of people. In 2024, a ransomware attack on Change Healthcare disrupted claims processing nationwide and ultimately affected about 192.7 million individuals, the largest health data breach reported to HHS (Paubox, 2025).

Phishing and spear phishing. Phishing emails trick users into clicking malicious links or revealing passwords. Spear phishing targets specific people, such as a finance officer, with messages that appear to come from a trusted colleague. Business email compromise, in which criminals impersonate executives or vendors to redirect payments, produced about $3 billion in reported losses in 2025 (Alder, 2026). Generative AI now makes these messages more convincing and enables voice and video deepfakes.

Distributed denial of service (DDoS). Attackers flood websites with traffic from networks of compromised devices to make them unavailable. Government portals, election websites and emergency services have been targeted, often by politically motivated groups.

Social engineering. Attackers manipulate people rather than technology, for example by calling a help desk and pretending to be an employee who needs a password reset. Because people are the most flexible part of any system, social engineering bypasses many technical controls.

Threats to SCADA and critical infrastructure. Supervisory control and data acquisition (SCADA) and other industrial control systems run water treatment, power grids, pipelines and traffic systems. Many were designed before internet connectivity and lack modern security. In 2021, an intruder remotely accessed a water treatment plant in Oldsmar, Florida, and attempted to raise sodium hydroxide to dangerous levels before an operator noticed. U.S. agencies have also warned that state-sponsored actors have pre-positioned themselves inside critical infrastructure networks to enable disruption during a future conflict [Course reading]. For local governments, a compromised water or power system is a direct threat to public safety.

External Versus Internal Threats

External threats include criminal groups, hacktivists and nation-states. Internal threats come from employees, contractors and partners, either malicious (stealing or sabotaging data) or negligent (clicking a phishing link, misconfiguring a server, losing a laptop). Insider risk is closely tied to workplace culture. Gallup’s State of the Global Workplace report found that only 20% of employees worldwide were engaged at work in 2025, a post-pandemic low, while the United States and Canada had the highest regional engagement at 31% (Parisi, 2026). Gallup estimates that low engagement costs the global economy about $10 trillion in lost productivity. Disengaged and resentful employees are less vigilant about security and, in rare cases, more willing to misuse access. Administrators should therefore treat engagement, fair treatment and trust as part of security strategy, alongside monitoring and access controls.

The Dark Web and Cybercrime as a Business

The internet has three layers. The surface web is indexed by search engines. The deep web includes content behind logins, such as email, bank accounts and government databases. The dark web is a small part of the deep web that requires special software such as Tor to access and hides the identities and locations of users and servers. Anonymity has legitimate uses, such as protecting journalists and dissidents, but the dark web also hosts marketplaces for stolen data, drugs, weapons, malware and child sexual abuse material.

Cybercrime now operates like an industry. Ransomware-as-a-service groups lease their malware to affiliates and split the profits. Initial access brokers sell entry into compromised networks. Stolen credentials, credit cards and full identity profiles (“fullz”) are sold in bulk, and cryptocurrency enables payment and laundering. Investment fraud, much of it involving cryptocurrency, was the costliest category in the 2025 IC3 report at about $8.6 billion (Alder, 2026). The same infrastructure supports human and sex trafficking, sextortion of minors and cyberwarfare and cyber-terrorism, in which nation-states and terrorist groups use cyberattacks to cause disruption, steal secrets or spread disinformation.

Threats to families and organizations. For families, the dark web means that passwords, Social Security numbers and medical records exposed in breaches may be sold and used for identity theft, account takeover, tax refund fraud or targeted scams against older relatives. Children face grooming and sextortion risks. For organizations, stolen employee credentials can give criminals access to networks, leaked data can be used for extortion and sensitive plans or vulnerabilities can be sold to attackers.

Minimizing the Risks: Best and Next Practices

• Adopt a framework. The NIST Cybersecurity Framework 2.0, released in 2024, organizes security into six functions: Govern, Identify, Protect, Detect, Respond and Recover (National Institute of Standards and Technology [NIST], 2024). The new Govern function makes cybersecurity a leadership responsibility, not just an IT task.
• Use phishing-resistant multifactor authentication for all users, especially for email, remote access and administrator accounts.
• Move toward zero trust: verify every user and device, segment networks and grant least-privilege access.
• Patch and inventory. Maintain an inventory of hardware, software and data, and patch known exploited vulnerabilities quickly.
• Back up and practice recovery. Keep offline, immutable backups and test restoring them; this removes much of ransomware’s leverage.
• Segment and protect SCADA systems from business networks, remove unnecessary internet exposure and change default passwords.
• Train and test people with realistic phishing simulations and a no-blame culture that encourages reporting.
• Plan and exercise incident response, including legal, communications and continuity of operations, and build relationships with CISA, the FBI and state fusion centers before an incident.
• Manage vendors, since many breaches occur through third parties, by requiring security standards in contracts.
• Protect families with password managers, multifactor authentication, credit freezes, privacy settings and open conversations with children about online risks.

Section 3: Applicable Biblical Principles

Scripture does not mention databases or firewalls, but it speaks clearly about stewardship, truth, justice, confidentiality and wisdom. These principles give public administrators a foundation that goes beyond legal compliance.

Stewardship and faithfulness. Jesus taught that “one who is faithful in a very little is also faithful in much” (English Standard Version [ESV] Bible, 2001, Luke 16:10). Information entrusted to an agency belongs ultimately to the people it describes. Administrators are stewards, not owners, and must account for how they protect and use it (1 Pet. 4:10).

Confidentiality and trustworthiness. “Whoever goes about slandering reveals secrets, but he who is trustworthy in spirit keeps a thing covered” (Prov. 11:13). Keeping confidential information private, and refusing to browse records out of curiosity, is a practical expression of trustworthiness.

Truthfulness and integrity. The commandment “You shall not bear false witness against your neighbor” (Exod. 20:16) applies to falsifying records, manipulating data and spreading disinformation. Accurate records protect people from being wrongly judged.

Love of neighbor and the Golden Rule. “Whatever you wish that others would do to you, do also to them” (Matt. 7:12). Before using someone’s data, an administrator can ask, “Would I want my family’s information used this way?”

Justice and protection of the vulnerable. God requires us “to do justice, and to love kindness, and to walk humbly” (Mic. 6:8). This principle calls administrators to test algorithms for bias, protect children from exploitation and ensure that data systems do not burden the poor or powerless.

Prudence and vigilance. “The prudent sees danger and hides himself, but the simple go on and suffer for it” (Prov. 22:3). Investing in cybersecurity, backups and training is an act of prudence. Jesus also told His disciples to be “wise as serpents and innocent as doves” (Matt. 10:16), a fitting description of security awareness that does not become cynicism.

Respect for governing authority and the rule of law. Romans 13:1–7 teaches respect for legitimate authority, which supports compliance with privacy and security laws even when they are inconvenient.

Making It Personal and Actionable

To help those around me prevent misuse or abuse of information, I will model and teach least-privilege access in my team, decline requests to look up information without a work need, report suspicious activity promptly and advocate for privacy impact assessments before new technologies are adopted. At home, I will set up password managers, multifactor authentication and credit freezes for family members, and talk with children and older relatives about scams and online predators.

To help others use information and technology wisely for the benefit of all, I will support open data that improves transparency while protecting personal privacy, encourage data-driven decisions that serve underserved residents and mentor colleagues in digital skills so that technology serves people rather than the other way around. Viewing information as a trust from God and from the public changes ordinary decisions, such as who gets access, what is shared and how quickly a breach is disclosed, into acts of faithfulness.

Summary

This paper showed that managing information in the public sector involves three overlapping responsibilities. Legally, administrators must navigate a patchwork of laws such as FERPA, HIPAA, GDPR, CIPA and the Privacy Act. Ethically, they must protect privacy, confidentiality, fairness and accuracy even where the law is silent. Technically, they must defend against ransomware, phishing, DDoS, social engineering, attacks on critical infrastructure, insider threats and a professionalized criminal economy on the dark web. Frameworks such as NIST CSF 2.0, multifactor authentication, zero trust, tested backups and a healthy workplace culture reduce these risks.

The most important lesson for me is that information security is ultimately about people and trust. Biblical principles of stewardship, truthfulness, confidentiality, justice and prudence give me a reason to protect information even when no one is watching. Personally, I will strengthen my own digital habits, protect my family’s accounts and identities and talk openly with them about online risks. Professionally, I will champion least-privilege access, privacy-by-design and a culture where employees feel valued and safe to report mistakes. By treating data as a trust, public administrators can use technology to serve citizens while guarding them from harm.

References

Alder, S. (2026, April 8). 2025 losses to cybercrime exceeded $20 billion. The HIPAA Journal. https://www.hipaajournal.com/fbi-internet-crime-complaint-report-2025/

English Standard Version Bible. (2001). Crossway Bibles.

National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29

Paubox. (2025). OCR reports 242 million records exposed in 2024. https://paubox.com/blog/ocr-reports-242-million-records-exposed-in-2024

Parisi, K. (2026, April 10). World of HR: Employee engagement drops globally for the second year in a row. HR Brew. https://www.hr-brew.com/stories/2026/04/10/world-of-hr-employee-engagement-drops-globally-for-the-second-year-in-a-row

[Course reading 1–5: add every assigned reading, video and presentation from your module here in APA format.]