CASE FILE #03 · DIGITAL CITIZENSHIP · GRADES 7–10

DIGITAL DETECTIVE

THE PHANTOM POST

OBJECTIVE: A teacher has been suspended after an anonymous post accused them of misconduct. But the evidence trail leads somewhere far more shocking. And the voice narrating this investigation?

They might not be on your side.

GRADES 7–10

NO PREP

INTERACTIVE DEMO

CC6 · CC7 · CC8 · CC9

CC ELA RL/RI/SL/W

// demo contains 3 evidence slides + verdict — full version: 16 slides

// INVESTIGATION HUB

INVESTIGATION HUB

Choose which evidence to examine. Visit all three before submitting your verdict.

✓

EVIDENCE 01 UNLOCKED

ANONYMOUS POST LOG

IP trace + metadata — who sent it, when, and from where

EXAMINE EVIDENCE →

✓

EVIDENCE 03 UNLOCKED

THE VICTIM'S STORY

Official complaint — read carefully. The guide has an agenda.

EXAMINE EVIDENCE →

✓

EVIDENCE 05 UNLOCKED

DELETED DM THREAD

Recovered from cloud backup — a hidden co-conspirator revealed

EXAMINE EVIDENCE →

CASE UPDATE LOCKED

CASE BROKEN OPEN

A mid-case revelation that changes everything

🔒Review Evidence 01 & 03 first

LOCKED

FINAL VERDICT LOCKED

SUBMIT VERDICT

Four possible outcomes — choose carefully

🔒Review all 3 evidence files first

LOCKED

INVESTIGATION PROGRESS

0%

POST METADATA — RETRIEVED BY ADMIN

POST ID:	#AN-7723-B
PLATFORM:	SpeakOut.anon
DATE/TIME:	14 Nov 2025 — 23:41:09
ACCOUNT:	@WhistleblowerX
CONTENT:	"Mr. Okafor has been sharing student grades with parents illegally."
IP ADDRESS:	192.168.10.44
DEVICE TAG:	SCH-LAPTOP-044
LOCATION:	School network — Library subnet
POST REACH:	847 views, 61 shares before removal
REPORTED BY:	Student Council — M. Torres

HOW TO READ THIS: SpeakOut.anon is an anonymous posting platform. But when a post is made from a school device on the school network, the IT system logs the device tag automatically — regardless of the account name used.

⚑ ANALYST FLAGS

Library closed at 23:41?

School library shuts at 21:00. How was a school device on the library subnet at 11:41 PM? Someone had after-hours access.

Same IP — two users?

IP 192.168.10.44 also shows a login from a staff account at 23:39 — two minutes before the post. Check if those credentials match.

Who is M. Torres?

The person who reported the post to the platform is the Student Council President. First to know about it — or first to cover their tracks?

Anonymous — really?

SpeakOut.anon promises anonymity to its users. But school IT can see device tags. Did the poster know the school could identify them?

DISCUSSION: Can a log entry be faked? What is session spoofing? Would a student know the difference between platform anonymity and network-level tracking?

CASE NOTES / case_03.txt / Zara Kapoor (reported victim)

Wednesday: I came forward about Mr. Okafor because I care about this school. He showed my private coursework grade to another student — that's illegal. I have nothing to hide.

The post on SpeakOut was anonymous, obviously. Anyone could have written that. I'm not behind it.

Thursday: The police were talking to me. I told them everything I know about the library computers. I've never used SCH-LAPTOP-044. I always use my personal phone.

Friday: Someone is trying to make ME look like the villain. That's what bullies do — they flip it. I'm the victim here. I always have been.

The election is next week. I think someone's trying to derail my campaign with these accusations.

DETECTIVE NOTE: The narrator says "I'm the victim here." But the analyst flags say otherwise. Who wrote these notes — and why might they have written them this way?

⚑ ANALYST FLAGS

"Anyone could have written it"

The post is tied to a specific school device — SCH-LAPTOP-044. This is not a random anonymous post. The device tag points to a specific machine.

"Never used SCH-LAPTOP-044"

The device audit shows login credentials on that laptop 3 times this term — including at 22:38 and again at 23:43 on the night of the post. Check Evidence 04.

The election mention

Zara connects the teacher scandal to her Head Student election campaign — unprompted. Why would an innocent victim frame things in terms of political advantage?

"I'm the victim here"

Classic DARVO pattern — Deny, Attack, Reverse Victim and Offender. A key media literacy red flag. The most convincing victims are sometimes the perpetrators.

DARVO: A manipulation pattern where the wrongdoer Denies, Attacks the person confronting them, and Reverses Victim and Offender. Can you see it in Zara's notes?

// CASE_BREAK.TXT — STOP. READ THIS.

CASE BROKEN OPEN

✓ MR. OKAFOR — CLEARED

CCTV from the school corridor shows Mr. Okafor left the building at 21:45 — nearly two hours before the post was sent. His keycard confirms it. He was never near the library that night.

But then why did Zara accuse him? And why were his staff credentials used to open the server room on the same night?

→ Mr. Okafor's password was COMPROMISED. Someone else used it.

⚡ NEW REVELATION

IT services found something buried in the election_strategy.pptx file — edited at 23:43, just 2 minutes after the post was sent:

"Phase 2: If post doesn't trend by Friday — release the photos. He won't go public about the password if we have those."

This was never just about accusing a teacher.

Zara was blackmailing Mr. Okafor — using his stolen credentials — to delete a rival candidate's coursework marks from the school system.

DETECTIVE PROMPT: Who is the rival candidate? What photos? And who else knew about this plan?
Check Evidence 05 — the deleted DMs — before you submit a verdict.

INSTAGRAM DMs — DELETED — RECOVERED FROM CLOUD BACKUP

⚡ CROSS-REFERENCE: @d_reyes21 = Diego Reyes, Year 11. He was never listed as a suspect — until now. The messages prove this was a coordinated conspiracy to rig the Head Student election and frame an innocent teacher.

⚑ ANALYST FLAGS

A hidden co-conspirator

Diego Reyes was never listed as a suspect. He appears only in these recovered messages — proving he knew the plan, facilitated it, and covered for Zara.

Deleted doesn't mean gone

"Delete these messages. Now." — but cloud backups retained them. Deleting a message from your screen does not remove it from server logs.

Jasmine was in the library

Diego saw her: "I saw someone in the library. Year 10 girl. Do you know a Jasmine Osei?" — this confirms the witness timeline and that Zara's team knew they'd been observed.

The scholarship angle

Diego says "I have my own scholarship application to protect." — he participated in covering this up partly to protect his own interests. Motive confirmed for both.

DISCUSSION: Messages you delete can be recovered from cloud backups. Does knowing this change how you use messaging apps? What does Diego's awareness of the plan make him legally?

SUBMIT YOUR VERDICT

Choose the option that best matches your analysis of all the evidence. Choose carefully.

VERDICT A PARTIALLY CORRECT

Zara Kapoor acted alone. She created the anonymous post to eliminate her rival Priya from the Head Student election. She stole Mr. Okafor's credentials as cover.

You identified the main perpetrator but may have missed something...

VERDICT B CORRECT — MASTER DETECTIVE

Zara Kapoor and Diego Reyes conspired together. Zara orchestrated the post and the blackmail. Diego was aware, assisted, and covered it up. The target was both Mr. Okafor and rival candidate Priya.

Full picture — did you get it?

VERDICT C INCORRECT

Maya Torres planted the post from the library to sabotage Zara's campaign. Maya had access, opportunity, and the teacher exit code.

You may have followed a red herring...

VERDICT D NARRATOR TRAP

The narrator (Zara) was telling the truth — the evidence is circumstantial and she is the victim of a smear campaign by her political rivals.

You trusted the narrator. Was that wise?

Select a verdict above to continue