<a id="ch-14"></a>

## Chapter 14 — UNKNOWN is the field; the names came from Ellen

<!-- open-cyber-academy:lesson-figures:start ch-14 -->
### Lesson map

Lesson 14. Map, example, EX060.

```mermaid
flowchart TD
  S["Set difference"] --> U["bb:77 and cc:19"]
  U --> A["Stop, write the labels, ask Ellen"]
  A --> N["Narrative: speaker and scanner"]
  N --> K["The print still says UNKNOWN"]
```

The names are an answer to a question. They are not keys in the lease list.

### Logical drawing

```text
unknown: ['bb:77', 'cc:19']
known but not seen: []
narrative names: smart speaker, delivery scanner
staff name: not printed
company name: not printed
```
<!-- open-cyber-academy:lesson-figures:end ch-14 -->

### Learning outcomes

After this chapter, you should be able to:

1. Compute the two set differences from the printed lists.
2. Keep UNKNOWN on the two rows.
3. Refuse a third device, a staff name, or a malware label.

### 14.1 A set difference is mechanical. An identification is a conversation.

The script builds `seen` as the set of labels in the seven leases and compares it with the five keys of `known`. Labels in `seen` but not in `known` sort as `bb:77` then `cc:19`. Keys in `known` but not in `seen` sort as an empty list. Both directions are required. Finding two strangers does not mean a till disappeared, and an empty missing-side does not mean the two strangers are safe. Chapter 3 applies the stop-and-ask rule from chapter 2: write down what was seen, and ask Ellen before going further. Leo does not inspect the contents of either device and does not try to connect to it. That prohibition is the defensive boundary. The chapter does not add a method for connecting.

The names arrive only in the prose. One device "turns out to be" a smart speaker a staff member connected. The other is a delivery company's handheld scanner left on charge. The staff member is not named. The company is not named. The print still says `UNKNOWN` on both rows, because the dictionary was not edited. Calling either device malware contradicts the exercise in chapter 3, which treats that label as the wrong answer. They are non-business devices on a network with the tills. The recommendation is to move them when guest isolation exists. The move, when chapter 4 narrates it, still does not create a third unknown and does not fill the empty missing-side.

One further limit keeps the evidence honest. Chapter 3 says the synthetic comparison is practice before a live export. The live export is not pasted. This book therefore has one lease table. The speaker and the scanner are the narrative attached to `bb:77` and `cc:19`. They are not a second table with different addresses. Inventing that table would look more thorough and would be false.

### 14.2 Worked example

| Addition | Source | Decision |
|---|---|---|
| "Unknown labels are bb:77 and cc:19." | The set difference | May stay |
| "The missing side is empty." | The other difference | May stay |
| "Ellen later calls them a speaker and a scanner." | The narrative | May stay, as narrative |
| "The rows now print those names, and a third device appeared." | Not in the run | Refuse |

> **Synthetic case.** No one's name is added to the staff story.

### Errors and limits

An identification can be right and still leave the printed cell as UNKNOWN.

### Apply

- **EX060 — What do you type beside bb:77?** Ellen identifies a speaker and a scanner. The staff member and the delivery company stay unnamed. What does the lease run print, and what do you add? *Rubric:* 3 = the run still prints UNKNOWN for bb:77 and cc:19; the missing side stays empty; the names stay narrative; no staff name, company name, third device, or malware label is added;; 2 = UNKNOWN stays and no third device is added;; 1 = the story only;; 0 = none.

<!-- open-cyber-academy:chapter-navigation:start ch-14 -->
### Continue studying — lesson 14 (chapter 14 of 20)

[← Chapter 13](#ch-13) · [Course chapter index](../SUBJECTS.md) · [Chapter 15 →](#ch-15)

Continue to the next authored lesson.
<!-- open-cyber-academy:chapter-navigation:end -->

## Worked answers

<a id="answer-ex060"></a>
**EX060.** The run still prints UNKNOWN for bb:77 and cc:19, and the missing side stays empty. The speaker and the scanner stay narrative. No staff name, company name, third device, or malware label is added.
