<a id="ch-18"></a>

## Chapter 18 — A later phish report is not another lab row

<!-- open-cyber-academy:lesson-figures:start ch-18 -->
### Lesson map

Lesson 18. Map, example, EX064.

```mermaid
flowchart TD
  P["Two months later"] --> R["Staff report a fake invoice-overdue email"]
  R --> N["No password entered"]
  N --> B["Sender blocked"]
  B --> U["Report button used three more times"]
  U --> Q{"Does this add a seventh tuple?"}
  Q -->|No| K["signins stays length 6"]
```

The report is success because people watched. It is not a new sign-in line.

### Logical drawing

```text
lab rows: still 6
password entered: no
sender: blocked
further uses of the report button that month: 3
not a night-country flag
```
<!-- open-cyber-academy:lesson-figures:end ch-18 -->

### Learning outcomes

After this chapter, you should be able to:

1. List what the later report established.
2. Keep it out of the sign-in list.
3. Refuse a seventh tuple or a second script.

### 18.1 The report is a human event. The list length stays six.

Two months later, a staff member reported a fake "invoice overdue" email. BrightPath confirmed that no one entered a password. The sender was blocked. The report button was used three more times that month. Leo counted the reports as success because people were watching, not because a detector printed a new line.

The Python list remains a sequence of six position-bound tuples, and nothing in the later month assigns into it. An unnamed reporter and an unprinted sender address cannot become fields, because the tuple shape is user, time token, and country token. Button presses are a separate tally of human reports. They are not loop iterations, and they do not reopen the closed first-month count of 11.

The four signals from chapter 1 still include staff reports of odd emails. This event is that signal working. It does not create a fifth signal. It also does not rerun the lab. A classmate who appends a tuple would be editing the file, not reading the later month.

| Fact about the later report | In the lab list? |
|---|---|
| No password entered | No |
| Sender blocked | No |
| Report button, three more times | No |
| Six original tuples | Yes, unchanged |

### 18.2 Worked example

| Offered addition | What it confuses | Decision |
|---|---|---|
| "No password was entered." | The confirmation | Keep, as prose |
| "The sender was blocked." | The action taken | Keep, as prose |
| "Add a seventh CHECK line." | The list length is six | Refuse |
| "Three button presses are three lab rows." | They are reports | Refuse |

> **Synthetic case.** The later email is not a sign-in tuple.

### Errors and limits

Do not append a row because the story continued.

### Apply

- **EX064 — Later report.** What did BrightPath confirm, what happened to the sender, and does this event add a row to `signins`? *Rubric:* 3 = no password was entered; the sender was blocked; the report button was used three more times; the sign-in list stays six rows;; 2 = the report stays prose and the list stays six;; 1 = one fact;; 0 = none.

<!-- open-cyber-academy:chapter-navigation:start ch-18 -->
### Continue studying — lesson 18 (chapter 18 of 20)

[← Chapter 17](#ch-17) · [Course chapter index](../SUBJECTS.md) · [Chapter 19 →](#ch-19)

Continue to the next authored lesson.
<!-- open-cyber-academy:chapter-navigation:end -->

## Worked answers

<a id="answer-ex064"></a>
**EX064.** No password was entered, and the sender was blocked. The report button was used three more times that month. The sign-in list stays six rows.
