>Most of the points is arguing that NSA could compel the company Duck Duck Go, Inc to install equipment and then forbidding the company from disclosing that fact.
You don't need to do anything like that. DDG doesn't crawl the web itself, it uses API providers like Bing (Microsoft/NSA) and Yandex (Russian/FSB). They're legally required to disclose that on their site.
It's possible to identify people solely through anonymised credit card transactions[0] so doing the same for search results is pretty much the same.
DDG isn't private, it just gives the illusion of privacy, same as TOR. That said though if you're a high profile target then there's much more direct means to track what you're searching.
Maybe teach her how to make a Wordpress plugin? It'd slot in with what she already knows and she'd see immediate benefit as well as a real life application of her code.
Learn Python the hard way is a great idea too though, I got my friend started with the Ruby one and she really took to it. Another good one for Python is http://automatetheboringstuff.com/
Something to watch out for though is a lot of books are hopelessly out of date, code moves so fast that all the code examples in a book even just a couple of months old will be broken. Trivial for experienced people to workaround but typically if you're reading the book to learn you won't be able to figure it out.
Where are all the ex-employees and leakers exposing the shenanigans? I do believe they have salespeople that suggest paying to fix things, but I don't believe they can actually do that.
It seems like it would be an easy experiment for somebody to do. Find a local restaurant with some poor ratings. If they want to cooperate, pay a Yelp salesperson to "fix" the problem and see if it goes away. If they deliver, then you have a bombshell article that could go viral.
