I see people do that in cold places... pull up their collar to keep warm

It is obvious that she is covering her face either away from the camera or from sun light. And what she's holding is the collar of her coat.

You should look into using DETER Testbed for this type of class. http://www.isi.edu/deter/ In short, DETER is an Emulab clone for Network Security type of experiments. There is an on-going effort to promote DETER for education purpose and the DETER team has access to several types of virus. https://education.deterlab.net/ Hope this helps. Young