Computer Law Commons^™

The Myth Of Sufficient Technological Barriers: Reevaluating The "Gates-Up-Or-Down" Analogy In Data Scraping, Yucen Zhong

Duke Law & Technology Review

In Van Buren v. United States, the Supreme Court adopted a “gates-up-or-down” analogy from physical trespass law to define “authorization” under the Computer Fraud and Abuse Act (CFAA). Despite historical shifts in judicial interpretation, courts have recently relied on this binary framework to interpret authorization as it applies to online trespass. But courts have struggled to apply this binary inquiry while still accounting for complications in modern authentication technologies. When pursuing a code-based inquiry based on the gates-up-or-down analogy, courts risk oversimplifying the dynamic nature of online trespass. Such an approach fails to account for how modern authentication measures—such as …

Cybersecurity Risk Shifting, Deborah R. Farringer

Vanderbilt Journal of Entertainment & Technology Law

The Change Healthcare cyberattack of 2024 paralyzed the health care system for months, creating an exceedingly far reaching and devastating impact on providers, suppliers, and patients across the country. While the scope of the attack was unprecedented, the cyberattack itself was not new, unique, or isolated. Indeed, this attack came just months after the close of a year in which the United States’ Department of Health and Human Services’ Office for Civil Rights (OCR) recorded the highest number of reported breaches of protected health information and the highest number of breached records. With a medical record fetching nearly four times …

Hacking With Uncle Sam: Imagining A Public-Private Partnership For Active Cyber Defense, Jonathan Coleman

Catholic University Journal of Law and Technology

Federal law makes no distinction between "good" and "bad" hackers—the Computer Fraud and Abuse Act criminalizes hacking by a private citizen in any form. While an anti-hacking statute is necessary to deter and punish cybercrime, the current law prohibits private entities from "hacking back" or, more precisely, from engaging in active defensive measures in response to a cyberattack. If these measures were legalized, they could allow private entities to assist law enforcement and reduce the financial and reputational costs of a cyber incident. Absent a change in the law, private entities are dependent on law enforcement to provide active cyber …

A Proposed Tort To Address The Negligent Enablement Of Cloud Data Breaches, Michael L. Rustad

American University Business Law Review

[INTRODUCTION] The term “cloud computing” means the remote storage of software applications, tools, and data accessed through the internet. Cloud customers enter into subscription agreements with providers who give 24/7, on-demand, as-needed access to software, storage, and networking services owned and managed by providers through a web browser. “Many businesses are transitioning to the cloud for data storage, remote work, and collaboration.” Cloud providers operate their software as a software-as-a-service (“SaaS”) model, under which customers pay a subscription fee to access the software. Netflix and Amazon Prime Video are examples of subscription services that deliver television programs and videos through …

Using Blockchain Technology To Help Secure America's Defense Critical Infrastructure, Vimal Buck, Aerin Krebs, Brynn Hillard, Jakob Gerha, Joseph Lutma, Srikar Maduposu, Ted Allen

Military Cyber Affairs

Critical water infrastructure in the United States faces increasing cybersecurity threats from state-sponsored actors, with potentially devastating consequences for national security, economic stability, and public health. (Cybersecurity and Infrastructure Security Agency, 2025). This infrastructure supports defense critical assets and is actively being targeted by various state-sponsored hacking groups, which poses a major concern for civilians and military alike. K. Herath (personal communication, February 24, 2025) reported being aware of two attacks on Ohio water systems during his tenure as Cybersecurity Strategic Advisor to Ohio Governor Mike DeWine.

Water is essential to everyday life and defense and presents as a high-value …

Gendering The New International Convention On Cybercrimes And New Norms On Artificial Intelligence And Emerging Technologies, Rangita De Silva De Alwis

Washington Journal of Law, Technology & Arts

The trifecta of the Digital Global Compact (2024), the UN General Assembly Resolution on AI for Sustainable Development (2024) and the new Cyber Crime Convention (2025) come at a time of what seems to be an inexorable march of new technology. It is also at a time of transborder disruption caused by data breaches and cyber threats, that binding international norms can respond to global challenge. However, it must be emphasized that digital violence, developer bias, and data bias are not new phenomena, they have existed since the origins of the internet. Data that is used to train machine-learning algorithms …

Guide To Sec And Business Open Source Corporate Intelligence, Lawrence J. Trautman, Brian Elzweig, Neal F. Newman

Faculty Scholarship

An agency of the U.S. intelligence community observes, "The explosion of open source intelligence (OSINT) in recent years has transformed how governments and people around the world consume and process information about society and global issues." It is likely that "We all use open-source and probably don't even realize it, but we also use it for different reasons. You might use open-source information to do a credibility check and to find out more about the person selling you something on Facebook marketplace." Others "may research someone… met on a dating app or before hiring someone for a job." Every use …

"Reasonable [Cybersecurity] Measures" For Digital Trade Secrets: Lessons From Marketing, Raj Sachdev

Law Faculty Scholarship

The loss of digital trade secrets in marketing and beyond, often the source of competitive advantage, can have disastrous impacts on brands and companies. Bad actors want to get their digital hands on digital trade secrets, and other actors and factors may also cause a risk to their secrecy. The Defend Trade Secrets Act (DTSA) makes clear that “reasonable measures” must be taken to maintain the secrecy of a trade secret. Likewise, the Uniform Trade Secrets Act (UTSA) requires “reasonable steps.” However, in a digital age, the definition of what is “reasonable” is even more unclear than in offline settings. …

Unto The (Data) Breach, Charlotte A. Tschider

Faculty Publications & Other Works

Since the early 2000s, U.S. courts have begun hearing “data breach” liability cases, the inevitable result of a growing internet-connected technology infrastructure. The relatively recent development of case law signals a body of law in development, stunted by significant limiting factors that prevent the coalescence of legal principles. To date, no holistic empirical exploration of data breach cases has offered sufficient detail to explore these factors. This descriptive empirical study analyzes, in detail, 225 data breach cases from 2005–2022, reviewing these cases over an extended period to descriptively identify key trends and changes within a bona fide data breach case’s …

Patching The Cfaa So Researchers No Longer Pay, Joshua Baker

Cybaris®

No abstract provided.

Is Sunlight The Best Disinfectant? The Role Of Regulation In Addressing Cybersecurity Concerns, Reagan Leverett

Vanderbilt Law Review

The technological landscape in the United States is changing rapidly, and this transformation carries with it unprecedented challenges for administrators, companies, and investors alike. In particular, cybersecurity concerns are growing in light of the new opportunities for cyber malfeasance in this landscape—opportunities to pillage corporate databases and exploit the sensitive consumer information housed therein. For administrators, these new threats challenge prevailing regulatory frameworks and demand novel solutions. For companies, this landscape brings financial and reputational threats. For stakeholders, the cyber era presents the risk of investment losses and, in some cases, loss of personal data.

The Securities and Exchange Commission …

Improving Ethics Surrounding Collegiate-Level Hacking Education: Recommended Implementation Plan & Affiliation With Peer-Led Initiatives, Shannon Morgan, Dr. Sanjay Goel

Military Cyber Affairs

Cybersecurity has become a pertinent concern, as novel technological innovations create opportunities for threat actors to exfiltrate sensitive data. To meet the demand for professionals in the workforce, universities have ramped up their academic offerings to provide a broad range of cyber-related programs (e.g., cybersecurity, informatics, information technology, digital forensics, computer science, & engineering). As the tactics, techniques, and procedures (TTPs) of hackers evolve, the knowledge and skillset required to be an effective cybersecurity professional have escalated accordingly. Therefore, it is critical to train cyber students both technically and theoretically to actively combat cyber criminals and protect the confidentiality, integrity, …

Securing The Void: Assessing The Dynamic Threat Landscape Of Space, Brianna Bace, Dr. Unal Tatar

Military Cyber Affairs

Outer space is a strategic and multifaceted domain that is a crossroads for political, military, and economic interests. From a defense perspective, the U.S. military and intelligence community rely heavily on satellite networks to meet national security objectives and execute military operations and intelligence gathering. This paper examines the evolving threat landscape of the space sector, encompassing natural and man-made perils, emphasizing the rise of cyber threats and the complexity introduced by dual-use technology and commercialization. It also explores the implications for security and resilience, advocating for collaborative efforts among international organizations, governments, and industry to safeguard the space sector.

Zero Progress On Zero-Days: How The Last Ten Years Created The Modern Spyware Market, Mailyn Fidler

Law Faculty Scholarship

Spyware makes surveillance simple. The last ten years have seen a global market emerge for ready-made software that lets governments surveil their citizens and foreign adversaries alike and to do so more easily than when such work required tradecraft. The last ten years have also been marked by stark failures to control spyware and its precursors and components. This Article accounts for and critiques these failures, providing a socio-technical history since 2014, particularly focusing on the conversation about trade in zero-day vulnerabilities and exploits. Second, this Article applies lessons from these failures to guide regulatory efforts going forward. While recognizing …

International Source Code Secrecy And The Characterization Of Intellectual Property As National Security, Anthony D. Rosborough

Articles, Book Chapters, & Popular Press

This chapter explores the emergence of source code secrecy rules in Free Trade Agreements (FTAs) and their implications for the future of intellectual property (IP). Rooted in geopolitical rivalry, these rules are framed as safeguards for national security and cybersecurity but carry significant potential social, economic, and environmental costs.

It traces the historical and geopolitical contexts that have shaped the rise of source code secrecy. Given that software-dependent technologies are now the dominant modality of innovation, the chapter highlights the impact of source code secrecy on domestic regulatory oversight, innovation, the right to repair, and equitable technology transfer to least-developed …

Integrating Nist And Iso Cybersecurity Audit And Risk Assessment Frameworks Into Cameroonian Law, Bernard Ngalim

Journal of Cybersecurity Education, Research and Practice

This paper reviews cybersecurity laws and regulations in Cameroon, focusing on cybersecurity and information security audits and risk assessments. The importance of cybersecurity risk assessment and the implementation of security controls to cure deficiencies noted during risk assessments or audits is a critical step in developing cybersecurity resilience. Cameroon's cybersecurity legal framework provides for audits but does not explicitly enumerate controls. Consequently, integrating relevant controls from the NIST frameworks and ISO Standards can improve the cybersecurity posture in Cameroon while waiting for a comprehensive revision of the legal framework. NIST and ISO are internationally recognized as best practices in information …

Cyber Plungers: Colonial Pipeline And The Case For An Omnibus Cybersecurity Legislation, Asaf Lubin

Articles by Maurer Faculty

The May 2021 ransomware attack on Colonial Pipeline was a wake-up call for a federal administration slow to realize the dangers that cybersecurity threats pose to our critical national infrastructure. The attack forced hundreds of thousands of Americans along the east coast to stand in endless lines for gas, spiking both prices and public fears. These stressors on our economy and supply chains triggered emergency proclamations in four states, including Georgia. That a single cyberattack could lead to a national emergency of this magnitude was seen by many as proof of even more crippling threats to come. Executive Director of …

Security-Enhanced Serial Communications, John White, Alexander Beall, Joseph Maurio, Dane Fichter, Dr. Matthew Davis, Dr. Zachary Birnbaum

Military Cyber Affairs

Industrial Control Systems (ICS) are widely used by critical infrastructure and are ubiquitous in numerous industries including telecommunications, petrochemical, and manufacturing. ICS are at a high risk of cyber attack given their internet accessibility, inherent lack of security, deployment timelines, and criticality. A unique challenge in ICS security is the prevalence of serial communication buses and other non-TCP/IP communications protocols. The communication protocols used within serial buses often lack authentication and integrity protections, leaving them vulnerable to spoofing and replay attacks. The bandwidth constraints and prevalence of legacy hardware in these systems prevent the use of modern message authentication and …

What Senior U.S. Leaders Say We Should Know About Cyber, Dr. Joseph H. Schafer

Military Cyber Affairs

On April 6, 2023, the Atlantic Council’s Cyber Statecraft Initiative hosted a panel discussion on the new National Cybersecurity Strategy. The panel featured four senior officials from the Office of the National Cyber Director (ONCD), the Department of State (DoS), the Department of Justice (DoJ), and the Department of Homeland Security (DHS). The author attended and asked each official to identify the most important elements that policymakers and strategists must understand about cyber. This article highlights historical and recent struggles to express cyber policy, the responses from these officials, and the author’s ongoing research to improve national security cyber policy.

The Security And Cyber Defence Realities And Difficulties In Algeria, Kada Aicha

Journal of Police and Legal Sciences

This research paper aims to shed light on the digital challenge faced by Algeria as it enters the world of the knowledge society, which qualifies it to achieve cybersecurity and cyber defense against various forms and types of security threats, including cyber threats. The researcher used an analytical approach to understand the phenomenon under study and trace its causes, in addition to a case study method to study all aspects of the studied phenomenon and identify the characteristics of the case study - Algeria was chosen as the analysis unit. The study concluded several important results, including:

The deficiency of …

Ransomware Groups On Notice: U.S. Cyber Operation Against Revil Is Permissible Under International Law, Justin Singh

American University International Law Review

The continued increase in the use of ransomware by cyber criminals has had a costly impact on businesses and organizations around the world. Ransomware groups continue to initiate attacks on businesses and organizations, and states have become increasingly concerned over the potential impact it may have on their critical infrastructure and economies. The United States’ recent acknowledgement of cyber operations against ransomware groups highlights the seriousness of the issue and exposes areas of international law that are complicated when applied to cyber operations against these groups. This Comment explores the relevant international law as it applies to the United States …

Strengthening Our Intuitions About Hacking, Jeffrey L. Vagle

Indiana Law Journal

The computer trespass analogy has served us reasonably well as a basis for cybersecurity policies and related anti-hacking laws, but computers, and our uses of them, have changed significantly in ways that stretch the computer trespass metaphor beyond usefulness. This Essay proposes an approach to expanding and strengthening our intuitions about computer security that accounts for new computing paradigms, giving courts and lawmakers additional tools for interpreting and drafting effective anti-hacking laws.

This Essay argues that many new and existing computer use scenarios leave courts unsure how existing anti-hacking laws might apply, increasing the possibility of under- or over-inclusive policies …

Securing Patent Law, Charles Duan

Scholarly Articles in Law Reviews & Journals

A vigorous conversation about intellectual property rights and national security has largely focused on the defense role of those rights, as tools for responding to acts of foreign infringement. But intellectual property, and patents in particular, also play an arguably more important offense role. Foreign competitor nations can obtain and assert U.S. patents against U.S. firms and creators. Use of patents as an offense strategy can be strategically coordinated to stymie domestic innovation and technological progress. This Essay considers current and possible future practices of patent exploitation in this offense setting, with a particular focus on China given the nature …

The Law And Politics Of Ransomware, Asaf Lubin

Vanderbilt Journal of Transnational Law

What do Lady Gaga, the Royal Zoological Society of Scotland, the city of Valdez in Alaska, and the court system of the Brazilian state of Rio Grande do Sul all have in common? They have all been victims of ransomware attacks, which are growing both in number and severity. In 2016, hackers perpetrated roughly four thousand ransomware attacks a day worldwide, a figure which was already alarming. By 2020, however, ransomware attacks reached a staggering number, between twenty thousand and thirty thousand per day in the United States alone. That is a ransomware attack every eleven seconds, each of which …

Small Business Cybersecurity: A Loophole To Consumer Data, Matthew R. Espinosa

The Scholar: St. Mary's Law Review on Race and Social Justice

Small businesses and small minority owned businesses are vital to our nation’s economy; therefore legislation, regulation, and policy has been created in order to assist them in overcoming their economic stability issues and ensure they continue to serve the communities that rely on them. However, there is not a focus on regulating nor assisting small businesses to ensure their cybersecurity standards are up to par despite them increasingly becoming a victim of cyberattacks that yield high consequences. The external oversight and assistance is necessary for small businesses due to their lack of knowledge in implementing effective cybersecurity policies, the fiscal …

Defensive Industrial Policy: Cybersecurity Interventions To Reduce Intellectual Property Theft, Dr. Chad Dacus, Dr. Carl (Cj) Horn

Military Cyber Affairs

Through cyber-enabled industrial espionage, China has appropriated what Keith Alexander, the former Director of the National Security Agency, dubbed “the largest transfer of wealth in history.” Although China disavows intellectual property (IP) theft by its citizens and has set self-sustained research and development as an important goal, it is unrealistic to believe IP theft will slow down meaningfully without changing China’s decision calculus. China and the United States have twice agreed, in principle, to respect one another’s IP rights. However, these agreements have lacked any real enforcement mechanism, so the United States must do more to ensure its IP is …

Breached!: Why Data Security Law Fails And How To Improve It, Woodrow Hartzog, Daniel Solove

Books

Digital connections permeate our lives—and so do data breaches. Given that we must be online for basic communication, finance, healthcare, and more, it is remarkable how difficult it is to secure our personal information. Despite the passage of many data security laws, data breaches are increasing at a record pace. In their book, BREACHED! WHY DATA SECURITY LAW FAILS AND HOW TO IMPROVE IT (Oxford University Press 2022), Professors Daniel Solove and Woodrow Hartzog argue that the law fails because, ironically, it focuses too much on the breach itself.

Drawing insights from many fascinating stories about data breaches, Solove and …

Locking Down "Reasonable" Cybersecurity Duty, Charlotte A. Tschider

Faculty Publications & Other Works

Following a data breach or other cyberattack, the concept of “reasonable” duty, broadly construed, is essential to a plaintiff’s potential causes of action, such as negligence, negligence per se, breach of contract, breach of fiduciary duty, and any number of statutory claims. The impact of an organization’s discretionary choices, such as whether to take specific security steps for a system, may result in potential risk to an individual, another organization, or the organization itself. Although organizations regularly engage in cybersecurity risk analysis, they may not understand what practices will be considered reasonable in a court of law and are therefore …

Locking Down 'Reasonable' Cybersecurity Duty, Charlotte A. Tschider

Faculty Publications & Other Works

Following a data breach or other cyberattack, the concept of “reasonable” duty, broadly construed, is essential to a plaintiff’s potential causes of action, such as negligence, negligence per se, breach of contract, breach of fiduciary duty, and any number of statutory claims. The impact of an organization’s discretionary choices, such as whether to take specific security steps for a system, may result in potential risk to an individual, another organization, or the organization itself. Although organizations regularly engage in cybersecurity risk analysis, they may not understand what practices will be considered reasonable in a court of law and are therefore …

Book Review: This Is How They Tell Me The World Ends: The Cyberweapons Arms Race (2020) By Nicole Perlroth, Amy C. Gaudion

Dickinson Law Review (2017-Present)

No abstract provided.