Computer Law Commons^™

Security In The Digital Age, Michael Gentithes

Akron Law Faculty Publications

Rapidly evolving technology allows governments and businesses to elevate our collective well-being in ways we could not have imagined just decades ago. Data is now a resource that governments and businesses alike can mine to address the world’s needs with greater efficiency, accuracy, and flexibility. But evolving technology and advanced data analytics also come with risk. New digital capabilities also create new means for nefarious actors to infiltrate the complex technological systems at the heart of nearly all of our daily activities. Just as new digital tools emerge to offer unique goods and services, new tools allow wrongdoers to invade …

Platforms, Encryption, And The Cfaa: The Case Of Whatsapp V Nso Group, Jonathon Penney, Bruce Schneier

Articles, Book Chapters, & Popular Press

End-to-end encryption technology has gone mainstream. But this wider use has led hackers, cybercriminals, foreign governments, and other threat actors to employ creative and novel attacks to compromise or workaround these protections, raising important questions as to how the Computer Fraud and Abuse Act (CFAA), the primary federal anti-hacking statute, is best applied to these new encryption implementations. Now, after the Supreme Court recently narrowed the CFAA’s scope in Van Buren and suggested it favors a code-based approach to liability under the statute, understanding how best to theorize sophisticated code-based access barriers like end-to-end encryption, and their circumvention, is now …

It's Time To Reform The U.S. Vulnerabilities Equities Process, Amy Gaudion

Faculty Scholarly Works

No abstract provided.

What's The Harm? Federalism, The Separation Of Powers, And Standing In Data Breach Litigation, Grayson Wells

Indiana Law Journal

This Comment will argue that the Supreme Court should analyze standing in data breach litigation under a standard that is deferential to state statutory and common law. Specifically, federal standing analysis should look to state law when determining whether an injury is concrete such that the injury-in-fact requirement is met. Some argue that allowing more data breach cases to proceed to the merits could lead to an explosion of successful litigation and settlements, burdening the federal courts and causing economic losses for the breached businesses. These concerns may be valid. But if state law provides a remedy to the harm …

The Evolution Of Legal Risks Pertaining To Patch Management And Vulnerability Management, James T. Kitchen, David R. Coogan, Keeton H. Christian

Duquesne Law Review

This article begins with an overview, in non-technical terms, of the tools generally available and processes implemented for vulnerability management and patch management. Section II identifies some of the evolving security standards that regulators and plaintiffs may rely on to show that companies are legally required to have vulnerability management and patch management. Section III identifies U.S. legal implications of vulnerability management and patch management and factors that a court and regulators may consider.

Persuasion About/Without International Law: The Case Of Cybersecurity Norms, Steven R. Ratner

Book Chapters

International law on cybersecurity is characterized by at best a thin consensus on the existence of rules, their meaning, and the desirability and content of new rules. This legal landscape results in a unique pattern of argumentation and persuasion by states and non-state actors both in advocating for a regulatory scheme for cyber activity and in reacting to malicious cyber acts. By examining argumentation in the absence of a generally agreed legal framework, this chapter seeks to provide new insights into the motivations for and effects of international legal argumentation in shaping debates and behavior. After describing the legal landscape …

Recognizing The Role Of Inspectors General In The U.S. Government's Cybersecurity Restructuring Task, Amy Gaudion

Faculty Scholarly Works

Months prior to the 2015 public disclosure of a data breach at the U.S. government’s Office of Personnel and Management (OPM), the Office of the Inspector General for OPM issued a report that identified significant deficiencies and material weaknesses in a number of the agency’s information systems and IT security programs. In response to the 2020 SolarWinds supply chain hack, attributed to Russia, calls are underway for inspectors general to conduct audits and inspections and to review prior inspector general assessments of information systems and vulnerabilities at federal agencies. The use of inspectors general to assess information system vulnerabilities and …

Show Me The (Data About The) Money!, Nizan Geslevich Packin

Utah Law Review

Information about consumers, their money, and what they do with it is the lifeblood of the flourishing financial technology (“FinTech”) sector. Historically, highly regulated banks jealously protected this data. However, consumers themselves now share their data with businesses more than ever before. These businesses monetize and use the data for countless prospects, often without the consumers’ actual consent. Understanding the dimensions of this recent phenomenon, more and more consumer groups, scholars, and lawmakers have started advocating for consumers to have the ability to control their data as a modern imperative. This ability is tightly linked to the concept of open …

Trimming The Fat: The Gdpr As A Model For Cleaning Up Our Data Usage, Kassandra Polanco

Touro Law Review

No abstract provided.

National Cybersecurity Innovation, Tabrez Y. Ebrahim

Faculty Scholarship

National cybersecurity plays a crucial role in protecting our critical infrastructure, such as telecommunication networks, the electricity grid, and even financial transactions. Most discussions about promoting national cybersecurity focus on governance structures, international relations, and political science. In contrast, this Article proposes a different agenda and one that promotes the use of innovation mechanisms for technological advancement. By promoting inducements for technological developments, such innovation mechanisms encourage the advancement of national cybersecurity solutions. In exploring possible solutions, this Article asks whether the government or markets can provide national cybersecurity innovation. This inquiry is a fragment of a much larger literature …

The Survival Of Critical Infrastructure: How Do We Stop Ransomware Attacks On Hospitals?, Helena Roland

Catholic University Journal of Law and Technology

Our nation’s infrastructure is under an emerging new threat: ransomware attacks. These attacks can cause anything from individual laptops, to entire cities to shut down for a period of time until the victim pays a ransom to the attacker. Unfortunately, these attacks are on the rise and the attackers have a new target: hospitals. Ransomware attacks on hospitals can temporarily shut down operating room technology and limit physician access to patient files, ultimately threatening the safety of hospital patients and the surrounding community. This paper examines how the threat of ransomware attacks on hospitals is on the rise and what …

Linn Foster Freedman Room Dedication At Rwu School Of Law 11-01-2019, Roger Williams University School Of Law, Michael M. Bowden

School of Law Conferences, Lectures & Events

No abstract provided.

Cybersecurity Oversight Liability, Benjamin P. Edwards

Georgia State University Law Review

A changing cybersecurity environment now poses a significant corporate-governance challenge. Although some cybersecurity data breaches may be inevitable, courts now increasingly consider when a corporation’s officers and directors may be held liable on theories that they acted in bad faith and failed to adequately oversee the corporation’s affairs. This short essay reviews recent derivative decisions and encourages corporate boards to recognize that in an environment filled with increasing threats, a reasonable response will require devoting real resources and attention to cybersecurity issues.

Creating A National Data Privacy Law For The United States, Shaun G. Jamison

Cybaris®

No abstract provided.

Dean's Desk: Iu Maurer Programs Supporting Careers In Cybersecurity, Austen L. Parrish

Austen Parrish (2014-2022)

A recent Bureau of Labor Statistics report estimated a near 30 percent growth in coming years for information security professionals, far outpacing most other job types. While Indiana University has long recognized the importance of data security and privacy, multiple new initiatives are ensuring that the next generation of chief information security officers, systems analysts, privacy professionals and others will come from our law school.

One of the ways the law school is leading the way is through the university’s new master of science in cybersecurity risk management. That degree program combines the resources of three of IU’s top-ranked schools …

Cybersecurity And The Rights Of The Internet User In France, Jennifer Cross

Georgia Journal of International & Comparative Law

No abstract provided.

“Private” Cybersecurity Standards? Cyberspace Governance, Multistakeholderism, And The (Ir)Relevance Of The Tbt Regime, Shin-Yi Peng

Cornell International Law Journal

We are now living in a hyper-connected world, with a myriad of devices continuously linked to the Internet. Our growing dependence on such devices exposes us to a variety of cybersecurity threats. This ever-increasing connectivity means that vulnerabilities can be introduced at any phase of the software development cycle. Cybersecurity risk management, therefore, is more important than ever to governments at all developmental stages as well as to companies of all sizes and across all sectors. The awareness of cybersecurity threats affects the importance placed on the use of standards and certification as an approach.

Promoting International Cybersecurity Cooperation: Lessons From The Proliferation Security Initiative, Duncan B. Hollis, Matthew C. Waxman

Faculty Scholarship

Global efforts by states to cooperate through international rules in combating cyber threats have generated mixed results, at best. In this paper, we examine the architecture of the Proliferation Security Initiative (PSI) as a possible model for future cybersecurity cooperation among interested states. We identify several features of PSI’s architecture (rather than its substantive focus on non-proliferation) for further analysis, including PSI’s low entry costs, tiered structure, and flexibility, as well as its leveraging of both territorial jurisdiction and state consent. We conclude that, despite several hurdles visible in the scope of its membership and its legal framework, PSI still …

Corporate Cybersecurity: The International Threat To Private Networks And How Regulations Can Mitigate It, Eric J. Hyla

Vanderbilt Journal of Entertainment & Technology Law

Cyberattacks are occurring at an accelerating pace. Foreign nations are increasingly utilizing hacking as a tool for economic gain, acts of aggression, or international political expression. At risk are US consumers'personal data, private firms' bottom line, and the economies'integrity. In response, federal and state lawmakers have issued a series of disparate, uncoordinated policies seeking to strengthen cybersecurity practices. However, recent events indicate that these policies are less than ideal. This Note suggests that a unified response to cybersecurity is required and calls for the establishment of a single, central federal agency with authority over all cybersecurity regulations. Such an agency …

Global Cybersecurity, Surveillance, And Privacy: The Obama Administration's Conflicted Legacy, Peter Margulies

Indiana Journal of Global Legal Studies

To analyze the Obama administration's cyber efforts, this Article proposes a paradigm of stewardship with both discursive and structural dimensions. Discursive stewardship refers to the Executive's openness to dialogue with other stakeholders. Structural stewardship refers to the domestic and transnational distribution of decisional authority, including checks and balances that guard against the excesses of unilateral action. The Article concludes that the Obama administration made substantial progress in each of these realms. However, the outsized role of law enforcement agendas and dearth of clearly articulated checks on transnational surveillance drove headwinds that limited forward movement.

Sony, Cyber Security, And Free Speech: Preserving The First Amendment In The Modern World, Conrad Wilton

Pace Intellectual Property, Sports & Entertainment Law Forum

Reprinted from 16 U.C. Davis Bus. L.J. 309 (2016). This paper explores the Sony hack in 2014 allegedly launched by the North Korean government in retaliation over Sony’s production of The Interview and considers the hack’s chilling impact on speech in technology. One of the most devastating cyber attacks in history, the hack exposed approximately thirty- eight million files of sensitive data, including over 170,000 employee emails, thousands of employee social security numbers and unreleased footage of upcoming movies. The hack caused Sony to censor the film and prompted members of the entertainment industry at large to tailor their communication …

Ispy: Threats To Individual And Institutional Privacy In The Digital World, Lori Andrews

All Faculty Scholarship

What type of information is collected, who is viewing it, and what law librarians can do to protect their patrons and institutions.

Enhancing Cybersecurity In The Private Sector By Means Of Civil Liability Lawsuits - The Connie Francis Effect, Jeffrey F. Addicott

University of Richmond Law Review

The purpose of this article is to explore the threats posed by

cybersecurity breaches, outline the steps taken by the government

to address those threats in the private sector economy, and

call attention to the ultimate solution, which will most certainly

spur private businesses to create a more secure cyber environment

for the American people-a Connie Francis-styled cyber civil

action lawsuit.

Making Democracy Harder To Hack, Scott Shackelford, Bruce Schneier, Michael Sulmeyer, Anne Boustead, Ben Buchanan, Amanda N. Craig Deckard, Trey Herr, Jessica Malekos Smith

University of Michigan Journal of Law Reform

With the Russian government hack of the Democratic National Convention email servers and related leaks, the drama of the 2016 U.S. presidential race highlights an important point: nefarious hackers do not just pose a risk to vulnerable companies; cyber attacks can potentially impact the trajectory of democracies. Yet a consensus has been slow to emerge as to the desirability and feasibility of reclassifying elections—in particular, voting machines—as critical infrastructure, due in part to the long history of local and state control of voting procedures. This Article takes on the debate—focusing on policy options beyond former Department of Homeland Security Secretary …

Transforming Election Cybersecurity, David P. Fidler

Articles by Maurer Faculty

No abstract provided.

Authorized Investigation: A Temperate Alternative To Cyber Insecurity, Casey M. Bruner

Seattle University Law Review

This Note aims to show that legal structures created to protect the Internet in its original form are completely insufficient to protect what the Internet has become. This antiquated legal framework is exacerbating the problem. The breadth of activity that the current law restricts severely limits the remedies that cyberattack victims can pursue, and it must be updated. While full hack-back may prove necessary in the long run, I argue for a more temperate initial response to the problem—I call this response “authorized investigation.” Specifically, the Computer Fraud and Abuse Act should be amended to allow victims access to their …

Silencing The Call To Arms: A Shift Away From Cyber Attacks As Warfare, Ryan Patterson

Loyola of Los Angeles Law Review

Cyberspace has developed into an indispensable aspect of modern society, but not without risk. Cyber attacks have increased in frequency, with many states declaring cyber operations a priority in what has been called the newest domain of warfare. But what rules govern? The Tallinn Manual on the International Law Applicable to Cyber Warfare suggests existent laws of war are sufficient to govern cyber activities; however, the Tallinn Manual ignores fundamental problems and unique differences between cyber attacks and kinetic attacks. This Article argues that several crucial impediments frustrate placing cyber attacks within the current umbra of warfare, chiefly the problems …

Comment With The Copyright Office Regarding A Proposed Exemption Under 17 U.S.C. Section 1201 For Software Security Research (Class 25), Candice Hoke

Law Faculty Reports and Comments

Professor Candice Hoke, Cleveland State University, and others (Douglas W. Jones, University of Iowa; Professor Deirdre Mulligan, University of California, Berkeley; Professor Vern Paxson, University of California, Berkeley;Professor Pamela Samuelson, University of California, Berkeley; Bruce Schneier Erik Stallman, Center for Democracy & Technology (CDT); comment addressing Proposed Class 25: Software Security Research and an exemption for software security research in order to promote the active research and testing efforts necessary to keep pace with evolving cybersecurity risks. Software and related access controls are increasingly embedded in a wide range of systems, from consumer goods to medical devices to infrastructure to …

Hacking The Wealth Of Nations: Managing Markets Amid Malware, David P. Fidler

Articles by Maurer Faculty

No abstract provided.

Whither The Web?: International Law, Cybersecurity, And Critical Infrastructure Protection, David P. Fidler

Articles by Maurer Faculty

No abstract provided.