Computer Law Commons^™

Mitigating Cyber Risk In It Supply Chains, Maureen Wallace

Global Business Law Review

This note argues that the United States needs to utilize current federal agencies to begin introducing cyber supply chain risk management regulation for IT supply chains. Cyber supply chain risk management is a critical area of cybersecurity that has barely been recognized by the United States government. The globalization of the digital world has introduced a new spectrum of risk management issues that affect the products exchanged by businesses and consumed by individuals and government agencies. While there have been some initiatives toward the promotion of tighter cybersecurity regulation, most initiatives only concern the public sector, leaving the private sector …

The Impact Of Technological Developments On The Rules Of Attorney Ethics Regarding Attorney–Client Privilege, Confidentiality, And Social Media, Pamela A. Bresnahan, Lucian T. Pera

St. Mary's Journal on Legal Malpractice & Ethics

This article focuses on the development of the law of ethics and technology. Emphasis is placed on how technological developments have affected the rules and means by which lawyers practice law and certain ethical pitfalls that have developed hand-in-hand with technological advancements. Topics examined include: (1) the ways by which electronic communication has increased the potential for the attorney–client privilege to be waived and the resulting impact on the present-day practice of law; (2) the effect of social media on lawyers’ ethical obligations, including counseling clients regarding the client’s use of social media and the lawyer’s own use of social …

Consenting To Computer Use, James Grimmelmann

Cornell Law Faculty Publications

The federal Computer Fraud and Abuse Act (CFAA) makes it a crime to “access a computer without authorization or exceed authorized access.” Courts and commentators have struggled to explain what types of conduct by a computer user are “without authorization.” But this approach is backwards; authorization is not so much a question of what a computer user does, as it is a question of what a computer owner allows.

In other words, authorization under the CFAA is an issue of consent, not conduct; to understand authorization, we need to understand consent. Building on Peter Westen’s taxonomy of consent, I argue …

“Hello…It’S Me. [Please Don’T Sue Me!]” Examining The Fcc’S Overbroad Calling Regulations Under The Tcpa, Marissa A. Potts

Brooklyn Law Review

Americans have received unwanted telemarketing calls for decades. In response to a rapid increase in pre-recorded calls made using autodialer devices, Congress enacted the Telephone Consumer Protection Act (TCPA) in 1992. The TCPA imposes restrictions on calls made to consumers’ residences and wireless phones using autodialer devices, even if they are not telemarketing calls. Congress appointed the Federal Communications Commission (FCC) to prescribe rules and regulations to enforce the TCPA. In 2015, the FCC released an order that defined autodialer more broadly under the statute. Consequently, devices that have the potential to become autodialers in the future, even if they …

The Question Concerning Technology In Compliance, Sean J. Griffith

Brooklyn Journal of Corporate, Financial & Commercial Law

In this symposium Essay, I apply insights from philosophy and psychology to argue that modes of achieving compliance that focus on technology undermine, and are undermined by, modes of achieving compliance that focus on culture. Insisting on both may mean succeeding at neither. How an organization resolves this apparent contradiction in program design, like the broader question of optimal corporate governance arrangements, is highly idiosyncratic. Firms should therefore be accorded maximum freedom in designing their compliance programs, rather than being forced by enforcement authorities into a set of de facto mandatory compliance structures.

Like A Bad Neighbor, Hackers Are There: The Need For Data Security Legislation And Cyber Insurance In Light Of Increasing Ftc Enforcement Actions, Jennifer Gordon

Brooklyn Journal of Corporate, Financial & Commercial Law

Privacy has come to the forefront of the technology world as third party hackers are constantly attacking companies for their customers’ data. With increasing instances of compromised customer information, the Federal Trade Commission (FTC) has been bringing suit against companies for inadequate data security procedures. The FTC’s newfound authority to bring suit regarding cybersecurity breaches, based on the Third Circuit’s decision in FTC v. Wyndham Worldwide Corp., is a result of inaction—Congress has been unable to pass sufficient cybersecurity legislation, causing the FTC to step in and fill the void in regulation. In the absence of congressional action, this self-proclaimed …

The Cybersecurity Threat: Compliance And The Role Of Whistleblowers, Jennifer M. Pacella

Brooklyn Journal of Corporate, Financial & Commercial Law

In today’s technologically dependent world, concerns about cybersecurity, data breaches, and compromised personal information infiltrate the news almost daily. The Securities and Exchange Commission (SEC) has recently emerged as a regulator that is keenly focused on cybersecurity, specifically with respect to encouraging disclosures in this arena by regulated entities. Although the SEC has issued non-binding “guidance” to help companies navigate their reporting obligations in this sector, the agency lacks binding cybersecurity disclosure regulations as they pertain generally to public companies. Given that the SEC has already relied on such guidance in threatening enforcement actions, reporting companies are increasingly pressured for …

Preserving Human Agency In Automated Compliance, Onnig H. Dombalagian

Brooklyn Journal of Corporate, Financial & Commercial Law

As technology transforms financial services, so too must it transform the regulation of financial markets and intermediaries. The imperative of real-time, prophylactic regulation increasingly compels reallocation of regulatory and compliance budgets to surveillance and enforcement technology. At the same time, in light of the well-known weaknesses of automated systems, securities firms (and their regulators) must temper investment in automation with efforts to augment the agency of compliance professionals. This symposium contribution considers how investment in the professional development of compliance personnel can better integrate automated tools within established compliance and supervisory structures and thereby advance regulatory and operational objectives.

Designing Laboratories For Small Scale Digital Device Forensics, Richard P. Mislan, Tim Wedge

Annual ADFSL Conference on Digital Forensics, Security and Law

The ubiquity of small scale digital devices (SSDD), the public’s ever increasing societal dependence on SSDD, and the continual presence of SSDD at all types of crime scenes, including non-technical and violent crimes, demand a formalized curriculum for the education and training of future cyber forensic examiners. This paper presents the various SSDD forensics labs currently in use and under development for future use at the Purdue University Cyber Forensics Laboratory. The primary objective of each module is to provide specific real-world cases for the learning, comprehension, and understanding of hands-on investigative techniques and methodologies. The purpose of this paper …

Network Forensic Investigation Of Internal Misuse/Crime In Saudi Arabia: A Hacking Case, Abdulrazaq Al-Murjan, Konstantinos Xynos

Annual ADFSL Conference on Digital Forensics, Security and Law

There are ad-hoc guidelines and a limited policy on computer incident response that does not include computer forensic preparation procedures (e.g. logging incidents). In addition, these guidelines do not consider the requirement of Islamic law for admissible evidence at an organisational level in Saudi Arabia. Network forensic investigation might breach the Saudi law if they follow ad-hoc or international digital forensic standards such as Association of Chief Police Officers (ACPO) guidelines. This might put the organisation in a costly situation when a malicious employee sues an Islamic court. This is because the law of Saudi Arabia is complying with Islamic …

Circumvention Of Geoblocking, Marketa Trimble

Boyd Briefs / Road Scholars

Professor Marketa Trimble gave her presentation Circumvention of Geoblocking at the "Law, Borders, and Speech" conference, held at Stanford Law School on Oct. 24, 2016.

Paper Session Ii: Computer Forensics Field Triage Process Model, Marcus K. Rogers, James Goldman, Rick Mislan, Timothy Wedge, Steve Debrota

Annual ADFSL Conference on Digital Forensics, Security and Law

With the proliferation of digital based evidence, the need for the timely identification, analysis and interpretation of digital evidence is becoming more crucial. In many investigations critical information is required while at the scene or within a short period of time - measured in hours as opposed to days. The traditional cyber forensics approach of seizing a system(s)/media, transporting it to the lab, making a forensic image(s), and then searching the entire system for potential evidence, is no longer appropriate in some circumstances. In cases such as child abductions, pedophiles, missing or exploited persons, time is of the essence. In …

Development Of A National Repository Of Digital Forensic Intelligence, Mark Weiser, David P. Biros, Greg Mosier

Annual ADFSL Conference on Digital Forensics, Security and Law

Many people do all of their banking online, we and our children communicate with peers through computer systems, and there are many jobs that require near continuous interaction with computer systems. Criminals, however, are also “connected”, and our online interaction provides them a conduit into our information like never before. Our credit card numbers and other fiscal information are at risk, our children's personal information is exposed to the world, and our professional reputations are on the line.

The discipline of Digital Forensics in law enforcement agencies around the nation and world has grown to match the increased risk and …

Designing A Data Warehouse For Cyber Crimes, Il-Yeol Song, John D. Maguire, Ki Jung Lee, Namyoun Choi, Xiaohua Hu, Peter Chen

Annual ADFSL Conference on Digital Forensics, Security and Law

One of the greatest challenges facing modern society is the rising tide of cyber crimes. These crimes, since they rarely fit the model of conventional crimes, are difficult to investigate, hard to analyze, and difficult to prosecute. Collecting data in a unified framework is a mandatory step that will assist the investigator in sorting through the mountains of data. In this paper, we explore designing a dimensional model for a data warehouse that can be used in analyzing cyber crime data. We also present some interesting queries and the types of cyber crime analyses that can be performed based on …

Siri-Ously? Free Speech Rights And Artificial Intelligence, Toni M. Massaro, Helen Norton

Northwestern University Law Review

Computers with communicative artificial intelligence (AI) are pushing First Amendment theory and doctrine in profound and novel ways. They are becoming increasingly self-directed and corporal in ways that may one day make it difficult to call the communication ours versus theirs. This, in turn, invites questions about whether the First Amendment ever will (or ever should) cover AI speech or speakers even absent a locatable and accountable human creator. In this Article, we explain why current free speech theory and doctrine pose surprisingly few barriers to this counterintuitive result; their elasticity suggests that speaker humanness no longer may be …

Reader Privacy In Digital Library Collaborations: Signs Of Commitment, Opportunities For Improvement, Anne Klinefelter

Faculty Publications

Libraries collaborate to digitize collections large and small in order to provide information with fewer geographical, temporal, or socio-economic barriers. These collaborations promise economy of scale and breadth of impact, both for access to content and for preservation of decaying print source material. Some suggest this increased access to information through the digital environment comes at the expense of reader privacy, a value that United States librarians have advanced for nearly eighty years. Multiplying risks to digital reader privacy are said to weaken librarians’ commitment to privacy of library use and to overwhelm libraries’ ability to ensure confidential access to …

Special Issue On Cyberharassment Investigation: Advances And Trends, Joanne Bryce, Virginia N. L. Franqueira, Andrew Marrington

Journal of Digital Forensics, Security and Law

Empirical and anecdotal evidence indicates that cyberharassment is more prevalent as the use of social media becomes increasingly widespread, making geography and physical proximity irrelevant. Cyberharassment can take different forms (e.g., cyberbullying, cyberstalking, cybertrolling), and be motivated by the objectives of inflicting distress, exercising control, impersonation, and defamation. Little is currently known about the modus operandi of offenders and their psychological characteristics. Investigation of these behaviours is particularly challenging because it involves digital evidence distributed across the devices of both alleged offenders and victims, as well as online service providers, sometimes over an extended period of time. This special issue …

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Icrc, Nato And The U.S. – Direct Participation In Hacktivities – Targeting Private Contractors And Civilians In Cyberspace Under International Humanitarian Law, Ido Kilovaty

Duke Law & Technology Review

Cyber-attacks have become increasingly common and are an integral part of contemporary armed conflicts. With that premise in mind, the question arises of whether or not a civilian carrying out cyber-attacks during an armed conflict becomes a legitimate target under international humanitarian law. This paper aims to explore this question using three different analytical and conceptual frameworks while looking at a variety of cyber-attacks along with their subsequent effects. One of the core principles of the law of armed conflict is distinction, which states that civilians in an armed conflict are granted a set of protections, mainly the protection from …