Title: Law and Ethics in Information Security
Course: IN 2001 Principle of Information Assurance > Section: Module 3: Chapter Three

Law and Ethics in Information Security

As individuals, we elect to trade some aspects of personal freedom for social order.

Laws are rules that mandate or prohibit certain behavior in society. They are drawn from ethics, which define socially acceptable behaviors.

Ethics, in turn, are based on cultural mores, which are the fixed moral attitudes or customs of a particular group. Some ethics are recognized as universal among cultures.

Organizational Liability and the Need for Counsel

1. Even if there is no breach of criminal law, there can still be liability.
2. Liability is the legal obligation of an entity that extends beyond criminal or contract law; it includes the legal obligation to make restitution or to compensate for wrongs committed by an organization or its employees.
3. An organization increases its liability if it refuses to take measures known as due care.
4. Due care has been taken when an organization makes sure that every employee knows what is acceptable or unacceptable behavior and knows the consequences of illegal or unethical actions.
5. Due diligence requires that an organization make a valid effort to protect others and continually maintain this level of effort.
6. Under the U.S. legal system, any court can impose its authority over an individual or organization if it can establish jurisdiction—that is, the court’s right to hear a case if the wrong was committed in its territory or involving its citizenry.
7. Trying a case in the injured party’s home area is usually favorable to the injured party.

Policy versus Law

1. Within an organization, information security professionals help maintain security via the establishment and enforcement of policies.
2. These policies—a body of expectations that describe acceptable and unacceptable employee behaviors in the workplace—function as organizational laws, complete with penalties, judicial practices and sanctions to require compliance.
3. Policies function as laws and must be crafted with the same care to ensure that they are complete, appropriate, and fairly applied to everyone in the workplace.
4. The difference between a policy and a law, however, is that ignorance of a policy is an acceptable defense.
5. For a policy to be enforceable, it must meet the following five criteria and demonstrate that it has done so:
  - Dissemination (distribution)
  - Review (reading)
  - Comprehension (understanding)
  - Compliance (agreement)
  - Uniform enforcement
6. Only when all of these conditions are met can an organization penalize employees who violate the policy, without fear of legal retribution.

Types of Law

1. Civil law represents a wide variety of laws that govern a nation or state and deal with the relationships and conflicts between organizational entities and people.

1. Criminal law addresses violations harmful to society and is actively enforced by the state.

1. Private law regulates the relationship between the individual and the organization and encompasses family law, commercial law and labor law.

1. Public law regulates the structure and administration of government agencies and their relationships with citizens, employees and other governments, providing careful checks and balances.  Examples of public law include criminal, administrative and constitutional law.