Title: Relevant U.S. Laws
Course: IN 2001 Principle of Information Assurance > Section: Module 3: Chapter Three

Relevant U.S. Laws

General Computer Crime Laws

1. The Computer Fraud and Abuse Act of 1986 (CFA Act) is the cornerstone of many computer-related federal laws and enforcement efforts.

1. The CFA Act was amended in October 1996 with the National Information Infrastructure Protection Act of 1996, which modified several sections of the CFA and increased the penalties for selected crimes. The severity of the penalty depends on the value of the information obtained and whether the offense is judged to have been committed:
  - For purposes of commercial advantage
  - For private financial gain
  - In furtherance of a criminal act
2. The USA PATRIOT Act of 2001 modified a wide range of existing laws to provide law enforcement agencies with broader latitude of actions in order to combat terrorism-related activities.

1. In 2006, this act was amended with the USA PATRIOT Improvement and Reauthorization Act, which made permanent 14 of the 16 expanded powers of the Department of Homeland Security and the FBI in investigating terrorist activity.  The act also reset the date of expiration written into the law for certain wiretaps under the Foreign Intelligence Surveillance Act of 1978 (FISA) and revised many of the criminal penalties and procedures associated with criminal and terrorist activities.

1. The Computer Security Act of 1987 was one of the first attempts to protect federal computer systems by establishing minimum acceptable security practices.

1. The National Bureau of Standards, in cooperation with the National Security Agency, became responsible for developing these security standards and guidelines.

Privacy

1. The issue of privacy has become one of the hottest topics in information security at the beginning of the 21st century.  The ability to collect information, combine facts from separate sources, and merge it all with other information has resulted in databases of information that were previously impossible to set up.

1. In response to pressure for privacy protection, the number of statutes addressing an individual’s right to privacy has grown.  It must be understood, however, that privacy in this context is not absolute freedom from observation, but rather is a more precise “state of being free from unsanctioned intrusion.”
2. Privacy of Customer Information - The Privacy of Customer Information Section of the common carrier regulation specifies that any proprietary information shall be used explicitly for providing services, and not for any marketing purposes.  It also stipulates that carriers cannot disclose this information except when necessary to provide their services.  The only other exception is when a customer requests the disclosure of information, and then the disclosure is restricted to that customer’s information only.

o   Aggregate information is created by combining pieces of nonprivate data—often collected during software updates, and via cookies—that when combined may violate privacy.

o   The Federal Privacy Act of 1974 regulates government agencies and holds them accountable if they release private information about individuals or businesses without permission.

o   The Electronic Communications Privacy Act of 1986 regulates the interception of wire, electronic, and oral communications.  The ECPA works in conjunction with the Fourth Amendment of the U.S. Constitution, which protects citizens from unlawful search and seizure.

o   The Health Insurance Portability & Accountability Act Of 1996 (HIPAA), also known as the Kennedy-Kassebaum Act, protects the confidentiality and security of health-care data by establishing and enforcing standards and by standardizing electronic data interchange.  This act impacts all health-care organizations.

o   The act requires organizations that retain health-care information to use information security mechanisms to protect this information, as well as policies and procedures to maintain this security.

o   The act also requires a comprehensive assessment of the organization's information security systems, policies, and procedures.

o   There is no specification of particular security technologies for each of the security requirements, only that security must be implemented to ensure the privacy of the health-care information.

o   The privacy standards of HIPAA severely restrict the dissemination and distribution of private health information without documented consent.

o   The standards provide patients the right to know who has access to their information and who has accessed it.  The standards also restrict the use of health information to the minimum necessary for the health-care services required:

HIPAA has five fundamental principles:

- Consumer control of medical information
- Boundaries on the use of medical information
- Accountability for the privacy of private information
- Balance of public responsibility for the use of medical information for the greater good measured against impact to the individual
- Security of health information

o   The Financial Services Modernization Act, or Gramm-Leach-Bliley Act of 1999, requires all financial institutions to disclose their privacy policies on the sharing of nonpublic personal information.  It also requires due notice to customers so that they can request that their information not be shared with third parties.

1. The act ensures that the privacy policies in effect in an organization are both fully disclosed when a customer initiates a business relationship and distributed at least annually for the duration of the professional association.
2. Identity Theft - The Federal Trade Commission defines identity theft as “occurring when someone uses your personally identifying information, like your name, Social Security number, or credit card number, without your permission, to commit fraud or other crimes”.

o   In May of 2006, President Bush signed an Executive Order creating the Identity Theft Task Force.  The goals of this group are to create a strategic plan to improve efforts of the government and private organizations and individuals in combating identity theft.  The group seeks better coordination among groups, more effective prosecution of criminals engaged in these activities and methods to increase restitution made to victims.

o   While numerous states have passed identity theft laws, at the federal level the primary legislation is the Fraud And Related Activity In Connection With Identification Documents, Authentication Features, And Information (Title 18, U.S.C. § 1028), which criminalizes creation, reproduction, transfer, possession or use of unauthorized or false identification documents or document-making equipment.  Penalties for such offenses range from one to 25 years in prison and fines as determined by the courts.

o   The Federal Trade Commission recommends the following four steps people can take when they suspect a theft of identity has occurred:

- Report to the three dominant consumer reporting companies that your identity is threatened so that they may place a fraud alert on your record. This informs current and potential creditors to follow certain procedures before taking credit-related actions.
- If you know which accounts have been compromised, close them.  If new accounts are opened using your identity without your permission, the U.S. FTC has provided a document template online that may be used to dispute these new accounts.  The ID Theft Affidavit can be found at Consumer theft affidavit .
- Register your concern with the U.S. FTC. Use the FTC provided complaint form at FTC complaint form.
- Report the incident to either your local police or police in the location where the identity theft occurred. Use your copy of the FTC ID Theft complaint form to make the report.  Once your police report has been filed, be sure to get a copy of it or else acquire the police report number.

Export and Espionage Laws

1. In an attempt to protect American ingenuity, intellectual property, and competitive advantage, Congress passed the Economic Espionage Act (EEA) in 1996.  This law attempts to prevent trade secrets from being illegally shared.

1. The Security and Freedom through Encryption Act of 1999 (SAFE) provides guidance on the use of encryption and provides measures of protection from government intervention.

U.S. Copyright Law

1. Intellectual property is recognized as a protected asset in the United States. U.S. copyright laws extend this privilege to the published word, including electronic formats.

1. Fair use of copyrighted materials includes their use to support news reporting, teaching, scholarship, and a number of other related activities, as long as the use is for educational or library purposes, not for profit and is not excessive.

1. As long as proper acknowledgment is provided to the original author of such works, including a proper citation, and the work is not represented as one’s own, it is entirely permissible to include portions of someone else’s work as reference.

Financial Reporting

1. The Sarbanes-Oxley Act of 2002, a critical piece of legislation that affects the executive management of publicly traded corporations and public accounting firms, seeks to improve the reliability and accuracy of financial reporting, as well as increase the accountability of corporate governance, in publicly traded companies.

1. Executives working in firms covered by this law will seek assurance on the reliability and quality of information systems from senior information technology managers who, in turn, will likely ask information security managers to verify the confidentiality and integrity of those same information systems.

Freedom of Information Act of 1966 (FOIA)

1. The Freedom of Information Act allows any person to request access to federal agency records or information not determined to be a matter of national security. U.S. government agencies are required to disclose any requested information upon receipt of a written request.

1. Some information is protected from disclosure, however, and the act does not apply to state or local government agencies or to private businesses or individuals, although many states have their own version of the FOIA.

State and Local Regulations

1. In addition to the national and international restrictions placed on organizational use of computer technology, each state or locality may have a number of its own applicable laws and regulations.

1. The information security professional must understand state laws and regulations and ensure that the organization’s security policies and procedures comply with those laws and regulations.