Cybersecurity and Data Protection Laws - An Overview

by Jack Barkstrom - Attorney, CPA

At the Core - Cybersecurity Laws

It used to be possible to understand or explain the field of cybersecurity law by listing a few examples of computer-related legislation, or laws which had evolved to deal with problems created by advances in information technology. Now it might be better to divide the field into laws or regulations which currently exist and those which might be enacted in the future. News headlines point to any number of problems requiring the attention of lawmakers. Some problems may be serious enough to make it into law eventually, while others may disappear or diminish with the passage of time. There are certain laws which might be considered to be at the center of cybersecurity. Many existing laws focus on specific problem areas, such as national security, privacy, and the protection of data. Some deal with the problems specific to a specific industry, such as the medical field or banking, while others deal with common security problems created by the universal use of computers and information technology. If the medical field deals with patient data and disease diagnosis, its billing and cost structure is something it shares with the insurance industry, the auto industry, and banking.

There has been recent concern about social media abuse by young people. Too many hours are being spent on computers or cell phones. Some have even considered it an "addiction." Some countries, such as Australia, have attempted to restrict access by those under a certain age to social media accounts. If it can be a serious problem in many cases, can it be solved by legislation or will it go away if people get involved in other activities? If addiction is a term often applied to social media, it has also been applied to the broader problem of an obsession with the Internet and e-mails. In a social setting at a restaurant, there is usually one person who prefers to look at their phone or take calls. In other situations, there seems to be the need to instantly answer e-mails or phone calls or even an urge to get back to the office to check for messages. There are any number of areas with potentially serious problems. On-line gambling is one potential problem area, with examples of individuals becoming addicted and losing hundreds or thousands of dollars. Like drinking and alcohol consumption, is it an individual problem, or something for which there is a legislative solution? Another potential problem area is that of social media platforms which allow individuals to express opinions. Are these platforms promoting "hate speech" or allowing "freedom of speech." Is legislation required or does it involve so-called "government suppression" of ideas it does not like? At the other extreme is the obsession with celebrities or individuals or events, and a desire to know and disclose information about their personal lives, whether true or just gossip. Historical events used to be the subject of books and movies. Now there are whole TV or Netflix series involving re-creations or dramatizations of individual lives, possibly true or entirely made up, calculated to satisfy Internet curiosity.(1)

Cybersecurity laws might be understood as being divided into two parts. First, at the core, are those laws specifically intended to deal with computers, criminal acts, and attacks. The second part are those laws which derived from laws with other goals, such as authorizing agencies or programs to operate, like Medicare or the Securities and Exchange Commission (SEC), which were expanded to deal with cyber security, privacy, and safety. Hospitals used to have to deal with budgets, billing, and patient survival. Now they have to contend with data breaches, cyber attacks, and the protection of patient privacy and records.

The Original Computer Security Laws

Laws dealing with cybersecurity have broadly fallen into a category called "compliance" laws. It should be noted that compliance is a term for requirements applied to "victims" or potential victims of cyber attacks. Compliance broadly refers to the processes by which an organization polices its own behavior to ensure that it conforms to applicable rules. In the area of cyberscurity, compliance primarily falls under the legal category of "administrative law," which involves oversight by federal agencies, such as the Federal Trade Commission (FTC) or the Securities and Exchange Commission (SEC). Compliance enforced by federal agencies is really only part of the larger world of compliance, which can involve insurance companies, the threat of litigation, or oversight by company boards of directors. With the Internet, it is difficult and time-consuming to identify the attacker or even the source of an attack. So the focus is on prevention or mitigation, meaning that the burden is on the organization which may be targeted to take measures to defend against attacks or to limit damage if an attack is successful. It is possible to create a hierarchy or ranking, in terms of importance, or in terms of historical origins, but they were created in response to different problems and at different times, so any ranking is somewhat arbitrary. Listing them in any order, if nothing else, serves as a starting point for any discussion. There are seven laws which fall into this category: 1) the Federal Information Security Management Act (FISMA); 2) the Health Insurance Portability and Accountability Act; 3) the Gramm-Leach-Bliley Act; 4) the Sarbanes-Oxley Act; 5) the Family Educational Rights and Privacy Act; and 6) the Children's Online Privact Protection Act; 7) the Children's Internet Protection Act. In addition to these laws, there are two others, almost in a category of their own: 7) the Computer Fraud and Abuse Act, which was amended or reenacted by the Identity Theft Enforcement and Restitution Act of 2008; and, in the area of national security, 8) the Foreign Intelligence Surveillance Act.(2)

Federal Information Security Management (Modernization) Act (FISMA)

The Federal Information Security Management Act (FISMA) of 2002, is unlikely to disappear, even though it represents perhaps the ultimate in bureaucratic goals. (The "faceless bureaucrat" making unnecessary rules and paperwork as a political target has its ups and downs.) FISMA was passed as Title III of the E-Government Act of 2002 and was partly a response to the September 11 terrorist attacks and the need for better information security. It is unlikely to go away because it was amended and re-passed in 2014 as the Federal Information Security Modernization Act (FISMA) of 2014 (sometimes called FISMA Reform) in response to the increasing amount of cyber attacks on the federal government.(3)

In some respects, the 2002 and 2014 acts were similar, if not identical. The National Institute of Standards and Technology (NIST) was given overall responsibility for developing standards under both acts. The Office of Management and Budget (OMB), which had been part of oversight in the 2002 act was still there in 2024, although some of its oversight responsibilities had been transferred to the Department of Homeland Security (DHS) in July 2010. The 2014 act reestablished the oversight authority of the Director of the Office of Management and Budget (OMB). One of its stated goals was the coordination of security efforts between government and the private sector and an attempt to integrate commercially-developed advancements into the governmental standards. It formally designated individual roles for the Secretary of Homeland Security (DHS), the Director of National Intelligence, and the Director of the National Institute of Standards (NIST) while monitoring compliance through annual audits. Reinforcing the goal of greater cooperation was the requirement of annual reports. Both individual agency and joint annual reports to Congress and the other agencies were required. An information security incident center was established to compile information and to assist potential risks. The 2014 law did add a "data breach notification" section, which required both up-to-date notification policies and guidelines, and notification to Congressional committees, as well as to affected individuals.(4)

Health Insurance Portability and Accountability Act of 1996

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), at least in part, began as an attempt to change insurance law, which may explain why the title began with "Health Insurance Portability." The goal of HIPAA was "portability," - the ability of employees to carry their health insurance forward from one employer to another, if they changed joba. It allowed employees to change jobs without having their new health plans exclude preexisting conditions. The "accountability" term in the title was somewhat less self-explanatory. While it may have suggested a desire to hold insurance companies accountable, it involved a broader goal - an overhaul and upgrade of the healthcare community.(5)

HIPAA, while seemingly a standalone insurance act, was actually an amendment to the Social Security Act of 1935, which had created the Old Age, Survivors, Disability, and Health Insurance (OASDI), what was known as, or became, the Social Security System. (It should be noted that the Social Security System is an insurance system.) The Social Security Act, and 1935, serves as the starting point. The next step, or reference point, is the creation of the Medicare program in 1965, which was also an amendment to the original Social Security Act (Title XVIII). The final step, the 1996 HIPAA amendment, which was Subtitle F of Title II of HIPAA, added Part C - Administrative Simplification - to Title XI of the Act. The Administrative Simplification provisions were intended to improve both the Medicare (Title XVIII of the Social Security Act) and Medicaid (Title XIX of the Social Security Act) programs.(6)

Just how did seemingly conflicting goals end up as part of one bill? It might have been less confusing to pass separate bills with their own titles. On the other hand, it was perhaps more efficient to get a single bill passed. It may be helpful to understand the political forces and actors which came together at this particular time to shape the final legislation. HIPAA, when it was first introduced, was intended to deal with the portability issue confronting employees and their loss of health insurance if they changed jobs, referred to as "job lock." Generally, it was seen as an opportunity to strengthen laws regulating fraud and abuse in healthcare and certain other insurance matters. There was also a coalition of organizations made up of parties who paid for healthcare, which included insurers and health plans. Their overall goal was "administrative simplification" of healthcare business transactions. Healthcare information and processing needed standardization. Medicare and Medicaid had already standardized their forms and transaction formats. However, over 450 different claim forms and transaction formats remained in use in the United States. The movement from a paper-oriented record system to an electronic and Internet-friendly system was in its early stages. It was hampered by the existence of incompatible proprietary electronic data interchange networks. It was felt, at the time, that an Internet-based transaction/transmission system, was the direction things were moving. The other major coalition of "lobbyists" was made up of privacy advocates, who saw the threats to privacy requiring some advocacy on behalf of patients. As they saw it, there was the need for both privacy protection rules combined with greater security protection requirements.(7)

In spite of concerns for the privacy and security of medical data, Congress was unable to agree on the specifics. Instead, it established a deadline of August 21, 1999 for it to re-visit the subject and enact comprehensive legislation to deal with privacy. If Congrees failed to act by that date, it directed the Department of Health and Human Services (HHS) to promulgate regulations. The deadline passed with no legislation and HHS published proposed regulations on November 3, 1999, although it would not become effective until 2003. HHS would publish its Security Rule regulations in 2003 which became effective in 2005.(8)

Health Information Technology for Economic and Clinical Health Act of 2009

In some ways the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH), incorporated the HHS regulations regarding privacy and security into the legislation which Congress had been unable to agree on in 1999. It was enacted as part of the American Recovery and Reinvestment Act of 2009 (ARRA). One of its significant changes was to move enforcement of HIPAA rules from the Centers for Medicare & Medicaid (CMS) to the Office for Civil Rights (OCR) within HHS. It added a mandatory data breach notification provision and increased the penalties for violations. In addition, as if the notification did not reach a wide enough audience, the HITECH act required a posting on the HHS website of a list of covered entities (CEs) with breaches of unsecured protected health information (PHI) where the breach involved 500 or more individuals. If news of the breach was not enough, this "wall of shame" might reinforce the message. The HITECH act expanded the organizations covered to include just about anyone who dealt with patient information in any way. It also provided for mandatory audits to determine compliance, although there was some leeway in how the audits requirement was to be applied, based on the size and type of organization involved.(9)

HHS would release its proposed final regulations on January 25, 2013, commonly called the "Omnibus Rule." It went into effect on March 26, 2013, although compliance would not be required until September 23, 2013. Generally, the HHS regulations were an attempt to deal with the still-developing world of electronic data use and e-commerce. There were technological developments in the world of electronics which provided for transmission and storage of larger amounts of data. This was combined with the introduction of new and smaller devices, such as cell phones, with greater processing and data handling capabilities. In an attempt to deal with new and unknown developments, the post-HITECH regulations provided for three categories of protection: 1) administrative safeguards; 2) physical safeguards; and 3) technical safeguards. Administrative safeguards were almost advisory in nature. Management was supposed to look at current and potential threats and within this threat area, it was to include a risk analysis of threats, and work on contingency planning. Physical safeguards were more specific. They included facility access control, workstation security and use, device use, and even disposal of hardware and electronic media. Technical safeguards were more focused on safeguards related to computer, information system, and network transmission - the workings of computer hardware, computer programs, and system connections. Technical safeguards included the use of passwords and authentication measures, restrictions on access to data, and the use of encryption measures to protect data when transmitted.(10)

Gramm-Leach-Bliley Act

The Gramm-Leach-Bliley Act (GLBA) of 1999, also known as the Financial Services Modernization Act of 1999, repealed parts of the Glass-Stegall Act of 1933 and the Bank Holding Company Act of 1956. One of its main goals was to make more financial services available to consumers. Which financial services were successful would be determined by the market, not regulators, and the free market would replace government regulation. There was also the concept of "functional regulation" where regulation would be subdivided into different categories: banking would be supervised and regulated by the banking agencie; insurance activities by the state departments of insurance; and securities transactions by the Securities and Exchange Commission (SEC) and state securities divisions. The modernization was to be accomplished by allowing business affiliations between banks, securities firms, and insurance companies through a structure called a financial holding company. It turned out to be a case of "it worked until it didn't." In 2008, the near collapse of the financial markets was blamed on the conglomerates created after Gramm-Leach-Bliley, and led to the passage of the Emergency Economic Stabilization Act (EESA) of 2008. This was followed by the Dodd-Frank Act of 2010, which brought back government regulation, although in not quite the same form. It also sought to restore some consumer protections.(11)

The Gramm-Leach-Bliley Act (GLBA) did provide additional safeguards for consumers and customer information. It required financial institutions to inform customers of their privacy policies, as well as a "conspicuous" privacy notice, along with an "opt-out" notice, which allows customers and consumers to limit, in some circumstances, the sharing of nonpublic personal information (NPI). At the same time, GLBA did not provide a private right of action for violations. Enforcement powers were only granted the Federal Trade Commission (FTC), federal banking regulators, and state insurance commissioners. Privacy advocates did win a concession in the form of the Privacy Rule, which the FTC issued in May 2000.(12)

It was on the security side that the GLBA perhaps had its most permanent impact. The GLBA required the FTC and other agencies to establish security standards for nonpublic personal information, with the mandate to develop an "information security program." In May 2002 the FTC issued its final regulations foer what would be known as the Safeguards Rule. Part of the impetus for the Safeguards Rule was an awareness that identity theft was a growing problem. It led to the passage of the Fair and Accurate Credit Transactions Act of 2003 (FACTA) which was an amendment to the Fair Credit Reporting Act of 1970 (FCRA). With three federal agencies focusing on security, the Safeguards Rule, in some variation, would ensure that financial institutions would increase security. In November 2007, the federal agencies involved, the Federal Reserve (the Fed), the Securities and Exchange Commission (SEC), and the Federal Trade Commisssion (FTC), issued a joint rule, known as the Identity Theft Red Flags Rule. It required covered entities to develop a written Identity Theft Prevention Program, which required organizations to develop programs to look for activities which would look for any number of red flags signaling possible signs of identity theft activities. Red flags included such things as fraud alerts, suspicious documents that looked altered or forged, suspicious presonal identifying information, and unusual or suspicious activity involving a covered account. What made these legislative and regulatory changes "permanent" was likely the growing number of headlines relating to terrorism and the almost unending announcements of data breaches.(13)

Sarbanes-Oxley Act

The Sarbanes-Oxley Act of 2002 (SOX or Sarbox), is the unofficial name of the Public Company Accounting Reform and Investor Protection Act signed by President George W. Bush on July 30, 2002. It was passed, primarily in response to the Enron scandal. The legislation moved through Congress almost at the speed of light. Enron had been formed in 1985 through the merger of two natural gas companies. Initially, it bought and sold gas and electricity. It soon expanded into other markets, purchasing steel mills and water utilities, along with investments in England, Mexico, and India. Between 1997 and 2001, it looked to be a very profitable company, alhtough it had borrowed about $8.6 billion, which was undisclosed. Many financial analysts in April 2001 began to question its financial statements. In October 2001, it announced its first ever loss, which was followed by an announcement in November 2001 that it was amending its 1997-2001 financial statement because of "accounting errors." On December 2, 2001 it filed for bankruptcy, the largest to that time. Arthur Andersen, Enron's auditor, was forced to close down, eventually going out of business. Enron had been able to hide its losses because the losses never appeared on Enron's books. Losses were moved to affiliated shell divisions, with fictitious and constantly changing names.(14)

Although SOX only applies to publicly-traded companies (those listed on stock exchanges), it primarily applies to large companies. There are some smaller publicly-traded companies to which it applies, although smaller is defined as a company with less than $75 million of public stock. Most smaller (or non-public companies) are not covered, with one exception. Electronic data relating to internal controls over financial reporting must be permanently retained both by publicly-traded companies and by private companies. It effectively eliminated the attorney-client privilege. Prior to SOX it was possible to hide certain information by claiming attorney-client privilege.(15)

SOX Section 302 requires the Chief Executive Officer (CEO) and the Chief Financial Officer (CFO) to certify, among other things, that the financial statements are accurate and not misleading, and that they have reviewed financial controls 90 days prior to filing reports with the SEC. SOX Section 906 provides for fines up to $1 million and imprisonment up to 10 years on CEOs and CFOs who knowingly certify fraudulent reports. The penalties on officers making fraudulent certifications are more severe: fines up to $5 million and imprisonment up to 20 years.(16)

Internal controls over financial reporting (ICFR) represent perhaps the most important enforcement mechanism. Internal controls involve all the steps related to recording, managaging, and reporting accounting transactions. SOX Section 404 requires a company's executive management to report on the company's internal controls. They must make this report each year on their Form 10-K (annual report filed with the SEC). There are two requirements for management: first, it must evaluate the design of internal control and second, it must test the operating effectiveness of those controls. As part of its internal control report, it will refer to a report on internal controls done by an independent auditor. In addition, since 2004, auditors of larger public companies have been required by the SEC to annually issue an audit report on the operating effectiveness of those controls.(17)

The SOX record retention requirement (Title VIII) came about as a result of actions by Arthur Andersen, Enron's auditors. There are two record retention requirements: 1) financial "audit papers" must be retained for seven years; and 2) records and documentation "used to assess a company's internal controls" over financial reporting, in contrast, must be retained permanently. Title VIII makes it a crime for any person to tamper with or destroy any record in an attempt to interfere with a federal investigation. When Enron's financial difficulties became public, partners at Arthur Andersen instructed employeesl to follow its document destruction policies. Arthur Andersen's employees shredded thousands of Enron documents. As a result of this action, Arthur Andersen would later be charged with obstruction of justice. While it was convicted of this charge, the U.S. Supreme Court in 2005 would overturn the conviction. The reversal came too late to save Arthur Andersen, which went out of business, or alternatively, had already gone out of business but was unable to recover.(18)

Sarbanes-Oxley, apart from its substantive requirements, created an oversight structure, called the Public Company Accounting Oversight Board (PCAOB), a private-sector nonprofit corporation, whose five members are appointed and overseen by the Securities and Exchange Commission (SEC). All accounting firms auditing public companies must register with the PCAOB. One of the main functions of the PCOAB is to set standards for auditors in their reviews of public companies. Standards have been created related to auditing, ethics independence, and quality control. The PCOAB conducts inspections of registered accounting firms to assess compliance with PCAOB and SEC rules. Accounting firms that audit more than 100 issuers must be inspected annually and other accounting firms must be inspected at least once every three years. Because Arthur Andersen had provided Enron with consulting services, in addition to its audit services, it was felt that there should be restrictions on what services audit firms could provide to their audit clients. To reinforce the concept of independence, Sarbanes-Oxley, placed restrictions on what services accounting firms could provide.(19)

Family Educational Rights and Privacy Act

The Family Educational Rights and Privacy Act (FERPA) was enacted in 1974. Its primary goal is to protect the privacy of student educational records. It applies to any educational agency or institution that receives federal funding. Educational institutions incude community colleges, colleges and universities, primary and secondary schools (kindergarten through twelfth grade), state and local educational agencies (including school boards), and schools or agencies offering a preschool program. Most information collected about a student is protected. The only information which can be disclosed without consent is directory information, i.e., information that is publicly available, such as a student's name, address, or telephone number, so long as it has given notice to the student that it will disclose this information. A student can choose to forbid the release of this type of information if it tells the school not to release this information. Parents have rights under FERPA until the student reaches the age of 18, when FERPA rights are transferred to the student.(20)

The most fundamental right under FERPA is student and parental access to the student's educational records. There are three rights under FERPA: 1) the right to know what data is in the student's student record with the right to inspect and review that record; 2) the right to request that a school correct errors in a student record; and 3) the right to consent to have certain kinds of student data released. FERPA requires schools to provide an annual notification to students and parents about their FERPA rights. In general, educational agencies or institutions cannot release educational records or personally identifiable information (PII), such as the student's name or address, without permission, and consent to release the information must be in writing. In certain situations designated officials may have access to student records without permission, so long as access is for a legitimate purpose.(21)

Children's Online Privacy Protection Act

The Children's Online Privacy Protection Act (COPPA) was passed in 1998 and first went into effect in April 2000. It regulates the collection and use of "personal information" gathered from children under age 13 by Internet websites or online services. The definition of Web site or online service is broad, including standard Web sites, as well as mobile apps, Internet gaming platforms, and advertising networks. There are two scope restrictions. COPPA applies to an operator of a Web site or online service 1) directed to children, or 2) any operator that has "actual knowledge" that it is collecting personal information from a child. It only applies to personal information collected "from" children themselves and not information collected from adults about children under 13. It might be said that the COPPA restrictions on minor Internet access are similar to Australia's current attempts to place age restrictions on social media accounts.(22)

The Federal Trade Commission (FTC) has oversight of compliance with COPPA. Its first rule relating to compliance was drafted in 1999. It issued a revised rule in 2012, which went into effect in July 2013. Personal information, under the revised rule, includes a voice, audio, imaage file containing a child's voice and/or image; geolocation data that reveals a street name plus city, or equally revealing information; online contac information, such as a screen name or user name, and persistent identifiers that recognize users across time and sites or services, such as an IP address or device serial number.(23)

The Children's Online Privacy Protection Act (COPPA) should not be confused with the Child Online Protection Act (COPA) or with the Children's Internet Protection Act (CIPA), although they sound very similar and have similar goals. The Child Online Protection Act (COPA) was enacted in 1998 with the purpose of protecting minors from access to harmful material on the Internet. It never went into effect because courts found that it was a violation of free speech.(24)

COPPA does include a knowledge component, which applies to both websites and third parties, when the third party is an agent or provides a benefit to the website operator. For example, a website using ads from an ad network is strictly liable for information collected by the ad network. A website or online service "directed to children" is required to comply with COPPA, which implies an assumption of knowledge. The required "actual knowledge," in the case of other users, can come from facts disclosed by a child, such as a date of birth. A third party can also be liable if it has actual knowledge that a website is directed to children, as would be the case if an ad network which be under contract with a children's website to collect data.(25)

If penalties for violations of COPPA can be fairly high - up to $16,000 per violation - COPPA is not classified as a federal criminal violation. Instead violations are classifed as "unfair or deceptive" trade practices under Title 15 of the U.S. Code dealing with "Commerce and Trade." This is why the Federal Trade Commission (FTC) is charged with enforcement. In addition, COPPA does not provide for a private cause of action.(26)

COPPA has two main rules for websites, when it comes to compliance, Operators must: 1) post a privacy policy, and 2) get varifiable parental consent before collecting information from children. The privacy policies must desribe what information is collected from children, how the operator uses such information, and the operators' disclosure practices. The privacy policy should be easily visible and accessible, with a link to the policy on the home page of the website and on every area where a child's personal information is collected. Parental consent must be verifiable, which would normally involve a written consent, some proof verification that the person consenting is actually the parent, and measures which would allow parental access to information collected. The website operators must have measures in place to prevent the information from being release to the wrong party.(27)

Children's Internet Protection Act

The Children's Internet Protection Act (CIPA) was passed in 2002. It is fairly limited in scope. It requires schools and libraries that receive funding from the U.S. government for Internet access to filter offensive and sexually explicit online content. The goal of CIPA is to limit children's (defined as minors under the age of 17) access to offensive content on the Internet. Offensive content includes any visual depictions considered obscene, child pornography, or harmful to minors. The law was challenged as a violation of the free speech rights of adults. However the Supreme Court upheld the law as constitutional because it was conditional, because only schools and libraries that chose to receive federal funding to subsidize their Internet access costs were required to follow the law. The federal funding was through a program known as E-Rate funding, which provided discounts to schools and libraries for what they paid for Internet access and telecommunications services. The discounts could range from 20 percent to 90 percent of the service costs paid. Schools and libraries, as part of their application, had to state that they were complying with CIPA. There were two main CIPA requirements: 1) the implementation of technologies to block or filter objectionable content, often with tools known as technology protection measures (TPM); and 2) the implementation of an Internet safety policy. The safety policy needed to address problems of Internet access by minors, prevention of unauthorized access and use - activities such as "hacking" on library or school computers were not allowed - and education about appropriate online behavior.(28)

Counterfeit Access Device and Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act (CFAA) was passed in 1986. It is the most often cited, or mentioned, law when it comes to computer crimes, and has become the primary U.S. federal statute that makes computer hacking a crime. Considered the first piece of federal legislation that identified computer crimes as distinct offenses, it had its origins, or began life, under a different name - the Counterfeit Access Device and Computer Fraud and Abuse Act of 1984. The Computer Fraud and Abuse Act of 1986 was an amendment to the 1984 law, which was focused primarily on hacking of financial institutions and the federal government. The House Judiciary Committee was made aware of a new crime, "hacking," which did not fit easily into existing criminal laws. They were also aware that personal computer sales in 1983 were estimated to be $1.5 billion, up from "virtually zero" in 1976. The Committee also acknowledged that computer fraud had been neglected in federal and state laws because it was seen as a "white collar" crime. It was suggested that traditional crimes, such as theft, focused on tangible property, such as goods or cash, and that there needed to be protections for intangible property. Information and access to information needed to be added to the equation. In order to deal with this emerging crime area, there was a need to deal with the "method" used to gain access to information, which, in the final CFAA version was translated into seven categories of "behavior" or purposes behind the hacking, such as hacking to commit espionage or hacking to commit fraud. It should be noted that, the Counterfeit Access Device and Computer Fraud and Abuse Act of 1984 was substantively amended six times, to reach its current form. Along the way the name was shortened to just the Computer Fraud and Abuse Act. The phrase "Counterfeit Access Device" had been dropped from the original act. (In spite of the title of the act, it did not address counterfeit access devices, so dropping it from the title did not really change things.) While the name had been shortened, the coverage had been expanded beyond financial institutions and the federal government.(29)

The Counterfeit Access Device and Computer Fraud and Abuse Act of 1984 was enacted as part of the Comprehensive Crime Control Act of 1984, signed by President Reagan. Codified at 18 U.S.C. § 1030, it was part of the second half of the 1984 Act. The first half of the bill was enacted as the Credit Card Fraud Act of 1984, codified at 18 U.S.C. § 1029.(30)

Computer Fraud and Abuse Act (CFAA)

The Computer Fraud and Abuse Act of 1986, in its basic form, criminalized seven different categories of behavior: 1) Section (a)(1) Hacking to commit espionage; 2) Section (a)(2) Hacking to obtain information; 3) Section (a)(3) Hacking a federal government computer; 4) Section (a)(4) Hacking to commit fraud; 5) Section (a)(5) Hacking to commit damage; 6) Section (a)(6) Trafficking in passwords; and 7) Section (a)(7) Threats of hacking.(31)

CFAA Section (a)(1): Hacking to Commit Espionage refers to the Atomic Energy Act of 1954, to define espionage as related to classified or national security information. Primarily this means espionage against the United States government (which could extend to contractors providing services to the government), rather than spying related to private companies, such as industrial espionage, (unless the private company is a military contractor supplying fighter aircraft). Violations of Section (a)(1) are felonies, which can carry prison terms of up to ten years, along with fines, increased to 20 years if convicted of another CFAA violation. In spite of the seriousness of violations, the federal government rarely brings prosecutions for espionage under this subsection. Espionage-related hacking prosecutions typically are brought under Section 793(e) of the Espionage Act.(32)

CFAA Section (a)(2): Hacking to Obtain Information seems to deal with financial information, since it mentions financial records of financial institutions, card issuers, or consumer reporting agencies. It then includes information from any federal government, department, or agency. From there, it expands to information from any "protected computer." Protected computer starts with a focus on computers used by financial institutions or the federal government but, after 2008 amendments, it included computers that "affect" interstate commerce, which, interpreted broadly, meant "protected computers" included any computer connecting the the Internet. Amendments in 2001 applied the CFAA to attacks on computers both inside and outside the United States. While courts have struggled with the subsections requirement of "intentionally" hacking, they have generally not required the theft, copying, or removal of the information. "Obtaining information," also subject to intrepretation, usually requires the observation or some review of the information which is obtained.(33)

CFAA Section (a)(3): Hacking a Federal Government Computer prohibits individuals from intentionally accessing "nonpublic" federal government computers without authorization. Nonpublic federal government computers would normally not include government website pages displayed for information lookup by the general public. However computer areas containing payroll or personnel information would fall within this subsection. Section (a)(3) was intended to cover hacking by outside individuals and not acts by government employess with access to federal computers. There have been few prosecutions under Section (a)(3) mainly because first-time violations are classified as misdemeanors.(34)

CFAA Section (a)(4): Hacking to Commit Fraud prohibits individuals from "knowingly and with intent to defraud" accessing a protected computer without authorization (or exceeding authorized access), and by means of such conduct furthers the intended fraud and "obtains anything of value." Value is defined as $5,000 or more during any one-year period. Sections (a)(4) of the CFAA is similar to the wire fraud statute, 18 U.S.C. § 1343 and the Senate Report during the legislative process discussed whether the wire fraud statute might be sufficient to deal with fraudulent schemes, since it included transmissions by "wire, radio, or television" and the instrumentality used is the mails or the wires. In addition, Section (a)(4), in regard to unauthorized access, seemed to duplicate or include language from Section (a)(2). It was suggested that these similarities made Section (a)(4) something of a hybrid, by combining the intent or language of the different sections. The Senate justified giving computer fraud a special status by distinguishing between "intent to defraud" and "intent to access" a computer. Computer fraud required intent to defraud, while merely accessing a computer, if intentionally done, was not sufficient to automatically be considered "hacking to commit fraud."(35)

CFAA Section (a)(5): Hacking to Damage a Computer, as the name suggests, involves some sort of damage to a computer. Damage is defined as "any impairment to the integrity or availability of data, a program, a system, or information." If a hacker somehow manages to hack a computer without doing damage as it is defined by Section (a)(5), they may still run afoul of a separate prohibited action - causing "loss." Loss can involve any type of resaonable cost to the victim, including the cost of responding, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the hack.(36)

CFAA Section (a)(5)(A) specifically covers any type of virus, malware, or malicious code, with the language "knowingly causes the transmission of a program, information, code, or command." Hacking involving directly accessing a computer or system, (non-malare hacking) is covered by Section (a)(5)(B) and Section (a)(5)(C). Section (a)(5)(B) involves intentionally accessing a protected computer and causing damage, such as deleting files. Section (a)(5)(C) involves intentionally accessing a protected computer, causing damage and loss, which would include actions such as deleting files plus the costs of conducting a damage assessment and restoring the deleted data.(37)

CFAA Section (a)(5) generally, is one of the more contentious sections. It involves issues such as whether an attacker intentionally "accessed" a system or intentionally "damaged" a system. Determining intent becomes important when it comes to charging and sentencing. Misdemeanor cases carry a sentence of up to a year in prison, while felony sentences involve imprisonment for more than a year. More than a year prison sentence can range from five years to 20 years, even life in prison, if the hacking resulted in a death. Death as a result of hacking may be rare, although not totally inconceivable, as in the case where computer damage causes a fire. Generally, the more damage an attacker intended to do, such as destroying an organization's entire system, the greater likelihood they will be charged with a felony or receive a longer sentence.(38)

CFAA Section (a)(6): Trafficking in Passwords, on its face, seems relatively clear about what is prohibited. However, it uses the phrase "password or similar information" which was intended to cover other identification access methods, such as PIN numbers or push-button IDs. Because the penalties are relatively small, Section (a)(6) is among the less commonly prosecuted and litigated sections of the CFAA. It is bsed heavily on the federal credit card fraud statute, 18 U.S.C. § 1029. It should be noted that trafficking, as used in the section, does not require evidence that the password or information was sold for money.(39)

CFAA Section (a)(7): Threats of Hacking, is intended to deal with attempts to extort money (or other thing of value) from any person. It is based largely on the federal interstate threat statute, 18 U.S.C. § 875. It prohibits extorting money or other property using threats to cause damage to computers. There are actually three types of threats or demands covered: 1) threat to cause damage to a protected computer; 2) threat to obtain information from a protected computer or to impair the confidentialty of information obtained from a protected computer; or 3) a demand or request for money or other thing of value, in relation to damage to a protected computer, where such damage was "caused to facilitate the extortion."(40)

CFAA Section (a)(7) was added to the CFAA in 1996, after the U.S. Justice Department reported that hackers had increasingly made threats to penetrate computer systems. Ransomware, as such, had not been identified as a problem, although someone on the Senate committee at the time, suggested the possibility of hackers penetrating a system, encrypting a database, and then demanding money for the decoding key. Since there was an awareness that threats were coming from outside the United States, Section (a)(7) explicitly covers threats involving both interstate and foreign commerce.(41)

Attempts to deal with threats of hacking found in CFAA Section (a)(7) have a threatening, almost ominous, feel. At the same time, due to the anonymity provided by current technologies, prosecutions and civil lawsuits are difficult. Threats are made anonymously, making identification of the threat, its source and the individuals involved, difficult. Payment is often required to be in Bitcoin or other cryptocurrency, adding another layer of anonymity. When threats come from outside the U.S., it is often difficult to locate or gain custody of perpetrators, even if identified.(42)

There is some confusion about the Computer Fraud and Abuse Act name. In 2008 the Identity Theft Enforcement and Restitution Act of 2008 was passed. It includes amendments to sections of Title 18 of the United States Code, which is where the Identity Theft and Assumption Deterrence Act of 1998, in § 1028, is found. The identity theft references in §1028 are for actual identity theft, which can involve using someone else's name, social security number, or date of birth, along with false identification documents, such as a fraudulent copy of a driver's license. 18 U.S.C. § 1030 is the federal computer misuse statute, the Computer Fraud and Abuse Act. The question is whether the 2008 act changed the name of the Computer Fraud and Abuse Act or simply amended a few phrases or sections within it. Most courts and current mentions, refer to it as the Computer Fraud and Abuse Act (CFAA), so the name has stuck - possibly because is shorter and easier to remember, than the Identity Theft Enforcement and Restitution Act of 2008.(ITEA) Due to the similarity of titles, it is difficult to distinguish, or remember, the Identity Theft and Assumption Deterence Act is the 1998 act, while the Identity Theft Enforcement and Restitution Act is the 2008 act (or amendment).(43)

National Security - Foreign Intelligence Surveillance Act

The Foreign Intelligence Surveillance Act (FISA) of 1978 had its origins in something of a turf war between different agencies within the intelligence community. It was more that the law to that time was a little unclear as to what the boundaries were. The Federal Bureau of Investigation (FBI) had responsibility for intelligence and counterintelligence, even collecting intelligence on foreign governments and their activities. The Central Intelligence Agency (CIA) had a similar function, although it was operating outside the United States. The issue which came up involved the collection of information about foreign powers and their agents within the borders of the United States. Generally, in criminal proceedings related to United States persons (citizens or permanent resident aliens), it is necessary to go to a court to obtain a court order to conduct surveillance. It is limited to criminal activity, after establishing probable cause.(44)

In 1976, a congressional committee led by Senator Frank Church (called the "Church Committee"), after an investigation of governmental national security surveillance, found that the FBI's CONTELPRO - counterintelligence program - was conducting warrantless surveillance of U.S. citizens, not because they were acting on behalf of foreign powers, but based on political beliefs. The purpose was to harass and intimidate. It went beyond wire tapping, and included surreptitious mail opening and break-ins. In addition, it was not just the FBI involved. The CIA had indexed the names of some 300,000 individuals in its computer system. The National Security Agency (NSA) had obtained millions of private telegrams. The Internal Revenue Service (IRS) had created intelligence files on more than 11,000 individuals and groups. The report would be influential in the creation of FISA.(45)

The Foreign Intelligence Surveillance Act (FISA) establishes standards and procedures for use of electronic surveillance to collect "foreign intelligence" within the United States, codified at 50 U.S.C. §§ 1801-1811. In overall purpose FISA was initially designed primarily to regulate how intelligence gathering agencies gain intelligence about foreign powers and agents of foreign powers within the borders of the United States. FISA generally applies when foreign intelligence gathering is a "significant purpose" of the investigation. "Significant purpose" is language which was created by the USA Patriot Act of 2001. Until that time courts had interpreted FISA to require only a "primary purpose." Domestic security surveillance was not included, and fell under the existing Title III criminal law enforcement framework.(46)

In order to ensure some sort of outside body to monitor compliance, FISA created the Foreign Intelligence Surveillance Court (FISC). Requests for FISA orders to conduct sureveillance must first be submitted to a FISC court for review. The court consists of a panel of federal district court judges, appointed by the Chief Justice of the United States. Its review meetings are held in secret. When FISA was first enacted in 1978, the number of judges was 7. The USA Patriot Act increased the number to 11. The Department of Justice (DOJ) makes the application on behalf of the agencies seeking a court order. The application must be approved by the Attorney General.(47)

In 2008 Congress enacted significant amendments to FISA, known as the FISA Amendments Act (FAA), adding Section 702. It was partly in response to a December 1995 New York Times article revealing that the National Security Agency (NSA) had been conducting a program of warrantless wiretapping of international phone calls since 9/11. The 2008 amendments did not prevent the NSA from conducting surveillance, although it did place some restrictions on the process. It also granted retroactive immunity to the telecommunications companies which had participated in the surveillance at least for the period starting on September 11, 2001 and ending on January 17, 2007. It did establish certain "targeting procedures" which were to be the standard for surveillance activities. The "significant purpose" requirement was kept.(48)

Electronic Communications Privacy Act (ECPA) of 1986

The Foreign Intelligence Surveillance Act (FISA) deals with electronic surveillance relating to intelligence activities outside the United States. It has its counterpart on the domestic side in the Electronic Communications Privacy Act (ECPA). In some ways surveillance and intelligence gathering on the domestic side suffered from the same or similar abuses. In practical terms there was no distinction since the conduct of both domestic and foreign surveillence gathering was the responsibility of the FBI, at least through World War II. The CIA, as an organization, was established in 1947 by the National Security Act. The NSA was only created in 1952.(49)

Wiretapping, in some form, has a comparatively long history, in modern terms, quickly following advancements in communications technology. The telegraph was invented in 1844 and wiretapping technology, the use of devices capable of intercepting telegraph (and later telephone) communications, was in use during the American Civil War (1861-1865). The telephone was invented in 1876 and the first police wiretap occurred in the early 1890s. Its widespread use began with the labor movement and law enforcement attempts to monitor protests over bad industrial working conditions, continued to cover social unrest durinbg World War I, and then was used to deal with the smuggling of alcohol during Prohibition. Prohibition would produce the first Supreme Court case dealing the issue under the Fourth Amendment, which prohibits unreasonable search and seizure by law enforcement. Four federal prohibition officers in western Washington state intercepted telephone messages by inserting samll wires along the ordinary telephone wires from the residences of the defendants and an office buildings. The information obtained was used to convict the defendants. The Supreme Court in Olmstead v. United States, 277 U.S. 438 (1928) decided that the wire tapping was not a violation of the Fourth Amendment, and therefore legal.(50)

There was a reaction to the Olmstead decision, mostly negative. The Justice Department however, considered wiretapping an important law enforcement tool and continued to use it through the 1930s. To curb such practices Congress included wiretapping limitations (Section 605) in the Communications Act of 1934. The Communications Act, in broader terms, was not just a wiretapping statute, since it created the Federal Communications Commission (FCC), more to deal with the regulation of commercial broadcasting than surveillance. The first commercial radio station (KDKA in Pittsburgh) began operating in November, 1920.(51)

Section 605 of the Communications Act, on its face, seemed to completely outlaw wiretapping altogether. There was no exception, even for an agency like the FBI. And yet, from the history of the period, the FBI managed to keep track of foreign agents and deal with security during the Manhattan Project and the development of the atomic bomb. The language of Section 605 reads "...no person not being authorized by the sender shall intercept any communication and divulge or publish the existence, contents, substance, purport, effect, or meaning of such intercepted communication to any person,,," and that is just the first half. The second half expands on the term "communication" to include wire and radio. "... and no person not being entitled thereto shall receive or assist in receiving any interstate or foreign communication by wire or radio and use the same or any information therein contained for his own benefit or for the benefit of another not entitled thereto..."(52)

In spite of the problems with the language of Section 605, there were a few loopholes. One of the first problems was that Section 605 did not allow for the use of any wiretapped data in federal courts, by federal agents, even if it had been obtained with a warrant. The Justice Department got around this by not using the evidence in Court, since Section 605 required two elements; 1) interception and 2) divulging or publishing. The courts seemed to agree with this reasoning. So long as the FBI didn't introduce the wiretapped evidence in court, it could wiretap without restriction. Section 605, in addition, only regulated the admissibility of wiretapping evidence in,federal court. It did not prevent state investigators from introducing wiretapping evidence in state court. Finally, Section 605 only applied to wire communications and wiretapping, not to eavsdropping on nonwire communications. Bugging, the use of secret recoring devices in a room or physical space, was not prohibited by Section 605.(53)

In spite of the obstacles provided by Section 605, wiretapping and surveillance continued before and during the Second World War, partly because J. Edgar Hoover, the director of the FBI, persuaded President Franklin Roosevelt to allow FBI wiretapping to deal with national security threats. Hoover argued that national security threats were not limited to spying by foreign countries, but also included the dangers of subversive actities by groups within the U.S.(54)

It is not surprising that Hoover would target communists and labor organizers. He had been appointed head of the Radical Division under Mitchell Palmer and, in that position, had been heavily involved in the planning and implementatation of the Palmer raids of the early 1920s. The raids had focused on the detention and deportation of foreign-born immigrants, communists, and labor leaders. Palmer's fortunes, which seemed on the rise in 1919, quickly fell out of favor. He looked like he might win the 1920 presidental nomination of the Democratic Party, but, after 39 ballots, he dropped out. Warren G. Harding, the Republican nominee, would go on to win the presidency. Hoover, despite his Radical Division activities, did not go down with Palmer. He had kept a low profile and survived politically to become head of the FBI. Perhaps he was more adept at adjusting policies to fit the political environment. Prohibition may have saved him. Al Capone, John Dillinger, and the threat of organized crime, allowed the FBI to focus on something other than communism. Hoover had also instituted reform measures within the FBI intended to improve its professional competence as a crime-fighting organization. His reputation and enhanced status gave him a lot of power. It came to light that he had abused his power.

It was discovered that Hoover had ordered wiretapping, and maintained dossiers on prominent citizens, such as Ernest Hemingway, Marlon Brandon, and Albert Einstein, as well as Supreme Court Justices and members of Congress. Martin Luther King Jr., the Civil Rights leader, was subjected to a campaign of harassment, which included wiretapping, threats, and disinformation. Such abuses contributed to a congressional decision to re-visit the 1934 wiretapping legislation - Section 605 of the Federal Communications Act. Curbing abuses was only part of the motivation. There was also a feeling that the 1934 act needed to be upgraded to reflect advances in new computer network technology. Congress made the upgrade in two steps. In 1968, it enacted Title III of the Omnibus Crime Control and Safe Streets Act of 1968, which made changes to the wiretapping provisions of the 1934 act. After the passage of the Electronic Communications Privacy Act (ECPA) of 1986, Title III was referred to as the "Wiretap Act." The second step was the passage of the ECPA in 1986, which amended the 1986 act.(55)

The Title III changes in the 1968 act did make significant changes to the wiretapping restrictions of the 1934 act, however, those changes were more on the legal side, than the technical side of the 1934 act. First, it covered wiretaps by federal and state officials, as well as private parties; Second, Title III required federal agents to apply for a warrant before wiretapping; Third, the Act criminalized private wiretaps, although, if any party to the conversation consented to the tapping, there was no violation of Title III; and Fourth, Title III authorized the Attorney General to apply to a federal judge for an order authorizing the interception of a "wire or oral communication." A judge could not issue a court order unless there was probable cause. Title III did not cover wiretaps for national security purposes, which were allowed without restrictions. President Nixon frequently used the national security exception to place internal dissidenta and radicals under surveillance. It 1972 the Supreme Court ruled that this was not allowed. Title III's national security exception did not apply to internal threats but only to foreign threats.(56)

Title III of the 1968 act had corrected many of the legal problems inherited from 1934. In 1986, Congress decided it was time to modernize the statute, to incorporate changes in the technology and apply those changes to the legal deficiencies of the 1968 act. The Electronic Communications Privacy Act of 1986 (ECPA) was the solution. In order to deal with technological changes, ECPA added three new sections. It began by classifying all communications into three types: (1) "wire communications"; (2) "oral communications"; and (3) "electronic communications." A "wire communication" (defined in § 2510(1)) means any aural transfer made in whole or in part through the use of facilities for the transmission of communications. An "aural transfer" is a communication containing the human voice at any point. (§ 2510(18))(57)

"Oral communications" are essentially spoken communications which are typically intercepted through bugs and other recording or transmitting devices. They differ from wire communications since they involve situations not over transmission lines. "Electronic communications" are essentially e-mail - non-wire and non-oral communications. (§ 2510(18)) The ECPA included all three types of communications into a general category of "intercepted communications," which were covered by what the legislation called the Wiretap Act, which was an updated version of the 1968 Title III. Under the 1986 act, the ECPA shifted the title to its first Title. The updated Wiretap Act, of ECPA, codified at Title I of ECPA, (18 U.S.C. §§ 2510-2522), more or less covered the technological side of voice communications, not only traditional telephone wiretaps, but also non-phone bugging, as well as newly developing electronic communications. On the other hand, the telegraph had been an electronic form of communication, which did not involve the voice. E-mail, was more advanced in technological terms, yet, in substance, not that much different.(58)

The ECPA did add two other parts, which involved both technological advancements and areas which had not been covered by either the 1934 act or the 1968 act: (2) the Stored Communications Act (SCA); and (3) the Pen Register Act. Activities which fall into the general category of conventional wiretappping were covered by the Wiretap Act. They involve the interception of active communications, such as talking on the telephone, or e-mailing someone. This represented only a portion of all communications, and left out communications which were in storage, either before or after transmission. Records in storage could include everything from subscription service records and payment information to records of e-mail transmissions, either while being drafted or after they had been sent. The Stored Communications Act (SCA) (codified at 18 U.S.C. §§ 2701-2711) covered such records. While it made such records accessible, access was not universal. Depending on the point of view, coverage under the Stored Communications Act either prevented disclosure of such communications or made them more accessible. Organizations providing a service, such as Internet Service Providers, were not covered, while law enforcement agencies or the government could gain access in certain circumstances.(59)

The Pen Register Act deals with an area of techology which allows for the tracking of telephone calls, both incoming and outgoing. Even without knowing what is said during a telephone conversation, the ability to know what phone numbers were called from a number or what number incoming calls came from, can be invaluable to law enforcement - or anyone else who wants to know. The Pen Register Act (codified at 18 U.S.C. §§ 3121-3127) governs this type of techology. The technology goes by two different names. Traditionally, a pen register was a device that records the telephone numbers dialed from a particular phone line (phone numbers of outgoing calls). A trap and trace device, in contrast, can record the telephone numbers where incoming calls originate - the revers of a pen register. The Pen Register Act governs both pen registers and trap and trace devices. The Pen Register Act broadly prohibits the installation and use of such devices. However, it does allow for such use by law enforcement and government in certain cases.(60)

Communications Assistance for Law Enforcement Act (CALEA) of 1994

The Communications Assistance for Law Enforcement Act (CALEA) of 1994, also known as the "Digital Telephony Act," requires telecommunication providers to help facilitate the government in executing legally authorized surveillance. Congress appropriated federal funding of $500 million to telephone companies to make the proposed changes. CALEA requires all telecommunications providers to be able to isolate and intercept electronic communications and be able to deliver them to law enforcement personnal.(61)

• 1) Abraham Wagner and Nicholas Rostow, Cybersecurity and Cyberlaw, 141-209, (Durham, NC: Carolina Academic Press, 2020); see also Daniel J. Solove and Paul M. Schwartz, Information Privacy Law, 38-39, 121, 242-246, 1160-1162, Seventh Edition, (New York: Walters Kluwer, 2021).
• 2) David Kim and Michael G. Solomon, Fundamentals of Information Security, xv, 460-491, Second Edition, (Burlington, MA: Jones & Bartlett Learning, LLC, 2014); see also Solove, Information Privacy Law, 38-39, ; see also Joanna Lyn Grama, Legal Issues in Information Security, 86-88, 218-230, 404, Second Edition (Burlington, MA: Jones & Bartlett Learning, LLC, 2015); see also Geoffrey Parsons Miller, The Law of Governance, Risk Management, and Compliance, 3, 157-194, Third Edition, (New York: Walters Kluwer, 2020).

Federal Information Security Management (Modernization) Act (FISMA)

• 3) Kim, Fundamentals of Information Security, 464-469; see also Grama, Legal Issues in Information Security, 220-230; see also Federal Information Modernization Act of 2014, P.L. 113-283 - Dec. 18, 2014, 128 Stat 3073; see also CMS website: Federal Information Security Modernization Act (FISMA)| CMS Information Security and Privacy Program https://security.cms.gov/learn/federal-information-security-modernization-act-fisma, June 20, 2023, accessed February 23, 2026.
• 4) Kim, Fundamentals of Information Security, 464-469; see also Grama, Legal Issues in Information Security, 220-230; see also Federal Information Modernization Act of 2014, P.L. 113-283 - Dec. 18, 2014, 128 Stat 3073; see also CMS website: Federal Information Security Modernization Act (FISMA)| CMS Information Security and Privacy Program https://security.cms.gov/learn/federal-information-security-modernization-act-fisma, June 20, 2023, accessed February 23, 2026; see also Congress.gov website: S.2521 Federal Information Security Modernization Act of 2014 Summary https://www.congress.gov/bill/113th-congress/senate-bill/2521, December 18, 2014, accessed February 23, 2026.

Health Insurance Portability and Accountability Act of 1996

• 5) Solove, Information Privacy Law, 38-39, 531-532; see also Grama, Legal Issues in Information Security, 152-157.
• 6) Harvey W. Rubin, Dictionary of Insurance Terms, 361-362, 487, Sixth Edition, (Hauppage, New York: Barron's Educational Series, Inc., 2013); Patricia D. King, ed., HIPAA/HITECH Resource Guide, 1, First Edition (Washington, DC: American Health Lawyers Association, 2014); see also Stephen S. Wu, A Guide to HIPAA Security and the Law, 2-4, 7-9, 17-18, 21-23, Second Edition (Chicago, IL: American Bar Association, 2016) Solove, Information Privacy Law, 38-39, 531-532; see also Grama, Legal Issues in Information Security, 152-157.
• 7) Wu, A Guide to HIPAA Security and the Law, 7-8.
• 8) Solove, Information Privacy Law, 531-532.

Health Information Technology for Economic and Clinical Health Act of 2009

• 9) King, HIPAA/HITECH Resource Guide, 77-80.
• 10) King, HIPAA/HITECH Resource Guide, 21-27, 36-43, 83; see also Wu, A Guide to HIPAA Security and the Law, 62-114, 131-147.

Gramm-Leach-Bliley Act

• 11) Thomas P. Fitch, Dictionary of Banking Terms, 146-147, 216-217, Sixth Edition, (Hauppage, New York: Barron's Educational Series, Inc., 2012, 2006); see also John Downes and Jordan Elliot Goodman, Dictionary of Finance and Investment Terms, 252-253, 296, Seventh Edition, (Hauppage, New York: Barron's Educational Series, Inc., 2006); see also Karol K. Sparks and Harding de C. Williams The Keys to Banking Law A Handbook for Lawyers, 36-42, 254, 260-261, (Chicago, Il: American Bar Association, 2012); see also Kim, Fundamentals of Information Security, 476-480; see also Grama, Legal Issues in Information Security, 103-112; see also Solove, Information Privacy Law, 39, 758, 792-796.
• (12) Fitch, Dictionary of Banking Terms, 146-147, 216-217; see also Downes , Dictionary of Finance and Investment Terms, 252-253, 296; see also Sparks The Keys to Banking Law A Handbook for Lawyers, 36-42, 254, 260-261; see also Kim, Fundamentals of Information Security, 476-480; see also Grama, Legal Issues in Information Security, 103-112; see also Solove, Information Privacy Law, 39, 758, 792-796.
• (13) Fitch, Dictionary of Banking Terms, 146-147, 216-217; see also Downes , Dictionary of Finance and Investment Terms, 252-253, 296; see also Sparks The Keys to Banking Law A Handbook for Lawyers, 36-42, 254, 260-261; see also Kim, Fundamentals of Information Security, 476-480; see also Grama, Legal Issues in Information Security, 103-112; see also Solove, Information Privacy Law, 39, 758, 792-796; see also Jeff Kosseff, Cybersecurity Law, 124-138, Second Edition, (Hoboken, New Jersey: John Wiley & Sons, Inc., 2020).

Sarbanes Oxley

• (14) Kim, Fundamentals of Information Security, 481-484; see also Grama, Legal Issues in Information Security, 191-195.
• (15) Kim, Fundamentals of Information Security, 481-484; see also Grama, Legal Issues in Information Security, 195-205.
• (16) Kim, Fundamentals of Information Security, 481-484; see also Grama, Legal Issues in Information Security, 195-205.
• (17) Kim, Fundamentals of Information Security, 481-484; see also Grama, Legal Issues in Information Security, 195-205. see also Alvin A. Arens, Randal J. Elder, and Mark S. Beasley, Auditing and Assurance Services An Integrated Approach, 289-283, 14th Edition, (Upper Saddle River, New Jersey: Pearson Education, Inc., 2012)
• (18) Kim, Fundamentals of Information Security, 481-484; see also Grama, Legal Issues in Information Security, 201.
• (19) Kim, Fundamentals of Information Security, 481-484; see also Grama, Legal Issues in Information Security, 207; see also Arens, Auditing and Assurance Services An Integrated Approach, 30,209.

Family Educational Rights and Privacy Act

• (20) Kim, Fundamentals of Information Security, 484-487; see also Grama, Legal Issues in Information Security, 135-145.
• (21) Kim, Fundamentals of Information Security, 484-487; see also Grama, Legal Issues in Information Security, 135-145.

Children's Online Privacy Protection Act

• (22) Solove, Information Privacy Law, 39, 926-928; see also Kim, Fundamentals of Information Security, 146; see also Grama, Legal Issues in Information Security, 125-130.
• (23) Solove, Information Privacy Law, 39, 926-928; see also Kim, Fundamentals of Information Security, 146; see also Grama, Legal Issues in Information Security, 125-130.
• (24) Grama, Legal Issues in Information Security, 126.
• (25) Solove, Information Privacy Law, 926-928; see also Grama, Legal Issues in Information Security, 125-128.
• (26) Brian Craig, Cyberlaw: The Law of the Internet and Information Technology, 195, First Edition (Upper Saddle River, New Jersey: Pearson Education, Inc., 2013); see also Solove, Information Privacy Law, 926-928; see also Grama, Legal Issues in Information Security, 125-128.
• (27) Solove, Information Privacy Law, 926-928; see also Grama, Legal Issues in Information Security, 125-128.

Children's Internet Protection Act

• (28) Grama, Legal Issues in Information Security, 131-135.

Counterfeit Access Device and Computer Fraud and Abuse Act

• (29) Joseph B. Tompkins, Jr. & Linda A. Mar, The 1984 Federal Computer Crime Statute: A Partial Answer to a Pervasive Problem, 6 Computer L.J. 459 (1986); see also Kosseff, Cybersecurity Law, 172-173; 505-512; see also Grama, Legal Issues in Information Security, 360-364; see also Wagner, Cybersecurity and Cyberlaw, 459-467.
• (30) Tompkins, The 1984 Federal Computer Crime Statute, 6 Computer L.J. 459; see also Kosseff, Cybersecurity Law, 172-173; 505-512.

Computer Fraud and Abuse Act

• (31) Kosseff, Cybersecurity Law, 173, 184-208, 505-512; see also Wagner, Cybersecurity and Cyberlaw, 459-465; see also Orin S. Kerr, Computer Crime Law, 30-32. 39-140, Fourth Edition (St. Paul, MN: West Academic Publishing, 2018)
• (32) Kosseff, Cybersecurity Law, 185-186; see also Wagner, Cybersecurity and Cyberlaw, 463-464; see also Kerr, Computer Crime Law, 30-32.
• (33) Kosseff, Cybersecurity Law, 184-185, 187-191; see also Wagner, Cybersecurity and Cyberlaw, 460, 463-464; see also Kerr, Computer Crime Law, 31, 83-97.
• (34) Kosseff, Cybersecurity Law, 185, 191-192; see also Wagner, Cybersecurity and Cyberlaw, 463-464; see also Kerr, Computer Crime Law, 31, 96-97.
• (35) Kosseff, Cybersecurity Law, 185, 192-195; see also Wagner, Cybersecurity and Cyberlaw, 463-464; see also Kerr, Computer Crime Law, 31, 97-107.
• (36) Kosseff, Cybersecurity Law, 185, 195-203, 505-512; see also Wagner, Cybersecurity and Cyberlaw, 463-464; see also Kerr, Computer Crime Law, 31, 107-141.
• (37) Kosseff, Cybersecurity Law, 185, 195-203, 505-512; see also Wagner, Cybersecurity and Cyberlaw, 463-464; see also Kerr, Computer Crime Law, 31, 107-141.
• (38) Kosseff, Cybersecurity Law, 185, 195-203, 505-512; see also Wagner, Cybersecurity and Cyberlaw, 463-464; see also Kerr, Computer Crime Law, 31, 107-141.
• (39) Kosseff, Cybersecurity Law, 186, 203-205, 505-512; see also Wagner, Cybersecurity and Cyberlaw, 463-464; see also Kerr, Computer Crime Law, 31.
• (40) Kosseff, Cybersecurity Law, 186, 205-208, 505-512; see also Wagner, Cybersecurity and Cyberlaw, 463-464; see also Kerr, Computer Crime Law, 31.
• (41) Kosseff, Cybersecurity Law, 186, 205-208, 505-512; see also Wagner, Cybersecurity and Cyberlaw, 463-464; see also Kerr, Computer Crime Law, 31.
• (42) Kosseff, Cybersecurity Law, 186, 205-208, 505-512; see also Wagner, Cybersecurity and Cyberlaw, 463-464; see also Kerr, Computer Crime Law, 31.
• (43) Solove, Information Privacy Law, 38, 802; see also Wagner, Cybersecurity and Cyberlaw, 221; see also Kerr, Computer Crime Law, 31.

Foreign Intelligence Surveillance Act

• (44) Solove, Information Privacy Law, 38, 438, 447-454; see also Wagner, Cybersecurity and Cyberlaw, 220-221, 1002; see also Kerr, Computer Crime Law, 858-877; see also Stephen Dycus, Arthur L. Berney, William C. Banks, Peter Raven-Hansen and Stephen I. Vladeck, National Security Law, 634-660, Sixth Edition (New York, NY: Wolters Kluwer, 2016)
• (45) Solove, Information Privacy Law, 446; see also Kerr, Computer Crime Law, 858; see also Dycus, National Security Law, 634-635; see also Wagner, Cybersecurity and Cyberlaw, 1058.
• (46) Solove, Information Privacy Law, 448; see also Kerr, Computer Crime Law, 858-862; see also Dycus, National Security Law, 635,
• (47) Solove, Information Privacy Law, 448; see also Kerr, Computer Crime Law, 858-859; see also Dycus, National Security Law, 637-638; see also Wagner, Cybersecurity and Cyberlaw, 1045-1047.
• (48) Solove, Information Privacy Law, 449-450, 473-475; see also Kerr, Computer Crime Law, 867; see also Dycus, National Security Law, 668-669, 677-686; see also Wagner, Cybersecurity and Cyberlaw, 301, 1049.

Electronic Communications Privacy Act

• (49) Solove, Information Privacy Law, 449-450, 473-475; see also Kerr, Computer Crime Law, 867; see also Dycus, National Security Law, 668-669, 677-686; see also Wagner, Cybersecurity and Cyberlaw, 221, 302-303.
• (50) Solove, Information Privacy Law, 277-281; see also Kerr,Computer Crime Law 621-622; see also Dycus, National Security Law, 592-596; see also Wagner, Cybersecurity and Cyberlaw, 312-313.
• (51) Solove, Information Privacy Law, 277-282, 374-376; see also Kerr,Computer Crime Law 621-622; see also Dycus, National Security Law, 595-597; see also Wagner, Cybersecurity and Cyberlaw, 298, 312-313.
• (52) Solove, Information Privacy Law, 374-376; see also Kerr,Computer Crime Law 621-622; see also Dycus, National Security Law, 595-596; see also Wagner, Cybersecurity and Cyberlaw, 313.
• (53) Solove, Information Privacy Law, 374-376; see also Kerr,Computer Crime Law 621-622; see also Dycus, National Security Law, 595-597; see also Wagner, Cybersecurity and Cyberlaw, 312-313.
• (54) Solove, Information Privacy Law, 374-376; see also Kerr,Computer Crime Law 621-622; see also Dycus, National Security Law, 595-597; see also Wagner, Cybersecurity and Cyberlaw, 312-313.
• (55) Solove, Information Privacy Law, 374-376; see also Kerr,Computer Crime Law 621-625; see also Dycus, National Security Law, 595-597; see also Wagner, Cybersecurity and Cyberlaw, 312-313.
• (56) Solove, Information Privacy Law, 375-376; see also Kerr,Computer Crime Law 622-623; see also Dycus, National Security Law, 595-597.
• (57) Solove, Information Privacy Law, 375-382; see also Kerr,Computer Crime Law 622-623.
• (58) Solove, Information Privacy Law, 375-382; see also Kerr,Computer Crime Law 622-623.
• (59) Solove, Information Privacy Law, 380-382; see also Kerr,Computer Crime Law 622-625, 675-682.
• (60) Solove, Information Privacy Law, 382; see also Kerr,Computer Crime Law 622-623, 661-675.

Communications Assistance for Law Enforcement Act (CALEA) of 1994

• (61) Solove, Information Privacy Law, 383-384.