Sovereign California Dispels Myth that California is Ungovernable
Approaching Cybersecurity Law · 2018-11-20 · This presentation provides insight in how to...
Transcript of Approaching Cybersecurity Law · 2018-11-20 · This presentation provides insight in how to...
ApproachingCybersecurityLawAGuideforInformationSecurityProfessionals
DavidJacksonNovember20,2018
ISSANationalCapitalChapterMeeting
Biography
Mr.JacksonisamemberoftheISSADCandNOVAchapters,andheholdsCISSP,CEH,andCIPPcertifications. HeworksasaregulatoryattorneyforagovernmentcontractorintheWashingtonDCarea,andheisaregularcontributortotheISSAJournal. Mr.JacksonhasaJ.D.fromtheUniversityofKansas,andanLL.M.fromtheUniversityofArkansas.
Abstract
ApproachingCybersecurityLaw- AGuideforInformationSecurityProfessionals
Cybersecuritylawisaconfusingsubject. Therearemanydifferenttypesoflaws,whichaffectdifferentorganizationsindifferentways. Thispresentationprovidesinsightinhowtoconsidercybersecuritylawasadiscipline,anddispelsthenotionthatlawasatoolisallpowerful. Infact,lawcanbequitelimited,slow,andbackwardlooking.Finally,thepresentationendswithadiscussionofthefutureofcybersecuritylaw,andhowtoidentifythecomingtrends.
TonightWeWillCover:
• HowtoViewCybersecurityLaw
• LawisNotAllPowerful– It’sImperfect
• FutureofCybersecurityLaw
Topic1HowtoViewtheCybersecurityLawLandscape
MostCybersecurityLawisLearnedfortheCISSPExam• CISSPDomain1– Law• Cybercrime• IntellectualProperty• Privacy• DifferentLegalSystems
ChallengesinUnderstandingtheLawinCISSPDomain1• It’sconfusing.Ahodgepodgeoftopics.• It’soverwhelming.Alotofforeigninformation.• Itneedssomeorganization.Aroadmap.
BettertoViewCybersecurityLawbyWhoisImpacted
Individuals
International
GovernmentBusinesses
IndividualsBusinessesGovernment
U.S.
LawsthatImpactIndividuals
• 2CategoriesofIndividuals• GeneralPublic• Criminals
• CybersecuritylawsaredesignedtoseparatetheCriminalsfromtheGeneralPublic• Butalso,perhaps,toencourageE-Commerce
Individuals
LawsSeparatingIndividualsandCriminals
• HackingGovernmentsorBanks• OrganizedCrime• SellingTradeSecrets• IdentityTheft• SellingPasswordstoAccounts
LawsEncourageE-Commerce?
• WhyE-Commerce• ReducesCosts• ImprovesAccuracy• Faster
• WhyEncourage• FrameworkforGlobalElectronicCommerce(90s)• Don’twanttokillthe“GoosethatLaystheGoldenEgg”
• NotExplicitlyStated• MoreofanInference– I’msuggestingthatthelawencouragese-commerce.
LawsthatImpactBusinesses
Notallbusinessesareaffectedbyallcybersecuritylaws– OnlyCertainBusinesses…
• Telecom• HealthCare• GovernmentContractors• Banks
Businesses
LawsthatImpactBusinessescon’d
… AndonlyCertainTypesofData
• HealthInformation• FinancialInformation• VideoRecords(BlockbustertoNetflix)• SchoolRecords• GovernmentData
BusinessandGovernmenthaveaBifurcatedRelationship• Partnership• ShareData• WorkTogetheronInvestigatingThreats
• Regulation• EnforceRegulations• PenalizeViolations
• Thelinescangetblurred!
LawsthatImpactGovernment
• SpecificGovernmentAgencies• LawEnforcement• Military• ExecutiveAgencies
• HowlawsimpacttheGovernment• LimitpowerwithintheUS• DefendUSInterestsinternationally
Government
WhichPartsofGovernmenthavetheirPowerLimited• LawEnforcement• Surveillance
• Military• DomesticOccupation
• GovernmentAgencies• PrivacyAct• AdministrativeProceduresAct
HowdoesInternationalfitintothismodelofCybersecurityLaw?• Inaglobaleconomy,andinanelectronicworld,thebordersarelessrestrictive.
• Samegroupofparticipants• Individuals• Businesses• Government
• PrimarilyUSGovernmentfacilitatedrelationship
• Canbedifficulttoenforceacrossborders
WhatTypesofLegalIssuesImpactInternational?• Individuals• Extradition
• Businesses• ExportControlledTrade• TradeSecretTheft
• Governments• Cyberwar• Cyberterrorism• Cyberespionage
PuttingitalltogetherintoaCybersecurityLawLandscape
Individuals
International
GovernmentBusinesses
IndividualsBusinessesGovernment
Extradition ExportControlCyberwar
U.S. SurveillanceProtectData
PartnershipRegulation
Topic2Thelawisn’tAllPowerful– It’sImperfect
Lawisn’tAllPowerful– Let’sDispelsomeMyths
Myths• Lawcanapplyeverywhere
• Lawappliestoanynewsituation
• Lawkeepsupwiththechangesofthetimes
Actuality• Lawislimited
• Lawisbackwardlooking(atfirst)
• Lawisslowtochange
TheLawisLimited – HowisitLimited?
• Thelawislimitedtocertainpeopleandcertainsituations
• Forourpurposes,thejournalismquestionsmaybemoreusefultounderstandthoselimitations:
• Who – theparty/partiesinvolved• What – theactionsinquestion• Where – thejurisdiction• When – thecircumstancesaroundtheactions• How – theenforcementmechanism• Why– thepolicyreasons
Let’susetheComputerFraudandAbuseActasanExample• ComputerFraudandAbuseAct(CFAA)wasthefirstbigcybersecuritylaw.(18U.S.C.§ 1030)• Criminalizesunauthorizedaccesstogovernmentandfinancialinstitutioncomputers.• TheDOJhasapracticemanualonCFAAtoprovidemoreguidanceonpriorcaselaw.• Theactuallawissomewhatconvoluted,soI’mabridgingthelawslightlyforourdiscussion.
Here’stheCFAAinSimplifiedForm
• Whoever,intentionallyaccessesacomputerwithoutauthorization,orexceedsauthorizedaccess,• andtherebyobtainsinformationcontainedinafinancialrecordofafinancialinstitution…• orinformationfromadepartmentoragencyoftheUnitedStates,…
• shallbepunished …byafineorimprisonment…• TheU.S.SecretService,theFBI,theSecretaryofTreasuryandtheAttorneyGeneralshallhavetheauthoritytoinvestigate.
HowtheCFAAcanbeanalyzedwiththejournalismquestions• Who – Whoever
• NaturalPerson(versusalegalperson– Corporation)• What –IntentionallyAccessesaComputer
• Withoutauthorization• Exceedsauthorization
• Where – Federal(implied– 18USC)• When – obtaininformationfrom:
• federalgovernment• financialinstitution
• How – FinesPrison/SecretService,Treasury,FBI/AG• Why – notrelevant– policyargumentsareweaker
• 1980s- movieWarGames
WhereistheCFAALimited?
• TheCFAAappliesonlytocertainsituations• FederalGovernment/FinancialInstitutioncomputers• WithoutAuthorization/ExceedsAuthorization• FederalLawEnforcementInvestigates
WheretheCFAADoesNotApply
• Notyourneighbor’scomputer.• (notafederalorbankcomputer)
• Notfilingyourstatetaxreturn.• (authorized)
• NotmistypingaURLintoyourwebbrowser.• (notintentional)
LawisLimited- InConclusion
• Onlycertain:• People• Locations• Activities• Circumstances
• Policy– the“Why”Doesn’tReallyMatter.• KeyisUnderstandingtheLimits.
LawLooksBackward(beforeitlooksforward)• Ourlegalsystemisbasedonprecedent – whatdecisionscamebefore– “StareDecisis”(letdecisionstand)• Thisforceseverylegalanalysistostartwithwhatlawcamebefore.• Howdoesthisnewsituationfitwithapriorlegalissue?
Let’sReturntothe1990sforanExample– AOLand“Spam”• AOLwasamajortargetfor“spam”(nowknownasunsolicitedcommercialemail).• In1990s,AOLsuedspammersaspartofitsanti-spamstrategy.• Itwasdifficultbecausethelawsdidn’teasilyaddressthisnewphenomenon.• ExpensivetoProsecute.• BTW,IworkedatAOLfightingspaminthe1990s.
AOLWonLawsuitsinPartUsing“TrespasstoChattels”• Definitions
• Tort– civilwrong– intentional- OldCommonLaw(fromEngland)• Chattelsarethings.• Trespassinthiscase=Interference (“damagessufferedbyreasonofthelossofitsuse.”)
• Seee.g.,AmericaOnline,Inc.v.IMSet.al.,24F.Supp.2d548(E.D.Va.,1998)
• So,thelawthatwasviolatedwas• Someonehadinterferedwiththeuseandenjoymentofsomeoneelse’sthingsthatcauseddamagethatcouldbecalculated.(thisishighlysimplifiedlanguage)
• ForAOL–• SpammershadinterferedwithAOL’suseandenjoymentofitsmailserverstoserveemailtoitsuserbase,andcostAOLtimeandmoneytoprocesstheextraemails,and”burdenedtheirequipment”(mailservers)
ChallengestothisLegalTheory
• Spamemailisjustemail.Youprovidetheserviceofemailtoyourusers,itgoeswiththeterritory.• 1st amendmentviolation?Nostateaction.• Increasedcostofmailserverscouldbeattributedtotheincreaseinmembership- moreusers,moremailservers– notthisemail.• Interferencerequiredshowingvolumethatdamagedbusiness– whatcausedtheburdentotheequipment?
TheLawLooksForwardandPassesCAN-SPAM• Afewyearslater,CongresspassesCAN-SPAM(Pub.L.108-
187,2003).
• Changesthelegalquestionfrominterference tounsolicited.• DropstheVolumeanalysisrequirement.• Unwantedisenough.• Damagesquantifiedbyemailasaunitandnotinaggregate.• But,Lawlooksbackwardbeforeitcanlookforward.
TheLawisSlowtoChange
• Oneofthebiggestchallengestoaddressingcybersecuritylawneeds,isthatthelawmakingprocessissoslow.• Cybersecuritythreatsarisequickly,anditcanbefrustratingtoseeklegalactiononlytofindthatthereisnoeasyfix– noapplicablelawforasituation.• Inordertotalkaboutwhythelawisslowtochangeweneedtolookathowlawsaremade.
HowLawsareMade– aCivicsReview• U.S.Constitution:ThreeBranchesofGovernment
• There’saBalanceofPowers
CongressMakesthelaw
PresidentEnforcesthelaw
CourtsInterpretsthe
law
HowtheLawsAreMadeamongtheThreeBranches• Butitisaserialprocesstoo:
• Ofcourse,theprocessisnotstrictlyserial- Courtscanreviewstatutes.• Thepointisthatmakingalawisajourneythroughthethreebranchesandtheirlawmakingprocesses.
CongressLegislativeStatutory
Makesthelaw
AgenciesAdministrativeRegulatory
Enforcesthelaw
CourtsJudicial
Interpretsthelaw
CaseorControversy
AuthorizingStatute
LegislativeProcess– WhyAreTheresoManyLawsinCongress?• Let’sreviewthenumbersbasedon“cyber*”inthiscurrentCongressionalsession.• BillisproposedinHouse(491)• Committee(132)
• Hearing• Report• Vote
• FullFloorVote(98)• SameProcessSenate(27)• Presidentsigns(19)– thenitbecomeslaw.• Manybillsareproposed,butveryfewbecomelaw!
RegulatoryProcess– HowGovernmentAgenciesMakeLaws• FederalRegisterasPaperofRecord(www.federalregister.gov)• Theprocesstocreateanewregulation:
• UnifiedAgenda(www.reginfo.gov)• NoticeofProposedRuleMaking• NoticeandCommentPeriod(www.regulations.gov)• FinalRule
• Therearesubsteps withinthisprocess.Thenumbersvarydependingontheissueandhowmanycommentsarereceived.• Commentsfromthepubliccanaffecttheregulation.• OnlytheFinalRulesmatter!Andonlyaftertheireffectivedate!!
JudicialProcess– HowCourtsDetermineWhetheraLawisGood?• Inordertosue- needacaseorcontroversy• Therearethreelevelsofreview:
• DistrictCourt• CourtofAppeals• SupremeCourt
• StartatDistrictCourt,thenappeal,andappeal.• ThisthreelevelsystemsappliestoStateCourtsandFederalCourts• Note:StateSupremeCourtdecisionscanbereviewedbytheU.S.SupremeCourt.Mirandav.Arizona forexample.
JudicialProcesswithNumbers
2409Federalcasesinvolvingcyber(approximately)• DistrictCourt(1,610)67%• CourtofAppeals(562)23%• SupremeCourt(237)10%
• OnlyafewgototheSupremeCourt.
• Thekeyisthatthecasedecisiononlyappliestothejurisdictionofthecourt.
LawMakingisaSlowProcess
• Legislative– 2yearcycle• NewCongress– startsover
• Regulatory– 4-8yearcycle• NewAdministration– startover?
• Judicial– 6– 15years• Eachcasecantakemonths/yearstobedecidedateachlevel.
• Very,Veryslow.10to20yearsintotal.• Alotofproposals,veryfewnewlaws.• Verypoliticaltoo.
InConclusion:TheLawisNotAllPowerful.• TheLawisImperfect:
• TheLawisLimited– certainpeople,certainsituations• TheLawLooksBackward– precedent– whatlegalissueshappenedprior?
• TheLawSlow toChange– thelawmakingprocesscantakeyears
• Therealityisthatthelawisoftentheantithesistotechnology• TechnologycanApplyBroadly• ItLooksForward• ItisVeryQuicktoChange
• ThisdichotomybetweenLawandTechnologycreatestensionbetweentheLegalandTechnologycommunities
Topic3WhatistheFutureofCybersecurityLaw
TheFutureofCybersecurityLaw–WheredoWeBegin?• Inordertounderstandthefutureofcybersecuritylaw,westartwiththerelationshipbetweentechnology,business,andlaw.
• AsImentionedtechnologychangesquickly.Thelawslowly.• Thereareactually2lagsbetweenlawandtechnology.
Technology Business Law
Law
1st Lag– IfChangeweretoStartSimultaneously,LawwouldLagBehind
TechnologyBusiness
• Technologychangesquickly– Moore’sLaw18mo.• Businesschangesabitslower– 5– 10yearstostartanewbusinessandachievescale.
• Lawchangesveryslowly– 10– 20yearsaspreviouslydiscussed.
Law
2nd Lag– ChangeisalsoSerial
Technology
Business
• Youhavetohavetechnologicalinnovationfirst.Sothelagiscumulative.• Cybersecuritylawdevelopmentlagsfarbehindtechnologyinnovation.
ThefutureofCybersecurityLawisintheNexusofBusinessandLaw• Betweentechnologyandbusinessistheideaofwhatcanbemonetizedorcommercialized.WhatisScalable.
• WhatproblemsarisefromscalingthatBusinessescan’taddressthroughtechnology?Whatarethesurprises?• That’sthefutureofcybersecuritylaw.Howtoaddressthesurprises.• Emailasanexample- RFC822(1980),ISPs(1990s),Spam(late90s),CAN-SPAM(2003).
Technology Business Law
Scalable Surprises
NewCybersecurityLawstoKnow
ByJurisdiction:
• California• SupremeCourt• FTC• RegulatoryAgencies• Europe• Congress
California– PushingtheFederalEnvelopein2018• InternetofThingslaw(SecurityofConnectedDevices,SB327,Cal.Civ.Code,Title1.81.26,§ 1798.91.04et.seq.)
• Manufacturers(notdistributors)• Connecteddevices(IPorBluetooth)• Reasonablesecurityfeature(natureandfunctionofdevice)
• CaliforniaConsumerPrivacyAct(AB375,Cal.Civ.Code,Title1.81.5,§ 1798.100et.seq.)• Effective1/1/2020• Consumerscanrequestthatbusinessdisclosethepersonalinformationcollectedandwhathas
beendonewiththatinformation.GDPRlike.• InresponsetoCambridgeAnalytica (FacebookisinCalifornia)
• NetNeutralitylaw(CaliforniaInternetConsumerProtectionandNetNeutralityActof2018,SB822,Cal.Civ.Code,Title15,§ 3100et.seq.)
• Unlawfultoblock,impair,ordegrade,lawfulInternettrafficbasedoncontent,application,service,ordevice
• Forbothfixed(broadband)andmobileInternetserviceproviders
Afewoverallthoughts:• CaliforniatendstobeProgressive– embracingchangesfirst.• AlltechnologyroadsleadtoCalifornia.(SiliconValley)• InferredPoliticalFightbetweenCaliforniaandtheU.S.Government.
SupremeCourt
• Carpenterv.U.S.(No.16-402,2018)• CellSiteLocationInformation(12,898locationpointsover127days)
• Question– reasonableexpectationofprivacy- cellphonesaselectronictrackersinyourpocket
• CourtRuled:LawEnforcementneedsawarrantforcelllocationdata
• Surveillance– 4th Amendmentand”new”technology• CareFirst,Inc.v.Attias (No.17-641,2017)
• CertDeniedFeb.20,2018• LowerCourtRulingstands(Attias v.CareFirst,Slip.Op.16-1708,DCCt.App.,2017)
• Courtheldthatdamagescouldbeawardedforthreatoffutureidentitytheftresultingfromadatabreach.
• Unusual– courtsHATEtospeculateaboutfutureharm- the“maybes”• So,whatdoesthismeanforCybersecurityInsuranceclaims/databreach
costs?
FTCandCybersecurity• UnfairorDeceptiveActsorPracticesinorAffectingCommerce isabroadumbrellaofauthorityunder§5.
• FTCv.Wyndham(3rd Cir.No.14-3514,2015)• FTC– haspursuedcasesagainstcompanieswithdeficientcybersecurity
practices• Wyndhamhadthreedatabreaches– itfailedtousereadilyavailablesecurity
measures(likefirewalls)– claimedtobethevictim• WyndhamclaimedFTCdidn’thavetheauthoritytoregulatecybersecurity
matters.• Businessesmustprotectcustomerpersonalinformation,andFTCcanpursue
caseswherethebusinessesdon’t.• LabMD v.FTC(11th Cir.,No.16-16270,2017)
• Factsofthiscaseareodd– billingmangerforalabwithafilesharingprogram/securitycompanydownloadedpersonaldataof9,300consumers/senttheinformationtotheFTC
• FTCclaimedabroadfailureofLabMD toprotectpersonaldata,buttheclaimwastoobroad.Theceaseanddesistordermustbespecifictothecaseinpoint.
• Takentogether,FTChaspowertoregulatecybersecurityindatabreaches,butthatpowerisproportionaltotheincident.
RegulatoryAgencies
SEC• CommissionStatementandGuidanceonPublicCompanyCybersecurityDisclosures(83FR8166,Feb.26,2018)• Mustinforminvestorsaboutcybersecurityincidentsandrisksbasedon:• Materialityofriskand• Importanceofcompromisedinformation
DOD• DODGuidanceforReviewingSystemsSecurityPlansandtheNISTSP800-171SecurityRequirementsNotYetImplemented(83FR17807,Apr.24,2018)
• DODdraftedguidanceforcontractorstouseinimplementing800-171andisseekingcomments.Admissionthattherearechallengeswithmeetingtheserequirements?Frombothsides?
• ConsiderthebifurcatedroleofGovernmentandBusiness– sharinginformationasapartnershipandregulatoryenforcement.
Europe
GeneralDataProtectionRegulation(GDPR)(EU)2016/679• ImplementationDate:May25,2018• PrivacyShield– CurrentU.S.DataSharingScheme-beingsuedinEuropeanCourt– likeSafeHarbor?• DataSecurityConcerns
• Processing– broad• Pseudonymized/AnonymizedData– assumestraceability• GeneralSecurityRequirement– Art32,CIATriad• MonitoringandProfiling(AI)
CongressionalActions
• InthisCongress– NoBIGchanges• NISTSmallBusinessCybersecurityAct(Pub.L.115-236,Aug.14,2018)
• CongressdirectsNISTtodevelopCybersecurityFrameworkforSmallBusinessesoutofexistingfunding
• DHS- CybersecurityandInfrastructureSecurityAgencyActof2018(H.R.3359,Pub.L.115-TBD,Nov.16,2018)• ReorganizetheDHSCybersecuritydepartments(internalchangeinoperations)
• InthepreviousCongress– afewchanges• CybersecurityInformationSharingAct2015(Pub.L.114-113)
• CreatesframeworkforbusinessestosharecyberthreatswiththeGovernmentwhocanreportbacktothewholesubscribership
• TradeSecretsAct2016(Pub.L.114-153)• Createsafederalrightofactionfortradesecrettheftcases.
• Point– lawschangeslowlyandinfrequently.
NewBusinessRisksontheHorizon–LookingintoaCrystalBall• CEHArmy
• Risk- HackBack?• Privateindustrywithoffensivecapability
• Botnets• Howtoassessliability– Masters,Bots,Networks?• DOJGuidance2015easierprosecution– subpoenascanbefiledcentrally
• IoT• RiskofInsecurity– Californiaaheadoftime,orrightontime?• Wearabletech– timeandlocationinformation– cellphonesashomingdevices– whataboutFitbits?
• Blockchain• Bitcoin- FinancialRegulation- inadecentralizedenvironment?• Supplychain/e-contracts– puttingattorneysoutofbusiness?• Traceability/Integrity- Riskofunplannedforking?
RevisitingtheCybersecurityLawLandscape
Individuals
International
GovernmentBusinesses
IndividualsBusinessesGovernment
Extradition ExportControlCyberwar
U.S. SurveillanceProtectData
PartnershipRegulation
PerennialIssuesthatAriseintheCybersecurityLawLandscape• Individuals
• Surveillance– 4thAmendment– Warrants?• E-CommerceEncouragement– Riskofdatabreach
• Business• Regulation– howfartogotoincreasesecurity• Partnership– howmuchsharing,whatcanchangeovertime• InternationalBusinessTransactions– exports,foreignpolicy
• Government• InternationalCriminalEnforcement– extradition,internationalsurveillance,protectingtradesecrets
• JustWarinCyberTimes– borderlessconflict- atimebeyondthenationstate?
InConclusion
• Cybersecuritylawcanbeorganizedbywhoisimpactedbythelaw– Individuals,Businesses,Government,International• Lawasacybersecuritytoolisnotallpowerful– it’slimited,backwardlooking,andslowtochange.Theoppositeoftechnology.• ThefutureofCybersecurityLawliesinthenexusbetweentechnology,business,andlaw.Wediscussed:(1)thenewlawsin2018,(2)thewhat’scomingnext,and(3)thewhat’salwaysatissue.
AdditionalResources
• HabeasData,Privacyvs.RiseofSurveillanceTech,CyrusFarivar,MelvilleHousePublishing,2018.• CybersecurityLaw,JeffKosseff,JohnWiley&Sons,2017.• FederalLawsRelatingtoCybersecurity:OverviewofMajorIssues,CurrentLaws,andProposedLegislation,EricA.Fisher,December12,2014,CRSReportR42114,CongressionalResearchService.• Websites
• www.congress.gov (AllLegislativeActions)• www.federalregister.gov (DailyNewspaperforAgencies)• www.ncsl.org (CybersecurityResearchatStateLevel)