# Chapter 4 – Laws, Regulations and Compliance

Three main categories of law:
* Criminal law
* Civil law
* Administrative law

Subjects in Civil law include contract disputes, real estate transactions, and employment matters.
Administrative law covers the policies, procedures and regulations of government agencies.

Civil law = Burgerlijk Recht, Administrative law = Bestuursrecht

## Cybersecurity laws
The **Comprehensive Crime Control Act of 1984**covered actions that targeted or used federal computer systems.
The **Computer Fraude and Abuse Act (CFAA)** extended that to cover all “federal interest” computers: offenses on computers used by the US government, financial institutions, and combinations of computers in different states.
The **Computer Abuse Amendments Act (CAAA) of 1994** included: creation of malicious code, any computer used in interstate commerce, allowed for imprisonment of offenders and for the victims to pursue civil action.

The **Federal Sentrencing Guidelines (1991)** provided punishment guidelines and formalized the *prudent man rule*: senior executives are personally responsibility for ensuring due care, but punishment is minimized if due diligence is demonstrated.
Proof of negligence has three burdens: the person accused must have a legally recognized obligation, must have failed to comply with recognized standards, and there must be a causal relationship between the negligence and subsequent damages.

The **National Information Infrastructure Protection Act of 1996** broadens CFAA to cover computer systems in international commerce, national infrastructure other than computers, and treats any intentional or reckless act against them as a felony.

The **Federal Information Security Management Act (FISMA) of 2002** requires federal agencies to implement an information security program, and include the activities of contractors in it.

The NIST (National Institute of Standards and Technology) outlines eight elements of an effective information security program:
1. Periodic assessments of risk
2. Policies and procedures based on risk assessments
3. Subordinate plans for providing adequate information security
4. Security awareness training for personel to comply with relevant policies
5. Periodic testing and evaluation of policies and controls
6. A process for planning, implementing, evaluating and documenting remedial actions
7. Procedures for detecting, reporting and responding to incidents
8. Continuity plans

### 2014 Federal Cybersecurity Laws

* FISMA – Federal Information Security *Modernization* Act centralized federal cybersecurity responsibility with the Department of Homeland Security, with the exceptions of defense-related and intelligence-related issues.
* Cybersecurity Enhancement Act gives NIST the responsibility for nationwide voluntary standards. Commonly used are NIST SP 800-53 (controls for federal information systems) and the similar NIST SP 800-171 (protecting unclassified information in non-federal systems and organizations). The NIST Cybersecurity Framework (NCF) is a voluntary risk-based framework. 
* National Cybersecurity Protection Act: Homeland Security is charged with establishing a national center to shared risks, incidents, analysis and warnings between federal and civilian organizations.

## Intellectual Property laws
Four major types: copyrights, trademarks, patents, and trade secrets.

**Copyright law** guarantees creators of original works protection against unauthorized duplication. Ownership defaults to the creator, except when he/she was “hired” by an employer or on the base of a contract.
Before the DMCA, software was copyrighted under the scope of literary works, but only the literal source code was protected, not the ideas or process behind it.
Protection is for 70 years after the death of the author, and for ‘works for hire’ 95 years after publication or 120 years after date of creation.

**1998 DMCA Digital Millennium Copyright Act**. Brought the US copyright law in line with the WIPO treaties (World Intellectual Property Organization).
The DMCA prohibits attempts to circumvent copy protection mechanisms. It also limits the liabilities of ISP’s for the transmitted materials, assigning them the same “common carrier” status as phone companies.
For ISP’s to qualify for the exemption, they may not be the initiator of the transmission, all activities should be carried out automatically, the ISP must not choose the receivers, no intermediate availability to others except the intended receiver, not kept longer then necessary, and no modification of the material.

**Trademarks** protect words, slogans, and logos that identify a company and it’s products. The main objective is to avoid confusion while protecting intellectual property rights of people and organizations.

**Patents** protect inventions. For 20 years from the application date. Patents have three main requirements: the invention must be new, useful and not obvious.

**Trade secrets** are intellectual properties that are critical to business, and when disclosed, would cause damage to the company. Copyrights and patents are not effective here, because they require disclosure when they are filed and the duration of the protection is limited.
To preserve Trade Secret status you must implement adequate controls and use NDA’s.
Software is best protected by Trade Secret protection.

The Economic Espionage Act of 1996 prohibits stealing trade secrets from US corporations and has extra highs fines if it is done with the intention of benefiting a foreign government or agent. It gives teeth to Trade secrets protection.
It extended the definition of theft as involving physical property, to include proprietary economic information.


## Licensing
Four common types of license agreements exist:
* Contractual license agreements: written contract between vendor and customer
* Shrink-wrap license agreements: written on the box
* Click-through or Click-wrap license agreements: click to agree with the terms
* Cloud service license agreements: the same, but sometimes just a link to legal terms.

## Import/export regulations
Two sets of federal regulations are of interest:
* ITAR (International Traffic in Arms Regulations) controls the export of items that are specifically designed for military use, including technical information about them. The items are listed on the United States Munitions List (USML)
* EAR (Export Administration Regulations) includes items that may have military applications. They are listed on the Commerce Control List (CCL). It includes a category covering information security products.

Currently high-performance computing can be sold to any country except those imposing nuclear threats.

Under previous regulations almost no encryption products could be exported, putting US companies at a great competitive disadvantage. This is now easened for ‘retail and mass market security software’.

## Privacy
The US Constitution does not explicitly provide a right to privacy. The Fourth Amendment is the basis for US privacy rights: “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures”.

The **Privacy Act of 1974** limits the ability of government agencies to disclose private information from individuals to others without prior written consent. 
Agencies can only keep records that are necessary and no longer than needed. It regulates access to records by individuals and the right to request amending incorrect records. It applies *only* to government agencies.

The **Electronic Communications Privacy Act (ECPA) of 1986** prohibits the interception or disclosure of electronic communication, including email, voicemail and mobile telephone conversations. (In the previous Federal Wiretap Act only communications ‘over the wire’ where protected).

The **Communications Assistance for Law Enforcement Act (CALEA) of 1994** requires all communications carriers to make wiretaps possible for law enforcement.

The Economic Espionage Act of 1996, with its inclusion of proprietary economic information, also has privacy implications.

The **Health Insurance Portability and Accountability Act (HIPAA) of 1996** governs health insurance and health maintenance organizations (HMOs) and requires strict security measures for all organizations that process private medical data about individuals. It also defines the rights of the subjects.

The **Health Information Technology for Economic and Clinical Health Act (HITECH) of 2009** is an amendment to HIPAA and extends the requirements to organizations handling PHI on behalf of a HIPAA covered entity. HITECH also introduced new data breach notification requirements (notifying affected individuals, the Secretary of Health and the media).

PHI = Protected Health Information

The **Children’s Online Privacy Protection Act (COPPA) of 1998** covers websites that cater to children or knowingly collect information about them. They must have a privacy notice, parents must consent and have the opportunity to review collected information.

The **Gramm-Leach-Bliley Act (GLBA) of 1999** relaxed the regulations on information exchange between banks, insurance companies and credit providers. It included limitations of the types of information that could be exchanged.

The **USA PATRIOT Act of 2001** broadened the powers of law enforcement and intelligence organizations. Wiretapping warrants where no longer on a ‘per circuit’ basis but allowed for blanket authorization for a person across different media. Also, ISPs may voluntarily provide a large range of information. The government may obtain detailed information on user activity through subpoenas.
It expired in 2015 but was promptly restored through the USA Freedom Act, which was renewed in March 2020.

The **Family Educational Rights and Privacy Act (FERPA)** affects government funded educational institutions.

The **Identity Theft and Assumption Deterrence Act** of 1998 makes identity theft a crime against any person, not just against defrauded creditors.

### US Privacy Shield
US Privacy Shield contains seven requirements:
- Informing individuals about data processing
- Providing free and accessible dispute resolution
- Cooperating with the US Department of Commerce
- Maintaining data integrity and purpose limitation
- Accountability for transfer to third parties
- Transparency on program enforcement actions
- commitments are kept as long as data is held, even after exiting Privacy Shield.

### Privacy in the Workplace
In US law, privacy is only guaranteed when there is a “reasonable expectation of privacy”. This does not extent to the use of employer-owned equipment and networks in the workplace.

### Compliance to regulations

The PCI DDS (Paynment Card Industry Data Security Standard) is an example of compliance requirement by contractual obligation (between a business that accepts credit cards and the bank that processes the transactions).

Organizations must accept audits, for instance to ensure compliance with SOX (Sarbanes-Oxley Act). The often must report regulatory compliance to internal and external stakeholders.