Analyzing Cyber Security Laws in Different States

Background: In class, we’ve discussed important cyber legislation such as the Computer Fraud and Abuse Act of 1984, HIPAA, Sarbanes-Oxley, etc. These key directives guide our actions as cyber security professionals. Unlike federal law, state laws for cyber security vary widely. What is legal in one state might not be legal in another. Our textbook provides a brief sample of differences between Vermont and New York law. The purpose of this assignment is to help you understand the sometimes subtle nuances of state laws and how they impact the cyber security profession.

General Instructions: This is a group assignment. Join a group and participate! Don’t be a social loafer who merely observes – I’ll certainly hear about it and adjust your grade accordingly. A key component of the grading for this assignment is your group’s critical analysis. Stating facts is not enough. You must provide an analysis of what the similarities / differences mean in terms of your work as a cyber security professional.

I. Identify at least 1 critical area of cyber law per member of your group (criminal statues, civil statutes, etc) that impact you as a cyber security professional. These can be security-related or information privacy-related.

a. Identify the two states that you will compare legislation from. You will only consider legislation from those two states for this analysis. Example: Virginia and Maryland

b. Legislation: Find the appropriate laws for your critical areas from your 2 states. Note that there may be more than 1 law for each area that you need to consider. Example: Critical areas might be things like “unauthorized use of computer systems”, “theft of intellectual property”, “breach notification requirements”, or “cyber stalking”. There are many “critical areas” that you can evaluate although it may take some work to clearly define them. (Hint: if you can’t find a law in both states that addresses it, find another critical area to examine).

c. Analyze: Examine the laws to determine how they are similar or different. Your analysis must consider 1) applicability, 2) prescribed penalties, 3) whether it addresses emerging technologies, 4) value as a deterrent, and 5) ability to make victims whole, but it may also consider any additional factors you deem relevant.

You may incorporate ideas from other sources, but remember that you must properly cite those sources!

d. Discuss: Contemplate the impact of each law from the perspective of a cyber security professional. How will this impact your organization? Do you have mandatory disclosures? Are you prohibited from collecting certain evidentiary data? Are you required to involve law enforcement when there is a breach? Are there specific evidence handling requirements that you must adhere to if you want to prosecute? This is certainly not a comprehensive list. I expect you to use your discretion in determining what questions are worthy of discussion for each particular law.

e. Recommend: Propose changes based on your knowledge. As a cyber security professional, you may be asked not only to make recommendations to management in your organization, but also recommendations for your community as well. What recommendations would you make to cyber legislators to improve each law you reviewed?

Helpful Hints:

Create a separate row for each piece of legislation in each table. You may have multiple rows if you have multiple pieces of legislation to discuss for a single critical area. Tables in some critical areas may only have 1 row, while tables in other critical areas may have several.

Use shading to distinguish one state’s laws from the other.