Law and ethics in information assurance

1. Laws and
Ethics in Information
Assurance

2. Law and Ethics in Information Security
Laws: Rules adopted and enforced by governments to codify expected
behavior in modern society
Ethics: Relatively fixed moral attitudes or customs of a societal group (based
on cultural mores)
The key difference between law and ethics is that law carries the sanction of a
governing authority and ethics do not.

3. Types of Law
Civil law: Pertains to relationships between and among individuals and
organizations
Criminal law: Addresses violations harmful to society. Actively enforced
and prosecuted by the state
Tort law: A subset of civil law that allows individuals to seek redress in
the event of personal, physical, or financial injury.

4. Civil lawsuits
In a civil law problem, ‘victim’ must take action to get a legal remedy
(adequate compensation).
● ‘victim’ must hire a private lawyer & pay expenses of pursuing the matter
● the police does not get involved, beyond the point of restoring the order
In Civil Law, to convict someone, the guilt must be proven on ‘balance of
probabilities’.
In Civil Law, monetary remedies (damages) are most common.

5. Criminal cases
In a criminal law problem, ‘victim’ (may) report the case to the police and they
have the responsibility to investigate.
If charge has been properly laid and there is supporting evidence, the Crown
Prosecutor (not person who complains of incident) prosecutes in the courts –
public funds finance these services
Even if a ‘victim’ starts a prosecution privately, the Attorney General has the
power to take over the prosecution.

6. Criminal cases II
● In Criminal Law, to convict someone, the guilt must be proven
‘beyond reasonable doubt’.
● In Criminal Law, the sentence to the offender may include one or a
combination of the following:
Fine, restitution (compensate for victim’s loss or damages), probation,
community service, imprisonment

7. Types of Law
Private law:
● Regulates the relationships among individuals and among individuals
and organizations. e.g Family law, commercial law, and labor law.
Public law:
● Regulates the structure and administration of government agencies
and their relationships with citizens, employees, and other
governments. e.g Criminal, administrative, and constitutional law.

8. Policy
Policies are expectations that describe acceptable and unacceptable
employee behaviors in the workplace-function as organizational laws,
complete with penalties, judicial practices, and sanctions to require
compliance.
Policies function as laws, they must be crafted with the same care, to ensure
that they are complete, appropriate, and fairly applied to everyone in the
workplace

9. Policy Versus Law
Difference between policy and law:
Ignorance of policy is an acceptable defense
Policies must be:
● Distributed to all individuals who are expected to comply with them.
● Readily available for employee reference.
● Easily understood, with multilingual, visually impaired and low-literacy
translations.
● Acknowledged by employee with consent form.
● Uniformly enforced for all employees.

10. General Computer Crime Laws
The Computer Fraud and Abuse Act of 1986 (CFA Act) is the cornerstone of
many computer-related federal laws and enforcement efforts.
It was amended in October 1996 by the National Information Infrastructure
Protection Act of 1996, which modified several sections of the previous act
and increased the penalties for selected crimes

11. Key Provisions of CFA
The CFAA criminalizes a range of activities, including:
Unauthorized Access: Accessing a computer without authorization (or
exceeding authorized access) to obtain information from: Financial
institutions, U.S. government computers, Protected computers.
Fraud: Committing fraud via computer systems. e.g., phishing, identity
theft, or other schemes using computers to defraud.
Damage to Computers: Knowingly causing the transmission of a
program, information, or code that intentionally damages a protected
computer (e.g., viruses, ransomware).

12. Computer Security Act of 1987
It was one of the first attempts to protect federal computer systems by
establishing minimum acceptable security practices.
The National Bureau of Standards, in cooperation with the National Security
Agency, became responsible for developing these security standards and
guidelines.
Required federal agencies to identify sensitive computer systems, develop
and maintain security plans, and conduct periodic reviews. Assigned NIST to
develop security standards and collaborate with the NSA for technical
assistance.

13. The USA Patriot Act of 2001
The USA PATRIOT Act of 2001 granted broader authority to law enforcement
agencies, enhancing their ability to monitor, investigate, and respond to
terrorism-related activities.
The 2006 USA PATRIOT Improvement and Reauthorization Act made 14 of the
16 expanded powers permanent and extended certain FISA wiretap
provisions by resetting their sunset clause expiration dates.

14. Key Provisions of Patriot Act
Enhanced Surveillance Powers: Enabled broader wiretaps, email
monitoring, and access to personal records; authorized roving wiretaps
across multiple devices.
Section 215 – Business Records: Allowed the FBI to obtain business
records relevant to terrorism investigations, sparking criticism for bulk
data collection without specific suspicion.
Information Sharing: Facilitated easier information exchange between
law enforcement and intelligence agencies.
Detention of Immigrants: Authorized detention and deportation of
non-citizens suspected of terrorism links.

15. Privacy
Privacy is the right of individuals to control access to their personal
information.
It involves the ability to decide what data is collected, how it is used, and
with whom it is shared.
Encourages collecting only the necessary personal information required for
a specific purpose, reducing exposure and misuse risks.

16. Key Concepts
Personal Data: Any information that can identify an individual (e.g., name,
email, location).
Consent: Users must be informed and agree to how their data is used.
Control: Individuals should have tools to manage their data visibility.

17. Privacy as a core Principle of IA
Confidentiality: IA ensures that personal/private data is accessed
only by authorized users.
Privacy protection depends on confidentiality being maintained in
digital systems.

18. Supporting Legal & Ethical Responsibilities
GDPR(General Data Protection Regulation): Protects personal data of
individuals in the EU and gives them more control over how their data is
collected, stored, and used.
HIPAA(Health Insurance Portability and Accountability Act): Protects
sensitive health information from being disclosed without the patient’s
consent or knowledge.
CCPA(California Consumer Privacy Act): Gives California residents more
control over their personal information.

19. Privacy of Consumer Information
Federal Privacy Act of 1974: The Federal Privacy Act of 1974 regulates
government agencies and holds them accountable if they release private
information about individuals or businesses without permission.
Electronic Communications Privacy Act of 1986: It is a collection of
statutes that regulate the interception of wire, electronic, and oral
communications. These statutes work in conjunction with the Fourth
Amendment of the U.S. Constitution, which protects individuals from
unlawful search and seizure.

20. Identity Theft
Occurs when someone uses your personally identifying information, like your
name, CNIC number, or debit card number, without your permission.
Typically used to commit financial fraud, open accounts, make purchases, or
engage in illegal activities under someone else’s identity.
Victims may face legal challenges, including disputes over fraudulent
transactions and efforts to clear their name from criminal activity committed
by the thief.

21. Export and Espionage Laws
Economic Espionage Act (EEA) of 1996:
An attempt to protect intellectual property and competitive advantage.
It also attempts to protect trade secrets from the foreign government,
another company or a disgruntled former employee that uses its classic
espionage apparatus to spy on a company

22. The SAFE Act of 1997
Security and Freedom through Encryption Act of 1997:
● Provides guidance on the use of encryption
● Institutes measures of public protection from government intervention
● Reinforces an individual’s right to use or sell encryption algorithms
● Prohibits the federal government from requiring the use of encryption
for contracts, grants, and other official documents, and correspondence

23. U.S. Copyright Law
- Extends protection to intellectual property, including words published in
electronic formats
- ‘Fair use’ allows material to be quoted so long as the purpose is educational
and not for profit, and the usage is not excessive
- Proper acknowledgement must be provided to the author and/or copyright
holder of such works

24. Ethics in Information Assurance
Ethics can be defined as a moral code by which a person lives. For
corporations, ethics can also include the framework you develop for what is
or isn't acceptable behavior within your organization.
In computer security, cyber-ethics is what separates security personnel from
the hackers. It's the knowledge of right and wrong, and the ability to adhere
to ethical principles while on the job.

25. Ten Commandments of Computer Ethics
From the Computer Ethics Institute.
Thou shalt not:
1. Use a computer to harm other people
2. Interfere with other people's computer work
3. Snoop around in other people's computer files
4. Use a computer to steal
5. Use a computer to bear false witness
6. Copy or use proprietary software (w/o paying)
7. Use other people's computer resources without authorization or
proper compensation

26. Ten Commandments of Computer Ethics
8. Appropriate other people's intellectual output
9. Think about the social consequences of the program you are writing or
the system you are designing
10. Always use a computer in ways that ensure consideration and respect
for fellow humans

27. Deterring Unethical and Illegal Behavior
• InfoSec personnel should do everything in their power to deter
unethical and illegal acts
– Using policy, education and training, and technology as controls to
protect information
• Categories of unethical behavior
– Ignorance
– Accident
– Intent

28. Deterring Unethical and Illegal Behavior
• Deterrence
– Best method for preventing an illegal or unethical activity
– Examples: laws, policies, and technical controls
– Laws and policies and their associated penalties only deter if three
conditions are present:
• Fear of penalty
• Probability of being caught
• Probability of penalty being administered

29. Ethics and Education
• Differences in computer use ethics:
– Not exclusively cultural.
– Found among individuals within the same country, within
the same social class, and within the same company.
• Key studies reveal that the overriding factor in leveling the
ethical perceptions within a small population is education.
• Employees must be trained on the expected behaviors of an
ethical employee.

30. Why is ethics significant to information security?
❖ The data targeted in cyber attacks is often personal and sensitive.
❖ Loss of that sensitive data can be potentially devastating for your
customers, and it's crucial that you have the full trust of the individuals
you've hired to protect it.
❖ Cybersecurity professionals have access to the sensitive personal data
they were hired to protect.
❖ So it's imperative that employees in these fields have a strong sense of
ethics and respect for the privacy of your customers.

31. Any Questions ??
Thank
You!