Question

Research and explain the purpose of one law that governs computer access, intellectual property (IP), or personally identifiable information (PII) in supporting an organization's business strategy.

Examples of applicable laws include:

1. USA Patriot Act
2. Health Insurance Portability and Accountability Act (HIPAA)
3. Electronic Communications Privacy Act (ECPA)
4. Computer Fraud and Abuse Act

Discuss strategic management strategies used to address the moral and ethical challenges and responsibilities these laws place on organizations. Provide specific examples to support your ideas.

Answer 1

The Computer Fraud and Abuse Act (CFAA) is a cybersecurity bill passed by United States in the year of 1986. This law was an amendment to the existing computer fraud law, which was present in the Comprehensive Crime Control Act of 1985. The CFAA law prohibits the accessing of a computer without the authorization or in excess of authorization. Before this law came into act, computer crimes were considered under mail and wire fraud which was mostly insufficient. The law is designed primarily to target hackers who access computers to steal information.

The bill was enacted in response to the concern that crimes related to computers going unpunished. This was based on the Report of the incident in which a young teenager from Seattle breaks into a U.S military supercomputer programmed to predict possible outcomes of nuclear war and it almost starts World War 3.

In the amendments of the law, the distribution of malicious code and denial of service attacks was also addressed. A provision criminalizing trafficking in passwords and similar items was also included in the amendments.

The major problem lies in the language used in the law, which is the meaning of Authorization. It prohibits accessing a computer “without authorization” or by “exceeding authorized access,” but it doesn’t define what “authorization” is.

This law can be interpreted in so many ways. For an organization, they can have a rule which prohibits using Facebook or personal mails or any other social media websites during the work hours, which can come as breakage of the law under CFAA. So it all depends on the Organization morals to do the same or not. Even lying about your age on a website that has an age restriction could be considered a punishable offense. In fact, doing anything that’s against any terms of service online could be considered a violation. This means that, under the law, you could theoretically face fines and jail time for these purported crimes. So not all these are considered a violation of the CFAA law even though these can be interpreted as a violation under the law.

This isn’t a law to be blasé about, and since we can interpret it in the way we want, it could spell big trouble for anyone on the wrong side of it.