The Transformative Nature of Cyber

This month’s blog posting is from Ira E. Hoffman, who is joining us as one of the speakers for tomorrow’s WIT.Connect: CyberConnect-The Intersection of Technology, Law and Law Enforcement. Please see his bio after the blog post.

The Transformative Nature of Cyber

Excerpted from Ira E. Hoffman’s “A PCI Blog Series”

This is the first in a series of blogs on the theme of the transformative nature of “cyber.”  In this installment, we will begin setting the baseline for a dynamic discussion of a wide range of cybersecurity issues, starting with the definition of “cyber.”  We will also provide a briefly annotated list of the statutes that most relate to the cybersecurity issues we will address.  In future blogs, we will cover other sources of U.S. cyber law and policy, and then will turn to the transformative nature of cyber.  Although cybersecurity affects everyone, not just government contractors, and we will address the effects of cyber issues on society, generally, we will always maintain a focus on the effects on government contractors, in particular.

To begin with, we need a working definition of “cyber,” and we derive ours from the National Institutes of Standards and Technology (NIST) definition of “cyberspace.”  Although the term “cyber” is usually used as a prefix in conjunction with words such as attack, incident, security, space, and threat, we will use the term “cyber” broadly, with or without a suffix, to refer to information technology (IT) that is used in connection with “the interdependent network of information systems infrastructures, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers.”  See NIST, Glossary of Key Information Security Terms, NISTIR 7298 (Rev. 2, 2013) (adapted from definition of “cyberspace”).

Now that we have a working definition of “cyber,” we turn to the current state of U.S. law relating to cyber, which can only be described as a “patchwork.”  Since there is nothing in the Constitution about cyber, and even though the courts have recognized a constitutional right to privacy, starting with Griswold v. Connecticut, 381 U.S. 479 (1965), the primary source of cybersecurity law is statutory.

Unfortunately, there is no single, comprehensive, remotely up-to-date Federal cybersecurity statute.  In that light, the following is a list, albeit an idiosyncratic one, of statutes that establish or affect significant Federal cybersecurity requirements.  Since they were passed in response to successive, evolving cyber threats of differing magnitudes, but without having a harmonized statutory scheme as an organizing principle, it is illuminating to list the selected statutes in chronological order.

• Counterfeit Access Device & Computer Fraud & Abuse Act of 1984, Pub. L. No. 98-473 (codified as amended at 18 U.S.C. § 1030) (prohibits attacks on Federal  computers and bank networks in interstate and international commerce)
• Computer Fraud and Abuse Act of 1986 (CFAA), Pub. L. No. 99-474 (codified at 18 U.S.C. §§ 1001 note, 1030) (expanded scope of CFAA of 1984; carved out  exemption for Intelligence Community (IC) and law enforcement agencies)
• Electronic Communications Privacy Act of 1986 (ECPA), Pub. L. No. 99-508 (codified at scattered sections of 18 U.S.C.) (bans unauthorized electronic eavesdropping) (includes the Stored Communications Act, 18 U.S.C. §§ 2701-2712, which proscribes illegal access to stored communications, which now include “cloud” storage of emails)
• Computer Security Act of 1987, Pub. L. No. 100-235 (codified at 15 U.S.C. §§ 278g-3 & 278g-4, 40 U.S.C. § 759) (directed NIST to develop cybersecurity policies for Federal civilian agency networks, except for national security systems used for DoD and the IC)
• Paperwork Reduction Act of 1995, Pub. L. No. 104-13 (codified as amended at 44 U.S.C. §§ 3501-3520) (directed OMB to develop Federal cybersecurity policies) (superseded in part by Homeland Security Act, infra)
• Clinger-Cohen Act of 1996 (a/k/a Federal Acquisition Reform Act (FARA) & Information Technology Management Reform Act of 1996 (ITMRA)), Pub. L. No. 104-106) (repealed portions of Brooks Act by giving agency heads authority to acquire IT; established CIO position at each agency; required agency heads to ensure adequacy of agency cybersecurity policies; exempted national security systems from most provisions)
• Health Insurance Portability & Accountability Act of 1996 (HIPPA), Pub. L. No. 104-191 (codified in scattered sections of 29 and 42 U.S.C.) (amended in pertinent part by the HITECH Act, infra) (required HHS to establish technical standards for protection of Personal Health Information)
• Gramm-Leach-Bliley Act of 1999, Pub. L. No. 106-102 (codified at 15 U.S.C. §§ 6801-6827) (requires financial institutions to protect customers’ personal information)
• Sarbanes-Oxley Act of 2002 (Public Company Accounting Reform and Investor Protection Act), Pub. L. No. 107-204 (codified at scattered sections of 15 & 18 U.S.C.) (requires public companies to report on internal financial controls, including cyber attacks that result in loss of protected information)
• Homeland Security Act of 2002, Pub. L. No. 107-296 (codified at scattered sections of 6 U.S.C.) (established Department of Homeland Security (DHS); included Cybersecurity Enhancement Act of 2002, Pub. L. No. 107-296, Title II, § 225 (codified at 6 U.S.C. § 145 & scattered sections of 18 U.S.C.) and original Federal Information Security Management Act of 2002 (FISMA), Pub. L. No. 107-296, Title X; transferred many cybersecurity functions from other agencies to DHS; directed DHS to provide information on cyber threats to State and local authorities and private entities and assist them in protecting critical infrastructure)
• Federal Information Security Management Act of 2002 (FISMA), Pub. L. No. 107-347, Title III (a/k/a E-Commerce Act of 2002) (codified at 44 U.S.C. §§ 3541-3549) (established broad framework of standards and requirements for Federal IT networks and services; last overarching Federal cybersecurity statute)
• Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA), Pub. L. No. 108-458 (codified at scattered sections of 42 and 50 U.S.C.) (created post of Director of National Intelligence; established cyber responsibilities for certain entities in the IC, homeland security and national security communities; and created a Privacy and Civil Liberties Board)
• Health Information Technology for Economic and Clinical Health Act (HITECH Act), Pub. L. No. 111-5 (2009) (codified at scattered sections of 42 U.S.C.) (updated and expanded HIPAA cybersecurity and privacy requirements for health-care providers)

To be sure, other statutes (and lists of statutes) contain provisions that are related to cyber, see, e.g., Eric A. Fisher, Cong. Research Serv., R42114, Federal Laws Relating to Cybersecurity:  Overview and Discussion of Proposed Revisions (2013), but this list and the blog series will focus more on those sources of law and policy that affect or potentially affect government contractors.

With that in mind, future blogs will cover Executive Order 13536, Improving Critical Infrastructure Cybersecurity, which the President issued in February 2013 to address the growing cyber threat to critical infrastructure, which “represents one of the most serious national security challenges we must confront.”  76 Fed. Reg. 11739 (Feb. 19, 2013).  We will also cover the cyber aspects of the interim DFARS rule on requirements relating to Supply Chain Risk, DFARS Subpart 239.73; the final DFARS rule on Safeguarding Unclassified Controlled Technical Information, DFARS Subpart 204.73; and the final DFARS rule on Detection and Avoidance of Counterfeit Electronic Parts, DFARS Subpart 246.8.  Then, having covered most of the sources of cybersecurity law relating to government contractors, we will turn to U.S. cyber policy, as set forth in, e.g., the NIST Framework and the various National Strategies regarding cyberspace.

Ira E. Hoffman’s Biography

Ira E. Hoffman is a Principal, practicing Cybersecurity, Government Contracts and International Law at Offit Kurman, a multi-state law firm.  He is a member of the CyberMaryland Advisory Board, the Governor's International Advisory Council, and the Board of the Public Contracting Institute. 

He has published several articles on aspects of cybersecurity law and policy, and has been a moderator or panelist at a number cybersecurity conferences, including CyberMaryland (2013 & 2014), the inaugural CyberMontgomery, and the Defensive Cyber Operations & Intelligence (DCOI) annual conference, which is co-hosted by Tel Aviv University's Institute for National Security Studies (INSS) and the U.S.-based Cyber Security Forum Initiative (CSFI).