East Stroudsburg University of Pennsylvania Center for Computer Security and Information Assurance

Computer Security Legal Resources

Law or Document Categories

· Committee on National Security Systems Documents

o CNSSP-1 National Policy for Safeguarding and Control of Communications Security Material

o CNSSP-3 National Policy for Granting Access to U.S. Classified Cryptographic Information

o NCSC-5 National Policy on Use of Cryptomaterial by Activities Operating in High Risk Environments

o CNSSP-6 National Policy on Certification and Accreditation of National Security Telecommunications and Information Systems

o CNSSP-17 National Information Assurance (IA) Policy on Wireless Capabilities – important now because of the recent improvements in wireless.

o NSTISSP-101 National Policy on Securing Voice Communications

o NSTISSP-200 National Policy on Controlled Access Protection

o CNSSD-901 National Security Telecommunications and Information Systems Security (CNSS) Issuance System, dated 16 December 2004; Supersedes

o CNSSI-5000 Guidelines for Voice Over Internet Protocol (VoIP) Computer Telephony

o CNSSI-5001 Type-Acceptance Program for Voice Over Internet Protocol (VoIP) Telephones

· Copyright Statutes

o Digital Millennium Copyright Act: http://thomas.loc.gov/cgi-bin/query/z?c105:H.R.2281.ENR:

o No Electronic Theft Act: http://www.usdoj.gov/criminal/cybercrime/17-18red.htm

o Fair Use – Incorporated into the Copyright Act of 1976, was its own doctrine before the Act: http://www.copyright.gov/fls/fl102.html

o Copyright Act of 1976: http://wiretap.area.com/Gopher/Gov/Copyright/US.Copyright.1976.txt

o Audio Home Recording Act of 1992: http://www.virtualrecordings.com/ahra.htm

· Encryption Statutes

o DMCA – The Digital Millennium Copyright Act: http://www.copyright.gov/legislation/dmca.pdf

o NRS 597.970 Restrictions on transfer of personal information through electronic transmission: 2.) http://www.realtime-itcompliance.com/laws_regulations/2007/10/new_nevada_law_explicitly_requ.htm

o Export Administration Regulations Section 740.13(e): http://www.bis.doc.gov/encryption/pubavailencsourcecodenofify.html

o CALEA – The Communications Assistance For Law Enforcement Act: http://www.askcalea.net/calea/103.html

o 201 CMR 17.00: Standards for The Protection of Personal Information of Residents of the Commonwealth: http://www.mass.gov/?pageID=ocaterminal&L=3&L0=Home&L1=Consumer&L2=Identity+Theft&sid=Eoca&b=terminalcontent&f=idtheft_201cmr17&csid=Eoca#1701

· Federal Information Processing Standards

o FIPS 180-3 - Secure hash Standard: http://csrc.nist.gov/publications/fips/fips180-3/fips180-3_final.pdf

o FIPS 185 – Escrowed Encryption Standard: http://www.itl.nist.gov/fipspubs/fip185.htm

o FIPS 186-2 – Digital Signature Standard: http://csrc.nist.gov/publications/fips/fips186-2/fips186-2-change1.pdf

o FIPS 190 – Guidelines for the use of advanced authentication technology alternatives: http://www.itl.nist.gov/fipspubs/fip190.htm

o FIPS 191 – Guidelines for the analysis of Local Area Network Security: http://www.itl.nist.gov/fipspubs/fip191.htm

o FIPS 196 – Entity Authentication Using Public Key Cryptography: http://csrc.nist.gov/publications/fips/fips196/fips196.pdf

o FIPS 197 – Advanced Encryption Standard: http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf

o FIPS 199 – Standards for Security Categorization of Federal Information and Information Systems: http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf

o FIPS 200 – Minimum Security Requirements for Federal Information and Information Systems: http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf

o FIPS 201-1 – Personal Identity Verification of Federal Employees and Contractors: http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf

· Internet Gambling Statutes

o Unlawful Internet Gambling Enforcement Act of 2006: http://www.gambling-law-us.com/Federal-Laws/internet-gambling-ban.htm

o Federal Wire (Wager) Act of 1961 (way before the www): http://www.gambling-law-us.com/Federal-Laws/wire-act.htm

o SAFE Port Act: http://en.wikipedia.org/wiki/SAFE_Port_Act

o Internet Gambling Prohibition Act: http://en.wikipedia.org/wiki/Internet_Gambling_Prohibition_Act

o Washington State anti-gambling bill (banning internet gambling): http://www.washingtonvotes.org/2006-SB-6613

· NIST SP 800 Series

o NIST SP 800-40 – Creating a Patch and Vulnerability Management Program: http://csrc.nist.gov/publications/nistpubs/800-40-Ver2/SP800-40v2.pdf

o NIST SP 800-41 – Guidelines of Firewalls and Firewall Policies: http://csrc.nist.gov/publications/nistpubs/800-41/sp800-41.pdf

o NIST SP 800-44 – Guidelines on Securing Public Web Servers: http://csrc.nist.gov/publications/nistpubs/800-44-ver2/SP800-44v2.pdf

o NIST SP 800-45 – Guidelines on Electronic Mail Security: http://csrc.nist.gov/publications/nistpubs/800-45-version2/SP800-45v2.pdf

o NIST SP 800-48 – Guide to Securing Legacy 802.11 Wireless Networks: http://csrc.nist.gov/publications/nistpubs/800-48-rev1/SP800-48r1.pdf

o NIST SP 800-53 – Recommended Security Controls for Federal Information Systems: http://csrc.nist.gov/publications/nistpubs/800-53-Rev2/sp800-53-rev2-final.pdf

o NIST SP 800-58 – Security Considerations for Voice over IP Systems: http://csrc.nist.gov/publications/nistpubs/800-58/SP800-58-final.pdf

o NIST SP 800-59 – Guideline for Identifying an Information System as a National Security System: http://csrc.nist.gov/publications/nistpubs/800-59/SP800-59.pdf

o NIST SP 800-61 – Computer Security Incident Handling Guide: http://csrc.nist.gov/publications/nistpubs/800-61-rev1/SP800-61rev1.pdf

o NIST SP 800-111 – Guide to Storage Encryption Technologies for End User Devices: http://csrc.nist.gov/publications/nistpubs/800-111/SP800-111.pdf

· Non Disclosure and Non Compete Agreements Statutes

o Invention Secrecy Act of 1951: http://en.wikipedia.org/wiki/Invention_Secrecy_Act

o The Uniform Trade Secrets Act: http://www.tms.org/pubs/journals/JOM/matters/matters-0601.html

o Standard Form 312: http://en.wikipedia.org/wiki/Form_SF-312

o Oregon 653.295: http://www.ncsl.org/programs/employ/non-compete-03.htm

o South Dakota 53-9-11: http://www.ncsl.org/programs/employ/non-compete-03.htm

· Trade Secret Statutes

o Uniform Trade Secrets Act: http://www.law.upenn.edu/bll/archives/ulc/fnact99/1980s/utsa85.htm

o US Code Title 18, § 1832. Theft of trade secrets: http://www4.law.cornell.edu/uscode/18/1832.html

o US Code Title 42, § 11042. Trade secrets: http://www4.law.cornell.edu/uscode/search/display.html?terms=trade%20secret&url=/uscode/html/uscode42/usc_sec_42_00011042----000-.html

o US Code Title 18, § 1905. Disclosure of confidential information generally: http://www4.law.cornell.edu/uscode/18/1905.html

· Wiretapping Statutes

o US Code TITLE 18 > PART I > CHAPTER 119 > § 2510 Wiretap Statute: http://www.law.cornell.edu/uscode/18/2510.html

o USA PATRIOT Act: http://en.wikipedia.org/wiki/USA_PATRIOT_Act

o Foreign Intelligence Surveillance Act: http://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act

o Electronic Communications Privacy Act: http://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act

o Communications Assistance for Law Enforcement Act: http://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act

o Federal Laws: http://www.ncsl.org/programs/lis/cip/surveillance.htm#Federal

Individual Documents or Laws

· A Summary Guide: Public Law, Executive Orders, And Policy Documents: http://csrc.nist.gov/groups/SMA/fasp/documents/pm/legal-requirements.doc

· Access Device Fraud Act: http://www.mpcfaculty.net/leandro_castillo/BeattyPowerPoiints/IntroBL2005-Ch07.ppt

· Citizen's Guide to United States Federal Exploitation and Obscenity Laws: http://www.usdoj.gov/criminal/ceos/citizensguide_porn.html

· Communications Act: http://www.fcc.gov/Reports/1934new.pdf

· Communications Assistance for Law Enforcement Act – CALEA: http://www.askcalea.net/

· Communications Decency Act: http://thomas.loc.gov/cgi-bin/query/F?c104:1:./temp/~c1045u3XR6:e760:

· Computer Fraud and Abuse Act: http://www.mpcfaculty.net/leandro_castillo/BeattyPowerPoiints/IntroBL2005-Ch07.ppt

· Computer Security Act: http://epic.org/crypto/csa/csa.html

· Conspiracy to Defraud the US Government: http://www2.northumberland.gov.uk/fraud/Documents/SFO%20Factsheets/Conspiracy%20to%20defraud.pdf

· Department of the Treasury Directive 87-05, Electronic Commerce Initiatives: http://www.ustreas.gov/regs/td87-05.htm

· Department of the Treasury Security Manual: http://www.ustreas.gov/regs/td71-10.htm

· Digital Millennium Copyright Act: http://thomas.loc.gov/cgi-bin/query/z?c105:H.R.2281.ENR:

· Economic Espionage Act: http://www4.law.cornell.edu/uscode/18/1831.html

· Electronic Communications Privacy Act: http://legal.web.aol.com/resources/legislation/ecpa.html

· Electronic Freedom Of Information Act: http://epic.org/open_gov/efoia.html

· Executive Order 12333, United States Intelligence Activities: http://www.defenselink.mil/atsdio/documents/eo1233.html

· Executive Order 12472, Assignment Of National Security And Emergency Preparedness Telecommunications Functions: http://www.fas.org/irp/offdocs/eo/eo-12472.htm

· Executive Order 12958, Classified National Security Information: http://www.whitehouse.gov/news/releases/2003/03/20030325-11.html

· Executive Order 13010, Critical Infrastructure Protection: http://www.fas.org/irp/offdocs/eo13010.htm

· Executive Order 13011, Federal Information Technology: http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=1996_register&docid=fr19jy96-133.pdf

· Executive Order 13103, Computer Software Piracy: http://www.bsagovernment.com/downloads/guidelinesForImplimenting.pdf

· Executive Order 13228, Establishing The Office Of Homeland Security And The Homeland Security Council: http://www.whitehouse.gov/news/releases/2001/10/20011008-2.html

· Executive Order 13231, Critical Infrastructure Protection In The Information Age: http://www.whitehouse.gov/news/releases/2001/10/20011016-12.html

· Federal IT Security Assessment Framework: http://csrc.nist.gov/drivers/documents/Federal-IT-Security-Assessment-Framework.pdf

· Federal Managers Financial Integrity Act: http://www.whitehouse.gov/omb/financial/fmfia1982.html

· Federal Property and Administration Service Act: http://en.wikipedia.org/wiki/Federal_Property_and_Administrative_Services_Act_of_1949

· Federal Records Act: http://www.ed.gov/policy/gen/leg/fra.html

· Fifth Amendment of the US Constitution: http://caselaw.lp.findlaw.com/data/constitution/amendment05/

· Financial Modernization Act (Gramm – Leach – Bliley Act): http://www.ftc.gov/privacy/privacyinitiatives/glbact.html

· First Amendment of the US Constitution: http://caselaw.lp.findlaw.com/data/constitution/amendment01/

· FISMA (Federal Information Security Management Act): http://csrc.nist.gov/drivers/documents/FISMA-final.pdf

· Foreign Intelligence Surveillance Act: http://www.fas.org/irp/agency/doj/fisa/

· Fourth Amendment of the US Constitution: http://caselaw.lp.findlaw.com/data/constitution/amendment04/

· Freedom Of Information Act (FOIA): http://www.gwu.edu/~nsarchiv/nsa/foia.html

· General Accounting Office, Federal Information System Controls Audit Manual: http://www.gao.gov/products/GAO-08-1029G

· General Accounting Office, Information Security Risk Assessment Practices of Leading Organizations: http://oai.dtic.mil/oai/oai?&verb=getRecord&metadataPrefix=html&identifier=ADA391082

· Government Paperwork Elimination Act: http://www.whitehouse.gov/omb/fedreg/gpea2.html

· Health Insurance Portability and Accountability Act: http://www.cms.hhs.gov/HIPAAGenInfo/Downloads/HIPAALaw.pdf

· Identity Theft and Assumption Deterrence Act: http://www.ftc.gov/os/2000/09/idthefttest.htm

· Information Security Reform Act: http://www.dodig.osd.mil/Audit/reports/fy02/02093sum.htm

· Information Technology Management Reform Act: http://govinfo.library.unt.edu/npr/library/misc/itref.html

· National Archives and Records Act: http://www.archives.gov/about/history/anniversary/introduction.html

· National Infrastructure Protection Act: http://epic.org/security/1996_computer_law.html

· National Security Directive 42, National Policy for the Security of National Security Telecommunications and Information Systems: http://www.cnss.gov/Assets/pdf/CNSSD-502.pdf

· National Security Presidential Directive 1, Organization of the National Security System: http://www.legislationline.org/legislation.php?tid=46&lid=8374&less=false

· National Stolen Property Act: http://www.usdoj.gov/usao/eousa/foia_reading_room/usam/title9/crm01311.htm

· OMB M-00-07, Incorporating and Funding Security in Information Systems Investments: http://clinton3.nara.gov/OMB/memoranda/m00-07.html

· OMB M-00-13, Privacy Policies and Data Collection on Federal Web Sites: http://www.whitehouse.gov/omb/memoranda/m00-13.html

· OMB M-01-08, Guidance on Implementing the Government Information Security Reform Act: http://www.whitehouse.gov/omb/memoranda/m01-08.pdf

· OMB M-01-24, Reporting Instructions for the Government Information Security Reform Act: http://www.whitehouse.gov/omb/memoranda/m01-24.pdf

· OMB M-02-01, Guidance for Preparing and Submitting Security Plans of Action and Milestones: http://www.whitehouse.gov/omb/memoranda/m02-01.html

· OMB M-99-18, Privacy Policies on Federal Web Sites: http://www.whitehouse.gov/omb/memoranda/m99-18.html

· OMB M-99-20, Security of Federal Automated Information Resources: http://www.whitehouse.gov/omb/memoranda/m99-20.html

· Omnibus Crime Control and Safer Streets Act: http://en.wikipedia.org/wiki/Omnibus_Crime_Control_and_Safe_Streets_Act_of_1968

· Paperwork Reduction Act: http://www.archives.gov/federal-register/laws/paperwork-reduction/3501.html

· Presidential Decision Directive 29, Security Policy Coordination: http://www.fas.org/sgp/spb/pdd29.html

· Presidential Decision Directive 39, Secret, U.S. Policy on Counterterrorism: http://www.fas.org/irp/offdocs/pdd39.htm

· Presidential Decision Directive 62, Combating Terrorism: http://www.fas.org/irp/offdocs/pdd-62.htm

· Presidential Decision Directive 63, Protecting America's Critical Infrastructures: http://www.fas.org/irp/offdocs/pdd-63.htm

· Presidential Directive 24, Telecommunications Protection Policy: http://www.jimmycarterlibrary.org/documents/pddirectives/pd24.pdf

· Privacy Act: http://www.usdoj.gov/oip/privstat.htm

· Racketeer Influenced and Corrupt Organizations Act: http://www.answers.com/topic/rico-law

· Sarbanes Oxley Act: http://fl1.findlaw.com/news.findlaw.com/hdocs/docs/gwbush/sarbanesoxley072302.pdf

· Telecommunications Act: http://www.crtc.gc.ca/ENG/LEGAL/TELECOM.HTM

· Trafficking in Counterfeit Goods and Services Statutes: http://www.supremelaw.org/copyrite/statutes/anticounterfeiting.pdf

· Treasury Memo: Office of the CIO Memorandum Subject: Guidance for Systems Security Plans: http://www.whitehouse.gov/omb/memoranda/fy2007/m07-19.pdf

· USA PATRIOT Act: http://epic.org/privacy/terrorism/hr3162.html