Computer Security And The Law Essay, Research Paper

Computer Security and the Law

Computer Security and the Law

Table of Contents

Part I Introduction Page 1

Part II The Technological Perspective Page 2

A. The Objectives of Computer Security Page 2

B. Basic Concepts Page 2 4

C. Computer Security Requirements Page 4

Part III The Legal Perspective Page 5

A. Sources of Computer Law Page 5

B. Current Views on Computer Crime Page 5 7

Part IV Conclusion Page 7

References / Works Cited Page 8

Computer Security and the Law

I. Introduction

You are a computer administrator for a large manufacturing company. In the middle of a production run, all of the mainframes on a crucial network grind to a halt. Production is

delayed costing your company hundreds of thousands of dollars. Upon investigating, you find that a virus was released into the network through a specific account. When you confront the owner of the account, he claims he neither wrote nor released the virus, but admits that he has distributed his password to “friends” who need ready access to his data files. Is he liable

for the loss suffered by your company? In whole, or in part? And if in part, for how much? These and related questions are the subject of computer security law. The answers may vary depending on the state in which the crime was committed and the judge who presides at the trial. Computer security law is a new field, and the legal establishment has yet to reach broad agreement on many key issues. Even the meaning of such basic terms as “data” can be

the subject of contention.

Advances in computer security law have been impeded by the reluctance on the part of lawyers and judges to grapple with the technical side of computer security issues [1]. Involving technical computer security professionals in the development of computer security law and public policy could mitigate this problem. This article is meant to help bridge the gap between the technical and legal computer security communities by explaining key technical ideas behind computer security for lawyers and presenting some basic legal background for technical professionals.

II. The Technological Perspective

A. The Objectives of Computer Security

The principal objective of computer security is to protect and assure the confidentiality, integrity, and availability of automated information systems and the data they contain. Each of

these terms has a precise meaning, which is grounded in basic technical ideas about the flow of information in automated information systems.

B. Basic Concepts

There is a broad, top-level consensus regarding the meaning of most technical computer security concepts. This is partly because of government involvement in proposing, coordinating, and publishing the definitions of basic terms [2]. The meanings of the terms used in government directives and regulations are generally made to be consistent with past usage. This is not to

say that there is no disagreement over definitions in the technical community. Rather, the range of such disagreement is much narrower than in the legal community. For example, there is

presently no legal consensus on exactly what constitutes a computer [3].

The term used to establish the scope of computer security is “automated information system,” often abbreviated “AIS.” An AIS is any assembly of electronic equipment, hardware, software, and firmware configured to collect, create, communicate, disseminate, process, store, and control data or information. This includes numerous items beyond the central processing unit and associated random access memory, such as input/output devices (keyboards, printers, etc.)

Every AIS is used by subjects to act upon objects. A subject is any active entity that causes information to flow among passive entities called objects. For example, subject could be a person typing commands, which transfer information from a keyboard (an object) to memory (another object), or a process running on the central processing unit that is sending

information from a file (an object) to a printer (another object).

Confidentiality is roughly equivalent to privacy. If a subject circumvents confidentiality measures designed to prevent its access to an object, the object is said to be “compromised.”

Confidentiality is the most advanced area of computer security because the U.S. Department of Defense has invested heavily for many years to find ways to maintain the confidentiality of

classified data in AIS [4]. This investment has produced the Department of Defense Trusted Computer System Evaluation Criteria [5], alternatively called the Orange Book after the

color of its cover. The Orange Book is perhaps the single most authoritative document about protecting the confidentiality of data in classified AIS.

Integrity measures are meant to protect data from unauthorized modification. Comparing its current state to its original or intended state can assess the integrity of an object. An object, which has been modified by a subject without proper authorization, is said to be “corrupted.” Technology for ensuring integrity has lagged behind that for confidentiality [4]. This is because the integrity problem has until recently been addressed by restricting access to AIS to trustworthy subjects. Today, the integrity threat is no longer tractable exclusively through access control. The desire for wide connectivity through networks and the increased use of

commercial-off-the-shelf software has limited the degree to which most AISs can trust its subjects. Work in integrity has been accelerating over the past few years, and will likely become as important a priority as confidentiality in the future.

Availability means having an AIS and its associated objects accessible and functional when needed by its user community. Attacks against availability are called denial of service

attacks. For example, a subject may release a virus, which absorbs so much processor time that the AIS becomes overloaded. This area is by far the least well developed of the three

security properties, largely for technical reasons involving the formal verification of AIS designs [4]. Although such verification is not likely to become a practical reality for many years, techniques such as fault tolerance and software reliability are used to mitigate the effects of denial of service attacks.

C. Computer Security Requirements

Labeling the subjects and objects in an AIS and regulating the flow of information between achieve the three security properties of confidentiality, integrity, and availability

them according to a predetermined set of rules called a security policy. The security policy specifies which subject labels can access which object labels. For example, suppose you went

shopping and had to present your driver’s license to pick up some badges assigned to you at the entrance, each listing a brand name. The policy at this store is that you can only buy brand

names listed on one of your badges. At the check-out line, the cashier compares the brand name of each object you want to buy with the names on your badges. If there’s a match, she rings it

up. But if you choose a brand name, which doesn t appear, on one of your badges, she puts it back on the shelf. You could be sneaky and alter a badge, or pretend to be your neighbor who has more badges than you, or find a clerk who will turn a blind eye. No doubt the store would employ a host of measures to prevent you from cheating. The same situation exists on secure computer systems. Security measures are employed to prevent illicit tampering with labels, positively identify subjects, and provide assurance that the security measures are doing the job correctly. A comprehensive list of minimal requirements to secure an AIS are

presented in the Orange Book [5].

III. The Legal Perspective

A. Sources of Computer Law

The three branches of government, legislative, executive and judicial, produce quantities of computer law, which are inveresly proportional to the amount of coordination needed

for its enactment. The legislative branch, consisting of the Congress and fifty state legislatures, produce the smallest amount of law, which is worded in the most general terms. For

example, the Congress may pass a bill mandating that sensitive information in government computers must be protected. The executive branch, consisting of the Executive Office of the

President and numerous agencies, issues regulations which implement the bills passed by legislatures. Thus, the Department of Commerce may issue regulations, which establish criteria for determining when economic information is sensitive, and describe how it must be protected. Finally, the judicial branch serves as an avenue of appeal and decides the meaning of the laws and regulations in specific cases. After the decisions are issued (and in some cases appealed) they are taken as the word of the law in legally similar situations.

B. Current Views on Computer Crime

Currently, there is no universal agreement in the legal community on what constitutes a computer crime. One reason is the rapidly changing state of computer technology. For example,

in 1979, the U.S. Department of Justice publication [6] partitioned computer crime into three categories: 1) Computer abuse, “the broad range of international acts involving a computer where one or more perpetrators made or could have made gain and one or more victims suffered or could have suffered a loss;” 2) Computer crime, “illegal computer abuse [that] implies

direct involvement of computers in committing a crime;” and 3) Computer-related crime, “any illegal act for which a knowledge of computer technology is essential for successful prosecution.” These definitions have become blurred by the vast proliferation of computers and computer related products over the last decade. For example, does altering an inventory bar code at a store constitute computer abuse? Should a person caught in such an act be prosecuted under both theft and computer abuse laws? Clearly, advances in computer technology should be

mirrored by parallel changes in computer law.

Another attempt to describe the essential features of computer crime has been made by Wolk and Luddy [1]. They claim that the majority of crimes committed against or with the use of

a computer can be classified as follows:

1) Sabotage: “Involves an attack against the entire [computer] system or against its subcomponents, and may be the product of foreign power involvement or penetration by a

competitor…”

2) Theft of services: “Using a computer at someone else’s expense.”

3) Property crimes involving the “theft of property by and through the use of computers.” [7]

A good definition of computer crime should capture all acts, which are criminal and involve computers and only those acts. Assessing the completeness of a definition seems problematic, but is tractable using technical computer security concepts. For example, consider the following matrix:

Threat Confidentiality Integrity Availability

Sabotage X X

Theft of Services X

Property Crimes X X

This shows that Wolk and Luddy’s categorization is strong with respect to availability and weaker in the areas of confidentiality and integrity. Indeed, upon closer examination

it becomes apparent that there are ways to violate confidentiality and integrity which do not constitute sabotage, theft of services, or property crimes. For example, a Trojan horse could append code to a word processor, which sends copies of a user’s confidential text as messages to the perpetrator’s electronic mailbox. This isn’t sabotage because no AIS functionality was destroyed or even altered; theft of services does not apply if the perpetrator is paying for his electronic mail account; and unless the confidential text was copyrighted, it is not a property crime. This analysis is significant because it demonstrates that examining a legal concept from a technical perspective can yield insights into its strengths and weaknesses and even suggest avenues for improvement.

IV. Conclusion

The development of effective computer security law and public policy cannot be accomplished without cooperation between the technical and legal communities. The inherently abstruse nature of computer technology and the importance of the social issues it generates demand the combined talents of both. At stake is not only a fair and just interpretation of the law as it pertains to computers, but more basic issues involving the protection of civil rights. Technological developments have challenged these rights in the past and have been met with laws and public policies, which have regulated their use. For example, the invention of the telegraph and telephone gave rise to privacy laws pertaining to wire communications. We need to meet advances in automated information technology with legislation that preserves civil liberties and establishes legal boundaries for protecting confidentiality, integrity, and assured service. Legal and computer professionals have a vital role in meeting this challenge together.

Works Cited

[1] Stuart R. Wolk and William J. Luddy Jr., “Legal Aspects of

Computer Use,” Prentice Hall, 1986, pg. 129.

[2] National Computer Security Center, “Glossary of Computer

Security Terms,” 21 October 1988.

[3] Thomas R. Mylott III, “Computer Law for the Computer

Professional,” Prentice Hall, 1984, pg. 131.

[4] Gasser, Morrie, “Building a Secure Computer System,” Van

Nostrand, 1988.

[5] Department of Defense, “Department of Defense Trusted

Computer System Evaluation Criteria,” December 1985.

[6] United States Department of Justice, “Computer Crime,

Criminal Justice Resource Manual,” 1979.

[7] Wolk and Luddy, pg. 117.