- [Instructor] While most of the laws related
to information security fall into the categories
of civil and administrative law,
occasionally, we cross paths with criminal law.
Cases of information theft, system intrusion,
identity theft, and other crimes are harmful to society
and may trigger criminal sanctions.
The Computer Fraud and Abuse Act, or CFAA,
is a criminal law that makes it a federal offense
to engage in many types of hacking activity.
Specifically, the CFAA prohibits unauthorized access
to any computer system that is engaged
in interstate commerce, and that basically applies
to any computer system that exists.
CFAA also prohibits the creation of malicious code
that might cause damage to a protected computer system.
There are many nuances to this law,
but the bottom line is that CFAA
makes hacking a criminal offense,
punishable by fine and/or imprisonment.
The Electronic Communications Privacy Act, or ECPA,
restricts the government interception
of communications and stored information.
That includes telephone calls,
network transmissions, email messages,
and pen registers that log records of communications.
Under the ECPA, the government
must meet stringent requirements
before receiving a search warrant
for electronic communications.
The Identity Theft and Assumption Deterrence Act
makes it a federal crime to steal an individual's identity.
This includes using or possessing false identification
and transferring or using identity information
without consent with the intent of committing fraud.
Violations of the Identify Theft
and Assumption Deterrence Act are punishable
by 15 years of imprisonment and a fine of up to $250,000.