So, we're going to talk about a couple of the U.S.
laws related to cyber crime and illegal online activities.
The first one is the U.S. Computer Fraud and
Abuse Act, that's CFAA, actually goes back a while.
But the goal of this law or this act, was to define
what is criminal, when it comes to things that you do online.
So, various types of online abuse.
And then define criminal sanctions against those kind of actions or
activities.
That constitute abuse or fraud.
So, it really covers unauthorized access to computers.
So, you're not allowed to be some place in the physical world,
we have laws like that.
Here we're sort of trespassing somebody's computer that
is connected to the internet and we can reach out to it.
So computer obviously has things of value that you are after.
If you happen to the the cyber criminal,
that's who is being targeted by this law.
So I said it goes back a while,
initially it was rather net-over it was trying to protect.
It's sort of multuation came from national security, national defense.
So, it's saying if you gain unauthorized access to a computer
that has data related to national defense.
That is illegal.
This was then extended to financial data,
because people do care about their money.
And criminals, cyber criminals actually after money.
They want to steal your online account or
steal credit card information and so on.
If you access either defense related or
financial data and the access is unauthorized.
CFAA says that that's an illegal act.
So, what exactly is unauthorized access?
Unauthorized access essentially, is getting hold of this data,
gaining access to it.
So remember, when it comes to data we had the confidentiality,
integrity and availability requirements.
That we had the CIA requirements,
that we had to find when you talk about securing data.
So, gaining access to it,
you're able to see the data that you shouldn't be able to see.
Use it, for example,
of financial gain modification is affecting its integrity, corrupting it.
Destroying is exactly that,
disclosure is to anybody who's not authorized to see it and so on.
If all this is done when the system under consideration happens to be
a government system.
Well that's how CFAA started, so
this basically is saying the law covers access to information.
Modification, we're not allowed to do so and
using that information in any shape and form.
Destroying it, affecting availability,
that's what you would do with this, is illegal.
So, this one initially was something that is operated by or
on behalf, so it could be a contractor or the US government.
But this, as a history this was broadened to include any computer.
The language is any protected computer,
basically a protected computer is any computer that's connected the Internet.
So, a protected computer, if you access it without permission, and
gain access to the data, or destroy it.
Or corrupt it while you're committing an illegal act.
It then actually keeps getting more and more specific.
Transmitting code or malware, malicious software that can damage a computer,
well that's illegal as well.
And finally,
it specifically addresses passwords that I'd use to gain access to computers.
So, if you steal a truckload of passwords and
want to sell them on the black market, the underground market.
That's trafficking in computer passwords and
if you did that, that would be illegal as well.
So, accessing data that is not yours in various forms.
Infecting computers with malicious software, trafficking in passwords that
allow others to gain access to computers that are protected.
All those things are covered under the Computer Fraud and
Abuse Act that we have in the United States.