TechFite Case Study: Cybercrime, Negligence & Cyber Law

Application of Relevant Cybercrime Laws

The Computer Fraud and Abuse Act (CFAA) and the Electronic Communications Privacy Act (ECPA) are foundational laws in the U.S. legal framework governing computer and network activities. Both statutes directly address the criminal activities discovered within TechFite's Applications Division.

The CFAA, codified in 18 U.S.C. §1030, was introduced to combat unauthorized access to computer systems and networks. This act makes it unlawful to gain unauthorized access to or use a protected computer beyond what is permitted, especially when it is being utilized for theft or fraudulent activities (Thomas, 2023). Evidence in the TechFite case shows that employees, including Sarah Miller and Jack Hudson, used privileged accounts to access systems without authorization. This resulted in the unapproved interception of private financial records from several departments. These actions, particularly the unauthorized access to competitors' networks using the Metasploit penetration testing tool, clearly violate the CFAA (Okuh, 2010). The division's activities qualify as unlawful under this act, as they involved "dumpster diving" and infiltrating private business networks without authorization (Walden, 2007).

The ECPA, passed in 1986, provides wiretap protections through its electronic communication provisions, prohibiting the interception or disclosure of a communication without proper authorization (18 U.S.C. §§2510–2522) (Gudgel, 2013). In the TechFite case, the unauthorized access to internal emails, executive communications, and other employees' sensitive client data without necessary supervision constitutes ECPA violations. It is unlawful to perform such interceptions, and organizations are required to ensure that electronic communications are secure. The lack of controls to monitor internal email traffic between divisions further violates ECPA protections (Martin & Cendrowski, 2014). Furthermore, the use of legitimate operations as cover to obtain unauthorized access to sensitive information demonstrates a clear disregard for the law.

Laws and Regulations Supporting Negligence Claims

The following laws and regulations support the position that TechFite should be held liable for negligence in the handling of client sensitive data. Cyber negligence is defined as the failure to exercise reasonable care to avoid harm where there are inadequate information security precautions (O'Dell, 2023).

The GDPR is a European Union regulation that sets high standards for handling the personal data of EU citizens for organizations across the globe. Its broad jurisdiction means any organization processing data of EU residents must comply with its standards. TechFite violates the GDPR if its clientele consisted of individuals or businesses in the EU and the company failed to implement data segregation and data loss prevention (DLP) procedures. In particular, GDPR Article 32 mandates the adoption of measures to guarantee a degree of security appropriate to the risk, including pseudonymization and encryption of personal information (Schwartz & Solove, 2021). Neglecting these security requirements could lead to substantial penalties under the GDPR, based on the harm caused to clients such as Orange Leaf Software and Union City Ventures, whose proprietary information was compromised (Chimes & Sankar, 2014).

Section 5 of the FTC Act prohibits "unfair or deceptive acts or practices" in commerce. Failure to implement effective data security measures can be classified as unfair or deceptive, particularly when clients are led to believe their proprietary data is secure (Kolasky, 2014). TechFite's failure to adequately protect client information from breaches — especially after promising to do so via nondisclosure agreements (NDAs) — would likely be seen as deceptive under the FTC's standards. This would justify legal action on grounds of negligence in data protection practices, as reflected in the FTC's frequent enforcement actions for similar lapses in cybersecurity (Cooper & Kobayashi, 2022).

In tort law, companies are required to meet a duty of care to avoid negligence in handling sensitive information. The Restatement (Second) of Torts, §282, defines negligence as the failure to act reasonably to prevent foreseeable harm (Robinette, 2018). In TechFite's case, the lack of proper safeguards for client data, failure to monitor internal traffic, and absence of data segregation represent a breach of this duty of care. TechFite should have foreseen the potential harm caused by the lack of internal controls and properly addressed the associated risks (Moore, 2018).

Instances of Lack of Duty of Due Care

Due care is fundamental to managing information security risks. TechFite failed in at least the following two areas:

There is a clear lack of duty of due care in the absence of a process — commonly known as a "Chinese wall" — to restrict access to client data. Without proper access restrictions, TechFite allowed client information to be accessed by individuals within the company who could misuse it. This directly led to the leakage of Orange Leaf Software and Union City Ventures data, making the company responsible for negligence (Kumar et al., 2016).

The second instance of negligence involves the lack of proper supervision of user accounts, particularly those with administrator access. Because there were no internal audit and monitoring activities within the organization, the creation of additional accounts by Carl Jaspers and their use in suspicious activities went undetected. A reasonable standard of care would have included regular audits and enforcement of the principle of least privilege, neither of which was followed (Haber, 2020).

References

Bryan, E., & Larsen, A. (2017). Cybersecurity policies and procedures. The Cyber Risk Handbook, 35–65.

Chimes, M., & Sankar, P. (2014). Confidential and proprietary information. The IACUC Handbook, Third Edition, 503–538.

Cooper, J., & Kobayashi, B. (2022). Unreasonable: A strict liability solution to the FTC's data security problem. Michigan Technology Law Review, (28.2), 257. https://doi.org/10.36645/mtlr.28.2.unreasonable

Gudgel, J. (2013). Internet privacy policy paradoxes: The Electronic Communications Privacy Act (ECPA) Amendments Act of 2013 & the Consumer Privacy Bill of Rights of 2012. SSRN Electronic Journal.

Gupta, P. P., Sami, H., & Zhou, H. (2016). Do companies with effective internal controls over financial reporting benefit from Sarbanes–Oxley Sections 302 and 404? Journal of Accounting, Auditing & Finance, 33(2), 200–227.

Haber, M. J. (2020). Privileged attack vectors. Privileged Attack Vectors, 1–10. https://doi.org/10.1007/978-1-4842-5914-6_1

Koehler, T. R. (2017). Espionage. Understanding Cyber Risk, 1–11.

Kolasky, W. (2014). "Unfair methods of competition": The legislative intent underlying Section 5 of the Federal Trade Commission Act. SSRN Electronic Journal.

Kumar, K. M., Tejasree, S., & Swarnalatha, S. (2016). Effective implementation of data segregation & extraction using Big Data in e-health insurance as a service. 2016 3rd International Conference on Advanced Computing and Communication Systems (ICACCS). https://doi.org/10.1109/icaccs.2016.7586323

Martin, J. P., & Cendrowski, H. (2014). Electronic Communications Privacy Act. Cloud Computing and Electronic Discovery, 55–74.

Moore, N. J. (2018). Restating intentional torts: Problems of process and substance in ALI's third restatement of torts. Journal of Tort Law, 10(2), 237–279. https://doi.org/10.1515/jtl-2017-0031

Moore, T. (2010). The economics of cybersecurity: Principles and policy options. International Journal of Critical Infrastructure Protection, 3(3–4), 103–117. https://doi.org/10.1016/j.ijcip.2010.10.002

O'Dell, E. (2023). Closing off the warren of negligence claims for data breaches. Data and Private Law, 161–174. https://doi.org/10.5040/9781509966059.ch-010

Okuh, O. C. (2010). When circuit breakers trip: Resetting the CFAA to combat rogue employee access. SSRN Electronic Journal.

Ribstein, L. E. (2002). Market vs. regulatory responses to corporate fraud: A critique of the Sarbanes-Oxley Act of 2002. SSRN Electronic Journal.

Robinette, C. J. (2018). Symposium issue: Appraising the restatement (third) of torts: Intentional torts to persons. Journal of Tort Law, 10(2), 155–157. https://doi.org/10.1515/jtl-2018-0002

Schwartz, P. M., & Solove, D. J. (2021). The EU General Data Protection Regulation (GDPR): A comprehensive review. International Data Privacy Law, 10(2), 77–91.

Thomas, A. J. (2023). Exceeding authorized access under the CFAA. The Open World, Hackbacks and Global Justice, 211–261. https://doi.org/10.1007/978-981-19-8132-6_7

Walden, I. (2007). Computer Crimes and Digital Investigations, 391–399.