Bảo mật hệ thống mạng part 8 ppt

STATE LAWS In addition to federal computer crime statutes, many states have also developed their own computer crime laws (see Figure 4-1). These laws differ from the federal laws with regard to what constitutes a crime (many do not have any minimum damage amount) and how the crime may be punished. Depending on where the crime occurred, local law enforcement may have more interest in the case than the federal authorities. Be sure to speak with your local law enforcement organization to understand their interest in and their capabilities to investigate computer crime. Table 4-1 provides a summary of the state laws. Keep in mind that state laws may change frequently and computer crime is an area of continued research and develop - ment. If you have specific questions about a particular statute, consult your organiza - tion’s general counsel or local law enforcement. Chapter 4: Legal Issues in Information Security 45 Figure 4-1. U.S. states with computer crime laws 46 Network Security: A Beginner’s Guide State Specific Computer Crimes Notes Alabama Offense against intellectual property No minimum damage level. A crime is committed if unauthorized access is even attempted. Alaska Criminal use of computer No minimum damage level. Attacker must obtain information concerning a person or introduce false information. Arizona Computer fraud No minimum damage amount. California Unauthorized access to computers No minimum damage level. Intent must be established. Colorado Computer crime If no information on the system is damaged or destroyed, there may not be a crime under Colorado law even if the system was accessed. Connecticut Unauthorized access to a computer system; theft of computer services; interruption of computer services; misuse of computer system information; destruction of computer equipment No minimum damage amount. Delaware Unauthorized access; theft of computer services; interruption of computer services; misuse of computer system information No minimum damage amount. Florida Offenses against intellectual property; offenses against computer equipment or supplies; offenses against computer users Broad interpretation of intellectual property and crimes against intellectual property. Table 4-1. Summary of State Computer Crime Laws Chapter 4: Legal Issues in Information Security 47 State Specific Computer Crimes Notes Georgia Computer theft; computer trespass; computer invasion of privacy; computer forgery; computer password disclosure Theft with or without the intent to deprive the owner is still a crime. No minimum damage amount except on password theft. Hawaii Computer fraud; unauthorized computer use Crimes are based on the amount of damage actually done. Idaho Computer crime No minimum damage amount. Illinois Computer tampering; aggravated computer tampering; computer fraud No minimum damage amount. Presumption of a crime if an access code was used by an unauthorized individual. Indiana Computer tampering; computer trespass No minimum damage amount. No concept of theft of information. Iowa Unauthorized access; computer damage; computer theft No minimum damage amount. Must have the intent to permanently deprive for theft to occur. Kentucky Unlawful access to a computer; misuse of computer information No minimum damage amount. Maryland Unauthorized access to computers No minimum damage amount. Theft of information is not a crime. Minnesota Computer damage; computer theft; unauthorized computer access Specifically targets distribution of viruses and Trojan Horse programs. Theft must cause the owner to be deprived of the use of the information. Table 4-1. Summary of State Computer Crime Laws (continued) 48 Network Security: A Beginner’s Guide State Specific Computer Crimes Notes Mississippi Computer fraud; offenses against computer users; offenses against computer equipment; offenses against intellectual property Copying information is a crime. Missouri Tampering with computer data; tampering with computer equipment; tampering with computer users Disclosing information or passwords is a crime. Possession of information received from a computer crime is also a crime. Nevada Unlawful acts regarding computers; unlawful interference with or denial of access to computers; forgery by modification of information on a computer; unlawful acts involving electronic mail Copying information is a crime. Changes to an e-mail header is a crime. New Jersey Computer-related theft No minimum damage amount. New Mexico Computer access with intent to defraud or embezzle; computer abuse; unauthorized computer use Unauthorized copying is a crime. New York Unauthorized use of a computer; computer trespass; computer tampering; unlawful duplication of computer-related material; criminal possession of computer-related material Copying information is a crime. North Carolina Accessing computers; damaging computers and related materials; denial of computer services to an authorized user No minimum damage amount. North Dakota Computer fraud Attempts to gain access are considered crimes. Ohio Unauthorized use of computer property Attempts to gain access are considered crimes. Table 4-1. Summary of State Computer Crime Laws (continued) Chapter 4: Legal Issues in Information Security 49 State Specific Computer Crimes Notes Oregon Computer crime Severity of the crime is dependent upon what was done, not how much damage was caused. Pennsylvania Unlawful use of computer Theft of information is not a crime. Rhode Island Access to computer for fraudulent purposes; intentional access, alteration, damage, or destruction; computer theft; computer trespass Unauthorized copying of files is a crime. Forging of e-mail headers to send bulk e-mails is a crime. Texas Breach of computer security; harmful access Perpetrator must know that a security system exists to prevent unauthorized access. Virginia Computer fraud; computer trespass; computer invasion of privacy; theft of computer services; personal trespass by computer; computer as instrument of forgery Unauthorized copying of files is a crime. Washington Computer trespass Severity is determined by the type of system being accessed. West Virginia Computer fraud; unauthorized access to computer services; unauthorized possession of computer data or programs; alteration or destruction of computer equipment; disruption of computer services; unauthorized possession of computer information; disclosure of computer security information; obtaining confidential public information; computer invasion of privacy; computer as instrument of forgery Unauthorized possession of information is a crime. Table 4-1. Summary of State Computer Crime Laws (continued) As you can see from the table, the concept of what constitutes a crime varies from state to state. Some states require that there must be an intent to permanently deprive the owner of access to information for computer theft to occur. Other states require that the owner of the information must actually be deprived of the information (so a backup of the information might negate the violation of the law). There is also a big difference when it comes to accessing systems. Some states require that the system must actually be accessed for the crime to occur. Other states make the unauthorized attempt to be the crime. Texas goes so far as to require the perpetrator to know that a security system is in place to prevent unauthorized access for there to be a crime. Finally, some states make the modifying or forging of e-mail headers to be a crime. This type of statute is directed at bulk e-mail or spam. No matter what state your organization is in, check with local law enforcement and with your organization’s general counsel so that you understand the ramifications of the local laws. This will directly impact when you may choose to notify law enforcement of a computer incident. EXAMPLES OF LAWS IN OTHER COUNTRIES Computer crime laws in the United States vary from state to state. Internationally, laws vary from country to country. Many countries have no computer crime laws at all. For ex - ample, when the ILOVEYOU virus was traced to an individual who lived in the Philip - pines, he could not be prosecuted because the Philippines did not have a law that made it a crime to write and distribute a computer virus. Computer crime laws in other countries may have an effect on computer crime inves - tigations in the United States as well. If an investigation shows that the attack came from a computer system in another country, the FBI will attempt to get assistance from the law enforcement organizations in that country. If the other country has no computer crime laws, it is unlikely that they will assist in the investigation. The following sections provide brief discussions of computer crime laws in three other countries. More specific information can be found by asking representatives of the foreign government (at an embassy or consulate) or by contacting the FBI. 50 Network Security: A Beginners‘s Guide State Specific Computer Crimes Notes Wisconsin Offenses against computer data and programs; offenses against computers, computer equipment, or supplies Copying of information is a crime. Table 4-1. Summary of State Computer Crime Laws (continued) TEAMFLY Team-Fly ® . crime is an area of continued research and develop - ment. If you have specific questions about a particular statute, consult your organiza - tion’s general counsel or local law enforcement. Chapter. deprived of the use of the information. Table 4-1. Summary of State Computer Crime Laws (continued) 48 Network Security: A Beginner’s Guide State Specific Computer Crimes Notes Mississippi Computer