6th European Conference - Academic Conferences

Tanya Zlateva et al.
security breaches lose an average of 2.1% of their market value within two days and subsequent
studies confirmed the sensitivity of financial performance from security breaches.
The threat of cyber espionage and cyber war is not anymore restricted to expert forums but has
become part of the public discussion. The increased number and sophistication of cyber-attacks
clearly indicate that these attacks originate from professionally run business and government
organizations. Estimates about the degree of the threat may vary—Clarke (2010) posits that cyber
armies are being set up in Russia, China Israel, North Korea and Iran while others believe the goal is
espionage not cyber . However, no one disputes the large negative impact an information security
breach can cause to the economy, government, or the individual.
These development trends clearly indicate that cyber law, business continuity and risk management
provide an indispensable context for framing information security problems and are an integral part of
finding effective solutions. A collaborative effort between the BU MET Computer Science and
Administrative Sciences Department is currently under way for developing a new course in cyber law
and for coordinating the curriculum of the information security concentrations in the MS program in
CS, CIS, and TC with an existing graduate certificate and specialization in Business Continuity,
Security and Risk Management (Boston University 2010b).
4.1 Law and regulation of information security
As technology evolves so must the law. The alleged obsolescence of legal rules in computers and the
Internet among other technologically advanced fields is well recognized in legal scholarship (Moses
2007; Downing 2005). Because the resolution of legal problems are typically left to the chosen dispute
resolution bodies, it is most important to identify in advance the types of legal problems that frequently
follow technological change (Moses 2007; Lessig 1995). Some of the more important questions
arising in relation to information security include:
Defining the technological advancements needed to secure greater protections to the citizens and
communities from cyber-attacks;
Determining who can best regulate the Internet environment and control activity in cyberspace in
a sovereign world;
Constructing with law enforcement and the intelligence communities, an effective means of
sharing actionable information with the private sector (Chander 2002);
Establishing an ethics and conflict policy governing cyber activity and information security to
address cultural change; and
Understanding the ways in which the rise of online interaction alters the balance of power among
individuals, corporations, and government, and how our choice of legal regime should be
influenced by these changes (Chander 2002).
We approach the development of the new information security course by framing a course
methodology and structuring the topics around the areas of the global regulatory environment,
computer crime regulations in the US, jurisprudence over cyber space, culture and information
security, cyber forensics and internet evidence, and international responsibility.
Framing an Information Security Law Curriculum Methodology.
Significantly, the global economy has expanded our vulnerability to manipulation of our software and
hardware through a new phenomena known as "the global supply chain" which increases the number
of actors and the complexity of understanding the legal environment from both a domestic and global
perspective. Technology today passes through many hands including design, manufacture,
distribution, transportation, wholesaler, retailer, installer, repair service and firmware update. To
prevent these vulnerabilities we must focus on better system design, supply chain management,
information security practices, public private partnerships, law enforcement, intelligence and most
important the education of users, employees and management.
The primary pedagogical approach to teaching security information law at Boston University is
through the Socratic method. Diverse Socratic methodologies are used to develop critical thinking
skills including inquiry and debate, examination of complex real-life cybersecurity problems and
ethical concerns, and conflict and contractual analysis, The case studies are derived primarily from
272