State of the Practice of Computer Security Incident Response Teams ...

Furthermore, CSIRT members must be familiar with any laws or regulations that may affect
their incident response and coordination efforts, such as requirements to notify others in the
event of a security breach. (For example, a 2003 law in the state of California requires anyone
who “conducts business” with any California resident to disclose any breach of security
of a system involving the unauthorized acquisition of the resident’s unencrypted personal information.
116 ) Several specific laws and regulations will be mentioned in the next sections.
In recent years, guidelines and standards for obtaining and handling computer evidence have
been developed by a number of sources. For example, the International Organization on
Computer Evidence (IOCE) 117 developed a short set of principles for standardizing the recovery
of computer-based evidence. 118 In the United States, the Department of Justice has published
detailed manuals for “Searching and Seizing Computers and Obtaining Electronic Evidence
in Criminal Investigations” 119 and the National Institute of Justice (NIJ) guide
“Electronic Crime Scene Investigation: A Guide for First Responders.” 120
The U.S. Secret Service and the International Association of Chiefs of Police 121 have published
“Best Practices for Seizing Electronic Evidence.” 122 And the Internet Society has published
a Best Current Practice (BCP 55/RFC 3227) on “Guidelines for Evidence Collection
and Archiving.” 123
As applicable laws may be varied and numerous, and the interpretation of some laws might
not be obvious or straightforward, it is highly recommended to seek the guidance of knowledgeable
legal counsel, as well as management, in determining the response to a computer
security incident. Such legal guidance should be incorporated into all incident response policies
and procedures. Because of this, it is often recommended that a team should look to establish
a working relationship with local law enforcement and with their own legal counsel.
3.9.1 International Cyber Crime Laws
It is still the case that many nations do not yet have effective laws to address computer
crimes. But recent efforts by a number of different countries and organizations are setting the
stage for the harmonization of substantive and procedural laws among multiple nations, and
116
117
118
119
120
121
122
123
California Civil Code Section 1798.82
CMU/SEI-2003-TR-001 115