State of the Practice of Computer Security Incident Response Teams ...

3.9.2 United States Cyber Crime Laws
In the United States, the Computer Fraud and Abuse Act (18 U.S.C. 1030 140 ) has been one of
the primary legal instruments for fighting computer intrusions. In addition to the offenses
outlined in Section 1030, dealing with unauthorized access to computers, other sections of
Title 18 of the United States Code describe other federal offences related to activity in connection
with access devices, destruction and denial of service, and unlawful access to transmitted
or stored communications. The U.S. Department of Justice, Computer Crime and Intellectual
Property Section (CCIPS), has created a web site to provide information about
computer crime and intellectual property crime laws, policies, cases, and other documents.
(See list of laws and URLs in Appendix D.)
At the state level, individual states have also created their own legislation addressing computer
crime activity within their jurisdictions. Most state laws are available online, and a
number of sites that provide links to state computer crime laws are included in Appendix D.
In addition to the above federal and state statutory laws, some industries or sectors may also
be subject to additional federal regulations or special requirements that relate to information
security, data protection, and privacy issues in their particular industry or sector. For example,
in the United States, health insurance and health care providers and the financial services industry
(including banks and insurance companies) are required to protect consumer data and
establish safeguards to protect the privacy and disclosure of nonpublic personal information,
as outlined in the Health Insurance Portability and Accountability Act) (HIPAA) 141 and the
Gramm-Leach-Bliley Act, 142 respectively. And U.S. federal government agencies are responsible
for ensuring the information security of their systems, including performing annual independent
evaluations, as outlined by the Federal Information Security Management Act
(part of the E-Government Act of 2002). 143 Under FISMA, all U.S. federal agencies are also
required to establish an incident response capability and procedures for detecting, reporting,
and responding to security incidents.
3.10 Current Projects
140
141
142
143
Throughout the CSIRT and computer security community many interesting projects are being
organized that may be of benefit to other CSIRTs. This benefit may range from the introduc-
Search the United States Code for a specific section at .
118 CMU/SEI-2003-TR-001