Infosecsyllabus | Andrea M. Matwyshyn

INFORMATION SECURITY LAW

Prof. Andrea Matwyshyn

Welcome.

1. Overview:

This course describes the substantive law relevant to the field of information security or "infosec" law, commonly known to policymakers as "cybersecurity." It examines how courts, legislatures, and regulators confront the major legal issues that information security presents. Each week consists of three types of 'readings' - one set introduces you to a key aspect of the history and culture of information security; the second set introduces technical and policy standards ; the third consists of statutes and caselaw.

The early weeks in this class introduce you to the state of the law of information security and assist you in acquiring technical competence in the terms of art of the field. The later weeks in the course identify and frame current legal debates in Congress, state legislatures, regulatory agencies, and the business community on matters of information security.

2. Grading: 50% Final Project; 50% Participation.

Final Project:

- Select a transparency project related to this class (make me an offer or ask me for a suggestion) that will help consumers to be more informed about some aspect of infosec regulation, the infosec-related workings of an agency or some aspect of market dynamics related to this class. Think about aggregating existing streams of data in new and more useful ways and providing legal analysis related to the issues discussed in class. Here are some sample projects: https://www.andreamm.com/student-projects

- Using information you have learned in this class as well as outside research, demonstrate your mastery of infosec regulation by authoring a white paper with detailed commentary explaining the legal issues raised by your project in a way understandable to non-experts. The paper should be extensively footnoted and contain a bibliography of sources. (approximate 5-10 pages)

- Due at exam time for this period, turned in by each student on Blackboard.

Participation:

- Preparation when volunteering or cold-called in class and in class 'workshop 'exercises

- Participation in project presentations in class - 20 minutes per project on final day of class

- Leading class discussion on the day you are the discussion leader + Hot Topic presentation (choose a security topic from the last calendar week and tell the class about it - 5 minutes)

3. Reading Materials:

Mandatory:

- Movies listed on syllabus (part of your assigned reading - arrive prepared to discuss)

- Readings linked off this syllabus

Recommended:

- Brian Kernighan, Understanding the Digital World http://www.kernighan.org

- Steven Bellovin, Thinking Security: Stopping Next Year's Hackers, https://www.amazon.com/Thinking-Security-Addison-Wesley-Professional-Computing/dp/0134277546/ref=sr_1_1?ie=UTF8&qid=1480686609&sr=8-1&keywords=bellovin

4. Office Hours : After class for two hours and by appointment - please email to schedule: a.matwyshyn@neu.edu with InfoSec Law as your subject line.

5. Visitors: Visitors are welcome with prior consent of the instructor upon not less than 24 hours advance notice.

6. Technology policy:

- Blackboard will be used for various class communications. Please check daily.

- As an act of respect to fellow students, all gadgets must be on mute during class. Laptop usage is permitted only for pedagogical purposes. Participation points may be deducted in the sole discretion of the instructor for any class disruption.

* * *

Week 1: Introduction - Definitions; the relationship of information security/"cybersecurity" to privacy and national security

** LECTURE NOTES: https://digitalcommons.law.byu.edu/lawreview/vol2017/iss5/6/ and https://www.sup.org/books/extra/?id=16759&i=Introduction_pages&p=1 and https://papers.ssrn.com/sol3/papers.cfm?abstract_id=914783

History and Practice