A. Demonstrate your knowledge of an application of the law by doing the following:
A1. Explain how the Computer Fraud and Abuse Act and the Electronic Communications Privacy
Act each specifically relate to the criminal activity described in the case study.
Rapid advancement of technology has introduced both positive and negative aspects, with illicit
computer activities becoming increasingly prevalent. These activities, including hacking and
unauthorized access to computer systems, are addressed by the Computer Fraud and Abuse Act (CFAA),
a law designed to combat computer-related crime. The TechFite case study presents clear violations of
both the CFAA and ECPA. These violations include the fictitious companies' presence in Nevada,
which contravenes the CFAA. What's more, the associated banks are in Pennsylvania. Account
privilege issues arise from Carl Jaspers creating accounts for inactive employees, granting unauthorized
access to sensitive company and client data. This violates both account privilege and separation of
duties. The ECPA violations involve invasive monitoring of individuals, both within and outside the
company, through electronic devices. Sarah Miller and Jack Hudson engaged in illegal 'intelligence
gathering' by monitoring the network and unlawfully mining company’s trash. While no specific
findings were mentioned regarding Mrs. Rogers, her actions align with those of Mrs. Miller as described
in the case study. TEchfite demonstrated a disregard for the law by violating both Acts. The violations
included engaging in interstate commerce through computer use, encountering account privilege
issues, and failing to maintain separation of duties. Notably, TEchfite, a company traded on NASDAQ,
primarily conducts online consulting and advertising services for entities.
A2. Explain how three laws, regulations, or legal cases apply in the justification of legal action based
upon negligence described in the case study.
Negligence that leads to criminal activity under the Computer Fraud and Abuse
Act (CFAA), the Electronic Communications Privacy Act (ECPA), and the SarbanesOxley Act (SOX) can justify legal action in various ways.
Computer Fraud and Abuse Act (CFAA):
Under the CFAA, negligence that leads to criminal activities such as unauthorized access,
data alteration, or system impairment can justify legal action in the following ways:
a. Breach of Duty of Care: Negligence implies a failure to exercise the necessary level of
care and caution expected in a given situation. If an individual or organization has a duty
of care to protect computer systems or data, their negligence in doing so can be seen as
a breach of that duty. Legal action can be taken to hold them accountable for breaching
this duty.
b. Harm to Others: Negligence in CFAA criminal activities can cause harm to individuals,
organizations (example of Orange Leaf Software LLC and Union City Electronic
1
Ventures), or national security. When unauthorized access or data manipulation occurs
due to negligence, legal action may be justified to seek compensation for the damages
caused by this harm.
c. Deterrence and Prevention: Legal action against those who exhibit negligence in CFAA
activities can serve as a deterrent to others who might engage in similar activities. By
making it clear that negligence in computer-related crimes will not be tolerated, legal
action helps prevent future incidents and protects computer systems and information.
d. Upholding the CFAA: The CFAA was enacted to protect computer systems and
information from unauthorized access and malicious activities. Legal action against those
who exhibit negligence in this regard helps uphold the objectives and principles of the
law.
2. Electronic Communications Privacy Act (ECPA):
Negligence that leads to criminal activities under the ECPA, such as wiretapping, illegal
use and disclosure of intercepted communications, or violations related to interception
equipment, can justify legal action in the following ways:
a. Civil Remedies: Negligence in ECPA criminal activities can result in civil lawsuits where
affected individuals can seek damages for any harm or injury caused by the violation of
their privacy rights. Legal action can be taken to hold the negligent party accountable and
seek compensation for any damages incurred.
b. Criminal Prosecution: Negligence in ECPA criminal activities may also lead to criminal
prosecution. Law enforcement agencies can investigate and gather evidence to bring
criminal charges against individuals or organizations involved in the negligent activities.
Perpetrators found guilty may face fines, imprisonment, or other penalties as determined
by the court.
c. Regulatory Actions: Negligence in complying with the ECPA can result in regulatory
actions by government authorities. Regulatory bodies responsible for enforcing the
ECPA, such as the Federal Communications Commission (FCC) and the Department of
2
Justice, may investigate and impose fines or sanctions for non-compliance. These actions
aim to deter future negligence and ensure adherence to privacy laws.
d. Reputation Damage: Negligence in ECPA criminal activities can also lead to reputation
damage for individuals or organizations involved. Public exposure of negligent actions
can harm the trust and credibility of the party responsible, leading to significant
reputational and financial consequences.
3. Sarbanes-Oxley Act (SOX):
Negligence that leads to instances of SOX violations, such as improper expense
management practices, failure to maintain effective internal controls, or overlooking
warning signs of accounting misconduct, can justify legal action in the following ways:
a. Violation of Federal Securities Laws: Negligence leading to SOX violations is a breach
of federal securities laws. Legal action may be pursued to address the violation and
enforce compliance with the law's provisions.
b. Investor Losses: Negligence in SOX compliance can result in misleading financial
reporting or improper accounting practices, causing financial harm to investors. Legal
action may be taken to seek compensation for the losses suffered by investors due to the
negligence.
c. Damage to Investor Trust and Company Reputation: Negligence in SOX compliance
can damage investor trust and harm a company's reputation. Legal action can be justified
to address the harm caused and restore investor confidence and trust in the company.
d. Penalties, Fines, Restatements, and Corrective Measures: Negligence-based SOX
violations can result in penalties and fines imposed by regulatory authorities. Legal action
may be initiated to enforce the payment of these fines and penalties. Furthermore,
restatements of financial statements and implementation of corrective measures may be
required to rectify the improper accounting practices identified. Legal action can ensure
compliance and hold responsible parties accountable.
3
When negligence leads to criminal activity under the CFAA, ECPA, or SOX, legal action
is justified as it seeks to hold accountable those responsible, compensate for damages
incurred, prevent future incidents, uphold the law, protect privacy rights, restore investor
trust, and maintain the integrity of financial markets.
A3. Discuss two instances in which duty of due care was lacking.
Two areas: safeguarding client information and conducting user account audits. Insufficient data loss
prevention technology exposed client information to potential abuse, while implementing account
auditing could have prevented issues within the BI Unit and ensured information security.
A4. Describe how the Sarbanes-Oxley Act (SOX) applies to the case study.
SOX is crucial for corporate governance and financial transparency to safeguard investors. It mandates
companies to diligently monitor internal control over financial reporting, ensuring the precision and
dependability of their financial statements. The investigation has revealed Three companies paid for
services at TechFite using checks. that compromise accurate monitoring. The Sarbanes-Oxley Act
(SOX) is relevant to this case as it aims to ensure the accuracy of financial reporting by publicly traded
companies. In TechFite's case, there were failures in maintaining legitimate finances, such as granting
excessive privileges to members of the marketing and sales units, which could lead to exaggerated or
fictitious sales. Additionally, unauthorized access to financial and executive documents raises concerns
about the accuracy of TechFite's financial records. An association was found between three shell
companies, owned by an associate of TechFite's CISO, that funneled money into the sales division
without a genuine online presence. This indicates potential artificial inflation of TechFite's profits and
a violation of Section 404 of SOX, which mandates internal controls for accurate financial reporting.
B. Discuss legal theories by doing the following:
B1. Explain how evidence in the case study supports claims of alleged criminal activity in TechFite.
The allegations of criminal activity were found in the evidence presented in the case study supports.
Carl Jaspers deliberately created false accounts, which were then used to violate the Computer Fraud
and Abuse Act (CFAA) by gaining unauthorized access to protected computers. The senior
management of the company had a responsibility to ensure accurate financial reporting through robust
internal controls. Moreover, the tool provided concrete proof of BI Unit employees scanning and
infiltrating other companies' networks without consent or approval.
B1a. Identify who committed the alleged criminal acts and who were the victims.
Noah Stevenson (CEO), Carl Jaspers (CISO), Sarah Miller, Megan Rogers, and Jack Hudson are
potentially individuals involved in criminal acts in this case study. Noah Stevenson's failure to
implement controls to verify financial information could lead to potential criminal charges under SOX
Section 906. Carl Jaspers directed the creation of dummy accounts and has suspicious connections to
4
shell companies, possibly involved in corporate fraud. Sarah Miller, Megan Rogers, and Jack Hudson
used the Metasploit tool to scan and infiltrate other companies' networks, potentially violating the
ECPA. The victims include companies with compromised proprietary information, affected rival
companies, and shareholders who invested based on misleading profitability.
B1b. Explain how existing cybersecurity policies and procedures failed to prevent the alleged criminal
activity.
The absence of account auditing enabled Carl Jaspers to elevate the privileges of dummy accounts,
granting unauthorized access to protected computers in different departments. The lack of
implementation of the principle of least privilege resulted in sales members having excessive access,
raising concerns about the accuracy of TechFite's sales reports. By enforcing administrative approval
for software installation, the principle of least privilege could have prevented unauthorized installation
of tools like Metasploit.
B2. Explain how evidence in the case study supports claims of alleged acts of negligence in TechFite.
TechFite’s cybersecurity breaches have resulted in allegations of criminal activity and negligence, as
the data of its clients has been compromised. • TechFite has been involved in criminal activity,
specifically identity theft, where clients' personal information was stolen. • TechCity’s negligence in
implementing cybersecurity policies, performing system checks and updates, conducting security
audits, and providing adequate training has resulted in the compromise of clients' personal data, leaving
them vulnerable to cybercrimes such as identity theft and cyberstalking. The case study highlights a
significant absence of policies from Senior Management, which could have mitigated TechFite's
problems. A conflict-of-interest policy could have prevented the inappropriate boss/subordinate
relationship and Carl Jaspers' business dealings with a college associate. The lack of enforcement and
audits regarding internal network monitoring suggests a failure in policy implementation, contributing
to rampant user account abuse. This negligence from the top fostered a toxic culture within the
company.
B2a. Identify who was negligent and who were the victims.
Nadia Johnson's negligence in failing to identify the lack of internal oversight within the BI Unit,
including user account audits, data loss prevention, and network monitoring, contributed to the issues
at TechFite. Senior Management's failure to implement a separation of duties policy and a policy against
boss/subordinate relationships also contributed to the problems. The victims of this negligence include
TechFite's clients whose information was compromised, companies whose communications may have
been affected, other departments whose documents were illegally obtained, and shareholders who
relied on inaccurate financial reports.
B2b. Explain how existing cybersecurity policies and procedures failed to prevent the negligent practices.
5
The existing cybersecurity policy at TechFite was effective in preventing external threats but lacked
an internally focused approach. Negligence was evident in the absence of policies for conducting user
account audits, detecting privilege escalation, scanning for unauthorized programs, and monitoring
network activity to address internal threats. Account audits could have prevented the elevation of user
privileges, unauthorized program scans could have detected Metasploit software, and network
monitoring could have revealed analysis and penetration of other companies as well as violations
within other departments.
C. Prepare a summary (suggested length of 1–2 paragraphs) directed to senior management that states
the status of TechFite’s legal compliance.
It is the responsibility of TechFite and its legal team to actively assess and fulfill their legal
obligations. They should consult with legal professionals and experts to ensure compliance with
the specific laws and regulations. Implementing measures to ensure compliance with legal
requirements is crucial for any company, especially in the technology sector where various laws
and regulations may apply. Senior management should ensure that appropriate measures are in
place to meet legal obligations and mitigate potential risks associated with non-compliance.
Regular evaluation and monitoring of the company's legal compliance status are essential for
maintaining a strong legal position and protecting the company's interests.
The negligence of the Techfile team leader has resulted in several criminal activities, including
6
unauthorized access and data alteration. These actions have also highlighted Techfile's failure to
comply with the principles outlined in the Computer Fraud and Abuse Act (CFAA)
The company's failure to comply with the Sarbanes-Oxley Act (SOX) was evident through a
combination of improper management practices, negligence, and a lack of effective internal
controls. These factors played a crucial role in highlighting the company's non-compliance with
SOX regulations, and By engaging in invasive monitoring practices, the company demonstrates
a disregard for individual privacy rights and violates the principles outlined in the ECPA.
Cited note.
Kierkegaard, S. M. (2006). Legal, privacy, and security issues in information technology. The
First International Conference on Legal, Privacy and security issues in it: Hamburg,
Germany April 30-May 2, 2006, proceedings. Amazon. https://www.amazon.com/LegalPrivacy-Issues-Information-Security/dp/1284207803
“Computer Fraud and Abuse Act.” Wikipedia, Wikimedia Foundation, 24 July 2023,
en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act.
7
8