Who makes, enforces, and interprets law — and which court a cyber dispute travels through.
Old legal authority, new technology: code regulates behavior, automated systems enforce rules, and legislatures respond to incidents.
Turn a messy fact pattern into Issue, Rule, Application, Conclusion — then find and cite the authority.
Read like a reviewer: what does Northstar say, what does it forget, and what would it need to prove later?
Score it, treat it, and name the proof: the Project 1 method.
| Item | Due | Points | Format |
|---|---|---|---|
| Project #1 — Northstar Policy Risk Assessment | 9/19/26 | 100 | Word doc: three 9-part risk items + Appendix A Excel risk matrix |
| Project #2 — Northstar Policy Gap Review | 10/10/26 | 100 | Word doc: 3 control + 3 compliance + 3 audit gaps, 7×9 gap table, 5–7 sentence closing |
| Find and Cite a Case | 10/10/26 | 10 | One attempt |
| Google Dorking Match Challenge | 10/10/26 | 10 | Three attempts; last graded attempt counts |
| IRAC and Nested IRAC Practice | 10/10/26 | 30 | Graded on completion |
| Assessment #1 | 10/10/26 | 100 | 50-minute limit, one attempt, automatic submission |
| Article | Addresses | Why it matters for cyber law |
|---|---|---|
| I | Congress and the power to create federal law | Who can pass statutes like the CFAA |
| II | Executive authority and enforcement | Who investigates and enforces |
| III | The federal judiciary | Who interprets and resolves disputes |
| VI | Supremacy of federal law | What happens when federal and state rules intersect |
Guiding question: why does understanding these articles matter before studying cybercrime, privacy, and cybersecurity regulation? Because cyber law questions often turn on who has authority to regulate, investigate, enforce, or interpret obligations.
One of three coequal branches in a system of checks and balances. Congress establishes federal courts; the President appoints judges; the Senate confirms them. Judges interpret and apply federal, constitutional, and international law.
| Tier | Role | Key facts |
|---|---|---|
| U.S. district courts | General federal trial courts — hearings, evidence, motions, verdicts | 94 districts; civil and criminal; each has a bankruptcy unit (Article I, 14-year judges); magistrate judges serve 8-year (full-time) or 4-year (part-time) renewable terms; district judges have lifetime Article III appointments |
| U.S. courts of appeals | Review district courts and some agencies for legal and procedural error | 12 regional circuits + the Federal Circuit; three-judge panels; no witnesses or new evidence |
| U.S. Supreme Court | Final arbiter of federal and constitutional questions | Nine justices (Chief + 8 Associate), lifetime terms; discretionary review by writ of certiorari; about 1% of petitions, typically 70–80 cases a term; decisions bind all lower federal and state courts |
Covers the three-tier structure of the federal courts (district, appellate, Supreme Court) and explains their functions.
| Level | Courts | Cyber examples from the module |
|---|---|---|
| Courts of last resort | Supreme Court of Texas (civil, juvenile) · Texas Court of Criminal Appeals (criminal) | Final state review; criminal and civil cyber cases take different paths |
| Intermediate appeals | 15 courts of appeals, including the Fifteenth (2024, statewide; certain civil disputes and exclusive Business Court appeals) | Review the record; often digital-search and warrant questions |
| District courts | General jurisdiction trial courts; plus the Texas Business Court for complex commercial and technology cases | Felony cybercrimes under Penal Code Ch. 33 (hacking, identity theft, ransomware, unauthorized access); civil privacy and data-breach suits |
| County level | Constitutional county courts, statutory county courts at law, probate courts | Misdemeanors and mid-level civil matters involving messages or online conduct |
| Local | Justice and municipal courts | Small claims, traffic, ordinances, evictions; some online-offense cases begin here |
Digital evidence in every court — courts decide authenticity, chain of custody, and whether records were lawfully obtained. Screenshots can be edited, accounts shared, timestamps misread. Forensic work (bit-for-bit images, hash values, deleted-file recovery, log correlation) must stay within warrant scope and be explainable in plain language. The module’s repeatable questions: What court? Criminal, civil, regulatory, or contractual? What evidence proves the facts? Who collected it? Was collection lawful? What privacy interests? What remedy?
Cybercrime cases (e.g., CFAA) usually start in U.S. district court → court of appeals → petition for certiorari. The module lists scenarios that could reach the Court:
Constitutional law, criminal law, privacy law, contracts, intellectual property, regulatory authority, and evidence. Focus on legal vocabulary, jurisdictional questions, and the difference between legal rules and policy arguments.
Software architecture can regulate behavior in ways that resemble legal rules. Conduct is shaped not only by statutes, regulations, contracts, and court decisions, but by code, platform design, access controls, automated permissions, protocols, and technical enforcement. Guiding question: why is blockchain such a great example of “code is law”? The module also asks whether you would hire Lessig to advise an organization on cyber law, digital governance, or technology policy — and why.
The automated ball-strike system (“Inside Baseball”) is an object lesson in technological rule enforcement: accuracy, transparency, appeals, trust, human judgment, and institutional authority. Guiding question: how does it help us think about moderation and rule enforcement on social-media platforms?
The module’s Schoolhouse Rock–inspired story: a Texas middle school is hit by ransomware; systems go down, student data may be stolen, staff aren’t sure whether FERPA applies, and families wait weeks for answers. The gap — no clear rule requiring fast disclosure — becomes the trigger for the Texas Data Breach Notification Act.
| Stage | What happens | Who does the work |
|---|---|---|
| 1 · Trigger & problem definition | Incident exposes a gap in law | Parents, staff, journalists, lawmakers |
| 2 · Agenda-setting | Pressure puts the issue on the agenda; staff summarize; agencies gather data | Parent groups, education agencies, media, legislative staff |
| 3 · Research & options | Federal rules (FERPA, COPPA) don’t cover all cases; options: define “breach” and “personal information,” deadlines, penalties, encryption safe harbors | Research offices, agencies, universities, stakeholders |
| 4 · Drafting & sponsorship | A legislator sponsors; text covers purpose, scope, timelines, penalties | Legislative counsel, sponsors, lobbyists |
| 5 · Committee & markup | Hearings and testimony; definitions and timelines clarified; central reporting portal added | Committee members, witnesses, staff lawyers |
| 6 · First-chamber floor | Debate (vendor liability, penalties, unfunded mandates); passes and is “engrossed” | Lawmakers, caucuses, journalists |
| 7 · Second chamber & reconciliation | Senate amends; a conference committee produces a conference report | Senators, conference committees, staff |
| 8 · Executive action | Governor signs (law), ignores (law after a set period), or vetoes (unless overridden) | Governor, legal staff, interest groups |
| 9 · Rulemaking | Agencies draft rules, take public comment, set compliance deadlines; FAQs, model notices, grants | Agencies, commenters, schools, businesses |
| 10 · Oversight & amendment | Monitoring, reports, court clarification, amendments | Agencies, legislators, courts |
The module pairs the classic Schoolhouse Rock segment with its own cybercrime walk-through of how a bill becomes law.
A fact pattern summarizes the key facts — who did what, when, where, how, and why — without discussing legal consequences. A good analysis shows a clear presentation of facts, a systematic analysis of legal elements, application of law to facts, and potential outcomes. The module’s examples: John Doe and the armed burglar (self-defense and Texas’s castle doctrine) and Tony Soprano’s disappearance (declaring a missing person legally dead after a continuous absence).
| Step | What it does | Van Buren (your IRAC) |
|---|---|---|
| Issue | The precise legal question | Does an officer violate the CFAA by accessing a database he’s authorized to use, for personal gain against policy? |
| Rule | The governing law | 18 U.S.C. § 1030(a)(2) and § 1030(e)(6); exceeding authorized access = obtaining information from areas that are off-limits, not misusing information you may obtain |
| Application | Connect the rule to these facts — not a summary | He used valid credentials to retrieve a category of information he was entitled to; his purpose was improper but the access wasn’t |
| Conclusion | The supported answer | No CFAA violation (6–3, 2021); the ruling doesn’t excuse the misconduct or bar other charges |
Nested IRAC — an IRAC sequence inside a broader IRAC when a secondary issue needs its own question, rule, analysis, and conclusion. It organizes complex arguments and reduces the chance of missing an element. A good nested issue is distinct but related — for Van Buren, whether a department purpose restriction can define “authorization.”
Jane slipped on a banana peel at the 2-mile mark; volunteers about 10 feet away were told but didn’t remove it, and it was visible about five minutes. She fractured her wrist, had a mild concussion, $8,500 in medical bills, and $6,000 in lost wages.
| Negligence element | Applied |
|---|---|
| Duty of care | The organizer owed participants a reasonably safe course and a response to hazards |
| Breach | Volunteers ignored a reported, visible hazard for about five minutes |
| Causation | The peel directly caused the fall; injury foreseeable after notice (proximate cause) |
| Damages | Medical expenses, lost wages, and lingering pain |
| Source | Format | Example from the module |
|---|---|---|
| Case | Case Name, Volume Reporter Page (Court Year) | Katz v. United States, 389 U.S. 347 (1967) |
| Federal statute | Law Name, Title U.S.C. § Section (Year) | Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (2020) |
| State statute | Law Name, State Code § Section (Year) | Texas Data Breach Notification Act, Tex. Bus. & Com. Code § 521.053 (2023) |
| Federal regulation | Law Name, Title C.F.R. § Section (Year) | HIPAA, 45 C.F.R. § 164.308 (2022) |
| Appeals case | Include the court | United States v. Nosal, 676 F.3d 854 (9th Cir. 2012) |
Tips: v. = versus; U.S. = Supreme Court reporter; F.3d = federal appeals reporter; always include the year; include the court unless it’s the Supreme Court; § = section; italicize case names when formatting allows. Common mistakes: missing year, missing section symbol, mixing up U.S.C. and C.F.R., leaving out the court for appeals cases, parts in the wrong order. The module asks you to verify citations with a librarian before final use.
| Operator | Does | Module example |
|---|---|---|
site: | Limits to one site or domain | site:ftc.gov "data security" |
filetype: | Specific file type | site:.gov filetype:pdf "incident response" |
intitle: | Words in the page title | intitle:"search warrant" "electronic" |
inurl: | Words in the URL | inurl:opinions "computer" |
"quotes" | Exact phrase | "unauthorized access" statute |
-term / OR / 2019..2025 | Exclude, alternatives, date range | "computer crime" -movie -tv |
Dorking is OSINT: it needs no break-in, only careful searching of what search engines have indexed. Defensively it finds accidental exposure — public login pages, old documents, directories, forgotten test pages, configuration references — before attackers do. Searching is not permission: public visibility doesn’t authorize opening, downloading, testing, reusing, or sharing results. Stay in scope, follow rules of engagement, and when in doubt, stop and ask.
Assigned before working with academic sources, scholarly articles, or research-based legal analysis.
Policy 0001, Data Protection and Security Readiness Policy, NDT-P0001, Revision 0.6 — a draft for legal and compliance review, not yet approved. Owner: Chief Information Security Officer. Approving authority: Executive Leadership Council. Applies to U.S. operations; related project: Cork Castle Data Center Readiness Planning in Ireland, which the policy treats as a future planning item.
| Score | Likelihood | Impact |
|---|---|---|
| 1 | Rare | Minimal |
| 2 | Unlikely | Minor |
| 3 | Possible | Moderate |
| 4 | Likely | Major |
| 5 | Almost certain | Severe |
Risk score = Likelihood × Impact (e.g., 4 × 5 = 20). Ratings: 1–4 Low · 5–9 Medium · 10–16 High · 17–25 Critical.
| Treatment | Meaning | Examples |
|---|---|---|
| Accept | Knowingly keep the risk and document why | Who approved it, why it’s acceptable, when it will be reviewed |
| Avoid | Stop or change the activity so the risk no longer exists | Delay a launch, remove a data-collection practice, disallow a type of access |
| Transfer | Shift some responsibility or financial impact to another party | Contracts, insurance, vendor agreements, SLAs, outsourcing |
| Mitigate / reduce | Keep the activity, add safeguards | MFA, encryption, training, access reviews, logging, monitoring, vendor reviews, stronger approvals |
Nine-part item: policy statement · risk explanation · category · likelihood · impact · score and rating · treatment · recommended change · evidence needed. Appendix A is an Excel matrix (number, title, category, likelihood, impact, score — e.g., =D2*E2 — rating, treatment). Not every risk is technical: leadership, privacy, vendors, legal compliance, employees, incident response, retention, monitoring, public trust, and international operations all count.
| Gap type | Asks | Example from the instructions | Sources |
|---|---|---|---|
| Control | Does the policy explain how Northstar will prevent, detect, or reduce a problem? | Secure access with no MFA, role-based access, or access reviews | NIST CSF 2.0; CISA Cybersecurity Performance Goals |
| Compliance | Does it explain how Northstar will meet a legal, regulatory, contractual, or privacy duty? | Customer data with no plan for personal-data protection or EU/Ireland expectations | GDPR (official EU text); NIS2 Directive |
| Audit | Does it say what evidence would prove the promise is kept? | Backups “tested” with no frequency, owner, results location, or success criteria | NIST SP 800-53 Rev. 5; SP 800-53A Rev. 5 |
Deliverable: one Word document with a 7-row × 9-column gap table (gap number, gap type, policy area, what is missing or weak, why it matters, recommended policy addition, evidence needed later) and a 5–7 sentence closing paragraph on which gap type is the biggest concern.
| Project 2 rubric row | Weight | Excellent looks like |
|---|---|---|
| Control Gap Analysis | 25% | Three strong, clearly supported gaps; what’s missing, why it matters, how it affects Northstar; research-supported |
| Compliance Gap Analysis | 25% | Clear links to legal, regulatory, privacy, contractual, or EU/Ireland duties; meaningful risk explained |
| Audit Gap Analysis & Evidence | 25% | Specific, realistic records — logs, reports, approvals, screenshots, checklists, review documents |
| Recommendations, Gap Table & Closing | 14% | Complete, consistent table; practical additions; well-supported 5–7 sentence closing |
| APA 7, Sources & Length | 11% | Consistent APA 7, integrated sources, required length, minimal errors |
Classify each as a control, compliance, or audit gap (some are more than one), and pick a treatment:
Built from the Module 01 pages (objectives, Projects 1–2, Read It, legal-systems and fact-pattern lessons, citation, dorking, supplemental resources, Assessment 1), the Northstar policy Rev. 0.6, the Project 2 rubric, and your Van Buren IRAC summary.