Separate the outsider prong from the insider prong, and know why purpose no longer decides an insider case.

• The statute — the Computer Fraud and Abuse Act (CFAA) is the main federal law used in hacking and unauthorized-access cases; it was enacted in 1986 in response to concerns about hackers breaking into computer systems.
• Two ways to violate it — intentionally accessing a computer without authorization (outsiders breaking in) or exceeding authorized access (insiders entering parts of a system they were not given).
• Van Buren’s facts — a Georgia police sergeant with a valid password to a license-plate database, trained not to use it for personal purposes, ran a plate search for a promised $5,000 in an FBI sting.
• The holding (6–3, June 3, 2021) — a person exceeds authorized access only by obtaining information from areas of a computer (files, folders, databases) that are off-limits to them; using permitted access for a forbidden purpose is not enough. Van Buren’s conviction was thrown out.
• House-key analogy — using the key you were given to go inside is not breaking in; forcing your way into a room locked with a different key is.
• Limits of the ruling — Van Buren’s conduct was still unethical and not free of consequences; and state anti-hacking laws do not always mirror the CFAA, so the same act can be legal federally and illegal under state law.

The comparison, not either case alone, is the lesson: misuse of access you have versus coming back after access was revoked.

• Shared facts — David Nosal left the executive search firm Korn/Ferry to start a competitor; the firm kept a confidential candidate database for company business.
• Nosal I (9th Cir. en banc, 2012) — current employees used their own valid logins to download data for Nosal in violation of a business-use policy; the court held “exceeds authorized access” covers getting at information you are not permitted to reach, not misusing information you are permitted to reach.
• Why the court drew that line — it refused to turn ordinary workplace policy violations into federal crimes; computer-use policies are often long, unclear, changeable, and rarely read.
• Nosal II (9th Cir., 2016) — after Korn/Ferry revoked their credentials, Nosal’s group got back in with a current employee’s shared login; the court held that using a computer after the owner has rescinded permission is access without authorization, and affirmed the conviction.
• Policy lesson — the outcome turned on permission, revocation, and credentials, not motive; clear access boundaries, documented revocation, and controls on credential sharing make the line provable before a dispute.
• DOJ’s charging policy agrees — the Justice Manual says a case cannot rest only on terms-of-service or personal-use policy violations, expects the insider boundary to be enforced technically (code or configuration), and treats a received cease-and-desist notice as revoking authorization.

Know the three functions, why privacy duties depend on the data and the promises made, and where privacy rights come from.

• Three functions — data protection keeps data available (data inventory, backup and recovery, life-cycle management); data security safeguards data against unauthorized access, theft, and corruption (physical security, identity and access management, encryption); data privacy concerns the ethics and transparency of why data is collected, how it is used, and how it is stored and protected.
• Strong security is not privacy — a company can have strong security tools and still create privacy problems if it collects too much, shares carelessly, or breaks its promises.
• A patchwork — U.S. privacy law mixes federal law, state law, constitutional ideas, consumer protection, health, education, and financial data rules, and international pressure such as the GDPR; duties depend on the type of data, who holds it, how it is used, and what was promised.
• Constitutional roots — the First Amendment protects speech, religion, press, assembly, and petition; the Third protects the home from forced quartering of soldiers; Griswold v. Connecticut recognized a right to privacy drawn from the First, Third, Fourth, and Ninth Amendments even though the word “privacy” is not in the Constitution.
• Feeling private vs. being private — a Nevada federal court found no reasonable expectation of privacy in public Twitter posts; public posts can be searched, copied, preserved, subpoenaed, or used as evidence.

The FTC is the de facto U.S. privacy regulator; know both prongs and what each case added.

• Section 5 — prohibits unfair or deceptive acts or practices in or affecting commerce; with no comprehensive federal privacy law, it has made the FTC the nation’s de facto privacy regulator.
• Deception — a representation, omission, or practice likely to mislead consumers that is material to their choices; privacy notices, marketing claims, and support scripts are all treated as promises.
• Unfairness — a practice causing (or likely to cause) substantial injury that consumers cannot reasonably avoid and that is not outweighed by benefits; it reaches harm even when no promise was broken, and weak data security is its leading application.
• Reasonable security — “reasonable does not mean perfect, but it does mean defensible”: safeguards proportionate to the data’s sensitivity and the likelihood of harm.
• FTC v. Wyndham (3d Cir. 2015) — after three breaches in 2008–2009 (more than 619,000 payment cards allegedly compromised), the court held the FTC may regulate data security under unfairness and that Wyndham had fair notice its practices could be found inadequate; the FTC pointed to weak passwords, poor network controls, inadequate incident response, and overstated security statements.
• LabMD v. FTC (11th Cir. 2018) — patient data was exposed through file-sharing software an employee installed; the court assumed unfairness but held the FTC’s order unenforceable because it lacked specific prohibitions and demanded an indeterminate “reasonableness” standard.

Privacy risk often comes from how a company makes money and whose code runs on its pages.

• You are the product — when a service is free, advertisers may be the paying customers and the user’s attention, behavior, and relationships part of what is sold; read privacy promises with the business model in mind.
• Dark patterns — interface designs that nudge users toward less privacy-protective choices (pre-ticked boxes, confusing toggles, button colors that make declining harder); they can be deceptive or unfair even with no explicit misstatement.
• Amazon (FTC, Sept. 2025) — a $2.5 billion settlement ($1 billion civil penalty, $1.5 billion in refunds) over allegations under the FTC Act and ROSCA that Amazon enrolled consumers in Prime without proper consent and made cancellation difficult.
• Third-party scripts — analytics, ads, session-replay tools, and embedded services can collect or expose user data in ways the site operator does not understand; responsibility does not disappear because a vendor’s code did it.
• Vendors under Section 5 — a company that makes promises about its ecosystem implicitly vouches for its third parties, so due diligence, ongoing monitoring, and clear contractual controls are compliance duties.

A breach creates legal duties beyond the technical fix, and the duties change with every state involved.

• No single national rule — states have their own laws requiring notice to individuals when certain personal information is compromised.
• Coverage — all 50 states plus the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have breach-notification laws.
• What the laws define — who must comply (businesses, data brokers, often government entities), what counts as personal information (commonly a name plus a Social Security, driver’s license, or account number), what counts as a breach (generally unauthorized acquisition), notice timing and method, and exemptions such as encrypted data.
• Multi-state reality — an organization that collects data across states must build an incident response plan that accounts for each state’s different duties.
• Beyond the fix — after a breach the organization may need to think about notification, law enforcement, insurance, customer communication, contract duties, and evidence preservation.

HIPAA is the module’s example of security duties written into law.

• Who it covers — covered entities and business associates that handle electronic protected health information (ePHI); found at 45 C.F.R. Part 164, Subpart C.
• Three safeguard families — administrative, physical, and technical safeguards.
• Structure to recognize — risk analysis, risk management, access controls, audit controls, integrity protections, and transmission security.
• Why it matters — it shows what happens when privacy and cybersecurity duties become formal compliance obligations with specific controls, unlike a general “reasonable security” standard.
• Risk analysis first — risk analysis and risk management are treated as required parts of protecting health information, not optional extras.

Evidence only helps if you can explain where it came from, how it was collected, who handled it, and that the process was reliable.

• NIST SP 800-86’s four phases — collection (identify, label, record, and acquire data while preserving integrity), examination (extract the relevant data), analysis (draw conclusions), and reporting (present results, describe actions, recommend improvements).
• Decide early, with counsel — determine with management and legal advisors whether evidence must be preserved for legal or disciplinary proceedings; when unclear, preserve by default. Acquire volatile data (memory) before non-volatile data.
• Legal hold — usually initiated by a lawyer, sent to the data custodian, who acquires the described data into a separate repository of electronically stored information (ESI) and keeps it producible for the court.
• Integrity and chain of custody — data must stay unmodified; hashes and digital signatures prove copies match the original and record who accessed the evidence and when.
• Document and preserve — data collected today may be used in legal proceedings years later, so record every acquisition step (RFC 3227 is the industry guideline), work from copies, and consider live acquisition on encrypted or remotely wipeable devices.
• E-discovery — collecting, preparing, reviewing, interpreting, and producing electronic documents; it is about acquisition, not analysis, and often hands images to a forensics team.

Finding a record is not the same as being able to use it; DOJ Chapter 5 explains the hurdles.

• Authentication — the party offering a record must show it is what it claims to be; challenges argue the record was altered, the program that produced it was unreliable, or the author cannot be identified.
• Computer-generated records — produced by a machine process with no human statement (for example, automatic logs); the hearsay rules generally do not apply, and the question becomes whether the process is reliable.
• Computer-stored records — store what a person wrote (for example, emails or documents); the hearsay rules can apply.
• Other issues — the best evidence rule and the use of computer printouts as “summaries.”
• Why it matters — logs, files, emails, metadata, and forensic reports all need a reliable path from collection to courtroom; poor evidence handling can weaken an otherwise strong investigation.
• Expert witnesses — a technical expert may need to show not only what happened, but how they know.

Ransomware is both a technical incident and a legal crisis.

• How it starts — an urgent email that seems to come from HR or the CEO; one click downloads software that holds business data hostage and locks the company out while criminals demand money.
• Prepare first — back up business data outside the network, train everyone to spot ransomware, and install the latest patches and security updates.
• If attacked — disconnect infected devices from the network right away to limit damage, then contact authorities such as the local FBI office (or report at ic3.gov).
• Paying — the FBI does not support paying: payment does not guarantee data recovery, encourages more attacks, and funds future crime.
• Evolution — ransomware grew from early malware and extortion into a criminal business model that adds data theft, breach notification, cryptocurrency tracing, sanctions, insurance, critical-infrastructure risk, and international law-enforcement problems.
• Ban debate — one side says payments fuel the ransomware economy; the other warns a ban could hurt hospitals, schools, small businesses, and critical services that cannot recover quickly.