FTOverview
As the CISO for VL Bank I was recently informed of the crime being committed against our customers. I have been tasked with investigating this crime and finding a swift resolution for our customers and to do everything within my power to bring the attacker(s) to justice. After carefully considering the document prepared by my information security analysts I have determined not only which laws apply to this crime but also the necessary steps taken to further the investigation and how to prevent security issues in the future.
Two Laws that Apply to this Case
After examining various case laws I have deduced the following laws apply in this case, they are the Computer Fraud and Abuse Act and the Electronics Communications Privacy Act. The Computer Fraud and Abuse Act explicitly states “when a trespass is made with an intent to defraud that results in both furthering the fraud and the attacker obtaining something of value” (Gallegos & Senft, 2009). This definitely applies in this case, the attacker(s) used an attack known as spear fishing to dupe our customers into unintentionally installing a keystroke logging virus on to their computers. Once the virus was in place the attacker(s) waited for our customers to log into their bank accounts and recorded all the information necessary to create new user accounts and transfer funds from our customers account to other various accounts eventually ending up in the attacker(s) accounts located overseas. This would meet the qualifications stated in the Computer Fraud and Abuse Act; the attacker trespassed on these computers with the intent to obtain something of value. Also by taking the data provided by the key logger they violated the Electronics Communications Privacy. Under Section 2511 of this act it “makes interception and disclosure of wire, oral, or electronic communications prohibited” (Gallegos & Senft,