Cybercrime, intellectual property and export controls in the US and abroad

Sub-domain 1.4 asks you to understand legal, regulatory and compliance issues in a holistic context. In practice that means knowing the main categories of law that affect security work, recognizing which questions need a lawyer, and understanding that an organization operating across borders may face several legal systems at once. This lesson covers cybercrime and data breaches, intellectual property and licensing, and import and export controls. Lesson 5 covers privacy and transborder data flows, and Lesson 6 covers contracts, compliance and investigations.

Categories of law

Security professionals meet three broad categories of law. Criminal law deals with offenses against society, prosecuted by the state, with penalties that can include imprisonment; the standard of proof is beyond a reasonable doubt. Civil law deals with disputes between private parties, such as breach of contract or negligence, and remedies are usually money damages or orders; the standard is the balance of probabilities, sometimes called the preponderance of the evidence. Administrative or regulatory law is made and enforced by government agencies under authority from legislation, such as privacy regulators, securities commissions and financial supervisors; it can bring fines, orders and license conditions.

Legal systems also differ. Canada, apart from Quebec's private law, and the United States use common law, in which court decisions create binding precedent alongside legislation. Quebec and most of continental Europe use civil law systems based on comprehensive codes. Some countries use religious or customary law, or mixtures. When an organization operates internationally, contracts usually specify which jurisdiction's law governs and where disputes will be heard.

Cybercrime

Most countries criminalize unauthorized access to computers, interference with data, and misuse of devices or passwords. Attacks often cross borders, which makes investigation and prosecution hard: the attacker, the victim, the servers and the stolen data may all be in different countries. International cooperation relies on mutual legal assistance treaties and on the Council of Europe Convention on Cybercrime (the Budapest Convention, 2001), which harmonizes offenses and procedures among its parties, including Canada and the United States. A United Nations Convention against Cybercrime was adopted by the General Assembly in December 2024 and opened for signature in 2025; it will take effect only after enough states ratify it, and many security and human rights groups have criticized its broad scope.

In the United States, the main federal cybercrime law is the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030, which criminalizes accessing a computer without authorization or exceeding authorized access, and damaging protected computers. In Van Buren v. United States (2021), the Supreme Court read 'exceeds authorized access' narrowly: a person who is entitled to access an area of a system does not violate the CFAA merely by using that access for an improper purpose. Other federal laws include the Electronic Communications Privacy Act (wiretapping and stored communications), the Identity Theft and Assumption Deterrence Act and the wire fraud statute. Every state also has its own computer crime laws. Incidents can be reported to the FBI's Internet Crime Complaint Center (IC3) and to CISA.

Data breach law sits between criminal and regulatory law. When personal information is exposed, organizations often have legal duties to notify regulators and affected individuals, whatever the cause. Lesson 5 covers breach notification rules in detail, because they are mainly part of privacy law. From a governance view, the key point is that the organization that held the data is responsible for the breach response even when a criminal caused it.

Intellectual property

Intellectual property (IP) is often an organization's most valuable information asset. Security programs protect it, and security professionals must also respect others' IP, for example by complying with software licenses. The four main types are copyright, trademarks, patents and trade secrets.

Trade secrets deserve special attention from security leaders, because their legal protection depends on the owner taking reasonable measures to keep them secret. Access controls, classification labels, non-disclosure agreements, exit interviews and monitoring of data transfers are not only good practice; they are evidence that the organization treated the information as secret if it ever has to go to court.

In the United States, copyright is governed by the Copyright Act of 1976 and the Digital Millennium Copyright Act (DMCA) of 1998, which prohibits circumventing technological protection measures, subject to exemptions reviewed every three years that include good-faith security research, and creates the notice-and-takedown safe harbor for online service providers. Trademarks are registered with the US Patent and Trademark Office (USPTO) under the Lanham Act, which also handles patents. Trade secrets are protected by state laws based on the Uniform Trade Secrets Act and by the federal Defend Trade Secrets Act of 2016, which allows civil suits in federal court, and the Economic Espionage Act of 1996 makes theft of trade secrets a federal crime.

Licensing

Software is usually licensed rather than sold: the buyer gets rights to use it under conditions. Common models include perpetual licenses, subscriptions, per-user and per-core licensing, site licenses, and open-source licenses ranging from permissive (MIT, Apache 2.0, BSD) to copyleft (GPL), which requires derivative works distributed to others to be released under the same terms. Click-through and shrink-wrap licenses are generally enforceable if users had a reasonable chance to see the terms.

License management is a security and compliance issue. Unlicensed software can bring legal claims and audits from vendors or industry groups; unmanaged open-source components can bring both license obligations and security vulnerabilities. A software bill of materials (SBOM), discussed in Lesson 10, helps track what components are in use and under which licenses. Software asset management tools and clear procurement policies keep usage within licensed limits.

Import and export controls

Many countries control the export of certain technologies, including some encryption products, intrusion software and items with military uses. Controls apply not only to shipping hardware but also to transferring software and technical data electronically, and sometimes to sharing controlled technical information with foreign nationals inside the country, which the US calls a deemed export. Multilateral regimes coordinate these controls. The Wassenaar Arrangement, with 42 participating states including Canada and the United States, maintains lists of dual-use goods and technologies, including categories for information security items.

In the United States, the Export Administration Regulations (EAR), administered by the Bureau of Industry and Security in the Department of Commerce, control dual-use items listed on the Commerce Control List; Category 5 Part 2 covers information security items, and many mass-market encryption products qualify for license exceptions after classification. The International Traffic in Arms Regulations (ITAR), administered by the State Department, control defense articles and technical data, including deemed exports to foreign persons in the US. The Treasury Department's Office of Foreign Assets Control (OFAC) administers sanctions, which can affect even ransomware payments to sanctioned groups.

Import controls also matter. Some countries restrict the import or use of encryption, require registration of cryptographic products, or require access to keys. Before sending staff abroad with encrypted laptops, or deploying products in a new country, security teams should check both export rules at home and import rules at the destination.

Working with law enforcement and counsel

Deciding whether to involve law enforcement after a cybercrime is a business decision that should be planned before an incident. Benefits include access to intelligence about the attackers, the possibility of recovering funds or decryption keys, and support for prosecution. Concerns include loss of control over the timeline, disclosure of sensitive information and the time staff must spend supporting the investigation. Many organizations decide in their incident response plan which kinds of incidents they will report, and build relationships with police cybercrime units and national cyber centers in advance.

Legal counsel should be involved early in any significant incident. Counsel can advise on notification duties, contractual obligations, evidence preservation and communications, and can direct forensic investigations in a way that may protect sensitive findings under privilege. Security leaders should know which outside law firms and forensic providers the organization will call, whether its cyber insurer requires specific panel firms, and who has authority to engage them at short notice. Ransom payments raise further legal questions, including sanctions laws that can make paying certain groups illegal, and most governments discourage paying at all.

Contracts with suppliers and customers often address these legal topics directly: who owns the intellectual property in work product, which country's law governs, how export-controlled data must be handled, and what each party must do if a cybercrime affects shared systems. Security leaders should review such clauses with counsel, because they shape responsibilities long before any incident occurs.