Cybersecurity Law: Legal Jurisdiction and Authority

TL;DR

This paper analyzes the complex legal jurisdiction issues surrounding cybersecurity threats to critical infrastructures, focusing on federal, state, and international law conflicts and their implications for governance and lawmaking.

Contribution

It provides a detailed legal analysis of jurisdictional ambiguities and conflicts in cybersecurity law, highlighting the need for clearer legal frameworks for critical infrastructure protection.

Findings

Jurisdictional ambiguities complicate cyber threat responses.

Federal vs. state authority conflicts impact cybersecurity governance.

International law involvement adds complexity to jurisdiction issues.

Abstract

Cybersecurity threats affect all aspects of society; critical infrastructures (such as networks, corporate systems, water supply systems, and intelligent transportation systems) are especially prone to attacks and can have tangible negative consequences on society. However, these critical cyber systems are generally governed by multiple jurisdictions, for instance the Metro in the Washington, D.C. area is managed by the states of Virginia and Maryland, as well as the District of Columbia (DC) through Washington Metropolitan Area Transit Authority (WMATA). Additionally, the water treatment infrastructure managed by DC Water consists of waste water input from Fairfax and Arlington counties, and the district (i.e. DC). Additionally, cyber attacks usually launch from unknown sources, through unknown switches and servers, and end up at the destination without much knowledge on their source or path. Certain infrastructures are shared amongst multiple countries, another idiosyncrasy that exacerbates the issue of governance. This law paper however, is not concerned with the general governance of these infrastructures, rather with the ambiguity in the relevant laws or doctrines about which authority would prevail in the context of a cyber threat or a cyber-attack, with a focus on federal vs. state issues, international law involvement, federal preemption, technical aspects that could affect lawmaking, and conflicting responsibilities in cases of cyber crime. A legal analysis of previous cases is presented, as well as an extended discussion addressing different sides of the argument.