Richmond Journal of Law & Technology Volume XX, Issue 4
2
comprehensive U.S. cyber legislation has been enacted since 2002,
and
neither legislative history nor the statutory language of the Computer
Fraud and Abuse Act (CFAA) or Electronic Communications Privacy Act
(ECPA) make reference to the Internet.
Courts have nevertheless filled in
the gaps—sometimes with surprising results.
[2] Because state law, federal legislative proposals, and case law all
are in a continuing state of flux, practitioners have found it necessary to
follow these developments carefully, forecast, and adapt to them, all of
which has proved quite challenging. As the title of this Comment
suggests, deploying sound cyber security practices is not only equally as
ERIC A. FISHER, CONG. RESEARCH SERV., R 42114, FEDERAL LAWS RELATING TO
CYBERSECURITY: OVERVIEW AND DISCUSSION OF PROPOSED REVISIONS 3 (2013),
available at http://fas.org/sgp/crs/natsec/R42114.pdf (discussing, for example, the
Federal Information Security Management Act).
See Yonatan Lupu, The Wiretap Act and Web Monitoring: A Breakthrough for Privacy
Rights?, 9 VA. J.L. & TECH. 3, ¶¶ 7, 9 (2004) (discussing the use of the ECPA and the
lack of words such as “Internet,” “World Wide Web,” and “e-commerce” in the text or
legislative history); see also Eric C. Bosset et al., Private Actions Challenging Online
Data Collection Practices Are Increasing: Assessing the Legal Landscape, INTELL. PROP.
& TECH. L.J., Feb. 2011, at 3 (“[F]ederal statutes such as the Electronic Communications
Privacy Act (ECPA) and the Computer Fraud and Abuse Act (CFAA) . . . were drafted
long before today’s online environment could be envisioned . . . .”); Miguel Helft &
Claire Cain Miller, 1986 Privacy Law Is Outrun by the Web, N.Y. TIMES (Jan. 9, 2011),
http://www.nytimes.com/2011/01/10/technology/10privacy.html?pagewanted=all&_r=1
& (noting that Congress enacted the ECPA before the World Wide Web or widespread
use of e-mail); Orin S. Kerr, The Future of Internet Surveillance Law: A User's Guide to
the Stored Communications Act, and a Legislator's Guide to Amending It, 72 GEO.
WASH. L. REV. 1208, 1208, 1213-14, 1229-30 (2004); see generally The Electronic
Communications Privacy Act: Government Perspectives on Privacy in the Digital Age:
Hearing Before the S. Comm. on the Judiciary, 112th Cong. 1-2 (2011) (statement of
Sen. Patrick Leahy, Chairman, S. Comm. on the Judiciary), available at
http://fas.org/irp/congress/2011_hr/ecpa.pdf (“[D]etermining how best to bring this
privacy law into the Digital Age will be one of Congress's greatest challenges. . . . [The]
ECPA is a law that is hampered by conflicting standards that cause confusion for law
enforcement, the business community, and American consumers alike.”).