Copyright Goodheart-Willcox Co., Inc. 60 Principles of Cybersecurity his job, Keys gave hackers the account names and passwords for Tribune company websites. In other cases, however, judges have ruled that prosecutors have over- reached on charges. One such case involves Lori Drew. She faked a social media profi le on MySpace. The profi le was used to engage in cyberbullying of a 13-year- old girl, who believed the profi le was for a boy from school. Ultimately, it was ruled that Drew’s actions did not represent unauthorized access. Electronic Communication Privacy Act The Electronic Communication Privacy Act (ECPA) protects wire and elec- tronic transmissions of data. This law covers communication such as e-mail, tele- phone conversations, and data stored electronically. Essentially, the law protects electronic communication whether made orally (by voice) or digital data transmis- sions. Protection starts at the beginning of the transmission, through the data in transit, and the data stored on computers, as shown in Figure 2-18. The ECPA has three titles: • Wiretap Act • Stored Communications Act (SCA) and • Pen Register Act. The Wiretap Act prohibits the intentional interception, use, disclosure, or procurement of any communication. Even attempting this is prohibited. Addition- ally, data collected by any such method cannot be used as evidence in court. The Stored Communications Act (SCA) protects the privacy of the content of fi les stored by service providers. It also protects records including subscriber names, billing records, and IP addresses. The Pen Register Act requires governmental entities obtain a court order on these devices. A pen register is a device that captures the numbers and related information of outgoing calls. A trap and trace captures numbers and information on incoming calls. There are many issues with the ECPA, and there are exceptions that have been made through the USA PATRIOT Act. There are also issues of confl ict with the Fourth Amendment rights to protect individuals from unreasonable search and seizure. Currently, stored data older than 180 days are considered to be aban- doned, and thus not subject to a warrant. This applies to e-mail and data stored in the cloud. Proposals have been made in Congress to address these confl icts and privacy issues. The ECPA was originally enacted to address interception of conversations on “hard” telephone lines, or landlines. It has since been updated to consider other technologies and methods of access. FYI The USA PATRIOT Act also covers electronic communication. FYI ECPA Protection Goodheart-Willcox Publisher female: SpeedKingz/Shutterstock.com server: BLACKDAY/Shutterstock.com male: Odua Images/Shutterstock.com Figure 2-18. ECPA protection begins at the start of the transmission and contin- ues to the end, including the data stored on computers.