What law requires me to safeguard classified information? Let's say I have a briefcase full of Top Secret papers, and I carelessly leave it on the table at Burger King and it falls into the wrong hands. 18 U.S. Code § 798 apparently only applies if I &quot;knowingly and willfully&quot; provide the information to an unauthorized person. My employer certainly expects me to safeguard the information I have been entrusted with, but does my negligence actually violate any law?
Assuming all the required elements are met, 18 U.S. Code § 793(f)(1) would presumably apply: Gathering, transmitting or losing defense information (f)Whoever, being entrusted with or having lawful possession or control of any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, note, or information, relating to the national defense (1) through gross negligence permits the same to be removed from its proper place of custody or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed, or (2) having knowledge that the same has been illegally removed from its proper place of custody or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and fails to make prompt report of such loss, theft, abstraction, or destruction to his superior officer— Shall be fined under this title or imprisoned not more than ten years, or both.
IANAL, and as @GeorgeBailey suggests, you should ask one. That said, some aspects of your question are directly addressable with what we know. Does US law states anything about this? Yes. Federally this falls under the Wiretap Act, 18 U.S.C. §2511. Workplace monitoring generally falls under either the "System Administrator Exception" or under Consent. In general, continuing past a banner constitutes consent. Does company policy enforcement with such a warning over ride the right to not be subject to surveillance? In general, yes. You don't need to use the companies network if you don't want to consent - and they don't need to hire you if you don't want to use their network. But it's their network, and their rules apply. There are some nuances, and courts have found that the wording of the notice has made a difference in some cases, but overall, if the systems are properly posted with banners, then the employer may capture communications. See the "Bannering and Consent" section of this article from cybertelecom.org, e.g.: Even if no clicking is required, a user who sees the banner before logging on to the network has received notice of the monitoring. By using the network in light of the notice, the user impliedly consents to monitoring pursuant to 18 U.S.C. § 2511(2)(c)-(d). Note that stored data is covered by different laws than communications. It's a nuance. Is it ethical to sniff all the data without giving any other warning than the logon banner? "Ethical" is a very different question than "Legal", and largely more subjective. Most employers require signed consent for monitoring as a condition of employment, and use banners thereafter. That is ethical by my definition, in that it meets or exceeds the requirements of the law, and does not mislead or use subterfuge. The tone of your question suggests you find it distasteful, and therefore probably it violates your personal code of ethics.
This is a super complex question and no one really knows the answer yet. Orin Kerr is probably the leading scholar on this question, and he generally argues that forced decryption of one's own device is not a Fifth Amendment violation. As I understand it (and oversimplifying by a lot), one key piece of his position is that requiring you to put in your password is a statement about your knowledge of the password itself, not about the contents of the machine into which you are entering it. And because your knowledge of the password for your own devices is presumed, an exception for "foregone conclusions" would leave this compulsion unprotected by the Fifth Amendment. You can read one of his explanations here. The Eleventh Circuit disagreed with that approach, but a California judge recently reached a conclusion similar to Kerr's. This will probably by a question for SCOTUS before too long.
You do not have to. The burden of proof is on the prosecution to prove that you made the threat. Reasonable doubt exists in the circumstances that you describe, that there are no logs of who accessed what when and how. Your attorney may have to introduce expert witnesses who can explain how it is possible that text from your computer can end up on a web page, and they can testify that there are many ways that data can be entered into the database, only a few of which actually involve you.
The most apparent potential offences would be under 18 U.S.C. § 1030, but these require the mens rea of &quot;knowingly&quot; or &quot;intentionally&quot; doing things without authorization, or doing so &quot;with intent to defraud&quot;, etc. See also the Department of Justice's manual entry on this family of offences. Particularly relevant is this quote: As part of proving that the defendant acted knowingly or intentionally, the attorney for the government must be prepared to prove that the defendant was aware of the facts that made the defendant’s access unauthorized at the time of the defendant’s conduct. Given your stipulation that the person has unintentionally viewed or downloaded the material without authorization, this would not be a violation of 18 U.S.C. § 1030.
What does your Data Protection Officer say? It’s their role to be aware of and assess if you policies, procedures and processes comply with the principles. For the particular application is it: “specified, explicit and legitimate purposes”? “adequate, relevant and limited to what is necessary” “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed” “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures” And can you clearly demonstrate compliance with the above? Just a personal observation: WTF are you using a spreadsheet for what is clearly a database problem? This is several dozen steps away from best practice data security.
It may not be libel, but it may violate other statutes and may support a judgement against the person publishing this information as long as there is an injury-in-fact ("an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical"). A recent case, Spokeo, Inc. v. Robins 578 U.S. ___ (2016) considered the case where a company created a profile for a person. That profile stated "that he is married, has children, is in his 50’s, has a job, is relatively affluent, and holds a graduate degree". The plaintiff asserted that all of this was incorrect. The plaintiff made a claim under the Fair Credit Reporting Act because the information was false. However, mere violation of statute is not sufficient to meet the "injury-in-fact" requirement for standing. Congress can't create standing via statute. Injury-in-fact still requires a "concrete" injury. This does not need to be a physical, tangible injury. But, it does need to be concrete. On its own, publication of false information, even when statute prohibits it, does not create standing. There must be an injury-in-fact.
I'm not familiar with this law, but if it works like other tax confidentiality laws I'm familiar with, it would be interpreted so broadly that there would effectively be no difference between "facts," "particulars" or "information." People receiving tax returns under this law would be prohibited from disclosing any of them. Anything that is in the return would be considered secret.