Introduction to Cyber Security Law and Policy

Cybersecurity has evolved from a specialised technological concern addressed within computer science, engineering and information security circles, to an exciting novel field of law that is being shaped as you read this descriptor. This is no surprise: network and information technologies have taken centre stage in economic growth, the fight against crime, defence and diplomacy. Cybersecurity is now regarded as essential for discharging the duties of the state and the endeavours of economic and civil society actors. In this highly technical, hands-on module, we will critically engage with what cybersecurity means legally, how and why the law has morphed into its current shape, as well as who is responsible to deliver cybersecurity. We will examine relevant concepts, such as capacity building, ‘CIA’, cyber war and peace, resilience and risks, unpack the interplay between ‘data’ and ‘cyber' security, question whether entities should be allowed to ‘hack back’ and whether cybersecurity should be a right.

Thanks to a decade of EU cybersecurity policymaking, we will focus on flagship instruments including the Network and Information Systems Directive 2, the Cybersecurity Act and the Cyber Resilience Act. Yet, to truly understand cybersecurity law, we will need to broaden the horizon beyond the EU Digital Single Market and take into account the role of Member States and other relevant stakeholders. We will also analyse international developments pertaining to standardization and relevant treaties adopted or under discussion within the African Union, the Council of Europe and the United Nations. The classes will feature a combination of lectures, invited lectures, seminar-style debates and group presentations, allowing for the in-depth analysis of the legal frameworks and the discussion of case studies, case law and policy documents. Participants will cover a broad range of legal instruments, including soft law, having a bearing on cybersecurity. Students will gain the necessary knowledge to appraise the effectiveness of such instruments, their interaction and the affordances of cybersecurity law. The course further aims to enable students to identify policy trends in cybersecurity as they unfold and analyse current legal developments.

Priority will be given to students registered for the LL.M Intellectual Property and Information Technology Law degree programme.

Learning Outcomes:

On successful completion of this module, students should be able to:

• Understand the different meanings of cybersecurity and other key terms and how these affect the interpretation of cybersecurity law and policy
• Apply relevant national, regional and international sources of primary, secondary and soft law to a given case
• Analyse the impact of technological, economic and political developments on cybersecurity law and policy
• Evaluate the tensions between areas of cybersecurity policy and the effectiveness of applicable laws
• Critically engage with cybersecurity scholarship by leading authors.

Assessment:

• 60%: Take home Assignment
• 35%: Group Presentation
• 5%: participation (pass=100/fail=0)

Back to LL.M module table