Legal Authority & Use of Force Flashcards

A chemical plant security team receives a court order to preserve all digital evidence from a compromised HMI. Which legal doctrine requires them to halt normal log-rotation procedures?

Answer: Legal hold (litigation hold)

A legal hold requires an organization to suspend normal data destruction or alteration processes to preserve evidence relevant to anticipated or active litigation.

Which concept describes the documented, unbroken transfer of evidence from an ICS incident scene to the courtroom?

Answer: Chain of custody

Chain of custody documents every person who handled evidence and every location it was stored, ensuring its integrity is not challenged in court.

A security professional conducting ICS vulnerability assessments for a U.S. federal agency must comply with which overarching federal information security law?

Answer: FISMA (Federal Information Security Modernization Act)

FISMA establishes requirements for information security programs at federal agencies and contractors handling federal information, including ICS systems.

In an ICS environment, what is the minimum requirement before security personnel may use force to defend against a cyberattack causing physical harm?

Answer: Imminent threat of serious bodily harm or death must exist

Use of physical force in defense against a cyberattack causing physical effects is governed by standard self-defense law requiring an imminent threat of serious harm.

Which international framework addresses the law of armed conflict as it applies to cyber operations targeting critical infrastructure like ICS?

Answer: Tallinn Manual

The Tallinn Manual is a non-binding expert analysis that applies international humanitarian law and laws of armed conflict to cyber operations, including attacks on critical infrastructure.

An energy company's ICS security team wants to 'hack back' against an attacker targeting their SCADA systems. Which U.S. law most directly prohibits this?

Answer: Computer Fraud and Abuse Act (CFAA)

The CFAA prohibits unauthorized access to computer systems, and hack-back operations against an attacker's infrastructure constitute unauthorized access under this law.

A private security officer at a natural gas compressor station may use deadly force ONLY when:

Answer: The officer reasonably believes there is an imminent threat of death or serious bodily injury

Deadly force is legally justified only when the officer has a reasonable belief of imminent threat of death or serious bodily injury, consistent with state use-of-force statutes.