LEGAL AUTHORITIES DATABASE

A “LEGAL FOUNDATIONS” STUDY

Report 4 of 12

Report to the 

President’s Commission 

on Critical Infrastructure Protection

1997

This report was submitted to the President’s Commission on Critical Infrastructure Protection, and

informed its deliberations and recommendations. This report represents the opinions and

conclusions solely of its developers.
ii

Acknowledgments

The Legal Foundations series of reports of the President’s Commission on Critical Infrastructure

Protection (PCCIP) resulted from the concerted efforts and hard work of several individuals. The

Commission gratefully acknowledges Commissioner Stevan D. Mitchell and Assistant General

Counsel Elizabeth A. Banker for their leadership and important contributions in developing the

Legal Foundations series of reports. Their research, writing and analytical contributions were

essential to the success of the effort.

The Commission also acknowledges Lee M. Zeichner, Esq. of LegalNet Works Incorporated and

his staff, for conceptualizing and maintaining the legal issues database and for providing tireless

research support. Finally, the Commission acknowledges the contributions of Senior Consultant

Paul Byron Pattak for his deft editing of this compilation.
iii

Preface

Executive Order 13010 established the President’s Commission on Critical Infrastructure

Protection (PCCIP) and tasked it with assessing the vulnerabilities of, and threats to, eight named

critical infrastructures and developing a national strategy for protecting those infrastructures from

physical and cyber threats. The Executive Order also required that the PCCIP consider the legal

and policy issues raised by efforts to protect the critical infrastructures and propose statutory and

regulatory changes necessary to effect any subsequent PCCIP recommendations.

To respond to the legal challenges posed by efforts to protect critical infrastructures, the PCCIP

undertook a variety of activities to formulate options and to facilitate eventual implementation of

PCCIP recommendations by the Federal government and the private sector. The PCCIP

recognized that the process of infrastructure assurance would require cultural and legal change

over time. Thus, these activities were undertaken with the expectation that many would continue

past the life of the PCCIP itself.

The Legal Foundations series of reports attempts to identify and describe many of the legal

issues associated with the process of infrastructure assurance. The reports were used by the

PCCIP to inform its deliberations. The series consists of 12 reports:

1. Legal Foundations: Studies and Conclusions

2. The Federal Legal Landscape

3. The Regulatory Landscape

4. Legal Authorities Database

5. Infrastructure Protection Solutions Catalog

6. Major Federal Legislation

7. Adequacy of Criminal Law and Procedure (Cyber)

8. Adequacy of Criminal Law and Procedure (Physical)

9. Privacy and the Employer-Employee Relationship

10. Legal Impediments to Information Sharing

11. Federal Government Model Performance

12. Approaches to Cyber Intrusion Response

and two special studies:

• Information Sharing Models

• Private Intrusion Response

Legal Foundations: Studies and Conclusions is the overall summary report. It describes the

other reports, the methodologies used by the researchers to prepare them, and summarizes the

possible approaches and conclusions that were presented to the PCCIP for its consideration. The
iv

series has been sequenced to allow interested readers to study in detail a specific area of interest.

However, to fully appreciate the scope of the topics studied and their potential interaction, a

review of the entire series is recommended.
Page 1

Legal Authorities Database

In the fall of 1996, the President’s Commission on Critical Infrastructure Protection (PCCIP)

commissioned the creation of a legal database. The PCCIP Legal Authorities Database

(Database) now houses over 14,000 legal authorities bearing on infrastructure assurance,

including Federal, state, local, international, and even private sector authorities such as standards

and guidelines.

The Database grew out of the PCCIP’s various legal “landscaping” projects. It was originally

intended to serve as a study tool—a collection point for legal authorities that appeared relevant to

infrastructure assurance efforts, but that defied ready categorization. As it turns out, many of the

authorities collected do in fact defy ready categorization, which makes the Database all the more

useful as a tool for researching avenues by which to implement infrastructure assurance

recommendations.

The Database content specifically reflects the results of a de novo review of pertinent legal

sources, and input from PCCIP Commissioners and staff from each of the five Sector Working

Groups. Laws and regulations were included based on sector reports, briefings and additional

authorities that came to the PCCIP’s attention. The content also embodies contractor

submissions, suggestions from numerous public officials, and reports from the private sector.

The Database features separate fields for (among other things) the title and citation of the

authority, a summary of the authority, relevant text, related citations, and a “current as of ” date.
Page 2 of 3

Uses For The Legal Authorities

Database

The Database as a Research Tool

The Database was designed to assist interested persons in a number of key ways. First, by

placing a substantial number of pertinent resources in one clearinghouse, the Database saves

researchers considerable time and energy. Critical infrastructure issues are difficult to research.

Numerous sources are required to address most critical infrastructure issues—Presidential

materials, Congressional statutes, administrative rulings, unpublished guidelines, international

laws, and private sector materials; these materials can now be accessed in one place.

Second, the Database provides a clearer context in which to analyze and understand critical

infrastructure assurance issues. Many of the materials in the Database were originally entered

around key words and concepts relevant to assurance efforts. These included topics such as

indications and warnings, information sharing, education and awareness, information security,

emergency response and the like. Although the Database has grown beyond these topics, they

continue to serve as useful search terms to guide research efforts. Most interested persons will

have limited experience with critical infrastructure assurance issues and the Database offers a

compass for navigating through rugged terrain.

The Database as an Implementation Tool

Given the difficulties inherent in categorizing many of the Database entries, it would likely prove

productive to enter search terms keyed to various recommendations; results of such a search are

likely to produce an array of authorities—Federal laws and regulations, international agreements,

and even private sector standards.
Page 3 of 3

For example, a sample search for laws addressing cyber threats to the Nation’s securities and

commodities exchanges direct the user to pertinent portions of the Federal criminal code,

Securities and Exchange Commission regulations and SEC Rules for emergencies, state

computer crime laws, and NYSE, AMEX and NASDAQ floor rules, among others. The PCCIP

Legal Authorities Database can assist implementation efforts by Federal and state agencies,

lawmakers, and even private practitioners.

A Closer Look at the Legal Authorities Database

Appendix A contains a manual which accompanies the Database CD-ROM disk itself. The

graphics illustrate the legal categories and critical infrastructure topic areas represented in the

Database. The Legal Authorities Database includes relevant legal materials for each of the

critical infrastructures. In addition, the Database includes up-to-date legal source materials on

relevant “cross-cutting” issues. Cross-cutting topics include state computer crimes legislation,

U.S. Sentencing Guidelines, the Federal Response Plan, reporting requirements for infrastructure

owners and operators, information security and similar laws at the state level.

Appendix A also suggests the ease with which the Database may be used to locate relevant legal

authorities. Instead of categorizing relevant laws in terms of issuing agency or general area of

law (e.g., section of C.F.R. or U.S. Code topics), the Database is based on critical infrastructure

issue areas (e.g., Energy, Telecommunications and Information, Vital Human Services, Banking

& Finance, and Physical Distribution). Few commercial legal database sources include all of

these materials in one searchable database file.

The Database manual contains graphic representations of the contents of the database for each of

the infrastructure sectors and select cross-cutting issues. It is meant to give the reader a flavor of

the scope and depth of the Database, and should not be taken as a comprehensive rendering of all

authorities in each area.
A-1

APPENDIX A

LEGAL AUTHORITIES DATABASE

MANUAL

The Legal Authorities Database will be forthcoming in the future.