Chapter 14: Legal Considerations

Overview

In his inspirational book, The Future of Law (Oxford University Press, 1996), Richard E. Susskind noted that, as far as law is concerned, one security fence at the top of a cliff is better than any number of ambulances at the bottom of that cliff. In theory, most IT security experts would agree with that seeming truism. In practice, most of them operate to the contrary maxim; namely, that an expensive and messy reactive legal cure is better than a proactive legal risks avoidance policy. There are several reasons for this strategic myopia.

The first of these is cultural. Lawyers tend to operate at one remove from the genesis of most technical and commercial projects. Lawyers view law as a parallel discipline that occasionally may proceed in lockstep with business, but does not need to form an integral part of it. The second reason is a related one. Lawyers and commercial people tend, respectively, to concentrate on the rarefied and on the newsworthy aspects of law. Certainly, any of the modish legal areas mentioned in passing under the heading “Legal Security Is Holistic” (in the concluding part of this chapter) can have a periodic operational relevance to online contracting—or to product/system design.

However, this chapter is concerned with distinguishing between law that may have an occasional relevance to online contracting and law that is fundamental to it, and will focus on the latter. In IT circles, the upshot of a misplaced attention to abstruse legislative moot points is a corresponding indifference towards workaday legal fundamentals— the settled common law basics of contract law and of evidence—that should inform the architectural specification of any secure online system from the outset.

This chapter outlines those common law basics and places them in a security context before applying them to some particular security technologies.