Cybersecurity for the extraordinary

Cybersecurity and Information Privacy Law are important to individual human beings, governments, and businesses. My trajectory to Cybersecurity and Information Privacy Law began with a practice and research in free speech rights and media law. Often times, free speech rights and privacy conflict, but there are times when privacy facilitates speech that would not exist but for some privacy protection. For example, a person would not be as forthcoming with her doctor or lawyer if they could share information with others. The same is true for the protection of a journalist's confidential sources. Thus, the intersection between free speech and privacy is a complex and fascinating topic. Cybersecurity is also critical to freedom of speech because, for example, encryption helps protect the important role of investigative journalism in a self-governing democracy.

Prof. Joseph A. Tomain

Professor Tomain, would you say the question of cybersecurity is a topic affecting people all around the globe but is often underestimated, even by lawyers?

Prof. Joseph A. Tomain: Yes. Cybersecurity affects everyone. Think of the several high profile breaches, such as Equifax and Target. It is difficult for me to say whether cybersecurity is underestimated. But I can say, there is an increasing need for better awareness by citizens, businesses, governments, and lawyers.
 

Most of your work is the lecture of information privacy law. What is the largest challenge here upcoming in the next few years?

Prof. Joseph A. Tomain: One of the largest challenges will be the United States' approach to information privacy law. With EU's GDPR and California's Consumer Privacy Protection Act (among other state legislation), there is an increasing push on the federal government to pass federal privacy legislation. Generally speaking, federal privacy law may be a positive because it could create uniformity throughout the United States.  One concern, however, is whether the federal legislation will preempt state laws. This is a concern if the federal legislation inadequately protects privacy rights and prohibits the states from engaging in the process of protecting privacy. Justice Louis Brandeis once described U.S. states as "laboratories of democracy." Federal privacy legislation that preempts states from regulating privacy frustrates this important role of states in our federal system.

Another major issue is the use of face recognition technology by both public and private actors. 
 

How did you first get in touch with the topic cybersecurity and how did you pursue it?

Prof. Joseph A. Tomain: My trajectory has been free speech and media law into privacy law into cybersecurity law. As the Director of the Maurer School of Law's  Information Privacy and Cybersecurity Program, I have had the wonderful opportunity to collaborate with students, faculty in other Indiana University schools, as well as work with IU's Center for Applied Cybersecurity Research. I have been blessed to work at a university that has been on the cutting edge of Cybersecurity and Information Privacy Law. In short, Indiana University is an excellent place to pursue theoretical and practical work in the field of Cybersecurity.

Is your program created for every LL.M.-student or only for those who want to work more on IT-issues?

Prof. Joseph A. Tomain: Maurer School of Law provides several opportunities for folks interested in Cybersecurity or Information Privacy Law. In short, no. Our LL.M is not intended solely for students focused on IT-issues. As a law school, our main focus is the law and policy component of cybersecurity and information privacy law. That said, we do have opportunities for students to develop their technical skills and knowledge through collaborations with Indiana University's School of Informatics, Computing, and Engineering (SICE).

Is it all about cybersecurity, or is there another argument in your opinion to choose Indiana University for LL.M.?

Prof. Joseph A. Tomain: There are many reasons for a student to consider the Maurer School of Law for an LL.M. There is a vibrant research community and students from across the world. For example, students in my Information Privacy Law I course are from India, Thailand, France, Italy, and China. This global diversity provides a unique perspective to a topic important to human beings across the globe.

Beyond the Cybersecurity and Information Privacy Law component, Maurer's LL.M program is a robust program that offers a wide range of courses and specialties that allow students to customize their courses to their specific interests.

Under Director Gabrielle Goodwin's leadership, the Graduate Legal Studies program at the Maurer School of Law has flourished.  It is a great joy to be a part of this program. The students I have met are wonderful and have enjoyed their time in lovely Bloomington, Indiana.
 

What is your opinion about the internet of things in terms of cybersecurity?

Prof. Joseph A. Tomain: We need businesses to continue improving the cybersecurity of IoT devices, as a matter of self-regulation and best business practices. We also need some type of government regulation to set minimum standards for cybersecurity of IoT devices. These concerns are not simply about privacy, but also security. When so many devices are connected (or can be connected), a devastating domino effect could cause economic harm and worse. 

Serving as a senior associate or being a lecturer at the university. Which would you prefer, if you had to choose?

Prof. Joseph A. Tomain: I love my current postion at IU. I am a Lecturer in Law, the Director of Maurer's Information Privacy and Cybersecurity Law program, and a Senior Fellow at IU's Center for Applied Cybersecurity Research (CACR). I am thankful to teach our excellent students, to help them navigate their career path, to research information privacy law, and to work with great folks at the CACR who are engaged in the practical application of these incredibly timely and important issues.  I am also thankful for my experience as a practicing attorney. That experience has allowed me to provide a holisitc approach to the study of law that focuses on the value of inculcating a joy for understanding both the theoretical and practical components of law. Both are important generally, but even more so in the fields of Information Privacy Law and Cybersecurity Law because they are developing quickly. In short, theoretical knowledge is important because students will be shaping the law.   
 

“Think before you click” is one slogan used by the Indiana University in terms of security at mailing. Maybe the biggest security risk is not the operating system itself but users in front of the device?

Prof. Joseph A. Tomain: There is no question that individual human beings play a role in their own cybersecurity, but the full burden does not fall on them.

Cybersecurity often also includes data security and privacy. Comparing the data privacy laws, which one has got a better security level – US or the EU? Or are these not comparable?

Prof. Joseph A. Tomain: There is room for the U.S. to improve its cybersecurity laws. Currently, the U.S. does not have a federal data breach law.  Assuming the right law is passed, a uniform data breach law could be a helpful step in a more secure future. 

New technologies and IT-infrastructures arriving more and more rapidly. Is our legislation to slow or the development to fast and how do you prepare your students for the practice according to this?

Prof. Joseph A. Tomain: Law will always lag behind technological development. One way I help prepare my students is to emphasize the importance of both the theoretical and practical aspects of law. One example I use is the collaboration between attorney Carrie Goldberg and law professors Danielle Citron and Mary Anne Franks in the development and passage of Non-Consensual Pornography laws.  These individuals, along with others, worked together to have Non-Consensual Pornography laws passed in almost all the 50 states in the U.S. This is just one example of research and practice coming together to help the law develop to face new challenges resulting from technological development.
 

Artificial Intelligence – Our final invention. What is your opinion about this phrase according cybersecurity?

Prof. Joseph A. Tomain: One of my favorite quotes comes from the Contracts casebook that I used as a law student and require my current 1Ls to read. The preface concludes: "No study of law is adequate if it loses sight of the fact that law operates first and last for, upon, and through individual human beings." Like all technology, AI can be used for beneficient and malicious purposes. Certainly, AI raises some unique challenges because of the nature of AI, but it also raises the same or similar concerns with all technology.

Ultimately, our focus should be on whether it serves individual human beings. If not, then the law could play a role in limiting uses that could be used to harm actual, living, human beings.
 

How are your curriculums included inside the LL.M. program?

Prof. Joseph A. Tomain: There are multiple options. Students can specialize in cybesecurity or information privacy. They can specialize in other areas of law as well. Or, they can take a general approach and select courses from across the substantive law spectrum. One of the beauties of Maurer's LL.M programs is in its flexibility. Director Goodwin, myself, and others are always happy to have conversations with individuals about their particular interests and how Maurer can help them achieve their specifc goals.

Compared to other law schools, what is the most outstanding feature of Indiana University to choose for LL.M.?

Prof. Joseph A. Tomain: The flexibility in the curriculum. The faculty and the staff. The diversity of the the student population. The chance to live in lovely Bloomington, Indiana.
 

Is there an example for a success story started with your program you would tell us?

Prof. Joseph A. Tomain: I have literally never heard any student express regret about choosing Maurer School of Law for their LL.M program. Moreover, I have had many students tell me how much they have enjoyed their legal education at Maurer and living in Bloomington.   
 

Is there a last advice you want to give to our readers who are not sure if they want to choose this program?

Prof. Joseph A. Tomain: My general advice is that people should do what they love. If you are interested in information privacy law or cybersecurity, Maurer School of Law and Indiana University generally are leaders in the field. At the very least, I encourage folks to give Maurer School of Law serious consideration. Finally, I am happy to answer any questions.

Short conclusion?

Prof. Joseph A. Tomain: There is a lot of work to do in the fields of cybersecurity and information privacy law because both are critical to a functional democracy. Thus, not only is the area of study exciting from an academic perspective, it is critically important for the future of our world. Thus, I will leave you with a quote from Nobel Prize in Literature winner, Bob Dylan: 

"'No reason to get excited,' the thief, he kindly spoke

'There are many here among us who feel that life is but a joke

But you and I, we’ve been through that, and this is not our fate

So let us not talk falsely now, the hour is getting late'”

Thank you, Prof. Tomain!