Intro:
When our first laws were put in place, there was a priority to address the most pressing issues of the time such as independence, property, and governance. As time marched forward, innovation created gaps in these laws. The invention of the lightbulb meant work could be done at all hours of the day calling for laws to protect workers’ rights. As Henry Ford experimented with his model T car, provisions had to be put in place to protect those on the road during the transition from horse and buggy to automobiles. More recently, the new frontier of the internet required laws and regulations to protect digital property. These laws were difficult to legislate and enact due to the blurry lines of privacy rights. Now, as crime has become digital, the US needs to create and update its laws to include the vast territory of cyberspace.
Problem:
Outdated cyber laws make prevention, investigation, and prosecution difficult due to inconsistent enforcement and unclear authority and jurisdiction. Regulations and agencies such as the CFAA, the FBI, and CISA have served the US well in the past, keeping cyber activity in line. However, technology is rapidly developing while the law is not. Because of this, the laws and agencies are falling short in deterring and catching cyber criminals.
Why it matters:
This matters because the US does not have a strong legal system for punishing cyber criminals in a way that allows cyber crime to go unsolved or at least go too far. Further, what kind of evidence is needed to convict cybercriminals and how does the offense of a cyber crime warrant a punishment? Cyber crime affects all citizens of the US which is why it is imperative we protect them. According to a 2025 Pew Research Center survey, 73% of US adults have been a victim of an online scam or attack like phishing. This results in identity theft, compromised passwords for businesses, and financial debt. The average person who contributes to the economy and society needs to be safe from these kinds of threats.
Additionally, regular citizens are not the only people affected by cyber crime. The US government is a high-risk victim of thousands of security attacks per year. While the government has stronger security standards than the average person, the federal government experiences tens of thousands of cyberattacks daily. The risk is never nonexistent. Security standards for both the government and the general population need to be stronger in order to protect the nation from nation-state threats and economic and social discord.
Solution:
The United States Congress should establish the Cyber Law Modernization Act which will clarify federal cybercrime statutes and give agencies like the SEC and CISA explicit cyber authority. For instance, this act will amend the language of the CFAA, specifically the “exceeds authorized access” language, in order to allow a broader application of the CFAA such as when information is legally accessed but used inappropriately. This way, loopholes in the cyber legal framework can be reduced. Additionally, this act will allow agencies more authority to make cyber work safer with protections for businesses, customers, and investors. This can include defining a baseline for cyber hygiene standards and enforcing timely disclosure of significant cyber incidents.
Currently, cybersecurity regulation is a shared responsibility among the FBI, CISA, the FTC, and the SEC. With multiple agencies comes overlapping mandates and gaps where each agency thinks another agency has authority when no one does. This can lead to confusion as to which agency leads in a particular agency. Additionally, agencies may compete for resources or credit which can slow coordination and undermine trust. This is especially prevalent when dealing with information that is deemed classified by an agency. This limits what information is shared across agencies leading to an incomplete scope of the issue. When major attacks occur, a cross-agency response is required but bureaucratic bottlenecks delay the process..
Conclusion:
In practice, more unity and clarity among the cyber community will provide legal certainty by reducing overreach claims and ambiguity of legal breadth, as well as stronger deterrence by closing loopholes exploited by cybercriminals and negligent actors.

