Instructors

• Norma Depriest
• Owen Gaddis

Governance, Technical Briefs and Case Studies

• Ethical Decision-Making

• Cybersecurity Governance

• Risk Analysis

  • Executive Decision Brief - Backup Modernization and Ransomware Resilience

• Policy Development

Reference Material and Topical Discussion

References

• ACM — Code of Ethics
  • Ethical responsibilities in computing and the public interest.
• ISC2 — Code of Ethics
  • Professional duties to society, clients, and the cybersecurity profession.
• ISACA — Code of Professional Ethics
  • Integrity, diligence, and responsible governance of information systems.
• IEEE — Code of Ethics
  • Public safety, honesty, fairness, and professional competence.
• DOJ — Computer Fraud and Abuse Act (CFAA) Guidance
  • Authorization boundaries and federal computer-crime charging policy.
• DOJ — Electronic Communications Privacy Act (ECPA)
  • Legal protections for electronic communications.
• CISA — Vulnerability Disclosure Policy Template
  • A process for reporting security vulnerabilities.
• NIST — Guide to Integrating Forensic Techniques into Incident Response (SP 800-86)
  • Collecting and using digital evidence during incident response.
• NIST — AI Risk Management Framework (AI RMF)
  • Managing risks across the AI life cycle.
• NIST — AI RMF Explainer Video
  • A brief introduction to the AI risk framework.
• NIST — AI Risk Management Framework: Generative AI Profile
  • Risks and safeguards specific to generative AI.
• NIST — Cybersecurity Framework (CSF) 2.0
  • Organizing and governing cybersecurity risk.
• NIST — Privacy Framework
  • Managing privacy risks in products and organizations.
• NIST — Digital Identity Guidelines (SP 800-63-4)
  • Identity proofing, authentication, and digital identity.
• NIST — Face Technology Evaluations (FRTE/FATE)
  • Independent evaluation of face recognition and analysis technology.
• Stored Communications Act (SCA)
  • Rules governing access to stored electronic communications.
• FTC — Privacy and Security Resources
  • Business guidance on protecting consumer data.
• FERPA Overview
  • Privacy rights and protections for student education records.

Casual Topics (mentioned in class)

• Microsoft vs. Nightmare Eclipse
  • A dispute over vulnerability disclosure, researcher relationships, and the risks of releasing zero-day exploits.
• Snowflake Compromised Credentials
  • How stolen customer credentials enabled access to Snowflake environments and exposed weaknesses in account security.
  • Snowflake data breach — Wikipedia overview
• Edward Snowden
  • Government surveillance disclosures and the ethical tension between secrecy, whistleblowing, and the public interest.
• Flock Safety Cameras
  • Automated license plate readers and questions about surveillance, data retention, and access to vehicle-location records.
• Benz v. PHB Realty Company
  • A court case involving alleged unauthorized access to an employee’s personal email.
• AI Hallucinations in Court Filings
  • A tracker of court decisions involving AI-generated errors, including fabricated citations. The linked article reports 2,046 identified cases worldwide as of September 21, 2026.
• Location-Based Delivery Pricing
  • How a delivery address may affect fees or prices, raising questions about transparency and fairness.
• The Rise and Fall of Agent Civilizations
  • An account of AI agents coordinating during evaluations and the security risks their behavior exposed.
• The Hidden Dangers of Musk’s VoteSafe.org
  • Privacy concerns about a Musk-backed voter information site and its collection of visitors’ personal data.
• The AI Doc: Or How I Became an Apocaloptimist
  • A documentary exploring the possible benefits and risks of artificial intelligence.

The 2024 Columbus Ransomware Breach: Public Statements, Connor Goodwolf, and the Class Action

⚠️ The Breach and the City’s Initial Claims

• NBC4i Investigative Report — Covers Mayor Ginther’s statements about the stolen data and the subsequent examination of its contents.
• StateScoop Timeline Analysis — Traces the ransomware attack, the city’s public statements, and the disputes that followed.
• Ohio Capital Journal Commentary — Criticizes the city’s transparency and response to questions about the exposed data.
• WOSU Public Media Retrospective — Reviews what remained unanswered one year after the attack.

🛑 The City’s Lawsuit Against Connor Goodwolf

David Leroy Ross Jr., known as Connor Goodwolf, examined data released after the breach and challenged the city’s description of it. The city sued him. This is separate from the breach victims’ case below.

• CNBC National Investigative Report — Examines Ross’s findings, the city’s lawsuit, and cybersecurity experts’ reactions.
• Ars Technica Legal Breakdown — Describes the city’s claims against Ross after he disclosed evidence about the breach’s severity.
• Malwarebytes Industry Response — Covers criticism of the city’s legal action from the cybersecurity community.
• Freedom of the Press Foundation First Amendment Analysis — Discusses the potential effect of the lawsuit on security research and reporting.
• WOSU Public Media: City Drops Its Lawsuit (October 2024) — Reports that the city dismissed its lawsuit against Ross with prejudice and describes the agreement concerning discussion of the breach and protection of private data.

⚖️ Breach Victims’ Proposed Class Action Against the City

People whose information was allegedly exposed sued the City of Columbus.

2024: Filing and Expansion

• WOSU: Columbus Police Officers File Class Action (August 2024) — Reports the initial suit by two officers who alleged that the breach exposed sensitive personal information.
• 10TV: Lawsuit Expanded to Other Affected People (August 2024) — Reports the expansion of the proposed class action beyond the officers. Two cases filed in August were later consolidated.

2025: Trial Court Dismissal

• WOSU: Judge Dismisses the Class Action (October 2025) — Reports the trial court’s decision that governmental immunity barred the claims against the city.

2026: Dismissal Reversed on Appeal

• Doe v. Columbus — Ohio Tenth District Court of Appeals (September 24, 2026) — The appeals court reversed the dismissal and sent the case back to the trial court. It found that immunity could not be decided against the plaintiffs solely from the allegations in their complaint.
• Columbus Dispatch: Class Action Will Move Forward (September 29, 2026) — Summarizes the appeals ruling and the plaintiffs’ allegations.

Current status as of October 7, 2026: The proposed class action has been returned to the trial court for further proceedings. The appeals ruling did not certify a class or determine that the city was negligent or liable.