The paper must be double spaced, follow Chicago Style end references, have Times New Roman font, size 12, and 1 inch margins in a Word Document (.doc or .docx) and should run between 14 to 16 pages of text. Tables and references do not contribute to the page count. In addition to the text of your paper, you must include the analysis output or analysis log used to generate your results (e.g. Excel, R, Python, Stata, etc) with your submission. Also, please follow the final paper Rubic to revise the paper too.Here is the professor's comment, please follow these comments to revise: First Draft Notes: 1) Make sure you have a separate title page for the final paper and that all your tables/figures are at the end of the manuscript. You should not use figures from other sources without citing them; all your tables and figures must be original. After making these formatting adjustments and removing the extra spacing, there were only 6.5 pages of text. 2) I currently only count 9 economics journal articles in the references. Some of your citations are incomplete, e.g. missing the journal. 3) Your research questions and hypotheses are currently organized as separate sections. These should be written up as normal text within the introduction. Four research questions and five hypotheses may be ambitious for a 14-16 page paper. 4) The literature review is currently organized as an annotated bibliography; be sure to revise and synthesize this section for the final paper. 5) Your methods section does not include your regression or other statistical analysis but you have results. How did you arrive at these?

Investigation Guidelines Investigation of Hypothetical Situation Begin the process of an Investigation by selecting a hypothetical situation that I have posted. Research caselaw by searching for relevant cases or law review articles. Your analysis may rely on the opinion in a particular case or a law review article; however, you may also rely on additional cases or law review articles. You must properly cite the cases and law review articles that you rely upon. Your report must begin with the name of the hypothetical situation you selected! If you are basing your analysis on a case primarily, write your report in the following sequence: Name of the selected hypothetical situation. Summarize the facts of case you are relying on primarily. Summarize the holding of the case. Summarize secondary sources: If you are relying on additional cases, explain their holdings; you may also, but are not required to, recapitulate their relevant facts. If you are relying on additional law review articles, recapitulate their relevant concepts. Explain how the holding in the primary case applies to the hypothetical situation. Explain how the secondary sources apply to the hypothetical situation. Conclude what the outcome should be for the hypothetical situation. If you are basing your analysis on concepts elucidated in a law review article, write your report in the following sequence: Name of the selected hypothetical situation. Summarize the concepts presented in the article. Summarize secondary sources: If you are relying on additional cases, explain their holdings; you may also, but are not required to, recapitulate their relevant facts. If you are relying on additional law review articles, recapitulate their relevant concepts. Explain how the concepts in the primary article apply to the hypothetical situation. Explain how the secondary sources apply to the hypothetical situation. Conclude what the outcome should be for the hypothetical situation. Chose one of the Topics: Discovery and evidence: Forensic investigations A company learns that its computer system has been breached and immediately hires an external attorney to defend it in any ensuing lawsuits. The attorney hires a forensic investigation company to analyze the attack and its consequences in preparation for litigation. The forensic investigator produces a report that identifies how the attack occurred and what data was likely exfiltrated; it also notes some additional vulnerabilities that were discovered during the investigation and recommends deploying certain countermeasures in order to prevent future breaches. The attorney recommends that the company implement the countermeasures simply because "there's no sense in making a bad situation worse." The company obtains bids for the additional security work but elects to wait on the work due to budgetary reasons. Shortly thereafter though, another attack occurs that exfiltrates a far greater amount of sensitive personal data. The company orders a second forensic investigation in preparation of litigation. This second report concludes that the countermeasures recommended in the first report would almost certainly would have prevented the second attack. Within weeks, Plaintiffs sue the company based on the second breach and request documents relating to the breach investigation. Can the Plaintiffs compel the production of the first forensic investigation report? Incident response: Standards of care A company called Righteous Music creates a website to deliver streaming music for a fee. Millions of people sign up and provide credit and debit card numbers, as well as other sensitive personal data, to Righteous Music through its website. The website suffers a breach due to an XSS attack that exposes the sensitive personal data of millions of customers. Without any further information about the security practices of Righteous, can its customers bring an action asserting that Righteous was negligent in its cybersecurity practices? Would the result be the same if the type of attack had been an SQL Injection attack? REPLY TO  Incident Response: Standards of Care In the case In re Heartland Payment Sys., Inc. Sec. Litig, attackers hacked into Heartland Payment System through a SQL injection attack and stole 130 million card numbers in 2007. Heartland did not become aware of the attack until mid-January of 2009 and subsequently publicly disclosed information on the breach on January 20, 2009. Consumers then brought an action against Heartland due to their stock prices decreasing claiming that Heartland fraudulently misrepresented the state of their computer security. In re Heartland Payment Sys., Inc. Sec. Litig., Civ. No. 09-1043, 2009 U.S. Dist. LEXIS 114866, 2009 WL 4798148 (D.N.J. Dec. 7, 2009). The Court in Heartland noted favorably that the officers’ answers were honest and that they timely alerted the public to the breach. The Court found that even though Heartland’s customers personal data was stolen by attackers, Heartland’s cybersecurity practices could not be constituted as misrepresentation due to their honesty with the public. The Court held that Heartland did not act fraudulently but did act negligently in their failure to prevent the SQL injection attack, since the knowledge of how to prevent a SQL attack is widely known throughout the IT industry. Attacks -- Part 1", Cybersecurity Law (lectures), DePaul University D2L, retrieved on Feb. 29, 2020. The Heartland case was distinguished by In Re Equifax Securities Litigation where attackers were also able to steal sensitive personal data of millions of customers. Internal company documents clearly demonstrate Equifax awareness and actual knowledge of the failures to maintain computer security since at least 2014. Equifax waited three years, until September 7, 2017, to publicly disclose the massive data breach which is why the Court found their cyber security practices fraudulent due to misrepresentation. In Re Equifax Securities Litigation No. 17-CV-3463-TWT, OPINION AND ORDER, (ND GA) Jan. 28, 2019. In the Heartland decision, the Court explained the differences between fraudulent and negligent cyber security practices: "In contrast, the Plaintiff here has not alleged that the Defendants’ statements concerning Equifax’s cybersecurity practices are false merely because Equifax suffered a security breach. Instead, the Plaintiff has asserted specific factual allegations describing the poor state of Equifax’s cybersecurity." As such, the Court demonstrated the difference between fraudulent behavior, with explaining how Equifax’s practices met the standard for fraudulent cyber security practices, and how Heartland’s practices met the standard for negligent cyber security practices. Similarly, in both Heartland and Righteous Music, both entities cyber security practices were subject to massive breaches due to SQL injection attacks that could have been prevented through security measures that are widely known in the IT industry. Therefore, the Court’s holding in Heartland that it acted negligently in its cyber security practices by not enacting the widely known preventive measures to avert SQL attacks, correctly applies to Righteous. Due to the method of preventing a SQL injection attack being widely known in the IT industry, Righteous was negligent in its computer security practices by not securing its consumers data from an SQL attack. Therefore, yes, Righteous customers can bring an action asserting that Righteous was negligent in its cyber security practices. Yes, customers could also bring an action asserting that Righteous was negligent in its cyber security practices if its customers sensitive personal data was data exposed due to a breach from an XSS attack. As the Court held in Heartland, that the entity acted negligently in failing to protect its computer system from a preventable security breach, it could be claimed that Righteous was negligent in its security practices by not protecting its consumers from an XSS attack since a solution to all XSS attacks was discovered that relies on DOM text. Attacks -- Part 1", Cybersecurity Law (lectures), DePaul University D2L, retrieved on Feb. 29, 2020.