Legal issues in information security