Digital evidence looks solid, but often it is not
An IP address, an account, a chat log: it sounds watertight, but digital evidence often says less than the OM assumes. The question is always whether it is traceable to you.
What counts as cybercrime
Cybercrime ranges from computer intrusion (art. 138ab) and disrupting systems to phishing, ransomware, DDoS attacks and online fraud. The possession or distribution of certain data is also punishable.
The technology is complex and the classifications are new and in flux. That is precisely where opportunities for the defence lie.
Hacking and computer intrusion
Computer intrusion requires deliberately and unlawfully gaining access to a system. Access with a weak or shared password, or a misunderstanding about authorisation, is more nuanced than the OM sometimes assumes.
We test whether there was actually "intrusion" and intent.
Phishing, ransomware and DDoS
In phishing, ransomware and DDoS it is often a matter of collaborations and the division of roles. The question is what you concretely did — and whether you were not yourself used as a money mule or intermediary.
We resist an overly broad attribution and bring your actual role precisely into focus.
Traceability and digital investigation
An IP address identifies a connection, not necessarily a person. Shared networks, hijacked accounts and malware mean acts can be wrongly attributed to you.
We test how data were obtained, whether the digital forensics are sound and whether the chain of evidence holds. We contest unlawfully obtained or improperly examined evidence.
International and encrypted evidence
Digital investigation is often cross-border and sometimes relies on intercepted, encrypted communication. Additional safeguards and mutual legal assistance rules apply to that.
If those have not been observed, it affects the usability of the evidence. We request access to the origin and method.
Sentence, seizure and future
In addition to a sentence, the seizure of devices, confiscation and the consequences for your VOG and work come into play. We request the return of your devices as soon as possible.
We steer towards acquittal or the lightest appropriate disposal and keep your future in view.
When to call us
- Your devices have been seized or searched
- You are being linked to an IP address, account or transaction
- You are suspected of hacking, phishing, ransomware or DDoS
- An international or digital investigation is under way
- You may have been used as a money mule or intermediary
- You have been invited as a suspect for interview
Frequently asked questions
They have my IP address. Am I then the culprit?
An IP address identifies a connection, not a person. Shared networks and hijacked accounts make the attribution uncertain. We run that defence with substantiation.
My account was hacked and misused. What now?
Then the question is whether the acts can be attributed to you. We investigate log files, login data and traces of takeover or malware.
Can digital evidence be excluded?
Yes. Unlawfully obtained data, an unsound forensic copy or a broken chain of evidence can lead to exclusion. We have that tested.
What if the case is international?
Cross-border digital investigation is subject to additional safeguards. If those have not been observed, it affects the usability of the evidence.
When is there computer intrusion?
When there is deliberate and unlawful intrusion into a system. Access with a shared or weak password is more nuanced; we test whether all the requirements are met.
I was used as a money mule. Am I criminally liable?
That depends on what you knew and did. Someone who was themselves recruited or deceived is in a different position from the mastermind. We bring that difference sharply into focus.
Will I get my phone and laptop back?
We test whether the seizure was lawful and request their return as soon as the interests of the investigation allow.
Does this affect my VOG and work?
A cybercrime conviction can complicate a VOG, particularly for IT positions. We keep that interest in view from the outset.