Cybercrime
Charges built from devices, logs and an IP address.
Cybercrime prosecutions rest on digital evidence, and digital evidence has to be lawfully obtained, properly preserved and correctly interpreted before it proves anything. An IP address is not a person. A device in a house is not a device in a pair of hands. These are the questions these cases turn on.
The situation
How these matters usually start
- Devices have been seized — laptops, phones, drives — and nobody has told you what happens to them or when you get them back.
- The allegation involves accounts, transfers or systems you may have had legitimate access to as part of your job.
- You have been linked to an IP address, an email account or a handle, and that link is being treated as identity.
- The matter crosses borders, and extradition or foreign authorities are being mentioned.
What the law says
What the law actually says
- The Cybercrimes Act creates specific offences including unlawful access, unlawful interception, and cyber fraud and forgery — these are distinct from common-law fraud and are charged differently.
- Seizure and search of devices must be lawful. Evidence obtained irregularly can be challenged, and in digital matters the irregularity is often in how the device was handled after seizure, not before.
- Digital evidence requires a provable chain of custody and a defensible forensic method. Copying a drive incorrectly can compromise the whole exhibit.
- Attribution is the hard part for the State. Linking an act to an account is not the same as linking it to a person, and that gap is frequently where these cases are actually contested.
How we handle it
- 01
Deal with the seizure
What was taken, under what authority, and what is legitimately recoverable now. Businesses often need their systems back before anything else matters.
- 02
Establish the allegation
Which offence under which section, over what period, and what conduct is actually alleged. Cyber charges are often pleaded broadly at first.
- 03
Interrogate the forensics
Imaging method, hash verification, chain of custody, and whether the interpretation of the artefacts holds up. This is where independent expertise earns its cost.
- 04
Attribution and defence
Shared devices, shared credentials, compromised accounts and authorised access are all real answers, and all of them are evidential arguments to be built.
What it costs
These matters usually require an independent digital forensic expert, and that is a real cost we will identify upfront rather than spring on you mid-case. Our own fees are staged, so you can see what each phase involves before it starts.
What moves the number
- The number of devices and the volume of data under examination
- Whether an independent forensic expert is required, and at what depth
- Whether the matter crosses borders or involves foreign authorities
- Whether it runs alongside a commercial crime or extradition matter
How long it takes
Forensic analysis alone commonly takes months, and the State often takes longer than the defence does. These are not quick matters, and treating them as such is the main way people end up under-prepared.
Common questions
Cybercrime
They have taken my computers. Can I get them back?
Sometimes, and sooner than people assume — particularly where a business cannot operate without them. There are also circumstances where a forensic copy serves the investigation and the original can be released. It is worth asking early.
I only had access because of my job. Is that a defence?
Authorised access is directly relevant, because unlawfulness is an element the State has to prove. Where the scope of your authorisation was genuinely unclear, that is a real argument rather than an excuse.
The case is based on an IP address. Is that enough?
An IP address identifies a connection, not a person. Shared networks, multiple users, dynamic allocation and compromised devices all sit between an IP address and an accused. Whether the State can close that gap is the central question.
Can a foreign country prosecute me for this?
Cyber offences frequently have cross-border elements, and extradition requests do arise. If that is a live possibility in your matter it needs to be addressed in parallel, not after the local case concludes.