# When should police be notified about host intrusion?

If an attacker gains unauthorized access to a host, or makes unauthorized modifications to information on that host, is it appropriate to contact the police or some other law-enforcement agency? In many cases, the host in question is in the United States, and the attack appears to originate outside the United States.

As far as I know (and don't go sticking your fingers in any ports now because of this) it's not worth reporting to any law enforcement unless there has been harm or damage to the system. In that case the cybercrime devision of the FBI is where you would report it, which is located in the "contact us" feature of the FBI's cyber-crime site and select "Internet crime" if you have a crime to report. At this point, when no harm is done, as far as I can tell it's pretty similar to walking on someone's lawn (there's no gate, so you don't have much of an argument, or there's a gate and I didn't break it when I came in).

Hence, to extend the metaphor, I recommend you send a report to the Host's web admin (which can usually be found using the whois www.abcdefg.com command in linux) and let them, (ehem, I couldn't resist) shoot whoever's in their lawn, or at least build a new gate!

Last, to go on a tangent, most local law enforcement authorities have a cybercrime division as well, but they mostly handle harassment (serious internet threats) and fraud investigation.

• While in the majority of cases it's unlikely the police will investigate. If they do investigate, it's ulikely that you will get restitution for any damage. However failing to disclose that your systems have been compromised could land you in a lot of trouble in the US and Europe where you can be required to do so in Stock Exchange filings and under data protection / privacy laws. – symcbean Aug 16 '12 at 13:07
• Thanks for the answer. Offline, I asked a friend with the CISSP certification, and he provided a very similar answer. – Eric Rath Aug 16 '12 at 17:40

I can only provide one Dutch case: A webdesign and hosting company (with approximately 100 clients) had a password hacked that was used for everything. (Yeah, don't get me started on all other security issues there.) A few websites were defaced, and private information from the owner was made public. Overall relatively little damage, but damage with a clear origin (we had the attacker's IP which was not a proxy and traced back to the same city).

We printed out the logfiles that we were able to get together (logging was malfunctioning on most websites...), and my boss went to the police with the information. At the police station, nobody knew anything about computers, but everything was written down best they could. The people usually taking these cases were having a training and would probably pick it up next week.

Next week came and passed. Next month came and passed. We called for updates, nothing. The case would have been a simple lookup (ISPs are required to log which IP is owned by whom at any given time), but they didn't do anything.

To the best of my knowledge, it's now 6 months later and the case hasn't even been looked at yet. I still think you should always go to the police with a breach, but the odds of it being solved are low when there is no big money involved.

• Have you tried meldpuntcybercrime.nl/english_information.html ? – Tie-fighter Aug 16 '12 at 0:34
• @Tie-fighter No we haven't, but I don't work there anymore. I would send this link to them, but solving this was not a priority at all since the attacker didn't return. Thanks for sharing this though, perhaps it'll be useful in the future (or for other users)! – Luc Aug 16 '12 at 0:39

I can't really tell you about the US, but here is a general consideration:

I heard a story of a woman (US) who parked her car in a long-term parking garage and when she wanted to retrieve it the company had gone bankrupt and her car was gone. Police didn't care to investige what appeared to be a multi car theft...

However I feel it is important to report such incidents for the sake of statistics and research, even if there is little or no chance of a positive outcome. Simplified speaking: If nobody reported crimes, police wouldn't know if the crime rate was high or low and what to focus on and try to prevent.

Even if police were not able to track somebody down based on your report, maybe one day they catch somebody and might be able to link your incident to that person.

Also a police report might be required by your insurance company in order to pay you out.

(Also don't underestimate the USA's diplomatic, political and military involvement around the globe...)

PS: Usually the officers at your local station will not know what to do but your country's Department of Justice will probably have experts and a point of contact.

What about an sql injection attack where data is only leaked(by selecting) and nothing is altered.
Would you call the authorities then?