Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that:

  • Integrity of the investigation is maintained
  • The undesired behaviour will cease
  • The damage is properly assessed
  • The value of the damages will be reimbursed

What types of cases succeed? What types of cases likely never see the light of day?

Is there a Law (or other) journal that covers these cases in any significant depth?

  • 3
    Note that this is a highly-localised question: relevant law in the US, EU and other areas all differ.
    – user185
    Nov 23, 2010 at 11:21
  • 1
    @Graham The US and EU example you gave aren't 'highly' localised, and is relevant to a vast majority of users on this site. Newtown township Pennsylvania, would be highly localized ;) Nov 23, 2010 at 13:32
  • @makerofthings7: there are many sovereign states in the EU, each with their own legislation. Such legislation varies over time. Therefore this question is localised in four dimensions.
    – user185
    Nov 23, 2010 at 13:45
  • 1
    Perhaps there is value in either sharing what is common among most, if not all, locations. It would also be of value to determine what applies to either the US or the UK, since that is relevant to a majority of this site's readership (please correct me if I'm wrong). Nov 23, 2010 at 13:49
  • 1
    Nothing. Remember Kevin Mitnick and Bernie S.? Aug 23, 2011 at 23:39

3 Answers 3


As I recall cyberlaw is pretty up in the air as it is a newer issue. The biggest issue, at least in the US, is proving that it actually was that person behind the keyboard. IPs can be spoofed, pseudonyms are just that pseudonyms, and intellectual property law is fairly unrefined as well. Also the hacker needs to be an adult or have committed a crime on a large scale, this of course is up to court discretion. Additionally one needs to consider is the user of the script to blame or the original developer? You can look at cases against Limewire and other P2P networks. I believe it really comes down to did the business take all necessary precautions to prevent this in addition to the attacker's intention. The RIAA has looked foolish in the past by trying to prosecute 12 year olds on music theft.

  • +1 I'll keep the RIAA example in mind when I come across an overzealous client Nov 22, 2010 at 21:15
  • On the other hand, FBI did prosecute a suspected trafficker in childporn, who claimed innocence blaming CSRF and the like (though I do not know what came of it).
    – AviD
    Nov 23, 2010 at 0:27
  • This case finally jailed the attacker who hacked a neighbour's wireless access point to plant incriminating child porn etc: arstechnica.com/tech-policy/news/2011/07/…
    – Rory Alsop
    Jul 16, 2011 at 9:24

I don't know of any law journals on this matter, as I am not a lawyer, but it appears that this involves all the procedures related to evidence in a civil lawsuit.

The sorts of resources that would be applicable would depend on the venue.

For example, let us say that I file a civil lawsuit via Federal diversity jurisdiction. Then, 28 USC controls the details. Furthermore, the court's local procedures as well as the federal court procedures would have a significant impact on the evidence, in addition to existing laws and precedents.

In short, you should provide more details.


It doesn't work that way.

The hackers don't have money, so you'll never get reimbursed for your damages.

Most hacking isn't repeated. That hacker will go away regardless, but that won't stop other hackers.

"Damage" is impossible to calculate. How much damage is lost reputation? HBGary had a nasty hack that damaged their reputation, but it also gave them a ton of publicity, so the hack may have instead helped them overall.

"Integrity of the investigation" rarely matters, because it's not that evidence that is used in trial. Instead, a lot of hackers are convicted of "conspiracy" or "intent" or "obstruction of justice" or some such nonsense. For example, the guy who stole Palin's e-mails was convicted of felony "obstruction of justice", because he deleted the evidence of the e-mail hack.

The evidence used to convict hackers usually comes from their hard drives, not yours. The police look for things like credit cards, other identity info, or child porn.

  • I think you'll find that in a high proportion of cases they do in fact have very large sums of money, as much 'hacking' is sponsored by organised crime and major governments. And the most serious attacks are repeated, because they make money. The methodologies and tools are sold to other attack groups to re-use. You are correct in saying that most money will never be reimbursed, but that is more the fault of failures in international law enforcement, anonymity on the web and international law, which is why you need to use 'conspiracy' or oter charges which are easier to prove.
    – Rory Alsop
    Aug 24, 2011 at 7:54

Not the answer you're looking for? Browse other questions tagged .