What happens when your server is compromised and you get help from the FBI?
Often when a company announces that its servers have been compromised, the company also states that they have begun working with the FBI or a similar law enforcement agency.
What does this actually entail? I'm imagining this means anything from simply beginning contact with the FBI, to sharing server logs with them, to giving them full access to the machine for full forensics and interviewing you and your staff.
For minor intrusions, I'd imagine that there are many cases when law enforcement wouldn't get involved at all due to limited resources. On the other end of the spectrum, when millions of users' financial records are compromised I would imagine a more detailed response.
Does anyone have any experience with this? I'm curious to know anyone's stories.
3 comments
[ 3.2 ms ] story [ 18.4 ms ] threadI work at one of the larger webhosting companies, so we have a point of contact with them to start with. We help them out with various things (CALEA, data preservation, child porn/financial fraud, etc) so they tend to assist for major problems.
We reach out to our point of contact. We have to prove that the criminal fit somewhere in http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf
They then ask for data (our proof). In all the cases we've handled, our proof has been enough to hand off to a prosecutor. Sometimes the data is enough for the prosecutor to move forward and score a conviction, sometimes they have doubts as to whether a jury can be convinced so they either let them take deferred adjudication, or they try to strike a plea.
We've always known the culprit personally when they commit the crime (name, address, etc.) so I can't speak for other peoples' investigations where these things aren't known.