PA 05 · Practice area
Computer and cyber crimes
Device searches, unauthorized-access (CFAA) charges, crypto and online fraud. We read the search warrant and the forensic report the way the examiner wrote them.
Cyber cases usually begin with something physical: a search warrant at dawn, a laptop and phone taken, an employer's IT team claiming you went beyond your access. We represent developers, IT staff, students, crypto traders and their parents. We work with an independent forensic examiner and we speak the language of hash values and chain of custody, because the case depends on it.
Usually for
Developers, IT and security staff, students, crypto traders and the families of young adults accused of computer offenses.
You are reading: Is this you?
Is this you?
It may be time to call if…
- Agents executed a search warrant and took phones, laptops or drives.
- Your employer says you exceeded your authorized access to a system.
- You are accused of phishing, business email compromise, SIM swapping or ransomware.
- A crypto account or exchange balance has been frozen.
- Agents asked for your passwords or passcodes.
Where this sits in a federal case
Where this work usually happens.
Marked on the rail: investigation; charges and first appearance; discovery and motions; and plea discussions. Select any stage to read what it means in our plain-language guide.
What we do
Five things, in roughly this order.
-
1
Read the warrant's limits
What could be searched, which devices, which dates, which accounts. Searches that go beyond the warrant can be challenged.
-
2
Test the forensic work
Our independent examiner reviews the images, hash values and tool reports, and checks the chain of custody from seizure to report.
-
3
Ask who was at the keyboard
Shared networks, reused credentials, remote access and malware all bear on attribution. We test the government's assumptions.
-
4
Get property back
Devices and data not needed as evidence can sometimes be returned, with copies made for any legitimate purpose.
-
5
Fight fair release terms
Release conditions can limit internet and device use. We argue for terms that let you work and study.
This week
What to do, and what to leave alone.
Do
- Keep the inventory receipt agents left after the search.
- Write down what was taken and from where, while you remember.
- Change passwords only after talking with your lawyer.
Avoid
- Giving passwords or passcodes without legal advice.
- Logging into accounts that may be monitored, or wiping remote devices.
- Contacting anyone described as a victim.
General information, not legal advice for your situation. Speak with a lawyer before acting.
Terms, in plain words
The words you will hear.
- Forensic image
- A bit-for-bit copy of a drive or phone. Examiners work from the copy, not the device.
- Hash value
- A digital fingerprint that shows whether a copy matches the original exactly.
- Chain of custody
- The record of who had the evidence and when, from seizure to courtroom.
- Exceeding authorized access
- A phrase from the federal computer fraud law. Courts have narrowed what it covers, which matters for employees accused of misusing access they were given.
A college student's devices are seized in a credential-stuffing case
Mixed result
- Situation
- Agents seized his laptop, phone and an old tablet after logins were traced to his apartment building.
- What we did
- Our examiner showed the logins came through a shared network and a device he no longer controlled. We moved for the return of property not covered by the warrant.
- How it ended
- He was not charged. Two devices were returned after the motion; the third was kept.
An illustration with details changed and no names, courts or cases. Every matter turns on its own facts; past results do not guarantee any outcome. See all example matters, including ones that went against us.
Questions
What people ask us first.
Can I get my laptop and phone back?
Sometimes. Property that is not evidence, or data that can be copied, may be returned on request or after a motion. It can take time, so we usually start early.
Do I have to give agents my password?
The law on compelled passwords, passcodes and biometrics is unsettled and fact-specific. Do not give or refuse anything without first speaking with a lawyer.
What if someone else used my account?
Attribution, who was actually at the keyboard, is a central question in many cyber cases. Logs, device history and network records can help answer it.
Confidential consultation
Talk to us about cyber crimes.
A short, confidential call is often enough to learn where you stand and what to leave alone this week. Do not send details through the form; we will cover them by phone.
Please do not send case details through any website form or by email. We cover them by phone or in person, under privilege.
Consultation line: 7 days, 7:00 a.m. to 10:00 p.m. If a search or an arrest is happening now, call at any hour.