Cyber Incident Response: Collaborating with Law Enforcement

Need to handle a cyber attack? Here’s what you must know about working with law enforcement:

Key Facts	Details
Cost Impact	Cyberattacks cost $8T in 2023, rising to $24T by 2027
Small Business Risk	46% of attacks target companies under 1,000 employees
FBI Recovery Rate	82% of funds recovered when reported within 24h
Response Time	297 days without FBI vs 281 days with FBI help

When attacked, do this immediately:

Time	Action
0-15 min	Pull affected systems offline
15-30 min	Contact FBI IC3 and local cyber unit
30-45 min	Document everything with screenshots and logs
45-60 min	Start system backup and damage assessment

Why work with law enforcement?

• Companies save ~$1M per incident with FBI help
• FBI has tools and legal powers your team doesn’t
• Evidence collected properly is crucial for prosecution
• Cross-border cases need official channels

Main challenges:

• Only 10-12% of cybercrimes get reported to FBI
• Companies wait too long to call law enforcement
• Evidence disappears quickly without proper handling
• Privacy rules can slow investigations

Bottom line: Call the FBI within 24 hours of discovering a breach. The longer you wait, the harder and more expensive recovery becomes.

Related video from YouTube

Key Problems

Law enforcement and companies face big challenges when dealing with cyber incidents. Here’s what’s happening:

Main Response Issues

Most police departments can’t handle cyber incidents well. Here’s why:

Challenge	Impact
Not Enough Resources	Over 18,000 U.S. police departments lack basic cyber procedures
Staff Problems	Cyber experts keep leaving for better-paying private jobs
Old Tech	Police need better tools to collect digital evidence
Too Much Data	Information overload makes it hard to find suspects

Working with Law Enforcement

When companies try to work with police, they hit these roadblocks:

Barrier	Details
Privacy Rules	GDPR stops police from getting the data they need
Different Countries	Each country’s laws slow down investigations
Finding Evidence	Criminals hide behind encryption and crypto
Sharing Info	Agencies won’t share data due to security fears

Cost of Slow Response

When companies wait to call the police, bad things happen:

Impact Area	Result
Lost Evidence	Digital clues vanish fast
Long Cases	Without police help, cases drag on for 297 days
Legal Help	Countries often fail to help each other get evidence
Getting Data	Strong encryption means time is critical

Here’s the BIGGEST problem: Companies wait WAY too long to call the police. By then, criminals have:

• Cleaned up their tracks
• Sent stolen money elsewhere
• Gotten rid of evidence
• Left the country

Bottom line: Call the police FAST. The longer you wait, the harder (and more expensive) it gets to fix things. Companies need to build strong connections with law enforcement BEFORE something goes wrong.

First Steps After an Attack

Time is critical when you spot a cyber attack. Here’s your hour-by-hour action plan:

Time	Action	What You Need to Do
0-15 min	Stop the Attack	Pull affected systems offline NOW
15-30 min	Call FBI & Police	Contact IC3 and your local cyber unit
30-45 min	Document Everything	Grab screenshots, logs, and notes
45-60 min	Start Recovery	Back up systems and check damage

Save Everything

The FBI needs these details to help you:

Detail Type	What to Track
Attack Timeline	First sign of breach, what happened next
Tech Info	OS versions, patches, IP addresses hit
Discovery Details	How you found the attack
Response Steps	Actions your team took to stop it

Lock Down Evidence

Digital evidence vanishes FAST. Here’s what to grab:

Evidence	Action Steps
System Logs	Copy them before ANY cleanup
Memory	Get RAM data before power-off
Network Data	Save all packet info
Access Logs	Export who logged in and when

Tools That Help

These tools make evidence collection easier:

Tool	What It Does
Forensic Apps	Copy drives bit-by-bit
Log Tools	Pull all system records
Chain Software	Track evidence handling
Time Tools	Mark when you found stuff

The Numbers Tell the Story:

• FBI got back $380M (82%) from cyber theft in 2020
• Only 10-12% of cyber crimes get reported
• Companies take 207 days to spot breaches

Bottom Line: Don’t touch ANYTHING until the FBI says OK. The more evidence you save, the better your chances of recovery.

Working with Law Enforcement

The FBI has cyber squads in all 55 field offices. Here’s what you need to know about working with them:

Direct FBI Connections

Connection Point	What It Does	Why You Need It
Local FBI Cyber Unit	Handles your case directly	First point of contact
InfraGard	Links you to FBI resources	Gets you insider access
IC3 Portal	Takes official reports	Speeds up response time
NCIJTF	Coordinates multiple agencies	Handles complex cases

Communication Protocol

When talking to the FBI, stick to these basics:

Info Type	What to Share	Purpose
Initial Report	Case #, when it happened	Starts your paper trail
Follow-ups	New data, status changes	Keeps case moving
Digital Evidence	Raw logs, files	Preserves legal value
Contact Person	One team lead	Keeps messages clear

Report Processing

Here’s what happens after you file with IC3:

Timeline	What Happens	Next Steps
Day 1	You get a case number	Keep it handy
Day 2	FBI checks severity	Team gets assigned
Day 3	Investigation begins	Evidence gathering starts
Day 4+	Recovery work starts	Action plans launch

Agency Roles

Different agencies handle different parts:

Who	What They Do	When to Call
FBI	Leads cyber cases	For all cyber attacks
Secret Service	Handles money crimes	For banking fraud
Police	Local support	For physical evidence
NCCIC	Tech info hub	For technical help

"Want FBI cyber help fast? Your InfraGard coordinator can connect you directly to the Cyber Task Force." – Stacy Stevens, FBI Mission Critical Engagement Unit Chief

Quick Facts:

• FBI teams can arrive in hours
• 30+ agencies work together
• 55 FBI offices across the US
• 48-hour max response target

The FBI has tools and legal powers your team doesn’t. Get them involved early – it makes a big difference.

Joint Investigation Steps

Team	Primary Tasks	Tools Used
Company IT	Secure systems, logs	Network monitoring, SIEM
Legal Team	Handle privacy issues	Case management software
FBI Cyber	Lead investigation	FBI forensic tools
Local Police	Physical security	Evidence collection kits

When the FBI gets involved in a cyber investigation, they work with multiple teams. Each team has specific jobs and tools they use.

Here’s what happens during an FBI joint investigation:

1. Initial Response: Company IT stops the attack and saves data. The FBI guides them on collecting evidence.
2. Evidence Collection: The company gives access to systems. FBI documents who handles the evidence and when.
3. System Analysis: Company helps find affected systems. FBI runs detailed forensic tests.
4. Interviews: Company points out key people to talk to. FBI runs formal interviews.

The FBI follows strict rules for collecting digital evidence:

Evidence Type	Collection Method	Storage Requirements
System Logs	Direct export	Write-protected media
Email Data	PST/server backup	Encrypted storage
Network Traffic	PCAP files	Tamper-proof vault
User Files	Bit-by-bit copy	Chain of custody forms

Every piece of evidence needs tracking:

Stage	Required Info	Purpose
Collection	Time, date, location	Establish timeline
Transfer	Handler names, times	Track possession
Storage	Vault location, access	Maintain security
Analysis	Lab details, methods	Court requirements

For privacy, different data types need different handling:

Data Type	Privacy Rule	Action Required
PII	GDPR/CCPA	Get legal approval
Health Data	HIPAA	Notify compliance
Financial	GLBA	Document access
Employee	Labor Laws	Inform HR

For cases that cross borders, the FBI has specific timelines:

Country	Process	Timeline
EU	Use MLAT agreements	30-90 days
UK	Direct FBI liaison	14-30 days
Canada	Cross-border task force	7-14 days
Others	Interpol channels	60-120 days

"The FBI’s Cyber Action Team can deploy across the country within hours to respond to major incidents." – FBI National Cyber Investigative Joint Task Force

What You Need to Know:

• Call the FBI within 24 hours
• Don’t change any evidence
• Write down who touches evidence
• Follow FBI evidence rules
• Only use secure communication

The FBI needs these forms:

Form Type	When to Use	Processing Time
FD-302	Witness statements	24-48 hours
Chain of Custody	Evidence transfers	Immediate
IC3 Report	Initial incident	1-2 days
Search Warrant	Device access	24 hours

Fixing Common Problems

Here’s what works when dealing with cyber incidents:

Problem Area	Common Issue	Solution
Communication	Delayed updates	Set up 24/7 hotline with FBI
Data Sharing	Privacy concerns	Use secure data transfer tools
Operations	Business disruption	Create parallel work systems
Team Management	Unclear roles	Define clear responsibilities

Better Communication

The FBI’s National Cyber Investigative Joint Task Force now connects directly with company IT teams. Instead of waiting hours, teams get help in minutes.

Here’s how different teams stay connected:

Communication Type	Method	Response Time
Emergency Updates	Secure messaging app	Within 15 minutes
Evidence Sharing	FBI portal	Within 1 hour
Status Reports	Encrypted email	Daily
Team Updates	Video conference	Twice daily

Keeping Secrets Safe

ScoreDetect tracks every file access. Each file gets a blockchain stamp – like a digital fingerprint – showing who touched it and when.

Data Type	Protection Method	Access Level
Customer Records	Split database	Need-to-know
System Logs	Hash verification	Read-only
Employee Data	Access control	HR only
Financial Info	Encryption	Finance team

Keeping Business Running

Your business needs to keep moving during an investigation. Here’s how:

Business Area	Backup Plan	Recovery Time
Customer Service	Cloud phone system	30 minutes
Payment Processing	Backup provider	1 hour
Email Systems	Mirror servers	Immediate
Data Access	Offline copies	2 hours

Managing Multiple Teams

Each team needs specific tools to do their job:

Team	Main Task	Communication Channel
IT Security	System protection	Direct FBI line
Legal	Evidence handling	Secure portal
Operations	Business continuity	Team chat
Management	Decision making	Video calls

Here’s what each team uses:

Tool Type	Purpose	User Group
Evidence Logger	Track case files	FBI + Legal
Chat System	Quick updates	All teams
Task Board	Track progress	Team leads
Report Builder	Document events	IT + Legal

What makes this work:

• Set up secure chats BEFORE you need them
• Keep your business systems separate from investigation systems
• Give teams clear tasks and power to act
• Use tools that log everything automatically

Working Together Well

Here’s how teams share info and work together to stop cyber attacks:

Information Sharing Rules

Type of Information	Sharing Method	Access Level
Attack Details	FBI Portal	Law + IT Teams
System Logs	Secure FTP	Forensics Only
Business Data	Split Database	Need-to-know
Case Updates	Encrypted Email	Team Leads

Every file gets a clear label about who can see it and how to use it. ScoreDetect puts a blockchain stamp on file access – so there’s no question about who touched what.

Tools and Tech

Resource Type	Purpose	Teams Involved
Digital Forensics	Evidence Collection	FBI + IT
Log Analysis	Attack Tracking	Security + Legal
Case Management	Progress Updates	All Teams
File Storage	Evidence Storage	Law + Legal

Time Targets

Task	Time Frame	Team Lead
Initial Report	First 24 Hours	Security
Evidence Collection	48-72 Hours	FBI
System Recovery	3-5 Days	IT
Case Updates	Daily at 10 AM	Legal

Measuring Success

Metric	Measurement	Goal
Response Time	Minutes to First Action	Under 15 Min
Evidence Quality	Files Meeting Court Rules	100%
System Recovery	% Systems Back Online	95% in 72h
Team Updates	Report Completion Rate	Daily 100%

Here’s something wild: The FBI’s Internet Crime Complaint Center says only 10-12% of cybercrimes get reported. That’s why tracking EVERYTHING matters.

"Information sharing has to be actionable. Make sure you’re not just passing info back and forth – work together, either online or in person."

Want to see this in action? Look at the Log4j response. CISA’s Joint Cyber Defense Collective gave teams exactly what they needed:

• Clear fixes they could use RIGHT NOW
• Rules to spot problems
• The right tools
• Simple breakdowns of what’s happening

Bottom line? Teams need to:

• Push updates FAST
• Keep evidence locked down
• Follow the legal rules
• Document every move

sbb-itb-738ac1e

Legal Requirements

Law Type	Reporting Time	Fine/Penalty
GDPR	72 hours	Up to €20M or 4% revenue
HIPAA	60 days (500+ affected)	Up to $2,067,813/year
SEC Rules	4 business days	Varies
State Laws	Varies (24-60 days)	State-specific

Here’s what you NEED TO KNOW about breach reporting laws:

Different laws = different rules. The table above shows the main ones you’ll deal with. But there’s more.

Let’s break down the state-specific stuff:

State	Requirements	Timeline
Pennsylvania	– Notify AG if 500+ affected – Include breach date and summary – Credit monitoring for SSN/bank data	12 months monitoring
Utah (2024)	– Report breach date – Total people affected – Breach description	Notify AG immediately

For privacy laws, here’s what matters:

Framework	Key Rules	Who Must Follow
HIPAA	– Protect health data – Limited disclosure – Keep records	US healthcare orgs
GDPR	– Get clear consent – Allow data deletion – Report all breaches	Anyone with EU data

When it comes to evidence, you MUST follow these rules:

Evidence Type	Requirements	Storage Method
System Logs	– Original copies – Time stamps – Chain of custody	Secure FTP
User Data	– Encrypted storage – Access controls – Backup copies	Split Database

For international stuff:

Region	Key Requirements	Response Time
EU	– Report to authorities – Notify affected users – Document actions	72 hours
US	– Follow state laws – Federal rules if applicable – Cross-border rules	Varies by state

Here’s something most people don’t know: The FBI and DOJ can let you delay reporting if there’s a national security risk. But you MUST:

• Tell the FBI right after finding the breach
• Prove there’s a security risk
• Document everything

"The DOJ anticipates that a U.S. government agency may seek a delay of public reporting in coordination with a registrant if disclosure poses a substantial risk to national security or public safety."

Bottom line: Every U.S. territory (50 states, DC, Puerto Rico, Guam, and Virgin Islands) has their own breach laws. Each one sets their own:

• When to report
• Who needs to know
• What to tell them
• How much you’ll pay if you mess up

Checking Results

Here’s what you need to track during an investigation:

Time-Based Metric	Target Range	Impact on Investigation
Time to Identify	< 24 hours	Quick detection helps preserve evidence
Time to Contain	< 48 hours	Stops data loss and system damage
Time to Eradicate	< 72 hours	Removes attacker access points
Time to Recover	< 96 hours	Returns systems to normal operation

Key Performance Indicators

Want to know if your investigation’s on track? Here are the core metrics to watch:

Metric Type	What to Track	Why It Matters
Detection	% of incidents found by internal controls	Shows if security tools work
Response	Mean time to respond (MTTR)	Measures team speed
Cost	Average cost per incident	Tracks financial impact
Team	First contact resolution rate	Shows team skill level

Investigation Outcomes

Investigation Outcome	Success Indicator
Evidence Collection	% of usable evidence gathered
System Recovery	% of systems restored
Data Protection	% of data secured/recovered
Legal Action	% of cases with legal outcomes

Recovery Metrics That Matter

Recovery Area	Key Metrics	Target
Systems	Uptime after recovery	99.9%
Data	Data recovery rate	95%+
Operations	Business function restoration	< 24 hours
Cost	Recovery costs vs. budget	Within 10%

Team Effectiveness

Performance Area	Measurement Method	Goal
Communication	Response time to LE requests	< 2 hours
Evidence Handling	Chain of custody errors	Zero
Information Sharing	Data package accuracy	100%
Joint Operations	Task completion rate	95%+

Here’s something that might surprise you: PwC found that 78% of CEOs DON’T have enough data to make risk decisions. And it gets worse – EY’s research shows that 85% of organizations aren’t getting the reporting they need.

Want to fix this? Here’s what to do:

• Pick your key metrics
• Run weekly checks
• Keep your law enforcement partners in the loop
• Adjust your tracking based on what works (and what doesn’t)

Bottom line: Good metrics make for better teamwork between organizations and law enforcement.

Making Things Better

Most companies wait until AFTER an attack to fix their security. Let’s flip that around.

Here’s what works RIGHT NOW:

Tool	Purpose	Key Feature
Squadcast	Alert Management	On-Call + Incident Management
Mandiant Defense	Threat Detection	ML-powered Alert Triage
Check Point IR	Planning	Tabletop Exercises
FireHydrant	Response Coordination	Team Communication

Want to know what the top companies do? IBM’s research shows 51% of companies spend more on security after getting hit. Here’s where smart teams put their money:

Area	Focus	Impact
Information Sharing	Daily Updates	Faster Response
Evidence Handling	Digital Chain	Court-Ready Data
Team Structure	Single Point of Contact	Clear Communication
Documentation	Real-Time Reports	Better Tracking

Here’s something scary: The FBI says 85% of breaches start with phishing. But there’s good news – you can train for this:

Training Type	Frequency	Goal
Tabletop Exercises	Monthly	Test Plans
Live Simulations	Quarterly	Test Skills
Law Enforcement Drills	Bi-annual	Build Trust
Team Reviews	Weekly	Fix Gaps

"Working with law enforcement is the only way you’re going to stop a repeat attack." – Bruce Nikkel, Head of Cybercrime Intelligence & Forensic Investigations at UBS

Banks get this. They’re teaming up through regional groups to share threat data. Look at Europe’s EC3 J-CAT program – it’s cutting response times by getting teams to work across borders.

Here’s what happens when teams work together:

Action	Result	Timeline
Joint Training	Shared Skills	Every 3 Months
Info Sharing Groups	Better Intel	Weekly Updates
Tech Updates	Faster Response	Monthly Review
Process Reviews	Fixed Gaps	Quarterly Check

Bottom line? The best defense isn’t solo work – it’s teamwork. And it’s working.

Next Steps

Here’s what you need to do to work with law enforcement during a cyber incident:

Action	Timeline	Key Steps
Risk Check	Monthly	Map systems, spot issues, plan fixes
Team Drills	Quarterly	Run breach drills with FBI cyber team
Law Watch	Weekly	Stay on top of cyber rules
Tech Tests	Monthly	Check backups and comms work

Getting Ready

The FBI needs these items on hand:

Item	Purpose	Storage
System Maps	Attack tracking	Keep offline
Key Contacts	Team info	Paper + digital
Core Assets	Must-protect list	Weekly updates
Action Plan	What to do	Multiple copies

Record Keeping

The FDIC says to track:

What to Log	When	Why
System Updates	Daily	Normal vs. odd
Login Tries	Now	Catch attacks
Team Steps	Each case	Legal proof
Money Impact	Each case	Insurance needs

Clear Communication

Set these up now:

Channel	Use	Backup
Secure Text	Fast notes	Phone chain
Email Groups	Full info	Print copies
Video Links	Team talks	Phone line
Chat Room	Live info	Radio

Using Resources Well

NIST breaks it down like this:

Team	Job	Tools
IT Group	Block attacks	Log data
Law Team	Court work	Case info
PR Staff	Public news	Media list
Leaders	Choose steps	Updates

"The first 24 hours after discovering a breach are critical. Having your documentation and contacts ready can mean the difference between catching the attackers or losing their trail", – FDIC guidance.

The FBI points out a simple fact: Most teams fail because they waste time hunting for basic info. Keep your plans basic and tested.

Related posts

• Anti-Piracy Coalitions: Law Enforcement Partnerships
• Incident Detection & Response for Digital Assets: Guide
• 8 Key Elements of Incident Response Training
• 10 Remote Incident Response Best Practices 2024