There is a strong desire these days for prosecutors to punish "hackers", and this political pressure has intensified with the recent ransomware attacks. Polit

There is a strong desire these days for prosecutors to punish "hackers", and this political pressure has intensified with the recent ransomware attacks. Politicians and prosecutors are frustrated that most the suspects are abroad so they crack down on any "hacker" they catch domestically with punitive zeal. It is normal in highly technical cases for prosecutors to throw "experts" and jargon at the judge and jury - which without contravening testimony from a defense witness, it generally accepted. This effectively turns the justice system on its head - placing the burden of proof and the heavy cost of defense on the accused. Let me give some words that might help from cases I've worked on (not limited to hacking cases)... Rule 1. Shut the F up. Transparency is not your friend. I have seen cases where sysadmins have told the truth about the tech, and then had charges of obstruction levied against them, because someone who had no knowledge of the tech in the accounting dept contradicted something they said. For example, provide exactly what's legally required by court order or your lawyer's advice - only in the exact time range requested and only the fields requested. Answer only the question you are asked, and as succinctly as possible. Make sure that any answers you give are either in writing or with the presence of a lawyer. I have also seen investigators claim someone provided contradictory information, just because the investigators themselves misunderstood the answer. Rule 2. There are no "routine" investigations. Get a lawyer. Do not treat any interaction with authorities lightly. If they are talking to you or your company, they are not your friends. Make sure your lawyer pressures them to define and limit the scope and time period of any investigations to only exactly what's needed for whatever they're investigating. Do not assume that just because they're investigating one of your clients, that you have no legal liability. Rule 3. Do not run a company like an infinite data retention store. Old files/records/databases/etc are a legal liability, because prosecutors can and WILL misrepresent data in court to try to pressure you. Hold data for legally required period, and then delete it permanently. Limit access within the company to only the data that people need to do their jobs. Transparency is not your friend. Rule 4. Being innocent does not absolve you of legal liability. Being innocent does not keep you out of court. Disgruntled customers can make things up or misunderstand. Disgruntled employees can make stuff up or misunderstand facts. You competitors in the market can make things up or misunderstand. All of these people can and will testify against you in court, and prosecutors can and DO construct cases based on misinformation. Rule 5. Do not engage criticisms on social media. You have a near-zero chance of convincing the mob of anything. Anything said publicly can and will be used against you in court. Also remember that legal liability extends to civil suits. Unhappy clients, employees, competitors, partners, will all use any information they can get to try to bias the court against you. I've seen cases where partners used social media content to claim grounds to break contracts without penalty. In summary, as a company, STFU.