Engaging Law Enforcement During a Cyber Incident Guide: When, How and What to Share

Many organisations hesitate to call the police during a cyber incident because they fear losing control of the investigation, disrupting operations or exposing the breach, and so they lose access to intelligence, legal powers and recovery help that only law enforcement has. This guide explains when and how to engage law enforcement in the UK, the US and the EU, what agencies such as the FBI, the National Crime Agency (NCA) and national police forces will and will not do, what to give them, how to preserve evidence they can use, and how to keep the relationship separate from regulatory notification. It is written for incident response leads, CISOs and in-house counsel. Mandatory reporting to regulators is covered in the Cyber Incident Reporting Requirements Map; this guide is about the criminal justice relationship. It is general guidance, not legal advice.

Key takeaways

• Build the relationship before the incident. The US Department of Justice (DOJ) advises organisations to establish a relationship with their local federal law enforcement offices in advance; the same applies to regional cyber crime units in the UK and EU.
• Reporting a crime is not regulatory notification. DOJ states it has no regulatory role for data breaches and that law enforcement does not routinely pass evidence to regulators. You still have to notify regulators separately.
• Law enforcement mostly wants technical data. Indicators, malware, attacker infrastructure, timelines and other victims seen in logs, not a full copy of your systems.
• Preserve evidence from the start. Forensic images, logs and a record of every action taken are what make a report useful and a prosecution or seizure possible.
• Agree timing and statements. Agencies generally coordinate public statements with victims, and several US state laws allow customer notification to be delayed at law enforcement request.

Why engage law enforcement

Victims gain things they cannot get any other way:

• Legal powers: warrants, court orders, subpoenas and international cooperation, which DOJ notes are unavailable to private parties. These can reach attacker infrastructure, cloud accounts and cryptocurrency exchanges.
• Intelligence: agencies may already know the group, its tooling and whether decryptors or keys are available from previous operations.
• Asset recovery: the FBI's Internet Crime Complaint Center (IC3) Recovery Asset Team works to freeze funds lost to cyber-enabled fraud, and fast reporting matters. In the Colonial Pipeline ransomware attack, the FBI attributed the attack to DarkSide within three days, and on 7 June 2021 the Justice Department seized 63.7 bitcoin of the roughly 75 bitcoin ransom.
• Deployment: the FBI says its Cyber Action Team can deploy within hours to major incidents.
• Collective defence: reports connect your incident to others, which helps disrupt the group and warn other victims.

The common objections are mostly misconceptions. DOJ states that law enforcement aims to minimise disruption to operations, coordinates public statements with victim companies, and treats information from an investigation as sensitive. Agencies do not take over your network or direct your recovery; the incident response team stays in charge of containment and restoration.

What to expect: will and will not

The last row is a judgment, not a promise from any agency: many attackers operate from countries that do not extradite, so the practical value often comes from takedowns, seizures and shared intelligence rather than a trial. Set executive expectations accordingly, so that the decision to report is not judged by whether someone is charged.

Who to contact: UK, US and EU

Check current routes and numbers before an incident and record them in the contact tree; reporting services are reorganised from time to time. See the Incident Response Contact and Call Tree Template.

When to engage: decision points

DOJ advises contacting law enforcement as soon as practicable after notifying internal leadership. A practical rule set for [Organisation]:

1. Always report ransomware or extortion, theft of funds, threats to life or safety, intrusions affecting critical services, and suspected nation-state activity.
2. Report within [24] hours confirmed intrusions with data theft, insider crime involving systems, and business email compromise payments. For lost funds, report to IC3 or the police immediately: recovery chances fall quickly.
3. Report in aggregate lower-impact crime such as phishing campaigns that were blocked, through the routine channels (for example the UK's [email protected] service for suspicious emails).
4. Decision owner: the incident lead recommends, legal counsel approves, and the executive sponsor is informed. Record the decision, time and reason in the incident log, including a decision not to report.

Ransom payments. The FBI advises against paying a ransom, noting payment does not guarantee data recovery and encourages further attacks. The NCA states that law enforcement does not encourage, endorse or condone ransom payments. Engaging law enforcement does not commit you to a payment decision either way, but agencies can tell you whether a group has delivered decryptors before and whether sanctions may apply. See the Ransomware Negotiation Guide.

What to give law enforcement

DOJ notes that what law enforcement needs is frequently limited to technical data. Prepare a report pack:

DOJ also notes that victims can provide summaries or excerpts of forensic reports rather than full reports, and that withholding or delaying forensic findings can hamper investigations. Coordinate with your incident response firm so investigators get technical data without duplicating work.

Evidence and confidentiality

• Preserve before you rebuild: DOJ advises ensuring that actions do not unintentionally or unnecessarily modify stored data, keeping logs, making forensic images of affected systems and documenting every step and its cost. See the Evidence Handling and Chain of Custody Guide and the Disk Imaging and Forensic Acquisition Guide.
• Chain of custody: record who collected each item, when, how, its hash and every transfer. Use the Chain of Custody Form Template.
• Log retention: extend retention as soon as the incident is declared; cloud and SaaS logs often expire within days.
• Privilege: decide with counsel what is shared and how, so that sharing technical facts does not waive privilege over legal advice and investigation reports. See the Legal Privilege in Incident Response Guide.
• Secure channels: DOJ advises against using a system suspected of being compromised to communicate about the incident. Use an out-of-band channel. See the Out-of-Band Communications for Incident Response Guide.
• Verify the caller: DOJ advises verifying the identity of anyone asking about the incident before sharing details. Call the agency back on a number from its official website; attackers impersonate police and regulators.
• No hacking back: DOJ warns that accessing, modifying or damaging a computer you do not own or operate, even one used in the attack, may break the law and harm innocent third parties.

Coordinating law enforcement with notification and communications

Regulators are separate. A crime report does not satisfy GDPR, NIS2, SEC, HIPAA or state breach duties. Run the notification clocks in parallel; see the Data Breach Notification Checklist.

Delay requests. Some laws allow notification to individuals to be delayed if law enforcement determines it would impede a criminal investigation, for example New York General Business Law 899-aa and Washington RCW 19.255.010. Get any delay request in writing from the agency, note its scope and duration, and check with counsel whether the regime you are under permits it: GDPR deadlines to regulators do not stop for an investigation.

Public statements. Agree in advance whether the agency may be named. The FTC suggests a notice may include information about the investigating law enforcement agency if that agency agrees. See the Customer Breach Notification Letter Template.

Insurers. Many cyber policies require prompt notice and consent before engaging vendors or paying ransoms. Tell the insurer you have reported to law enforcement; see the Cyber Insurance Guide.

Implementation: preparing before an incident

1. Name the liaison. One person (usually the incident lead or a security manager with counsel) owns law enforcement contact, with a deputy.
2. Make contact in peacetime. Meet the local FBI field office cyber squad, regional cyber crime unit or national police cyber unit. Join outreach programmes where available. Record names and direct numbers in the call tree.
3. Write the decision rules from the section above into the incident response plan, including who approves a report and who may speak to agencies.
4. Prepare the report pack template and evidence procedure so they are filled in during response, not reconstructed afterwards.
5. Agree with the retainer firm how it shares technical findings with agencies and how privilege is handled.
6. Exercise it. Include a law enforcement inject in tabletop exercises: the call, the information request, a delay request and a press enquiry. See the Tabletop Exercise Guide.

Small versus large organisations: a small business may only need the IC3 or Action Fraud route, a named counsel and the evidence basics. A large or critical organisation should hold standing relationships with the FBI field office or national cyber crime unit, have a documented liaison role and include agencies in exercises. Groups operating in several countries should map which national agency leads for each subsidiary, because a single incident can involve several police forces at once.

Measurement

• Time from incident declaration to law enforcement report for incidents meeting the "always report" criteria.
• Percentage of qualifying incidents reported, with documented reasons for those not reported.
• Evidence completeness: share of reported incidents with forensic images, logs and chain of custody records preserved.
• Contact freshness: date each law enforcement contact was last verified (target within [12] months).
• Exercise coverage: number of exercises in the last year that included a law enforcement inject.

Framework mapping

Common failure patterns

• Rebuilding before imaging. Systems are wiped to restore service and the evidence that could identify the attacker or trace funds is lost.
• Reporting late for fraud. Business email compromise payments reported days later, when funds have already moved through several accounts.
• Treating the crime report as the regulatory notice, then missing a GDPR or state deadline.
• Using compromised email to arrange calls with investigators, alerting the attacker.
• No named liaison, so several people give agencies inconsistent information, or none does.
• Taking calls from fake officials without verifying them through an official number.

Practitioner checklist

• Record current reporting routes for every jurisdiction you operate in, with direct contacts where you have them.
• Name a law enforcement liaison and deputy, and agree counsel's role.
• Add reporting decision rules and approvals to the incident response plan.
• Prepare a technical report pack template and an evidence handling procedure.
• Preserve forensic images and logs before rebuilding, with chain of custody.
• Report lost funds to IC3 or the police immediately.
• Get any notification delay request from an agency in writing and check it against each regime with counsel.
• Keep regulatory notifications running in parallel.
• Include a law enforcement inject in at least one exercise a year.

Standards and references

• US Department of Justice: Best Practices for Victim Response and Reporting of Cyber Incidents
• FBI: Cyber Crime
• FBI: Ransomware
• CISA: Report Anything Suspicious
• National Crime Agency: Cyber Crime
• NCSC: Incident Management
• Action Fraud: National Fraud and Cyber Crime Reporting Centre
• Europol: Report Cybercrime Online

Related NHI Mgmt Group resources: Cyber Incident Reporting Requirements Map · Evidence Handling and Chain of Custody Guide · Ransomware Response and Recovery Guide · Legal Privilege in Incident Response Guide. This guide summarises official law enforcement guidance and is not legal advice.