Legal issues
The exact CMA section matters. Employer access, shared credentials, administrator rights, testing activity, malware, denial-of-service conduct and possession/supply of tools can engage different provisions.
Evidence that matters
Evidence may include server and authentication logs, IP records, device forensics, cloud records, source code, messages, credentials, access policies, audit logs and expert evidence.
Reasonable lines of enquiry
Enquiries may include preserving logs before retention periods expire, establishing user/device attribution, reviewing access permissions, examining shared credentials and independent forensic review of alleged malware or system impairment.
What happens next
Cybercrime cases may involve device seizure, specialist forensic examination and cross-border platform or server evidence. Serious cases can proceed to the Crown Court.
Immediate steps
Preserve logs, policies, permissions and device information. Do not alter systems or wipe devices after learning of an investigation. Record the scope of any work or access authority.
What should you send us?
Send the allegation/charge, system details, access policies, logs, forensic reports, device/account information, police papers and next date.