If an organization suspects criminal activity during the response to an incident, when should they notify law enforcement authorities?

According to established incident response best practices, law enforcement should be notified as soon as there is a reasonable suspicion of criminal activity. Early engagement is crucial for several reasons: it ensures evidence is preserved in a forensically sound manner, prevents inadvertent destruction of data (spoliation) by the internal response team, and allows investigators to begin their work while the trail is still fresh. Waiting for absolute confirmation can severely compromise the integrity of the evidence and the viability of a future legal case. The primary trigger for notification is suspicion, not confirmation or the crossing of an arbitrary business impact threshold.

A. After one day of network downtime. This is an arbitrary operational metric. Criminal activity may not cause downtime, and downtime does not automatically imply a crime has occurred.
B. According to a pre-defined cost threshold. This is a financial metric. Significant criminal acts, such as intellectual property theft, may have a low initial cost but high long-term impact, making this an unreliable trigger.
D. After the criminal activity is confirmed. Waiting for confirmation is too late. The process of confirming the activity may inadvertently destroy or alter critical evidence, jeopardizing the investigation and any potential prosecution.

1. NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide. Section 3.4.2

"Sharing with Law Enforcement Agencies

" states

"If it is suspected that an incident involves a violation of law

the organization should decide if it will report the incident to law enforcement." This establishes suspicion as the trigger point for the decision-making process.

2. Carnegie Mellon University

Software Engineering Institute

CERT Best Practices for Victim Response and Computer Forensics. In various guides

CERT emphasizes that early contact with law enforcement is critical. For example

the "State of the Practice of Digital Forensic Examinations" (CMU/SEI-2019-TR-004)

Section 2.1

discusses the importance of preserving the crime scene (digital environment) immediately

an action best guided by law enforcement as soon as a crime is suspected.

3. U.S. Department of Justice

Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations. Section I.B.2

"The Role of the Victim

" implicitly supports early reporting by outlining how law enforcement relies on timely information from victims to secure warrants and preserve volatile evidence

which is only possible if notification occurs at the point of suspicion.