The Cybercrime Code Act 2016 gives police substantial powers. Whether they can be used usefully depends almost entirely on what happens in the first few days.
1. Preserve everything, immediately
The instinct after an intrusion or an abusive campaign is to remove the material. Resist it. Once deleted, the evidence is usually gone.
Preserve:
- The original messages — in the account, not only as screenshots. Headers, timestamps and account identifiers matter as much as the words.
- Account names, profile URLs and phone numbers used by the offender.
- Dates and times, with the time zone.
- Transaction records where money moved — references, amounts, receiving accounts.
- System logs where a business system was affected, and the affected machines themselves where possible.
Take screenshots as well, but keep the originals. A screenshot is easy to challenge; the underlying record is not.
2. Report quickly, and ask for a preservation notice
A member of the Police Force may, by written notice, require a person in control of data to preserve it for up to 14 days, extendable once by a Magistrate. No court order is needed to issue it.
Provider logs rotate. Accounts are deleted. Traffic data has a short retention life. A preservation notice issued in the first days freezes the material while the slower steps proceed.
When reporting, give the investigating officer the technical particulars listed above — those are what a notice must specify.
3. What police can do next
| Power | Use |
|---|---|
| s 36 preservation notice | Stops the data being deleted — police issue it themselves |
| s 35 production order | Obtains the data, and identifies the account holder |
| s 37 partial disclosure | Identifies which providers carried the communication and by what path |
| s 38 restraining order | Prevents removal, destruction or dealing with material |
| ss 32–33 search | Search of premises and seizure of devices under warrant |
| ss 46–47 | Mutual assistance and extradition where the offender is offshore |
4. What not to do
Do not pay. In a ransomware or blackmail case, payment funds the conduct and does not end the demand. The offence is complete on the threat; nothing needs to have been published for a prosecution to follow.
Do not negotiate or engage. Continued contact rarely improves the position and may destroy evidence.
Do not retaliate. Accessing the offender’s account, or publishing material about them, exposes you to section 6, section 21 or section 23.
Do not stay silent out of embarrassment. In a sextortion case, section 24(3) makes it immaterial whether the accusation is true. The truth of the underlying material is no answer for the offender and no reason for the victim to stay quiet.
5. Identifying the offence
| What happened | Likely provision |
|---|---|
| Account broken into | s 6; s 6(2) if damage or loss followed |
| Money taken by deception | s 12 — 25 years |
| Identity used | s 15 |
| Files encrypted, ransom demanded | s 24(1) — 25 years |
| Intimate images used to demand money | s 24(2) — 25 years |
| False statements published about you | s 21 |
| Sustained abuse online | s 23; s 22 if the victim is a child |
| Confidential material leaked | s 25 |
6. Other steps worth taking
- Secure the accounts. Change passwords from a clean device, enable two-factor authentication, and check for recovery addresses added by the offender — but preserve the evidence first.
- Tell your bank immediately where money is involved. Speed determines whether a transfer can be stopped.
- Report to the platform as well as to police. A platform may remove material faster than a court order can be obtained.
- Consider civil remedies. Where copyright or a trade mark is involved, the Copyright Act and the Trade Marks Act provide their own remedies.
- Where a child is involved, see how children are protected online.
Sources
- Cybercrime Code Act 2016 — ss 6, 12, 15, 21–25, 32–38, 46, 47
- Copyright and Neighbouring Rights Act 2000; Trade Marks Act (Chapter 385)
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.