Evidence and forensics after a cyber incident or fraud

In short. Gathering evidence is not merely a technical activity but a legally decisive process. The quality of the forensics affects whether the nature and extent of the attack are established, whether the amount of the loss can be proved, whether the insurance claim is paid and whether claims can be brought against those responsible. The most common mistake is to concentrate on rapid restoration and to leave the evidence in the background.¹

For claims handlers, the chapter explains what evidence an Estonian claim should rest on and how Estonian law allocates the burden of proof between the insured and the insurer.

The three central components are IT forensics, the analysis of financial flows and the preservation of evidence.

1. IT forensics

The aim of IT forensics is to establish what happened, how it happened and what the extent of the attack was. It covers:

• identifying the attack vector (a phishing e-mail, a vulnerable system, a compromised supplier, an insider act);
• identifying the compromised systems and accounts;
• assessing the extent to which data were altered or exfiltrated;
• reconstructing the timeline of the attacker's activity.

IT forensics is not a technical audit but a process of proof. The data collected must be authentic, verifiable and documented in a way that allows them to be used in a dispute.

Example. A company discovers malware on a server. The IT department removes it at once but saves neither the state of the system nor the logs. Later it is impossible to establish how the attack took place and whether data were exfiltrated. This hampers the assessment of the loss, the assessment of the data protection notification duties and the presentation of the insurance claim.

Forensics must therefore be carried out by a specialist who uses standardised methods. Many cyber policies require or prefer forensic partners on the insurer's panel; involving them early helps to ensure that the evidence meets the insurer's expectations and that the costs are covered. The forensic report is the basis for the insurance claim, for regulatory proceedings and for possible litigation.

Commissioning through legal counsel. In international practice, forensics is often commissioned through a lawyer in order to protect the confidentiality of the report. Under Estonian law a forensic report is not in itself a document protected by legal professional privilege (advokaadisaladus); the extent of the protection depends on who commissioned and prepared the report and for what purpose. This must be taken into account before the report is shared with the insurer, the supervisory authority or the opposing party.

2. Analysis of financial flows

Where the incident involves a financial loss (fraud, embezzlement), financial forensics is critical. Its aim is to:

• establish where the money went;
• reconstruct the chain of transactions;
• assess the extent of the loss;
• trace the money and, where possible, recover it.

Financial forensics focuses on abnormal and concealed transactions: bank transactions, payment orders, related persons and accounts, international transfers, changes to the supplier master data, general ledger entries.

Example. As a result of a fraud, a company makes several transfers to different accounts. At first sight the money appears to be lost. Financial forensics establishes that the money passed through several jurisdictions and that part of it can be frozen.

From the insurance point of view, the financial analysis matters because:

• crime insurance requires precise evidence of the direct loss and of the mechanism by which it arose;
• the insurer may dispute the amount of the loss;
• in long-running internal fraud it must be proved when the loss arose and when it was discovered (to check the discovery period and the retroactive date);
• amounts recovered reduce the indemnity or must be repaid to the insurer.

Financial analysis may also be needed in a D&O context, where a claim is brought against the board in connection with the prevention or detection of fraud.

3. Preservation of evidence

The preservation of evidence is the most critical and often underestimated part of forensics. Even evidence that has been collected loses its value if it is not preserved properly. Preservation involves:

• ensuring the integrity of the data (hash values, write-protected copies);
• access control;
• preventing alteration;
• a documented chain of custody: who handled the evidence, when and for what purpose.

In a dispute it must be possible to show that the evidence has not been altered. Otherwise the opposing party or the insurer may challenge its reliability.

Example. A company saves its logs after an incident but does not document who accessed them and when. Later the insurer argues that the logs may have been altered.

In addition:

• evidence must be kept long enough (disputes can last for years; the limitation period for claims arising from an insurance contract is as a rule three years, counted from the end of the calendar year in which the claim fell due, Law of Obligations Act (võlaõigusseadus, VÕS) § 475 lg 1);²
• evidence must be protected against internal risks as well (in internal fraud the suspect may be an IT or finance employee);
• evidence must be accessible to both lawyers and experts;
• e-mails must be kept together with their headers, not merely as screenshots.

4. The insurance perspective

The insurer assesses whether the loss is sufficiently proven, whether the evidence is reliable and whether the insured has complied with the duty to cooperate. Policies usually oblige the insured to preserve evidence, to cooperate with the insurer and to allow an investigation.

Under Estonian law, the occurrence of the insured event must as a rule be proved by the claimant, while the insurer must prove the circumstances on which its refusal is based, including a breach of an obligation and its effect.³ The Supreme Court has at the same time stressed the policyholder's duty to cooperate: the policyholder must provide the information and documents available to it that are needed to determine the extent of the insurer's obligations.⁴ A standard term that allows the loss to be proved only by certain specific evidence (for example, only by an inspection or by producing the remains) may be unreasonably detrimental to a consumer.⁵

Forensic costs are usually covered in cyber insurance. Properly conducted forensics is therefore not only a cost but part of the insurance cover.

5. Typical mistakes

• rapid "cleaning" of systems before the analysis;
• deleting or overwriting logs (log retention is often only a few days);
• deficient documentation;
• using unreliable tools;
• forensics without a qualified specialist;
• involving the suspect in the investigation where internal fraud is suspected.

The result may be that the nature of the attack remains unclear, the loss cannot be proved and the insurance claim is rejected. Without high-quality proof, even an obvious loss may remain uncompensated.

6. An evidence preservation plan before an incident

Evidence often disappears before anyone starts collecting it. The preparation must therefore be made before an incident.

• Log retention. In many systems logs are kept for only a few days. The logs of critical systems (e-mail, remote access, cloud services, the domain controller, payment systems) should be kept for at least several months and protected against deletion.
• Evidence preservation procedure. A written procedure under which the board or the lawyer can, in the event of an incident, suspend the routine deletion of documents and e-mails.
• Forensic partner. A contract with, or at least the contact details of, a pre-selected partner that the insurer accepts.
• Access. It is known who can give the forensic team access to the audit logs of cloud services and how this can be done quickly.
• Bank documents. It is known how the payment details and the correspondence can be obtained from the bank quickly.

7. Internal investigation and employees

Where internal fraud is suspected, the rights of employees must be taken into account when evidence is gathered. Checking an employee's e-mail and devices must be lawful and proportionate, having regard to the data protection requirements and the company's internal rules. Practical principles:

• the suspect is not involved in the investigation, or informed of it, before the evidence has been secured;
• the investigation is led by a person who has no conflict of interest;
• every step is documented;
• where necessary, the police are involved, whose powers to gather evidence are wider.

Evidence gathered in the wrong way may be of less value in a dispute and may in turn create liability for the company.

8. Checklist for the forensic partner

• Is the partner on the insurer's panel, or has its engagement been agreed with the insurer in writing?
• Does the partner document the chain of custody?
• Does the report distinguish facts, conclusions and assumptions?
• Does the report answer the questions that the insurer and the supervisory authority ask (start, extent, data affected, attack vector)?

9. Types of evidence and their value

Related pages

• The first 24 to 72 hours
• How to present a claim
• Estonian Supreme Court: notification, proof and due date
• Crime and fidelity claims in Estonia

References