Question

When law enforcement becomes involved, the need may arise to freeze systems as part of the evidence. There is also the likelihood that the incident will become known publicly. Do you think these issues play a significant part in the decision to involve law enforcement? Why or why not? Can you name some situations in which you believe that large organizations have decided not to involve law enforcement?

Answer 1

The decision to escalate incidents to law enforcement which is an area fraught with conflict and specifically the pros and cons of law enforcement involvement.

The establishment of proper security policy is imperative to any organization, even after compliance to these policies events/incidents do occur that disrupts the normal operations of the organization. Thus, It’s equally important to have a response plan to such situations even though their probability of occurrence is next to negligible. Also, during such scenarios the decision of whether or not to escalate the incidents to law enforcements is a subject consisting difference of opinions, while the decision to escalate incidents to law enforcements primarily depends on the magnitude or severity of the incident with the interest of the organization. Law enforcements come in when it has been decided that the incident occurred exceeds the violation of policy of the organization and constitutes to a violation of any one of the local, state, federal laws.
The decision to shoot up the incident outside of the organization to law enforcement really depends on the organizational decision itself, that is the board or body of management with the involvement of key personnel such as CEO, CIO, CSO, CRO who are responsible to make the crucial call during such unexpected situations. The organization’s current reputation, financial stature, market value, domain of business all come in as factors that determine whether or not to escalate the issue to law enforcements. The ultimate outcome of involving law enforcements and the consequences resulting from it is duly considered, because what good is the involvement that will leave the organization’s business tarnished such that it’s arduous to recover from it at the end of the process.
Law enforcement involvement has its own merit when seen from an organization’s point of view, even though this is exactly what law enforcements have expertise on, involving them can also have its own demerits. The merits of involving law enforcement agencies are that they are better equipped at processing evidences and unless security team in the organization have similar expertise in processing evidences and computer forensics, them taking matters into their own hands can cause more damage than actually finding information to convict a suspect for the incident. Also if the organization has unknowingly tampered or modified some evidence this can go against them during future jurisdiction. Law enforcement personnel can be of a great aid to the security administrators of the organization and also they possess authority to handle the warrants and subpoenas that are necessary to documenting a case. They are also proficient in obtaining crucial intel and statements from witnesses, affidavits and other sources.
The flip side of involving law enforcement agents in can be that once they are involved in the investigation with the incident, they hold true and complete control of the case and the chain of events that follow with it. Also, the organization won’t be informed about the ongoing status of the case for the entire duration of the investigation, and upon investigation of an individual in the organization if he/she decides to deny all events may face criminal charges. One of the biggest demerits for small or medium scale organizations is that all the equipment and hardware resources that were involved in the incident will be confiscated, which can be a huge blow for their regular operations.

Attacks such as the recent Yahoo data breach is an example for gain an understanding on how important it is for law enforcements to be involved in the right time. The decision of escalating the incident to law enforcement is well and truly an area of conflict but whenever the incident is suspected with criminal activity, notifying law enforcement and following any applicable federal, State, or local legal requirements relating to the notification of law enforcement is necessary.