Caught! What to Do If You’re Facing Criminal Charges for Cybercrime

It might seem that breaking the law in the digital world is safer than in real life: it’s easier to erase traces of a crime, and there aren’t that many specialized experts in law enforcement. In reality, that’s not the case. I served for seven years in preliminary investigation agencies (the Investigative Committee, the Ministry of Internal Affairs) and investigated many crimes in the field of information technology. In this article, I’ll explain what to expect and how to make things easier for yourself if you’ve come under the scrutiny of law enforcement. Hopefully, you’re reading this out of curiosity, not necessity!

Types of Cybercrimes

• Theft Using Information Technology: This includes phishing scams, stealing money from accounts, and carding.
• Drug-Related Crimes: Since the emergence of illegal marketplaces like Silk Road, the fight against anonymous online drug sales has intensified. Many still believe their online stores are untraceable, but statistics show that hundreds of such businesses are shut down every year. In Russia, drug dealing can land you up to 25 years in prison.
• Acquisition of Special Devices: Law enforcement likes to boost their stats by charging people for buying unlicensed devices (like cell phones, GPS trackers, micro-cameras) that can be used for covert information gathering.
• Internet Extremism: Many have heard about people getting sentences for memes or reposts. While this is less common now, hundreds have still received criminal records for it.
• Creating or Spreading Malware, or Unauthorized Access to Computer Information: These are classic hacker charges. The rarer the crime, the more interesting it is for law enforcement statistics, so you’ll get extra attention if you’re suspected of this.
• Distribution of Child Pornography: Torrent users are at risk here—if you download and forget to delete illegal files, you’re committing a crime. If your PC is infected and becomes part of a botnet, you could be targeted as well.

Law enforcement really does “track by IP”—no joke. Most people caught this way aren’t hardcore hackers, but regular users who downloaded cracked software. Still, your devices will likely be seized.

The Internet Makes Things Worse

According to the Criminal Code, fraud, theft, and drug trafficking committed via the internet carry harsher penalties than the same crimes committed offline. Cybercrimes are harder to solve, so the law now treats them as serious or especially serious offenses. For example, stealing 2,000 rubles from a purse might get you a suspended sentence, but stealing the same amount from a bank card could get you arrested and sentenced to up to 10 years.

Time Is Not on Your Side

If you’ve crossed the line (intentionally or not), law enforcement probably won’t come for you immediately. Even operational units are bogged down by bureaucracy and often take their time to build a solid case. Officers are trained to wait for the right moment, sometimes investigating cybercriminals for over a year. Eventually, most suspects slip up, and law enforcement can charge them with multiple offenses at once—each theft or illegal act is a separate crime, and it’s more advantageous for them to charge you with 10–20 crimes than just one.

How Do Law Enforcement Agencies Find Out About You?

The first “thread” can come from anywhere: informants, provider data, traffic analysis, or citizen reports. Signs you’re under surveillance include:

• Your phone starts acting strangely, or you suspect you’re being tapped.
• “New friends” show interest in your activities.
• Strangers ask your neighbors about you—these could be law enforcement officers.

If you’re actually doing something illegal, you might still have a chance to stop before it’s too late. If officers start openly questioning your neighbors or relatives, the investigation is likely in its final stage and they’re preparing to open a criminal case.

Pre-Investigation Check

Before opening a criminal case, law enforcement reviews the evidence. If such material exists, they already have information about a possible crime. One tactic is to gather all the evidence at this stage so the investigation doesn’t drag on. The pre-investigation check can last up to 30 days, but this period can be restarted, so checks can go on for years. Criminal cases, however, can’t be extended indefinitely—investigators aim to finish within two months, except for high-profile cases.

Some investigative actions can be carried out even during the pre-investigation check:

• Crime scene inspections (including your apartment), during which equipment can be seized
• Interviews (not formal interrogations)—you can bring a lawyer
• Expert examinations
• Collection of voice, handwriting, fingerprint, and DNA samples
• Requests to ISPs, banks, mobile companies, and other organizations
• Requests to other agencies, including foreign ones via Interpol

Inspections

Without a criminal case, a search can’t be conducted, but if there’s clear evidence of a crime in your home, everything necessary can be done during a regular inspection—even against your will. Such actions are usually later legalized through the courts. Searches are more thorough, but even during inspections, officers can look anywhere and for anything.

Interviews

You may be called in for an interview (not an interrogation). You can bring a lawyer, and it’s wise to have one on standby in case you’re detained. If you’re detained, you won’t be able to leave the building on your own.

Criminal Case

If a criminal case is opened against you, you’ll find out right away—usually in the investigator’s office. However, a case can also be opened against an “unidentified person.” Sometimes, you may be informally identified, but the investigator uses this tactic to continue investigative actions while you remain unaware.

Possible Scenarios

• You learn a case is being investigated against an unidentified person, but you were actually involved. If you weren’t involved, there’s nothing to worry about—wrongful convictions for cybercrimes are rare.
• You’re involved in non-active investigative actions (questioned as a witness, searches while still a witness, etc.). You have fewer rights as a witness, which makes the investigation easier for law enforcement.
• You’re officially a suspect or have been interrogated as such. In this case, immediately hire a lawyer.

If you find out you’re under investigation—even if it’s just a pre-investigation check—stop all illegal activity immediately and “put on your white hat” for good. You might get off with just a scare and some lost nerves.

Preliminary Investigation Stages

1. Opening a Criminal Case: Already covered above.
2. Interrogation: This gives you a procedural status: witness, suspect, or accused. Each status comes with its own rights and responsibilities. If the crime isn’t serious, you’ll be summoned for questioning and likely released on a travel ban. For serious crimes, you can be detained—even before a case is officially opened.
3. Detention: Officers can detain you anywhere except your home (which requires a court order and an open case). You must sign the detention protocol—refusing to sign will hurt you in court. Make sure the time of detention matches the actual time, as you have 48 hours before the investigator must go to court for an arrest warrant. You’re entitled to one phone call—use it wisely. Don’t call accomplices; call your lawyer or relatives and ask them to bring you warm clothes and bedding for the detention center.
4. Search: Early in the investigation, your home or workplace will be searched, with at least two witnesses present. Any items of interest can be seized. If your tech is to be seized, an IT expert must be present.
5. Expert Examinations: These can be computer, phonoscopic, fingerprint, or biological. Suspects are always informed about examinations; witnesses are only informed if their samples are taken.
6. Other Investigative Actions: These include on-site testimony (with video/photo recording), investigative experiments (recreating the crime), and face-to-face confrontations (where an accomplice may testify against you).
7. Charges: Once the investigator has classified your actions, you’ll be formally charged. You can agree, partially agree, or disagree. You’ll be interrogated again as the accused to clarify your position before trial.
8. Final Stage: You’ll be given access to all case materials to review with your lawyer and choose your defense strategy. You can also request a special trial procedure or a jury trial. After this, the case goes to the prosecutor and then to court.

Plea, Confession, and Special Procedure

Whether to confess is your decision. The main rule: never confess to something you didn’t do, even under pressure. If you’re threatened or abused, threaten to file a complaint with the Investigative Committee—this usually stops the threats, as forced confessions are a crime for officers and carry serious penalties.

If you did commit the crime, denying it is the worst option if the case goes to court—you’ll get the maximum sentence. On the other hand, the system is lenient to those who confess. If it’s your first offense and you confess, you might avoid trial altogether and just pay a court fine, leaving you without a criminal record. If you don’t qualify for a fine, you can request a special procedure—if you fully admit guilt, the court won’t examine the case in detail and will only decide on the penalty, which is usually a suspended or minimal sentence.

Lawyer

Your lawyer is your main defense tool. You can hire one yourself or use a free public defender. Many public defenders are diligent, and the days of “pocket lawyers” are mostly gone. If your strategy is to confess, a public defender is often enough, and it’s better to spend your money on restitution. If you’re being charged with more than you did, hire a private lawyer. Good lawyers are expensive and won’t guarantee you’ll avoid responsibility, but they’ll be honest about your chances. There are no reliable lawyer ratings, so rely on word of mouth and experience in similar cases.

General Tips for Dealing with Investigators

• Don’t antagonize law enforcement—they always have more power. This is especially true for investigators, who can influence your case outcome.
• Maintain proper conduct. Disrespectful behavior can backfire, while respect and understanding may earn you leniency.
• Don’t be too compliant—investigators aim to send cases to court with the most serious charges possible.
• The best approach is to negotiate. For example, if the investigator forgets to inform you of your rights, mention it politely and ask for leniency instead of filing a complaint.
• Investigators are people too and want to do their job fairly. If you show you’ve learned from your mistake and are ready to change, they may go easier on you.

Checklist

• Internet crimes carry harsher penalties.
• Police are patient; criminals lose vigilance.
• If things get risky, stop illegal activity immediately.
• Each violation is a separate crime.
• Watch for signs you’re under investigation.
• You can be investigated even before a case is opened.
• Consult a lawyer about your strategy and arrange for emergency help in advance.
• Witness status does not guarantee safety.
• An accomplice can betray you.
• Don’t resist arrest.
• Don’t call accomplices—call your lawyer or relatives.
• Ask relatives to bring you warm clothes for detention.
• Check the time of detention and sign the protocol.
• Plea deals, confessions, and voluntary surrender can reduce your sentence.
• Never confess to something you didn’t do, even under pressure.
• Free lawyers aren’t always useless.
• Paid lawyers aren’t always good—choose based on reviews.
• Don’t fight with the investigator—negotiate!