The first thing the victim must do is gather evidence for the judicial proceedings that s/he intends to pursue the attack of which s/he was the target. If the victim uses a specialist company to repair the damage (e.g. to recover destroyed files), a report on this work could prove invaluable during the court proceedings. It should, therefore, be as detailed as possible.
Evidence of a computer attack includes the items (logs, damage) that document the illegal actions of the attacker. For them to be valid in court, these traces must be recovered in a specific way. In Luxembourg, the victim can inform the Grand Ducal Police (‘New Technologies’ service). S/he can also make a “voluntary surrender” of the evidence to CIRCL, a government initiative dedicated to incident responses.
As the traces left on the hard disk or in the log files of the infected machine are often minimal, the machine’s memory must be backed up. When you notice an attack on your computer tool, leave it running and ask CIRCL to help you perform the backup. This is called a “voluntary surrender” of information, which may subsequently be admissible in court.
After collecting evidence, the victim may consider taking legal action. S/he has the choice between:
To make a complaint, it is sufficient for the victim to go to a police station or to send a letter to the state prosecutor informing the latter of the place where the offence was committed.
For the court district of Luxembourg (cantons of Luxembourg, Capellen, Esch, Grevenmacher, Mersch and Remich):
Palais de Justice de Luxembourg
For the court district of Diekirch (cantons of Diekirch, Clervaux, Echternach, Redange, Vianden and Wiltz):
Tribunal d’Arrondissement de Diekirch
The complaint must:
It is not necessary at this stage to accurately quantify the damage, but it may be useful to include an estimation (taking care to specify that this estimate without prejudice), for example, based on the time required to repair the system and restore the damaged data.
Nor is a legal appraisal of the facts required, i.e. detailing the offences committed or applicable texts: these tasks are the responsibility of the Public Prosecutor. The claimant may, however, provide a legal definition or text considered applicable (taking care to specify that this is without prejudice).
Finally, to make a complaint, it is not necessary to know the identity of the perpetrator of the attack or even have a suspicion about any particular person. Under the principle of discretionary prosecution, it is then up to the public prosecutor to decide whether an investigation and prosecution should be initiated. The Public Prosecutor may decide not to pursue the case.
A civil action is a formal act by which the victim manifests their intention to claim compensation for damages suffered in connection with an offence. This may be the case, for example, when a hacker has been able to destroy data on a company’s computer system and the company has been harmed by it. A claimant who alleges harm due to a computer attack and wishes to get the authorities to investigate the acts of which they have been the victim may file a civil action.
Filing a civil action differs from making a complaint in that:
Article 56 of the Code of Criminal Investigation: A civil action must be filed with the investigating magistrate.
A private prosecution is the procedure whereby the victim triggers the prosecution and directly launches a petition to the trial court. In a private prosecution, the victim pursues the alleged perpetrator of an offence in court without any inquiry or preliminary investigation by the Public Prosecutor or the investigating magistrate. An important practical consequence of the lack of investigation into the case is that the claimant must bring all the evidence to the court. It is therefore important to prepare a complete and convincing case and this can be complex.
Private prosecution is only possible when the alleged perpetrator of the attack is known. It is important to note that a private prosecution is no longer possible when a civil action has already been filed.