Filing a Complaint

In Brief

The victim of a computer attack can file a complaint against the attacker, even if the latter is not known.

The first thing the victim must do is to gather evidence for the judicial proceedings that s/he intends to pursue the attack of which s/he was the target. If the victim uses a specialist company to repair the damage (e.g. to recover destroyed files), a report on this work could prove invaluable during the court proceedings. It should, therefore, be as detailed as possible.

Proof of a Computer Attack

Evidence of a computer attack includes the items (logs, damage) that document the illegal actions of the attacker. For them to be valid in court, these traces must be recovered in a specific way. In Luxembourg, the victim can inform the Grand Ducal Police (‘New Technologies’ service). S/he can also make a ‘voluntary surrender’ of the evidence to CIRCL, a government initiative dedicated to incident responses.

As the traces left on the hard disk or in the log files of the infected machine are often minimal, the machine’s memory must be backed up. When you notice an attack on your computer tool, leave it running and ask CIRCL to help you perform the backup. This is called a ‘voluntary surrender’ of information, which may subsequently be admissible in court.

After collecting evidence, the victim may consider taking legal action. S/he has the choice among the following options:

• making a complaint and leaving it up to the public prosecutor to prosecute the perpetrators;
• bringing a civil action seeking compensation for the damage suffered;
• taking a private prosecution against the perpetrators themselves (if known).

Making a Complaint

To make a complaint, it is sufficient for the victim to go to a police station or to send a letter to the state prosecutor informing the latter of the place where the offence was committed.

For the court district of Luxembourg (cantons of Luxembourg, Capellen, Esch, Grevenmacher, Mersch and Remich):
    State Prosecutor
    Palais de Justice de Luxembourg
    B.P.15
    L-2010 Luxembourg

For the court district of Diekirch (cantons of Diekirch, Clervaux, Echternach, Redange, Vianden and Wiltz):
    State Prosecutor
    Tribunal d’Arrondissement de Diekirch
    B.P. 164
    L-9202 Diekirch

Drafting a Complaint

The complaint must:

• clearly state the facts in chronological order;
• include any useful details (e.g. who had the system password, who used the system last, etc.);
• describe (briefly) the damage caused by the attack (e.g. data loss, system rendered unusably).

It is not necessary at this stage to accurately quantify the damage, but it may be useful to include an estimation (taking care to specify that this estimate without prejudice), for example, based on the time required to repair the system and restore the damaged data.

Nor is a legal appraisal of the facts required, i.e. detailing the offences committed or applicable texts: these tasks are the responsibility of the Public Prosecutor. The claimant may, however, provide a legal definition or text considered applicable (taking care to specify that this is without prejudice).

Finally, to make a complaint, it is not necessary to know the identity of the perpetrator of the attack or even have a suspicion about any particular person. Under the principle of discretionary prosecution, it is then up to the public prosecutor to decide whether an investigation and prosecution should be initiated. The Public Prosecutor may decide not to pursue the case.

Civil Action

A civil action is a formal act by which the victim manifests their intention to claim compensation for damages suffered in connection with an offence. This may be the case, for example, when a hacker has been able to destroy data on a company’s computer system and the company has been harmed by it. A claimant who alleges harm due to a computer attack and wishes to get the authorities to investigate the acts of which they have been the victim may file a civil action.

Filing a civil action differs from making a complaint in the following:

• it triggers prosecution;
• it obliges the claimant (i.e. the victim) to deposit an amount determined by the investigating judge, corresponding to the presumed costs of the proceedings;
• if the claimant loses the case, they may be ordered to pay the costs of the proceedings (in whole or in part).

Article 56 of the Code of Criminal Investigation: A civil action must be filed with the investigating magistrate.

Private Prosecution

A private prosecution is the procedure whereby the victim triggers the prosecution and directly launches a petition to the trial court. In a private prosecution, the victim pursues the alleged perpetrator of an offence in court without any inquiry or preliminary investigation by the Public Prosecutor or the investigating magistrate. An important practical consequence of the lack of investigation into the case is that the claimant must bring all the evidence to the court. It is, therefore, important to prepare a complete and convincing case and this can be complex.

Private prosecution is only possible when the alleged perpetrator of the attack is known. It is important to note that a private prosecution is no longer possible when a civil action has already been filed.