Is an IP address enough to charge me?

An IP address identifies a connection at a point in time, not a person. On a shared network, in a household with several users, or where a router was compromised, the link between the address and the perpetrator must be proved separately. This is the most frequent weakness in indictments in this field.

What is the hash value and why does it matter?

It is the digital fingerprint of a file or disk image. Analysis is carried out on a bit for bit copy, and the hash value proves that the copy is identical to the original. If it is missing from the file or does not match, the integrity of the digital evidence can be challenged.

Data was obtained from a platform based abroad. Can it be used?

It depends on the basis on which it was obtained. The mutual legal assistance request, compliance with the procedure and the guarantees applicable to transmission are all examined. Data obtained outside that framework can be challenged in the preliminary chamber.

My devices were seized. What happens next?

They are sealed under a report, and a computer search is then authorised separately. You are entitled to have observations recorded in the report and, through a lawyer, to take part in the computer search. Errors at this stage are used in the preliminary chamber.

Cybercrime Defence in Romania

Scope of practice

Illegal access to an information system (Art. 360 Criminal Code) and illegal interception of transmissions;
Interference with data integrity and disruption of information systems;
Computer fraud (Art. 249 Criminal Code) and illegal operations with electronic payment instruments;
Connected cases: online harassment, unauthorized account access.

The technical side of the defense

Digital evidence — logs, IP addresses, forensic images of devices — appears precise, yet it is open to interpretation: an IP identifies a connection, not a person; a log may be incomplete or altered; the chain of custody for digital evidence follows strict rules. The computer search (Art. 168 Criminal Procedure Code) has its own legality conditions, and exceeding them leads to exclusion of the evidence.

I challenge technical expert reports with counter-expertise, verify the integrity of forensic copies, and test how digital actions have been attributed to a natural person.

Who this is for

From individuals wrongly accused on the basis of ambiguous digital evidence, to IT professionals whose working tools have been mischaracterised in criminal terms. See also DIICOT proceedings.

Which offences fall here

Offences against the security of computer systems, art. 360 to 366 of the Criminal Code: illegal access to a computer system, illegal interception of a data transmission, altering the integrity of data, disrupting the operation of systems, unauthorised transfer of data, illegal operations with devices or software.
Frauds committed through computer systems, art. 249 to 252: computer fraud, fraudulent financial operations, and accepting fraudulent financial operations.

Computer forgery under art. 325 is frequently added, as are money laundering charges and, where an organised group is alleged, the case moves to DIICOT.

Why these cases turn on the technical record

In an ordinary case the evidence is read. In a cybercrime case the evidence must first be produced, and producing it is a procedure with strict rules that are easy to breach.

Seizure of devices. Sealing, kit serial number, entries in the report, and the right to have objections recorded on the spot. Objections recorded at the scene carry different weight from those raised three months later.
Computer search. This is authorised separately from a home search. Exceeding the scope of the authorisation, extending it to data outside it, or carrying it out before authorisation are grounds for exclusion.
Forensic image and hash value. Analysis is performed on a bit for bit copy, and identity between copy and original is proved by the hash value. Its absence, or a mismatch, undermines everything that follows.
Chain of custody. Who had access to the device, when, and under what storage conditions. An undocumented gap between seizure and analysis is a real breach.
Attribution. The most frequent weakness of the prosecution case. An IP address identifies a connection, not a person. An account identifies a credential, not a user. Shared networks, devices used by several people, remote access and previously compromised data all break the link between the act and the accused.
Data obtained from abroad. The mutual legal assistance request, the basis on which the platform disclosed the data, and the procedural guarantees applicable to transmission.

Computer fraud against ordinary fraud

The distinction matters because the penalty ranges and the structure of the defence differ. Computer fraud requires the input, modification or deletion of data, or restriction of access to it, causing loss. Ordinary fraud requires a person to be deceived. Where the operation was executed by a computer system without a deceived human intervening, the correct classification is the computer offence.

In card cases, the distinction between carrying out fraudulent financial operations and accepting them separates the perpetrator from the merchant who processed the payment, and the latter's procedural position is frequently misassigned.

Working with a client based abroad

Proceedings are conducted in Romanian and an interpreter is provided by the authorities, but the practical work happens before that. Documents, correspondence and strategy discussions are handled with you in English, then filed in Romanian. A lawyer holding a mandate can represent you at most procedural stages, so not every hearing requires you to travel.

If a preventive measure is in place, judicial supervision may include an obligation not to leave the country or a specified area. That obligation can be challenged and modified during the proceedings, which is one of the first things to address for a non-resident client.

Cybercrime defence in Romania