Cybercrime lawyer - when the evidence is on a screen and its lawfulness is in dispute
Cybercrime cases are the fastest-growing category in Georgia and the least understood by both sides: the accused often does not realise that logging in with someone else's password or sending an ex-partner's photo is a criminal offence, and the victim does not realise that an online transfer can genuinely be recovered if they act correctly in the first hours. For both, the case rests on one thing: digital evidence lawfully seized and correctly read.
This page describes which articles apply, what the lawyer checks when phones, computers and accounts are seized, how they defend the accused against a "the IP address is yours" charge, how they help the victim block the money and identify the offender, and what happens when the other party or the server is in another country.
Updated · Practice area: Criminal defence lawyer
Which act falls under which article - and where the line of defence runs
The six points of defending the accused in a cyber case
Lawfulness of the device seizure
Phone, computer, drive - seizure under the search rules, with a report and sealing. Access to the device's contents requires a separate court order; disclosing the passcode is not an obligation. Digital evidence obtained in breach is inadmissible - and in a cyber case that is often the whole case.
"The IP address is yours" - disputing authorship
An IP address identifies an internet connection, not a person: shared Wi-Fi, family members, an unsecured router, a VPN, spoofing. The lawyer obliges the prosecution to prove the link to a specific person and device - logs, time, authentication, biometrics. This is the central battle in a cyber case.
Checking the digital forensics
The prosecution's examination studies a copy of the device; the lawyer checks the hash match (is the copy identical to the original?), the continuity of the chain, the method, and commissions an alternative examination - file creation times, the device, metadata often contradict the prosecution's version.
The knowledge and intent element
Many cyber cases concern acts committed without technical knowledge: a "drop" who "lent" their account to a friend, an employee who did not close their access, a partner who "knew the password anyway". The lawyer proves the absence of intent and knowledge - without them there is no crime.
Amount of damage and qualification
In online fraud the amount decides the qualification; in data interference - whether the damage is real. The lawyer disputes the prosecution's calculation of damage (recoverable data, insured sums, the part already returned) and brings the amount down to a lower category.
Reconciliation, agreement, trial
Compensating the victim and deleting the material often ends the case or makes the sentence suspended. When authorship or the lawfulness of the seizure is disputed - trial; in cyber cases the share of acquittals on technical grounds is high if the lawyer speaks the language of forensics.
Online fraud or a hacked account - five steps in the first 24 hours
The bank in the first hour
A request to the bank to cancel the transfer or block the recipient's account at once - in writing, with the transaction number. A transfer between Georgian banks is often not yet finally processed; abroad - a rapid notice to the receiving bank through a lawyer.
Fixing the evidence
Screenshots with URL and time, exports of correspondence, transfer details, phone numbers, account identifiers, full e-mail headers. The website and the account vanish within days - the lawyer arranges notarial certification or a web archive.
A complaint built on the elements of the article
A "my money was stolen" complaint does not work; what works is a complaint with the scheme of deception, the movement of the money, the recipient's identifiers and a specific demand for seizure of bank/platform logs. An investigation is opened on a lawyer's complaint more often than a "civil dispute" reply comes back.
Platforms and data requests
Social networks, marketplaces and crypto exchanges disclose data on an investigator's or a court's request - and the request must be correctly formulated (account ID, time window, IP, payment method). The lawyer proposes the text of the request to the investigator personally.
Recovering the loss
Victim status, attachment of the recipient's account, a civil claim - against the "drop" too, if the organiser cannot be identified. The bank's liability is a separate line if the bank breached a security rule.
The server is abroad, the accused is abroad, the money is in crypto - what works and what does not
Most cyber cases have an international element: the platform is in one country, the server in another, the offender in a third, the money in cryptocurrency. Georgian jurisdiction applies if the act or the result occurred here - the victim is here, the account is Georgian. But obtaining evidence from abroad requires a mutual legal assistance request, which takes months; the Budapest Convention and international cooperation speed this up but do not remove it.
On the accused's side the foreign element is a defence argument: evidence obtained from a foreign server without the procedure is inadmissible; a foreign IP registration makes authorship harder to establish; a crypto transaction shows a wallet, not a person. On the victim's side - a realistic expectation: punishing a foreign offender is rare, but recovering the money from a Georgian account and holding the "drop" liable is real.
In both cases the lawyer answers one question on the first day: which evidence is in Georgia and can be obtained quickly, and which is abroad and can be obtained slowly or not at all. The strategy is built on that answer.
Eight mistakes that ruin a cyber case for either side
- Accused: disclosing the device passcode as a sign of "cooperation" - access to the contents requires a court order, and your consent replaces it.
- Accused: deleting data after a summons - it is recoverable and is a separate charge of destroying evidence.
- Accused: a statement of the "not me, but I know who" type without a lawyer - it reads as an admission of complicity.
- Victim: contacting the "fraudster" personally and negotiating a "refund" - a second transfer and spoiled evidence.
- Victim: filing a complaint instead of going to the bank, or after it - the window for blocking the money is hours, not days.
- Victim: a screenshot without the account ID, URL and time - the platform will find nothing.
- Both: "cleaning" or replacing the phone before the forensic examination - the metadata could have been decisive for either side.
- Both: discussing the case on social media - for the accused it counts as pressure or an admission, for the victim it invites a defamation claim.
How long, what it costs and what forensics are needed
- The window for blocking money
- Hours between Georgian banks, days abroad - after that the money is usually cashed out or moved on. A written request to the bank and a lawyer's notice in parallel.
- Length of the investigation
- A local case - 3-8 months because of the forensics; with an international element - a year or more. The accused's device is seized for that time - the lawyer asks for a copy to be left and for a return date.
- Forensics
- Digital forensics is the centre of the case, and an alternative examination by a private expert on the accused's side is often decisive. The cost depends on the device and volume, separate from the fee.
- Fees
- By stage; in cyber cases a lawyer's value lies in knowing the technical language - logs, hashes, metadata, platform procedures. Recovering a victim's loss is often agreed as a percentage of the result. The price of the first consultation is on the card.
Questions about cybercrime
I logged into my ex-partner's Instagram with their own password and did nothing. Is that a crime?
Formally - yes, access without permission is the act under Article 284 regardless of the result. The line of defence: the password was shared and permission existed during the relationship, the purpose and result of the access are insignificant, the public danger is minor. Reconciliation and an apology often end the case - through a lawyer, not by direct messaging, which turns into a new charge.
My account was used as a "drop" - money came in and a "friend" withdrew it. Am I accused?
The risk is real: the account holder is the first address the investigation goes to. The defence rests on the knowledge element - you did not know the money was criminal, you received no reward, you can produce the "friend's" identity and correspondence. Cooperating with the investigation in a lawyer's presence is often the right tactic here, but only with the scope of the statement agreed in advance.
I paid an online shop, the goods never came, the page disappeared. Is getting the money back realistic?
For a transfer to a Georgian account on the first day - often yes, through a bank block and a quick start to the investigation; abroad or in crypto - rarely. For a card payment the chargeback procedure through the bank works even without a criminal case - the lawyer starts both routes in parallel.
An intimate photo of me was distributed. What can I demand?
Opening a criminal case on the distribution, removal of the material from platforms (on a lawyer's request, often within hours), protection measures, compensation for non-material damage. Do not delete the material yourself before fixing the evidence - a screenshot with URL and date, then the removal request. This category is punished ever more strictly in court.
A former employee deleted the company database. Is that a criminal or a civil matter?
Both: interference with data (285) is a criminal case if the access was already unauthorised or deliberate destruction is proved; the damage can also be claimed under civil law. The evidence - system logs, access times, backups - must be fixed on a lawyer's request the same day, before the logs are overwritten.
Lawyers for cyber cases
This category requires knowledge of the technical language - logs, hashes, platform procedures. The card shows typical cases; within 15 minutes the coordinator connects you with a lawyer who works with digital evidence - on the accused's or the victim's side.
No published lawyers in this category yet
That does not mean we cannot help. Call us - we will match you with a specialist for a remote consultation or from a nearby city.
Call: 568 330 318Online fraud, a hacked account or a cyber charge? Logs are overwritten within days
Within 15 minutes the coordinator connects you with a cyber case lawyer who tells you today which evidence must be fixed now and which request goes to the bank or the platform.