Cybercrime and Computer Offences Lawyer in Israel

A summons to the police cyber unit, a seized phone or laptop, or a complaint from an organisation that says you broke into its systems: computer offences have grown sharply in Israeli criminal law over recent decades. Acting in the digital space is relatively easy, sometimes done from home in a few minutes, yet the damage to organisations, businesses, public institutions and private individuals can be enormous. Enforcement has become far more sophisticated as well, with dedicated units, advanced evidence-gathering, international cooperation and at times extradition proceedings, so the legal risk in a cyber file is real.

Our firm represents suspects and defendants in computer and internet offences, including cases with international aspects and cases that allege intrusion into systems, ransomware and the use of digital information to commit other offences. This calls for criminal law expertise together with real familiarity with how digital evidence is built. In a short video interview I explained that in cyber offences that also involve extradition proceedings, a person needs a lawyer in the country where the case originated as well.

Two kinds of computer offence

Computer offences usually fall into two groups:

• Offences in which the computer or system is the victim: intrusion, disruption, deletion or encryption
• Offences in which a computer or network is the means of committing another offence, such as fraud, extortion, invasion of privacy, impersonation, threats or economic offences

The same conduct often involves both: intrusion into a system, and use of the stolen information to take money, to extort or to commit a related offence.

The main offences under the Computers Law

The following sections of the Computers Law, 5755-1995 are the core that recurs in many indictments.

Disrupting or interfering with a computer (section 2)

Acts that disrupt the normal operation of a system or service: bringing down servers, attacks that overload traffic, disrupting organisational processes or preventing access to information. Depending on the circumstances, the disruption may be alleged to have been caused intentionally or recklessly.

False information or false output (section 3)

Entering false information into a system or producing false output in a way that misleads. This can arise in organisational, payment and information systems, internal records and elsewhere.

Intrusion into computer material (section 4)

Unauthorised access to computer material, even where no actual damage was caused. In many cases the intrusion is an offence in its own right, and the court examines its extent, the method used, its duration and whether sensitive information was accessed.

Intrusion in order to commit another offence (section 5)

Here the matter is usually more serious, because the intrusion is part of a plan to commit a further offence, such as extortion, fraud, invasion of privacy, identity theft or obtaining a thing by deceit. Where the further offence is financial, our page on fraud and embezzlement offences is also relevant.

Prohibited acts involving software (section 6)

Creating, distributing or using software designed to carry out prohibited acts, intrusion, disruption or harm to systems. It sometimes extends to holding tools, scripts or infrastructure that serve criminal activity.

What makes digital evidence different

In a computer offence case, the heart of the file is how the alleged events can be proved. Unlike human testimony, digital evidence rests on technical data such as logs, login records, IP addresses, traces of account use and data extracted from devices or the cloud.

For digital evidence to be admissible and convincing, there must be a proper chain of custody of the devices and the information, from the moment of seizure, through the way the data was stored and copied, to a professional examination that prevents the data from being altered or contaminated. Identifying the actual user also matters a great deal. Is there an unambiguous link between the digital act and a particular person? Were tools used to hide identity? And are there alternative explanations, such as another person using the device, remote access or a hacked account?

Common cyber cases

These files cover a very wide range:

• Ransomware attacks and encryption of systems, sometimes by international groups, with ransom demands and threats to publish information
• Attacks attributed to hostile states or terrorist organisations against infrastructure and systems
• Apparently law-abiding “hackers” with no criminal record, who sometimes do not grasp at the time how serious their actions are in criminal terms
• Use of the digital space for threats, impersonation, spreading harmful information or harming organisations

Some files grow more complex still when foreign actors, intelligence, cooperation with foreign authorities and extradition come into play.

If you are summoned by the police cyber unit

If you have been summoned, especially by a dedicated unit or after being told it is a “cyber case”, treat it as a full criminal matter, however informal the invitation sounds. A few basic rules can be decisive:

• Do not give an account in passing on the phone, on WhatsApp or in an informal conversation with an investigator
• Understand what the suspicion is, what the main evidence is and what the interview is for: obtaining a confession, verifying data or linking devices to an account
• Consult a lawyer before the interview and arrive prepared with an orderly account

See also our guide to preparing for a police interview.

Common mistakes before questioning

The most costly mistakes are often made before questioning, out of pressure, confusion or an attempt to put things right. Avoid in particular:

• Giving a partial or apologetic account on the phone or in a first reply, before you understand the suspicion and the evidence
• Deleting messages, files or history, even if it seems innocent, since it may be read as obstruction
• Discussing the case with friends or in WhatsApp or Telegram groups in the belief that it is private, since this sometimes becomes evidence
• Attending without prior advice and then giving quick answers under pressure without understanding their legal meaning
• Assuming that “they have no way to prove it”, when computer cases often rest on cross-referenced data rather than on a single piece of evidence

Matching the offence to the evidence

For each main offence, this is what the police will try to prove and the digital evidence they will rely on:

• Intrusion into computer material (section 4): unauthorised access or entry, proved through logs, IP addresses, device fingerprints, permissions and server records
• Disruption or interference (section 2): denial of service or shutdown, proved through traffic monitoring, SOC reports, logs and records of the outage
• False information or output (section 3): misleading or altered data, proved through file versions, write permissions and change histories
• Intrusion to commit another offence (section 5): intent plus the related offence, such as extortion or fraud, proved through correspondence, digital wallets and links between accounts
• Prohibited acts involving software (section 6): use, distribution or development of attack tools, proved through software files, repositories, C2 servers and records of operation

Penalties: why this is not a technical offence

These offences are regarded as serious because of their potential for harm, the relative ease of committing them and the damage to public trust and security. Sentences vary widely according to:

• The extent of the harm and the financial or public damage
• The number of victims and whether an organisation or infrastructure was affected
• The sophistication of the act and the degree of organisation
• Criminal record, acceptance of responsibility, cooperation, and whether related offences such as extortion, fraud or threats were committed

Proper handling therefore starts at the first stage, before questioning or immediately after it.

When to consult a cybercrime lawyer

A cybercrime lawyer is a criminal lawyer who understands how these files are built in evidential terms: the chain of custody of devices, computer expert opinions, data recovery, the link between a user and an account, and arguments about authorisation, identification, disruption or mistaken digital identification. Early advice is particularly important when:

• You have been summoned for questioning, or your phone or computer has been seized
• A complainant or an organisation has accused you of intrusion or disruption
• There is a risk of international proceedings or a foreign element in the case
• An indictment has been filed, or there are contacts with the prosecution before an indictment

We represent suspects and defendants throughout Israel, including Tel Aviv and the centre, Jerusalem, Haifa and Be’er Sheva. Our work can begin at the summons stage and covers dealings with investigators and prosecutors, review of the digital evidence and a strategy suited to the sensitivity of the file. Where a file may still end without charges, see our page on closing criminal files and hearings.

I have practised criminal law, extradition and international crime since 1998, and I serve as Chairman of the Extradition and International Crime Committee of the Israel Bar Association. If you are suspected or under investigation, seek advice early. We can be reached 24/7 on +972-3-6969080.

Frequently asked questions

This page provides general information and is not a substitute for legal advice based on the facts of a particular case. A Hebrew version of this page is available at עבירות מחשב וסייבר.