The $1.3 Million Wire and the Server in Hong Kong
On 14 August a $1.3 million wire left Corvane Logistics' account at a New York bank to a Hong Kong account after the accounts-payable clerk received an email that appeared to come from the CFO's address, instructing an urgent payment for a 'confidential acquisition.' The real CFO was on a plane. Corvane's IT team found no malware; the message came from a lookalike domain registered 11 days earlier, and the clerk had forwarded her own W-2 to the same address a week before. On 16 August the FBI opened a case and asked Corvane to 'keep the matter confidential' and not to contact the Hong Kong bank directly. Corvane wants to (a) subpoena Microsoft 365 for the attacker's mailbox and sign-in logs, (b) hire a firm to 'access' the Hong Kong server hosting the lookalike domain, and (c) rely on a three-day-old disk image of the clerk's laptop that an IT intern took without a write-blocker.
1. What lawful process can Corvane use to obtain the Microsoft 365 records, and how should it handle the FBI's confidentiality request?
Read the worked answer
Rule. Microsoft 365 is an electronic communication service and remote computing service under the Stored Communications Act, 18 U.S.C. §2701 et seq. Records about an account - subscriber information, IP logs, sign-in history - can be obtained with a subpoena or a §2703(d) order; content stored or sent more than 180 days ago can be obtained with a subpoena or §2703(d) order plus notice, and content within 180 days requires a warrant. Section 2703(f) permits a governmental entity to direct preservation for 90 days, extendable. A private litigant uses Federal Rule of Civil Procedure 45, which requires notice to the subscriber unless a court orders otherwise. A §2705(b) nondisclosure order requires a court finding.
Application. Corvane can serve a Rule 45 subpoena on Microsoft for subscriber records, sign-in and mailbox audit logs for the lookalike account and for the clerk's account. Notice to the account holder may be impossible or unhelpful for the attacker's account, so seek a court order limiting notice. The FBI's verbal request is not a legal bar - only a court order can compel silence - but the operational point is real: parallel civil process can tip off the attacker and cause deletion.
Sequencing. Preserve first (a §2703(f) request through the FBI, or a litigation-hold letter to Microsoft), then decide when to serve. Consider the CLOUD Act: a US provider can be compelled to produce data regardless of where it stores it, so a claim that the logs sit in an EU data center is not an answer.
2. Can Corvane hire a firm to access the Hong Kong server? Analyze the criminal and evidentiary exposure and the realistic alternatives.
Read the worked answer
Rule. Unauthorized access to a computer is an offense under the Computer Fraud and Abuse Act, 18 U.S.C. §1030(a)(2) and (a)(4), and under state computer-crime statutes. There is no private 'self-defense' or 'hack back' exception; proposed active-cyber-defense legislation has never been enacted. Accessing a server in Hong Kong also engages Hong Kong law, including section 161 of the Crimes Ordinance, and is entirely outside US legal process.
Application. The fact that the server holds stolen data does not transfer authority to Corvane: the attacker's lack of a lawful claim does not make Corvane's access authorized. The exercise would also destroy the evidential value of whatever is on the server, taint the FBI's case, and expose the officers and the company to criminal and civil liability; cyber insurers routinely exclude it. The firm's offer should be declined in writing.
Lawful alternatives. (1) Preserve and subpoena WHOIS and registrar records, which are often held by US-based registrars and are the fastest route to identifying the actor. (2) Ask the FBI to use the Budapest Convention 24/7 network where a party is available - but note that the US–Hong Kong mutual legal assistance agreement has been suspended since 2020 and Hong Kong is not a Budapest Convention party, so formal MLAT preservation there is slow or unavailable. (3) Pursue the funds, not the server: request a recall through Corvane's bank, the correspondent bank and SWIFT, and check whether the receiving bank will freeze pending an indemnity. (4) Preserve the lookalike domain's DNS and mail records before they expire.
3. The only image of the clerk's laptop was taken without a write-blocker and sat in an IT drawer for three days. Is the evidence unusable? What should Corvane do now?
Read the worked answer
Rule. Authentication under FRE 901(a) requires evidence sufficient for a reasonable jury to find that the item is what it purports to be. Electronic records can be self-authenticated under FRE 902(13) and 902(14) through a certification of a process that produces an accurate result. Chain-of-custody gaps do not render evidence inadmissible as a matter of course; they go to weight, and the opposing party is free to argue tampering. The best-evidence rule (FRE 1002) governs proof of content, not the existence of the device. Spoliation is a separate problem: FRCP 37(e) sanctions are available where a party fails to preserve electronically stored information in the face of anticipated litigation and prejudice results.
Application. Imaging without a write-blocker means the act of imaging may have written to the source disk, altering metadata and timestamps. Three days in a drawer means anyone with access could have touched it. Neither fact is automatically fatal - a qualified examiner can testify to the process, compare hash values and explain any anomalies, and the original laptop can be preserved for the defense to re-image. The larger risk is a spoliation instruction or an adverse-inference argument if Corvane cannot show it preserved the laptop in the condition in which it was found.
Actions now. Stop all handling of the machine; re-image with a write-blocker; record and verify hashes at acquisition; photograph the device and its surroundings; document every custodian and transfer with timestamps; consider an independent third-party examiner to blunt the bias argument; and obtain a FRE 902(14) certification for the Microsoft 365 logs. Tell the FBI what happened - in a parallel criminal case, chain-of-custody discipline matters more, not less.