Industries · Legal · Criminal Defence
Cyber security for Australian criminal defence practices.
Criminal defence files carry information that creates risk well beyond a standard data breach. Informant identities, covert operation details, client confessions and material subject to suppression orders. A breach here is not just a Privacy Act matter.
IronSights helps criminal defence practices protect legal professional privilege, secure sensitive file categories, and prepare a breach response plan that accounts for their court-based obligations alongside their Privacy Act duties. ISO 27001 certified, Sydney-based.
Threat context
Why criminal defence practices face distinct risk.
Criminal defence practices face the same baseline cyber security exposure as the rest of the legal sector: credential theft affecting LEAP and PracticeEvolve, ransomware targeting file servers, phishing campaigns using court notification and document portal lures, and Microsoft 365 environments that have never been specifically hardened. Those risks apply regardless of practice area.
What is different in a criminal defence context is what a compromise means. The prosecution brief in a serious criminal matter may include informant identities, covert agent details, police methodology disclosed to the defence through the evidence process, and materials subject to public interest immunity claims. Client communications contain privileged advice and instructions about prior conduct that has not been charged. Expert reports are prepared on instructions that are themselves privileged.
The motivation for certain attackers to target criminal defence files is also different from the financial motivation that drives most legal sector attacks. A party with an interest in a serious criminal proceeding, whether a co-accused, an organised crime group or another actor, may see intelligence value in a defence practitioner's files that goes well beyond any resale value. This is not a theoretical risk. It is one that criminal defence practitioners and their insurers are aware of, and that the Law Societies have flagged in their cyber guidance.
When a breach occurs in a criminal defence context, the response has to account for suppression orders, discovery implied undertakings, privilege implications, and potentially client safety, simultaneously with the standard NDB assessment and notification process. Having that process planned before the event is the only way to work through it without creating additional exposure.
Common risks
What we find when we work with criminal defence practices.
Informant and covert witness file exposure
Criminal defence files may contain informant identities and covert agent details disclosed through the prosecution brief or obtained through suppressed evidence applications. If this material reaches an attacker, the consequence is not a regulatory breach. It is a safety risk to identified individuals. Limiting access to these files to named individuals working on the matter, rather than the practice's shared file environment, is the primary control.
Legal professional privilege and evidence of intent
Client communications in a criminal defence matter include advice about instructions, strategic decisions and case theory. If a compromised staff account gives an attacker access to privileged correspondence, that correspondence may end up in the wrong hands at an operationally sensitive point in proceedings. A contested criminal matter may run for years. An active attacker inside the practice's email environment has time on their side.
Suppressed material and contempt exposure
Criminal proceedings regularly produce suppression orders. Material subject to a suppression order that is accessed in a breach and subsequently published may give rise to contempt, potentially implicating the practice whose security failure enabled the access. The practice will need to assess whether any accessed files were subject to court orders, and what obligations arise from that assessment, simultaneously with its Privacy Act notification obligations.
Discovery implied undertaking breaches
Documents produced by the prosecution under the discovery process are subject to an implied undertaking that they will be used only for the purpose of the proceedings. A breach event that gives an attacker access to prosecution discovery material raises the question of whether the undertaking has been breached by the access itself, and what the practice must do in response to that, in addition to the NDB assessment.
Inadequate MFA on matter management systems
Most criminal defence matters run through the same LEAP and PracticeEvolve environments used across the legal sector. Those platforms have MFA available. It is often not enabled. A compromised credential gives access to the matter list, the document history for each matter, and the full correspondence record, which in a criminal defence context includes brief material, expert reports and privileged communications with counsel.
How we help
Services for criminal defence practices.
The security posture a criminal defence practice needs accounts for what the practice holds, who might want it, and what happens if it gets out. We help you build it and test whether it works.
Microsoft 365 security
enforcement, policies, sensitivity labelling scoped to matter type and classification, and permission controls that restrict access to sensitive files to named individuals. For criminal defence practices, the configuration accounts for the specific handling requirements of informant material, suppressed evidence and brief documents.
Penetration testing
External network and simulation tests. For criminal defence practices, phishing simulations include lures that replicate court notification emails, legal aid correspondence and document portal requests. Thirty-day free retest included.
Audit and assurance
An and a Privacy Act readiness review that accounts for the specific handling requirements of criminal defence files. The output gives you a documented baseline for your PI insurer and the Law Society guidance, and a practical roadmap for addressing the gaps.
Incident response
Available 24 hours a day. When a breach occurs in a criminal defence context, the response has to account for privilege, suppression orders, discovery implied undertakings and potentially client safety alongside the standard assessment and notification process. We support the full response process from containment through to notification.
Compliance
Regulatory and court obligations for criminal defence practices.
APP obligations and the NDB scheme
Criminal defence practices with annual turnover above $3 million are covered entities under the Privacy Act. The NDB serious harm threshold is easily met when criminal defence files are accessed without authorisation. The information held, police methodologies disclosed through the brief, client instructions about prior offending, witness statements and expert reports, carries immediate harm risk if it reaches the wrong party. The assessment is not a close call.
Uniform Law obligations and the LPCC
The Legal Profession Uniform Law in NSW and Victoria imposes obligations on practitioners to protect client confidentiality. A cyber failure that exposes privileged criminal defence communications may constitute unsatisfactory professional conduct before the Legal Profession Conduct Commissioner. Law Societies in NSW and Victoria have published guidance citing the Essential Eight as the relevant technical baseline, and that guidance is the reference point in any disciplinary proceeding following a breach.
Suppression orders and discovery undertakings
Criminal proceedings routinely produce suppression orders and discovery obligations that run alongside Privacy Act obligations. A breach event may give rise to contempt exposure if suppressed material is accessed and subsequently published, and to questions about whether discovery implied undertakings have been engaged by the access. The breach response plan must account for both court-based obligations and the NDB notification process simultaneously.
Common questions
Asked by criminal defence practitioners.
Not in this list? Call us on 1300 004 766 or book a 30-minute consultation. No obligation.
Can a cyber breach affecting a criminal defence file give rise to contempt of court?
It can, depending on what the file contains and what happens to that information as a result of the breach. Criminal proceedings regularly involve suppression orders restricting publication of information about parties, witnesses, police methodology or covert operations. Material subject to a suppression order that is published as a consequence of a breach, whether by the attacker directly or as a result of subsequent events, may constitute contempt. The risk is distinct from the Privacy Act and NDB obligations that also arise from the same event. A criminal defence practice that experiences a breach affecting suppressed material needs to account for both regulatory streams simultaneously.
Are criminal defence practices at greater risk than other law firms?
The general cyber security risk profile is similar to other legal practices: credential theft, ransomware, business email compromise and inadequate Microsoft 365 configuration are all relevant. The difference is in what a compromise means. A criminal defence file may contain informant identities, covert agent details, police methodology that a client disclosed in privileged communications, exhibits from committal proceedings, and material provided under discovery implied undertakings. The consequences of that information reaching the wrong party are not limited to a regulatory breach. The motivation for certain attackers to seek access to a criminal defence file is also different from the financial motivation that drives most legal sector attacks.
How does legal professional privilege interact with a cyber security incident response?
Privilege is not a bar to breach notification under the Privacy Act and NDB scheme, but it is relevant to what a criminal defence practice can say and to whom when responding to a breach. The assessment of what was accessed, what was disclosed and who was affected involves decisions about whether information in the file remains privileged or whether privilege has been waived by the circumstances. An incident response that involves external forensic investigators also raises questions about whether disclosures to those investigators themselves engage privilege or create a waiver. These questions should be worked through with experienced legal counsel before the breach occurs, not after.
What are discovery implied undertakings and how do they affect data breach obligations?
Documents produced under the discovery process in criminal proceedings are subject to an implied undertaking that they will be used only for the purpose of the proceedings. If documents produced under discovery are accessed without authorisation in a breach event, the implied undertaking may be engaged alongside any Privacy Act obligations. The practice will need to consider whether the breach event itself, and the steps taken to investigate and notify, are consistent with its obligations to the court under the implied undertaking. This is particularly relevant where the prosecution has produced large volumes of materials in evidence.
What should a criminal defence practice's breach response plan specifically address?
Beyond the standard NDB assessment and notification process, a criminal defence breach response plan should address: how to assess whether suppression orders cover any information that was accessed, who can be told what about the nature of the breach and what was in the files affected, how to notify clients who may be in custody or subject to bail conditions that restrict communications, what obligations arise under any discovery implied undertakings covering accessed documents, and whether the PI insurer and any relevant legal assistance bodies need to be notified. The plan should be specific, not generic, and tested by the person who would need to act on it.
Further reading
Related insights.
Cyber security obligations for Australian legal practices
Privacy Act, Legal Profession Uniform Law and AML/CTF Tranche 2 reforms. What each framework requires and who it applies to.
Read more →ComplianceLegal professional privilege and cyber breach response
How privilege interacts with breach notification obligations, what can be said to whom, and where external forensic investigation creates risk.
Read more →Threat intelligenceRansomware in Australian law firms
Legal practices are consistent ransomware targets. Why attackers go after legal data and what the NDB obligations look like when it happens.
Read more →TechnicalThe Essential Eight for Australian legal practices
Law Societies in NSW and Victoria have cited the Essential Eight as the relevant baseline. What each control means for a criminal defence practice.
Read more →Also in legal
IronSights works across the legal sector.
Start with a review
A structured security review tells you exactly where your practice stands.
We assess your Microsoft 365 environment, file access controls, breach notification readiness and alignment with your Privacy Act and Legal Profession obligations. For criminal defence practices, the review accounts for suppression orders, privilege and the court-based obligations that run alongside your data protection duties.
ISO 27001 and ISO 9001 certified. NSW Master Security Licence 000109187. Microsoft certified security engineers. Australian-owned. Sydney-based.