Expert reports on digital forensics, mobile forensics, telecommunications evidence, encryption, digital fraud, evidence authenticity, cybercrime offences and software disputes.
Official Intelligence is led by principal consultant Simon Smith, a Melbourne based digital forensic expert witness with more than 24 years of technical experience. The practice prepares independent, court ready expert reports for instructing solicitors in matters involving computer crime, mobile and software crime, civil and commercial disputes, encrypted communications, cybersecurity incidents, smartphone and wearable device evidence, telecommunications records, cyberstalking, online fraud, and data breaches. Instructions are accepted from defence and plaintiff law firms, insurers, corporate counsel, and private parties across Australia.
Quick jump across the full reference.
The practice draws on more than 24 years of technical experience in software and systems engineering, information security, the forensic examination, validation, and interpretation of digital evidence, covering mobile devices, encrypted messaging platforms, network traffic, cloud data, and server-based systems.
Official Intelligence Pty Ltd, led by principal consultant Simon Smith, provides independent, court-recognised digital forensic and cybersecurity services to law firms, insurers, corporate clients, and individuals nationwide. The practice draws on more than 24 years of technical experience in the forensic examination, validation, and interpretation of digital evidence, covering mobile devices, encrypted messaging platforms, network traffic, cloud data, and server-based systems.
Reports are prepared for computer software and civil software disputes, cybercrime and cryptocurrency matters, and mobile and telecommunications evidence, including Call Data Records (CDRs), SMS logs, cell tower locations, and Event-Based Metadata (EBM). The practice assists courts in understanding the reliability and limits of mobile network records and in correcting common misinterpretations of timing and location data.
Experience extends to wearable technology, multimedia content, and secure messaging platforms such as Threema, ANOM, Session, EncroChat, SnapChat, Kik, Ghost, Cypher, SkyECC, Phantom Secure, Wickr, Signal, Telegram, WhatsApp, Conversations.im (XMPP), and custom OMEMO-encrypted XMPP systems.
Cybersecurity services cover incident response, breach investigation, and post-incident recovery, with the aim of minimising disruption, preserving admissible evidence, and securing affected digital assets.
Based in Melbourne and operating nationwide. To brief the practice, please complete the Case Review form on this page.
Official Intelligence provides digital forensic, cybersecurity, and expert witness services that support legal proceedings, protect digital assets, and assist with the investigation, documentation, and recovery from cybercrime, fraud, and data breach incidents.
Independent expert reports and oral testimony for defence practitioners, commercial litigators, insurers, and private parties. Engagements address digital forensic examination, cybercrime allegations, electronic fraud, and disputed software conduct, with findings prepared to the standard required for use in courts and tribunals.
Structured examinations of suspected intrusions, insider misconduct, and control failures. Each investigation defines the scope of the compromise, preserves digital artefacts to an evidentiary standard, and produces written findings that counsel, directors, and insurers can rely on in subsequent proceedings.
Forensic response to ransomware, credential compromise, business email compromise, and unauthorised data exfiltration. Work includes preservation of volatile evidence, scoping of affected records, support for obligations under the Privacy Act and the Notifiable Data Breaches scheme, and remediation advice to contain further loss.
Investigations for individuals and businesses subjected to online harassment, doxxing, impersonation, and image-based abuse. Evidence is captured in a form suitable for personal safety intervention orders, civil proceedings, eSafety Commissioner removal requests, and complaints to platforms and telecommunications carriers.
Evidence preservation and recovery assistance for individuals, families, and small businesses affected by investment scams, romance scams, invoice redirection, and remote access fraud. Work includes guidance on reporting to ACCC Scamwatch, disputes with financial institutions, and referrals to AFCA where a banking or financial services complaint is appropriate.
A preliminary case review to identify urgent evidence preservation steps, clarify relevant timelines, and outline the forensic or expert work required. Offered without obligation to law firms, businesses, and private parties weighing whether formal engagement is warranted.
A closer view of each service line at Official Intelligence Pty Ltd, including scope of work, deliverables, engagement stages, turnaround, ideal client fit and common referral sources.
Scope of work. Independent expert analysis and report preparation on disputed digital evidence, computer and software disputes, cybercrime allegations, electronic fraud, mobile device forensics, network logs, cloud artefacts and encrypted messaging content. Work is carried out to the standard required by the Expert Witness Code of Conduct applicable in the relevant jurisdiction.
Typical deliverables. Written expert report compliant with the applicable Expert Evidence Practice Note, supplementary or responsive reports, joint reports from conferences of experts where ordered, hash verified forensic images and affidavits of authenticity, and oral evidence in committal, interlocutory and trial hearings.
Engagement stages. Conflict check, scope and letter of instruction review, preliminary case review, evidence preservation direction, forensic examination, draft report, review with instructing solicitor, final report, conferences of experts if ordered, then oral evidence.
Turnaround. Preliminary case review within several business days. Standard written report work is scoped in hours and quoted in advance; urgent work for running hearings is accommodated where possible and is disclosed transparently in the letter of instruction.
Who the service suits. Defence solicitors, commercial litigators, insurers appointed panel counsel, and self represented parties where a court has made a direction permitting that.
Referral sources. Barristers at the Victorian Bar, the New South Wales Bar Association, the Queensland Bar Association, the South Australian Bar Association and the Western Australian Bar Association, and defence solicitors across the Commonwealth.
Scope of work. Structured technical investigation of suspected unauthorised access, insider misuse, credential abuse and control failures. Methods are aligned with guidance published by the Australian Cyber Security Centre on managing cyber security incidents.
Typical deliverables. Chain of custody register, forensic images and triage packages, timeline of attacker and internal user behaviour, scoping memorandum of confirmed and unconfirmed compromise, control gap recommendations, and a written investigation report signed by Simon Smith.
Engagement stages. Intake and conflict check, emergency preservation direction, endpoint and log acquisition, analysis, scoping findings, draft report, client feedback, and final report. Where litigation is contemplated the work is conducted on a litigation hold footing from day one.
Turnaround. Emergency preservation within 24 to 72 hours of instruction. Full investigation report typically within 2 to 8 weeks.
Who the service suits. Corporates responding to suspected intrusion, insurers triaging a claim, boards needing independent review, and solicitors preparing civil or criminal proceedings arising from an intrusion.
Referral sources. General counsel, information security leaders, cyber insurance claims managers, and privacy officers.
Scope of work. Forensic response to ransomware, credential compromise, business email compromise, invoice fraud and unauthorised exfiltration of personal information. Assessment work supports obligations under the Privacy Act 1988 and the Notifiable Data Breaches scheme.
Typical deliverables. Forensic preservation of compromised hosts and mailboxes, technical scoping of affected personal information, written assessment supporting the statutory timeframe under the NDB scheme, incident timeline, and containment and remediation recommendations.
Engagement stages. Intake and conflict check, issue of a legal hold, forensic acquisition, triage and initial scoping, full scoping and attribution analysis where feasible, draft assessment, review with legal counsel, and final documented assessment with technical appendices.
Turnaround. Urgent preservation work commences within 24 hours. Statutory assessments under the NDB scheme are produced within the statutory period, subject to reasonable access to systems and logs.
Who the service suits. Australian organisations covered by the Privacy Act 1988 that have experienced a suspected or confirmed data breach, and small businesses dealing with invoice redirection or ransomware.
Referral sources. Privacy counsel, Chief Information Security Officers, and cyber insurance lead counsel.
Scope of work. Evidence focused investigation of online stalking, doxxing, impersonation, and image based abuse. IP addresses, account metadata, platform audit logs and carrier records are reviewed, with attribution evidence preserved in a form suitable for personal safety intervention orders, civil proceedings, eSafety Commissioner complaints, and requests to platforms and telecommunications carriers.
Typical deliverables. Exhibit packs comprising captured source material with cryptographic hashes, written attribution analysis, carrier and platform request letters drafted for counsel, and affidavit ready technical statements.
Engagement stages. Safety first intake, preservation of volatile content, platform and carrier request preparation, forensic attribution analysis, draft report, review, and production of a final report suitable for filing as exhibits.
Turnaround. Urgent preservation within 24 to 48 hours. Attribution reports are typically produced within 2 to 4 weeks depending on third party response times.
Who the service suits. Individuals subjected to ongoing harassment, family law parties dealing with monitoring and location tracking concerns, small businesses facing impersonation, and solicitors preparing safety or intervention applications.
Referral sources. Family law practitioners, intervention order practitioners, small business advisers, and community legal centres.
Scope of work. Evidence preservation and recovery assistance for investment scams, romance scams, invoice redirection, remote access fraud and cryptocurrency theft. Reporting to Scamwatch, disputes with financial institutions and escalation to the Australian Financial Complaints Authority are handled with supporting technical documentation.
Typical deliverables. Evidence dossier with hashed exhibits, cryptocurrency wallet mapping where relevant, draft dispute letters to banks and payment providers, draft AFCA complaint framing, and signed technical summary suitable for civil proceedings.
Engagement stages. Intake and conflict check, evidence preservation, scam typology and attribution analysis, bank dispute drafting, AFCA framing, and closure pack for the client.
Turnaround. Urgent evidence preservation within 24 to 72 hours. Written scam dossier typically within 1 to 4 weeks.
Who the service suits. Individuals and small businesses affected by scams, families assisting older relatives affected by investment fraud, and solicitors preparing civil recovery or tracing applications.
Referral sources. Community financial counsellors, AFCA referrals, and legal aid referrals.
Scope of work. A structured preliminary conversation to identify urgent evidence preservation steps, clarify timelines, and scope the forensic or expert work required. Offered without obligation. Findings from the review are documented briefly in writing and are not themselves expert evidence.
Typical deliverables. Written case review note summarising relevant facts, urgent preservation recommendations, scope options, and an indicative fee range for any subsequent engagement.
Engagement stages. Enquiry, conflict check, scheduled call, short written note, optional follow up scoping meeting.
Turnaround. Preliminary review note typically delivered within 3 to 5 business days of the conversation.
Who the service suits. Law firms considering whether a forensic or expert engagement is warranted, and private parties considering whether to instruct an expert.
Referral sources. Barristers, solicitors, and community legal centres.
To engage the practice on any of the service lines above, please complete the Case Review form on this page. A conflict check is completed before substantive discussion.
Specialist matter categories commonly instructed at Official Intelligence Pty Ltd, organised as Tier 1 parent buckets (general matter category) and Tier 2 sub-types (specific matter patterns under each parent). Matters are taken on merit, subject to conflict checks and the expert's capacity to act independently.
General expert examination of digital artefacts for admissibility in criminal and civil proceedings.
Forensic examination of smartphones, tablets, wearables and computers.
Interpretation of call, messaging and location records produced by Australian carriers.
Evidence examination on commodity and hardened encrypted platforms, and the limits of attribution.
Defence expert opinion on Commonwealth and State computer and carriage service offences.
Expert evidence in matters where scam facts intersect with civil recovery, bank disputes, AFCA complaints and criminal charges.
Digital threats of harm, data release, disclosure of imagery or impersonation unless a payment is made. See the canonical summary at #cyber-extortion.
Repeated unwanted contact, doxxing and coordinated multi-account abuse, with care in distinguishing orchestrated conduct from mental health presentations. See #cyberstalking and #gang-stalking-coordinated-abuse.
Forensic assessment under the Privacy Act 1988 Notifiable Data Breaches scheme, including class action response. Canonical block: #data-breaches. Class actions list: #class-actions. Reference list of high profile matters: #reference-list.
Breach of confidence, misuse of employer information, trade secret exfiltration, and Corporations Act 2001 section 183 matters. Frequently co-engaged with the Data theft and USB block.
Forensic reconstruction of employee or contractor data theft using USB devices, external drives or cloud sync clients. Canonical block: #data-theft-usb-exfiltration.
Expert reports in commercial software, SaaS and IT services disputes, including fitness for purpose, delivery failure and arbitration.
Expert evidence on on-chain tracing, exchange disputes and asset recovery.
Defence expert examination of alleged unauthorised access, modification or impairment under Criminal Code Act 1995 (Cth) Part 10.7 and State equivalents. Attribution, authentication logs, IP tracing, device fingerprinting and session evidence.
Expert evidence on header analysis, SPF/DKIM/DMARC authentication, mailbox audit logs, session token replay and forwarding rule abuse in invoice redirection and payment fraud matters.
Defence expert work on classification, recovery state and attribution under Division 474 and 473 of the Criminal Code Act 1995 (Cth). Canonical block: #tool-csam.
Device examinations in parenting, family violence and FDRP contexts, including monitoring software, covert location tracking and social media attribution.
Independent digital forensic reports on cryptocurrency, Bitcoin and other digital currency for property settlement and financial disclosure in the Federal Circuit and Family Court of Australia and the Family Court of Western Australia, as a single expert or a party appointed expert.
Expert evidence on the authenticity and provenance of AI-generated imagery, audio, video and text, and on the limits of attribution for synthetic media.
Simon Smith also specialises in independent digital forensic IT matters involving Dedicated Encrypted Criminal Communication Devices (DECCD) and Dedicated Encrypted Communication Devices (DECD), including allegations of encrypted device possession, encrypted messaging use and issues arising under s 192P of the Crimes Act 1900 NSW.
His work assists solicitors and counsel with the technical review of a DECCD or DECD allegation - device configuration, user attribution, account linkage, extraction reliability and encrypted messaging artefacts - where the issue is the meaning, reliability or attribution of material recovered from a mobile device, encrypted platform or forensic extraction.
Reports can address whether the technical material supports the alleged use of such a device, whether the artefacts have been interpreted correctly, and whether alternative explanations arise from the underlying device data, application records, telecommunications material or extraction methodology, including the limits of any police or prosecution interpretation.
The following topics are the ones on which I most often provide independent expert opinion to Australian defence counsel. Each entry anchors the scale of the problem to a figure from an authoritative Australian source and sets out the defence expert role.
The ACCC reports in Targeting Scams: report of the ACCC on scams activity 2023 that Australians lost approximately 2.74 billion dollars to reported scams in 2023, a 13.1 percent decline on 2022 (accc.gov.au media release; full report at Targeting Scams 2023 PDF).
I am routinely retained by defence counsel to provide independent opinion on the digital evidence arising from scam related matters, including the origin and control of the accounts involved and the reliability of attribution.
To instruct on a matter of this kind, please complete the Case Review form on this page.
The same ACCC Targeting Scams 2023 report records 1.3 billion dollars in reported investment scam losses in 2023, the largest category of scam losses (accc.gov.au). Consumer facing guidance is published by ASIC Moneysmart (moneysmart.gov.au).
I am routinely retained by defence counsel to provide independent opinion on the technical provenance of investment scam platforms, wallet custody, and the reliability of funds flow evidence.
To instruct on a matter of this kind, please complete the Case Review form on this page.
The ACCC Targeting Scams 2023 report records 201.1 million dollars in reported romance scam losses in 2023 (accc.gov.au).
I am routinely retained by defence counsel to provide independent opinion in matters where disputed romance scam facts intersect with civil recovery proceedings, bank dispute evidence, or criminal charges framed around facilitation conduct.
To instruct on a matter of this kind, please complete the Case Review form on this page.
The ACCC Targeting Scams 2023 report records approximately 256 million dollars in reported losses from remote access scams in 2023, a category closely linked to cryptocurrency extraction from victims (accc.gov.au).
I am routinely retained by defence counsel to provide independent opinion on on chain tracing, wallet cluster attribution, and the limits of attribution to a natural person.
I regularly accept appointment as an expert in family law property proceedings governed by Part 7.1 of the Federal Circuit and Family Court of Australia (Family Law) Rules 2021. The usual questions are the value of a digital asset at a relevant date, such as the date of disposal, and whether cryptocurrency can properly be associated with a party.
Much of my recent cryptocurrency work in federal jurisdictions has involved ensuring the Court is given an accurate picture of the digital asset evidence, including identifying where another expert's analysis has overstated or understated the position, or where cryptocurrency has been associated with a party without properly tested expert evidence. I am as comfortable scrutinising another expert's report as I am preparing the primary report.
My practice covers digital asset and wallet attribution, on chain transaction analysis, tracing of disposed assets, and valuation at a nominated date using a stated methodology.
The scope, and therefore the cost, of a cryptocurrency engagement is driven by the questions asked and the material available. Relevant factors include the number of wallets, addresses or transactions to be examined, whether tracing is required or valuation only, the relevant date or dates and the valuation methodology, the volume of source material such as bank and exchange records, blockchain data and affidavits, and whether the engagement may extend to a supplementary report, conferences or court attendance. A letter of instruction setting out the scope allows me to provide a fixed fee quotation or a detailed estimate.
To instruct on a matter of this kind, please complete the Case Review form on this page.
The ASD Cyber Threat Report 2022 to 2023 records that business email compromise continued to be a significant category of reported cybercrime affecting Australian businesses, with self reported financial losses in 2021 to 2022 exceeding 98 million dollars and an average reported loss of approximately 64 000 dollars per incident (cyber.gov.au Cyber Threat Report 2022 to 2023; subsequent Annual Cyber Threat Reports continue the series at 2023 to 2024).
I am routinely retained by defence counsel to provide independent opinion on email header analysis, authentication failure, mailbox rule abuse and session token replay in BEC matters.
To instruct on a matter of this kind, please complete the Case Review form on this page.
The OAIC Notifiable Data Breaches Report for July to December 2024 records 595 data breach notifications, a 15 percent increase on the prior six months, and 1 113 notifications for calendar 2024 in total, the highest annual number since the scheme began. The health sector accounted for approximately 22 percent of notifications (oaic.gov.au NDB report July to December 2024).
I am routinely retained by defence counsel to provide independent technical opinion supporting a regulated entity's NDB assessment under Part IIIC of the Privacy Act 1988.
To instruct on a matter of this kind, please complete the Case Review form on this page.
The eSafety Commissioner has published that approximately one in two Australians have experienced technology facilitated abuse at some point in their lifetime, with domestic violence research finding that more than one quarter of domestic violence cases involve technology facilitated abuse of children (esafety.gov.au research; eSafety media release).
I am routinely retained by defence counsel to provide independent opinion on attribution and preservation of digital evidence in family law, personal safety intervention order and civil proceedings arising from technology facilitated abuse.
To instruct on a matter of this kind, please complete the Case Review form on this page.
Section 477.1 of the Criminal Code Act 1995 (Cth) captures unauthorised access, modification or impairment with intent to commit a serious offence (legislation.gov.au). The Australian Institute of Criminology Cybercrime in Australia 2024 report records that nearly half of surveyed respondents reported being a victim of at least one type of cybercrime in the prior 12 months, indicating a continuing body of offending conduct of the kind addressed by Part 10.7 (aic.gov.au Cybercrime in Australia 2024).
I am routinely retained by defence counsel to provide independent opinion on authentication logs, IP attribution and device attribution in unauthorised access matters.
To instruct on a matter of this kind, please complete the Case Review form on this page.
Section 477.2 of the Criminal Code Act 1995 (Cth) captures unauthorised modification of data causing impairment (legislation.gov.au). The ASD Annual Cyber Threat Report 2023 to 2024 records a substantial body of reported cybercrime incidents involving malicious modification of data across Australian networks (cyber.gov.au).
I am routinely retained by defence counsel to provide independent opinion on forensic images, hash validation and proper attribution of the modification in s 477.2 matters.
To instruct on a matter of this kind, please complete the Case Review form on this page.
Section 474.17 of the Criminal Code Act 1995 (Cth) prohibits use of a carriage service in a way that reasonable persons would regard as menacing, harassing or offensive (legislation.gov.au). eSafety research indicates the prevalence of technology facilitated abuse in Australia is approximately one in two adults over a lifetime (esafety.gov.au research).
I am routinely retained by defence counsel to provide independent opinion on account attribution, device custody at the relevant time and whether the content engages the statutory standard.
To instruct on a matter of this kind, please complete the Case Review form on this page.
Divisions 474 and 473 of the Criminal Code Act 1995 (Cth) contain the principal Commonwealth CSAM offences, including offences in sections 474.19 to 474.24 (legislation.gov.au). Oversight of the broader online safety framework is conducted by the eSafety Commissioner under the Online Safety Act 2021 (legislation.gov.au; esafety.gov.au).
I am routinely retained by defence counsel to provide independent opinion on hash matching reliability, the provenance and timing of disputed files, tool version validity and the limits of attribution to a natural person.
To instruct on a matter of this kind, please complete the Case Review form on this page.
Division 145 and Division 372 of the Criminal Code Act 1995 (Cth) address false and misleading information offences and identity crime offences (legislation.gov.au). The Australian Institute of Criminology Cybercrime in Australia 2024 report records that approximately 21.9 percent of surveyed respondents had been a victim of identity crime and misuse in the prior 12 months (aic.gov.au).
I am routinely retained by defence counsel to provide independent opinion on document metadata, device attribution and session evidence in false document and identity crime matters.
To instruct on a matter of this kind, please complete the Case Review form on this page.
Expert reports in matters involving employee or contractor data theft and USB-based data exfiltration. Forensic analysis of artefacts left by USB mass storage activity, LNK files, registry USBSTOR and MountedDevices keys, shellbag evidence, jump lists, shadow copies and cloud synchronisation logs, to assist the court in determining likely exfiltration windows, device identification and volume of data copied. Commonly engaged by RTOs, professional services firms and small business plaintiffs pursuing former employees, and by employee defendants in the same matters.
To instruct on a matter of this kind, please complete the Case Review form on this page.
The OAIC NDB report for July to December 2024 records that malicious or criminal attacks accounted for approximately 69 percent of breaches, with ransomware representing approximately 24 percent of cyber incidents within that subset (oaic.gov.au NDB July to December 2024). Separately, the Cyber Security Act 2024 (Cth) introduced national ransomware incident reporting obligations for certain entities (legislation.gov.au).
I am routinely retained by defence counsel to provide independent opinion in ransomware matters, including scoping of exfiltration, validation of decryption claims, and technical support for the NDB assessment.
To instruct on a matter of this kind, please complete the Case Review form on this page.
The High Court decision in CD v Commonwealth [2025] HCA 37 confirms the framework within which evidence derived from the ANOM platform is now admitted in Australian prosecutions (auspublaw.org). Defence analysis of R v TB and CD (SA) is available at egreaves.com.au.
I am routinely retained by defence counsel to provide independent opinion on the reliability of exports from ANOM and other encrypted platforms, the structure of disclosed datasets, and the proper attribution of individual accounts or handles to a natural person.
To instruct on a matter of this kind, please complete the Case Review form on this page.
Expert evidence in matters involving repeated unwanted contact, doxxing, harassment via social media, SMS, email and secure messaging platforms, including attribution of burner accounts, VPN egress, tor-routed traffic and the interplay with Commonwealth carriage service and state stalking offences. Analysis of metadata, platform logs, device forensic artefacts and linked accounts.
To instruct on a matter of this kind, please complete the Case Review form on this page.
Expert evidence in matters involving coordinated multi-account abuse, sockpuppet networks, doxxing campaigns, targeted online pile-ons and fabricated allegations designed to damage reputation. Forensic analysis of account creation patterns, IP and device fingerprints, behavioural tells and cross-platform correlation. Acknowledges that some presentations of gang stalking reflect mental health issues rather than orchestrated activity, and notes the care required in distinguishing the two.
To instruct on a matter of this kind, please complete the Case Review form on this page.
Expert evidence in matters involving digital threats of harm, data release, disclosure of private imagery or impersonation unless a payment or act is performed. Covers the full range of modern cyber extortion vectors listed below. Forensic analysis of communications, payment rails, underlying infrastructure and attribution.
To instruct on a matter of this kind, please complete the Case Review form on this page.
Named extortion scam categories commonly seen on defence and plaintiff briefs. Each entry is a short description.
To instruct on a matter of this kind, please complete the Case Review form on this page.
Simon Smith specialises in information technology, information security, and cybersecurity, providing expert analysis, written reports, and oral evidence in matters involving digital systems, telecommunications, and computer-based evidence. Engagements have included defence work in criminal and regulatory proceedings, and civil matters acting for law firms, insurers, corporate clients, and private parties. The following is an illustrative, not exhaustive, list of courts and jurisdictions in which expert evidence has been given or reports prepared:
Commonwealth of Australia - Federal Circuit and Family Court of Australia, Federal Court of Australia.
New South Wales - Supreme Court of New South Wales, District Court of New South Wales, Local Courts of New South Wales.
Victoria - Supreme Court of Victoria, County Court of Victoria, Magistrates' Court of Victoria.
Queensland - Supreme Court of Queensland, District Court of Queensland, Magistrates Courts of Queensland.
South Australia - Supreme Court of South Australia, District Court of South Australia, Magistrates Court of South Australia.
Western Australia - Supreme Court of Western Australia, District Court of Western Australia, Magistrates Court of Western Australia.
Tasmania - Supreme Court of Tasmania, Magistrates Court of Tasmania.
Australian Capital Territory - Supreme Court of the Australian Capital Territory, Magistrates Court of the Australian Capital Territory.
Northern Territory - Supreme Court of the Northern Territory, Local Court of the Northern Territory.
New Zealand - High Court of New Zealand, District Court of New Zealand.
His work has addressed Commonwealth and State cybercrime, hacking, telecommunications, and technology-related offences, including but not limited to:
Use of a carriage service to menace, harass, or cause offence (Criminal Code Act 1995 (Cth), s 474.17).
Use of a carriage service in connection with child abuse material and child exploitation offences (Criminal Code Act 1995 (Cth), Part 10.6).
Possession, control, production, transmission, or accessing of child abuse material using a carriage service (Criminal Code Act 1995 (Cth), ss 474.19 to 474.24).
Unauthorised access to, or modification of, restricted data (Criminal Code Act 1995 (Cth), s 478.1).
Unauthorised impairment of electronic communications or data (Criminal Code Act 1995 (Cth), s 477.3).
Possession or control of data with intent to commit a serious computer offence, including possession of hacking tools, malware, scripts, or exploit code (Criminal Code Act 1995 (Cth), s 478.3).
Producing, supplying, or obtaining data with intent to commit a serious computer offence, including hacking and intrusion tools (Criminal Code Act 1995 (Cth), s 478.4).
State-based computer misuse, unauthorised access, and cyber-enabled offences involving computers, mobile devices, servers, and online platforms.
Short notes on the typical matter types seen in each Australian court and tribunal in which expert evidence has been prepared.
The Federal Court of Australia regularly hears intellectual property, copyright, anti-piracy and trade mark proceedings involving digital evidence, as well as matters under the Corporations Act 2001 and proceedings brought by regulators such as the Australian Competition and Consumer Commission and the Australian Securities and Investments Commission.
Expert evidence in that forum is prepared under the Expert Evidence Practice Note GPN-EXPT and the Harmonised Expert Witness Code of Conduct annexed to it (https://www.fedcourt.gov.au/law-and-practice/practice-documents/practice-notes/gpn-expt). Work typically involves software source code examination, network traffic analysis, domain and hosting attribution, cryptocurrency tracing and examination of platform logs.
Family law matters frequently raise questions about monitoring software, covert location tracking, image based abuse and unauthorised access to email and social media accounts. Reports in this forum focus on the technical examination and its limits. Privacy handling is carried out consistently with the Australian Privacy Principles annexed to the Privacy Act 1988 (https://www.legislation.gov.au/C2004A03712/latest/text).
Cybercrime matters on indictment, complex computer misuse allegations, and civil proceedings arising from serious data breaches are seen in the Supreme Court of Victoria. Expert reports are prepared in accordance with Part 4.6 of the Evidence Act 2008 (Vic) and the Court's Expert Witness Code of Conduct, Form 44A of the Supreme Court (General Civil Procedure) Rules 2015 (Vic) (https://content.legislation.vic.gov.au/sites/default/files/2023-12/15-103sra029%20authorised.pdf).
The County Court of Victoria hears a significant number of indictable Commonwealth cybercrime matters, including offences under Part 10.7 of the Criminal Code Act 1995 (Cth) (https://www.legislation.gov.au/Series/C2004A04868), and related Commonwealth carriage service offences. Defence engagements often focus on the reliability of digital forensic tools, validation of hash comparison evidence and the proper attribution of user activity.
Summary matters, personal safety intervention order hearings and committal proceedings in the Magistrates' Court of Victoria often involve digital exhibits taken from mobile devices, CCTV, and social media. Expert evidence is provided on the authenticity, timing and attribution of that material.
The Supreme Court of New South Wales and the District Court of New South Wales hear cybercrime matters on indictment, including charges under the Crimes Act 1900 (NSW) Part 6 and Commonwealth Code offences. Expert reports are prepared consistently with Schedule 7 of the Uniform Civil Procedure Rules 2005 (NSW), the Expert Witness Code of Conduct (https://legislation.nsw.gov.au/view/html/inforce/current/sl-2005-0418#sch.7).
Indictable matters in the Supreme Court of Queensland and the District Court of Queensland frequently involve telecommunications evidence, call data records and encrypted messaging. Expert evidence follows the Uniform Civil Procedure Rules 1999 (Qld) Part 5 Division 2 and the Court's expert evidence requirements (https://www.legislation.qld.gov.au/view/html/inforce/current/sl-1999-0111).
The Supreme Court of South Australia and the District Court of South Australia hear cyber enabled indictable matters. Reports are aligned with the Uniform Civil Rules 2020 (SA) (https://www.courts.sa.gov.au/rules-and-forms/uniform-civil-rules-2020/).
The Supreme Court of Western Australia and the District Court of Western Australia receive expert digital forensic evidence in matters that commonly include allegations under the Criminal Code Compilation Act 1913 (WA) and Commonwealth offences. Rules of Court for expert evidence are set out in Order 36A of the Rules of the Supreme Court 1971 (WA).
The Supreme Court of Tasmania and the Magistrates Court of Tasmania receive evidence in matters involving computer misuse and telecommunications evidence. Reports address mobile device forensics and preservation of exhibits at a standard suitable for indictable trial.
The Supreme Court of the Australian Capital Territory and the Magistrates Court of the Australian Capital Territory hear matters that often sit at the intersection of Commonwealth regulatory conduct and local offending, where digital evidence is central.
Matters in the Supreme Court of the Northern Territory and the Local Court of the Northern Territory commonly involve mobile device evidence, remote access fraud, and assistance interpreting call data records.
The High Court of New Zealand and the District Court of New Zealand receive cross-border expert evidence on digital forensics. Reports follow Schedule 4 of the High Court Rules 2016 Code of Conduct for Expert Witnesses (https://www.legislation.govt.nz/regulation/public/2016/0225/latest/whole.html).
A typical engagement follows a predictable sequence from initial contact to delivery of the final report. Steps are adjusted to urgency, jurisdiction and scope.
A good letter of instruction from an instructing solicitor to a digital forensic IT expert witness frames the retainer so the expert can produce admissible evidence efficiently and without later scope disputes. The letter should identify the instructing solicitor and the client, the court and proceeding number where known, whether the retainer is for civil or criminal work, and whether the expert is being retained for the prosecution, the defence, the plaintiff or the defendant in a civil matter.
The letter should set out the specific questions the expert is asked to address, framed as discrete numbered issues rather than a general commentary, since the final report will need to respond to each issue separately under the Harmonised Expert Witness Code of Conduct. Where the questions involve technical terms such as attribution, authenticity, timing or reliability, the letter should avoid assuming the answer and should instead invite the expert to form an independent view on each point.
The letter should identify the material available for review, including any Cellebrite or Magnet Axiom extractions, any carrier subpoena returns, any cloud account disclosures, any CCTV or physical exhibits, and any prior expert reports. It should state where each item sits, how the expert is to obtain access, and whether any material has integrity hashes that should be verified on receipt. If the material is voluminous, the letter should nominate a staged approach so the expert can confirm scope and fee before reviewing further.
The letter should confirm the deadline for the report, any procedural dates such as listed conclaves, conferences or trial dates, and the format required for the final report (for example, compliant with the Federal Court Practice Note GPN-EXPT and the Harmonised Expert Witness Code of Conduct, or with the applicable state rules). It should attach or reference the code of conduct the expert will acknowledge. It should state the funding arrangement, whether privately funded, Legal Aid funded or otherwise, and the initial retainer or estimate cap.
Finally, the letter should confirm that the expert is to consider every matter afresh on its own facts, to form an independent opinion, and to comply with the expert's overriding duty to the court. It should also confirm the expected protocols around privileged communication and preserved working papers. A short annexure listing the material and the questions is preferable to a long narrative.
An outline of the categories of digital evidence commonly examined in current Australian proceedings.
Mobile device evidence includes call history, SMS, multimedia messages, GPS and cell tower records, application databases, cached media and backup artefacts. Preservation uses validated forensic tools with cryptographic hashing. Reports note the tool and version used, known limitations, and the basis of any timeline reconstruction.
Commentary on encrypted messaging applications such as Signal, Telegram, WhatsApp, Threema, Wickr, Session, and historical platforms including ANOM, EncroChat, SkyECC, Phantom Secure and Conversations.im (XMPP OMEMO). Reports address the forensic integrity of seized devices, server side records where accessible, and the limits of recovery from volatile memory. Attribution of a message to a person requires a chain of corroborating evidence and is not inferred from a single artefact.
Cloud and SaaS platforms retain sign in logs, mailbox audit entries, file access records, administrative changes and API logs. Retention periods vary by vendor and licence tier. Requests for data through legal process or authorised user consent are produced in formats that must be parsed and validated before any inference is drawn.
CCTV authenticity work examines container integrity, frame rate consistency, encoding artefacts, device time settings and continuity across clips. Where a recording has been exported through a vendor specific player, metadata is preserved separately and compared against the original recorder.
Tracing of Bitcoin and other on chain asset movements uses publicly available ledgers and, where instructed, commercial analytics. Wallets are mapped to clusters by address reuse, spending behaviour and known service counterparties. Attribution to a person is a separate exercise from attribution to a wallet cluster.
Open source intelligence artefacts include public social media posts, WHOIS records, certificate transparency entries, public Git history, archived pages, and breach listings. Captured artefacts are hashed and preserved with capture date, capture tool and the URL at capture. Inferences drawn from OSINT are always supported by more than one independent observation where available.
Email evidence is examined at the level of headers, authentication results (SPF, DKIM and DMARC), audit logs from the mailbox provider, and supporting network telemetry. Business email compromise matters often involve credential stuffing, session token replay or forwarding rule abuse.
Smart watches, fitness trackers and vehicle telematics systems retain location, motion and device interaction records. Retention and granularity varies between vendors. Reports describe the retention policy published by the vendor at the time of examination and note where a figure is an estimate rather than a directly observed value.
A structured guide, aimed at solicitors and counsel, to the Commonwealth and State provisions that most commonly arise in computer hacking, unauthorised access and computer misuse matters. All citations link directly to the Federal Register of Legislation or the relevant State legislation portal.
Part 10.7 of the Criminal Code Act 1995 (Cth) contains the principal Commonwealth computer offences, including serious computer offences, unauthorised access to or modification of restricted data, unauthorised impairment of electronic communications, and possession or control of data with intent to commit a serious computer offence. The full text is maintained at the Federal Register of Legislation (https://www.legislation.gov.au/Series/C2004A04868).
Key sections routinely instructed include:
Part 10.6 of the Criminal Code Act 1995 (Cth) covers telecommunications and carriage service offences, which often accompany a computer misuse charge. The most frequently instructed section is 474.17, which concerns use of a carriage service to menace, harass or cause offence. Offences relating to child abuse material and child exploitation material appear in sections 474.19 to 474.24 and in related provisions.
The Telecommunications (Interception and Access) Act 1979 (Cth) sets out the framework for lawful interception and access to stored communications, as well as the preservation regime for carrier held data (https://www.legislation.gov.au/Series/C2004A02124). It is routinely considered in cybercrime matters where interception warrants or stored communications warrants are relied on by the prosecution.
The Spam Act 2003 (Cth) regulates unsolicited commercial electronic messages and is administered by the Australian Communications and Media Authority (https://www.legislation.gov.au/C2004A01214/latest/text).
The Cybercrime Act 2001 (Cth) amended the Criminal Code Act 1995 (Cth) to introduce the modern computer offence framework and replaced Part VIA of the Crimes Act 1914 (Cth) (https://www.legislation.gov.au/C2004A00957/latest/text).
In Victoria, computer related offences sit within the Crimes Act 1958 (Vic), including unauthorised access, modification or impairment of restricted data, and unauthorised impairment of electronic communications (https://content.legislation.vic.gov.au/sites/default/files/2025-08/58-6231aa296%20authorised.pdf).
New South Wales computer offences sit in Part 6 of the Crimes Act 1900 (NSW), including unauthorised access, modification or impairment of restricted data or electronic communication (https://legislation.nsw.gov.au/view/html/inforce/current/act-1900-040#pt.6).
Queensland computer offences are found in Chapter 33A of the Criminal Code Act 1899 (Qld), with section 408E being the most commonly instructed unauthorised use of computer offence (https://www.legislation.qld.gov.au/view/html/inforce/current/act-1899-009).
Part 4 of the Summary Offences Act 1953 (SA) deals with offences of unauthorised access to or use of a computer system, and related provisions (https://www.legislation.sa.gov.au/lz?path=%2FC%2FA%2FSUMMARY%20OFFENCES%20ACT%201953).
Western Australian computer offences sit in the Criminal Code Compilation Act 1913 (WA) (https://www.legislation.wa.gov.au/legislation/statutes.nsf/law_a146.html).
The Privacy Act 1988 (Cth) incorporates the Australian Privacy Principles and, via Part IIIC, the Notifiable Data Breaches scheme. Where unauthorised access results in a data breach likely to result in serious harm, notification obligations arise (https://www.legislation.gov.au/C2004A03712/latest/text). The scheme is administered by the Office of the Australian Information Commissioner (https://www.oaic.gov.au/privacy/notifiable-data-breaches).
The Security of Critical Infrastructure Act 2018 (Cth) imposes reporting, risk management and incident response obligations on responsible entities for critical infrastructure assets (https://www.legislation.gov.au/C2018A00029/latest/text).
Beyond pure computer misuse, related offences that frequently appear on defence briefs involve child exploitation material, false documents and fraud. Each area is summarised here as a starting reference. Defence engagements in these areas are accepted on merit and subject to a conflict check.
Child abuse material offences at Commonwealth level are located in Part 10.6 of the Criminal Code Act 1995 (Cth), including sections 474.19 to 474.24, covering possession, control, production, transmission and access using a carriage service (https://www.legislation.gov.au/Series/C2004A04868). State equivalents exist in Victoria under the Crimes Act 1958 (Vic), in New South Wales under the Crimes Act 1900 (NSW), and in equivalent legislation in each other State and Territory.
Forensic defence work in this area focuses on the reliability of hash matching, the provenance and timing of files, user attribution, and the limits of what can and cannot be inferred from a recovered artefact. The Office of the eSafety Commissioner publishes guidance on the broader online safety framework at the Online Safety Act 2021 (https://www.legislation.gov.au/C2021A00076/latest/text).
False document offences are dealt with in Commonwealth and State law. At Commonwealth level, Division 145 of the Criminal Code Act 1995 (Cth) covers false and misleading information offences, while identity crime offences are in Division 372 (https://www.legislation.gov.au/Series/C2004A04868). State provisions exist in the Crimes Act 1958 (Vic) (forgery provisions) and equivalents in each State.
Forensic defence work in this area considers document authenticity, metadata reliability, account takeover evidence and mobile device location and timing artefacts that tend to bear on whether a person was in a position to transmit or use a document at the alleged time.
Fraud offences arise under the Criminal Code Act 1995 (Cth) (Division 134 and related provisions) and under State legislation, including the Crimes Act 1958 (Vic) section 81 and the Crimes Act 1900 (NSW) sections 192B to 192H. Consumer protection context for scam related fraud is administered by the Australian Competition and Consumer Commission via Scamwatch (https://www.scamwatch.gov.au/about-us/about-scamwatch) and, where financial services are involved, by the Australian Securities and Investments Commission (https://www.asic.gov.au/about-asic/what-we-do/our-role/) and the Australian Financial Complaints Authority (https://www.afca.org.au/).
Section 474.17 of the Criminal Code Act 1995 (Cth) prohibits use of a carriage service in a way that reasonable persons would regard as menacing, harassing or offensive (https://www.legislation.gov.au/Series/C2004A04868). Defence work frequently considers attribution of online conduct to a person, the sequence of messages, and whether device and account control can be reliably established at the relevant time.
The Online Safety Act 2021 (Cth) sets out the eSafety Commissioner's powers in relation to image based abuse, adult cyber abuse and cyber bullying of children (https://www.legislation.gov.au/C2021A00076/latest/text; https://www.esafety.gov.au/). Civil removal and civil penalty schemes can run in parallel with criminal proceedings, and defence forensic work must consider both.
The core Commonwealth offence is section 478.1 of the Criminal Code Act 1995 (Cth): unauthorised access to, or modification of, restricted data (legislation.gov.au). The same conduct, when done with intent to commit a serious offence, is captured by section 477.1. Typical factual patterns include password sharing after the access right has ended, use of a former employer's VPN credentials, and access to a cloud account using a recovered session token.
Defence expert work addresses authentication logs, IP attribution, geolocation and device fingerprint evidence, and whether the access condition was in fact in force at the relevant time. Key matters: Kennedy v The Queen [2010] NSWCCA 260; DPP (Cth) v Parker line of authorities.
Sections 477.2 and 477.3 of the Criminal Code Act 1995 (Cth) cover unauthorised modification of data and unauthorised impairment of electronic communications. State equivalents include section 247C of the Crimes Act 1958 (Vic) and Division 2 of Part 6 of the Crimes Act 1900 (NSW). Ransomware, wiper malware and malicious scripts typically sit here.
Expert work considers the provenance of the modification, the chain of custody for the forensic image of the affected system, and whether the modification is properly attributed to the accused rather than to a tool, a co-user, or automated activity.
Internet based hacking prosecutions combine Part 10.7 of the Criminal Code Act 1995 (Cth) with interception or stored communications issues governed by the Telecommunications (Interception and Access) Act 1979 (Cth) (TIA Act). Reconnaissance scanning, credential stuffing, SQL injection, web shell deployment and lateral movement over VPN are common prosecution narratives.
Expert work examines server logs, WAF and IDS telemetry, payload hashes, command and control infrastructure attribution, and the independent reproducibility of the alleged exploit. The Australian Signals Directorate Essential Eight maturity model is used as a neutral reference for control posture (cyber.gov.au Essential Eight).
Data theft charges combine Part 10.7 offences with Commonwealth theft under Division 131 of the Criminal Code Act 1995 (Cth), fraud under Division 134, and, where personal information is involved, the Privacy Act 1988 (Cth) Notifiable Data Breaches scheme (oaic.gov.au).
Forensic defence work examines exfiltration artefacts: outbound proxy logs, cloud upload metadata, mass file access by a single account, archive creation immediately before copying, and the device that the data was moved to. The expert evidence separates the fact of access from the fact of exfiltration, and attribution to a person from attribution to an account.
A substantial portion of civil and criminal matters involve former employees who have removed data using USB storage, external drives, personal cloud sync accounts such as Dropbox, Google Drive, OneDrive or iCloud, or by emailing documents to a private address. The legal framework sits at the intersection of:
Forensic techniques in these matters include:
Simon Smith has conducted extensive work on departing employee matters of this character, preserving the source system, the removable media and the cloud identities in parallel, and producing a report that distinguishes between three questions: did the data leave the system; was the data accessed by an unauthorised person; and is the departing employee properly attributed to the conduct.
Division 145 (false and misleading information) and Division 372 (identity crime) of the Criminal Code Act 1995 (Cth) are the principal Commonwealth provisions (legislation.gov.au). State forgery provisions sit alongside, including the Crimes Act 1958 (Vic) Part I Division 1 Subdivision (8) and the Crimes Act 1900 (NSW) Part 5. Expert work considers metadata integrity, printer artefact analysis, and attribution to the device that produced the instrument.
Division 134 of the Criminal Code Act 1995 (Cth) and equivalent State provisions apply. Business email compromise, investment scams, payment redirection and invoice fraud are the most common fact patterns. Reports separate the conduct of a foreign threat actor, the conduct of a domestic money mule, and the conduct of the ultimate accused.
Section 474.17 prohibits use of a carriage service in a menacing, harassing or offensive way (legislation.gov.au). Related sections 474.17A (aggravated form), 474.14 (unauthorised use of a telecommunications service) and 474.15 (threat using a carriage service) regularly appear alongside. Expert work deals with authentication of the account in use, device custody at the relevant time, and whether the content engaged the statutory standard in fact.
A remote access trojan is a program that gives a remote operator covert control of a compromised device. Typical technical features include a persistence mechanism to survive reboot, a command and control channel (commonly over HTTPS or a protocol that tunnels through standard ports), keystroke capture, credential theft, clipboard scraping, screenshot capture, webcam or microphone access, file system enumeration, and data exfiltration routines. RAT evidence commonly sits alongside charges under Part 10.7 of the Criminal Code Act 1995 (Cth), in particular sections 477.1 (unauthorised access with intent to commit a serious offence), 477.2 (unauthorised modification of data causing impairment), 478.1 (unauthorised access to or modification of restricted data), and 478.3 (possession or control of data with intent to commit a computer offence) (legislation.gov.au).
The ASD Annual Cyber Threat Report 2023 to 2024 continues to record RAT-style tooling as a notable category of observed activity in Australian networks (cyber.gov.au; series page annual cyber threat report series).
I am routinely retained by defence counsel to provide independent opinion on RAT related evidence, including examination of binary artefacts, unpacking and symbol analysis, persistence artefacts in the Windows Registry (Run keys, Scheduled Tasks, Services, WMI subscriptions), command and control indicators, the boundary between possession of generic dual-use tooling and the narrower statutory thresholds, and the limits of attribution to a natural person as distinct from to a device or account.
Commonwealth offences that regularly apply to the creation, supply or control of offensive cyber tools include section 478.3 (possession or control of data with intent to commit a computer offence) and section 478.4 (producing, supplying or obtaining data with intent to commit a computer offence) of the Criminal Code Act 1995 (Cth) (legislation.gov.au). These provisions apply to both bespoke custom code and modified open source or commercial offensive security tooling.
Evidentiary questions that commonly arise include: authorship attribution from compiler fingerprints, build artefacts and embedded resource strings; code reuse analysis against public malware families; whether the tool as disclosed by the Crown is the precise build alleged to have been deployed, or a later or earlier variant; the packaging and distribution chain, including torrents, forums and private channels; and whether the accused's possession was knowing, contemporaneous and attended by the requisite intent.
I am routinely retained by defence counsel to provide independent opinion on malware development and distribution matters, including disassembly, decompiler comparison, build metadata review, signing certificate analysis, and the treatment of shared or publicly available components.
A matter before a superior court of an Australian State involving allegations that a proprietary program, referred to in the brief as Firebird, was used to commit unauthorised access and unauthorised modification offences under Part 10.7 of the Commonwealth Criminal Code (legislation.gov.au). I was retained as the defence digital forensic expert witness.
The Crown produced the executable and source code. The forensic analysis examined the program's actual behaviour, its documented features, its network telemetry, and the limits of what the artefacts supported as a matter of fact as distinct from hypothesis. The resulting expert report addressed the reliability of the Crown's opinion, the scope of what could be proved from the available digital evidence, and common misinterpretations around attribution and intent.
The matter remains on foot. The accused, the solicitor on the record, the court and the precise charges are not identified in this summary. To engage the practice on a matter of this character, please complete the Case Review form on this page.
Digital forensic evidence has become the spine of many serious indictable Crown cases in Australia. Encrypted messaging platform exports, device examinations, geolocation artefacts, cell site call records, CCTV authenticity analysis and admissibility challenges under the uniform Evidence Act 1995 (legislation.gov.au Evidence Act 1995) and the Surveillance Devices Act 2004 (Cth) (legislation.gov.au Surveillance Devices Act 2004) are routinely at the centre of defence preparation. Where Crown opinion rests on digital artefacts, independent defence scrutiny of those artefacts can be decisive.
ANOM derived prosecutions (Operation Ironside). Extensive Australian authority now exists on the admissibility of ANOM material, including the High Court decision in CD v Commonwealth [2025] HCA 37 (auspublaw.org analysis; Mondaq commentary) and the Full Court of the Supreme Court of South Australia in Questions of Law Reserved 1 and 2 of 2023 (2024) SASCA 82 (dpp.sa.gov.au summary; defence commentary on the trial decision in R v TB and CD at egreaves.com.au).
Encrypted platform prosecutions involving EncroChat, Sky ECC and Phantom Secure. A substantial body of Australian and overseas authority addresses the admissibility of evidence from hardened encrypted communications platforms. Australian forums receive expert opinion on the provenance of platform exports, the forensic integrity of the database snapshots disclosed in evidence, and the reliability of attribution of individual accounts.
Organised crime and gang related matters involving digital evidence. Public reporting in New South Wales and Victoria covers matters concerning the Alameddine and Hamzy/Hamze networks, the Brothers for Life milieu, and related conflict (reporting for example at Wikipedia Alameddine crime network). These are referenced in this section only as publicly reported examples of the category in which digital forensic evidence regularly arises, and not as assertions of any particular retainer by Official Intelligence Pty Ltd.
Kidnapping and violent crime matters. Mobile forensic evidence, including call data records, cell tower location, messaging application data and device activity timelines, has been central to Crown and defence expert opinion in these matters. Technical questions commonly include the limits of cell tower location, clock drift across exhibits and the proper treatment of deleted and unallocated artefacts.
Murder prosecutions. Messaging application content, device activity timelines, CCTV authenticity and Internet of Things artefacts increasingly appear in indictable homicide matters. Defence expert work focuses on the reliability of the timeline, the authenticity of the exhibits, and the boundary between what the artefacts actually support and what is being put to the trier of fact as hypothesis.
Simon Smith's role. Simon Smith of Official Intelligence Pty Ltd accepts instructions from defence counsel on serious indictable matters where digital forensic evidence is in issue. The work is confined to what the artefacts actually support; opinion is independent and provided in accordance with the harmonised expert witness code of conduct and the applicable uniform evidence legislation. Cross reference the Former employee USB and cloud drive data theft panel at #off-usb and the Important case law section at #case-law. To engage the practice on a matter of this character, please complete the Case Review form on this page.
An expert-level introduction, for counsel, to the digital forensic tools most commonly encountered in Australian cyber matters, and to the headline law enforcement operations that have generated defence work in this practice. Simon Smith acts as a defence expert witness in matters involving these tools and operations and does not adopt the prosecution perspective.
Cellebrite UFED (Universal Forensic Extraction Device) and its analysis counterpart, Physical Analyzer, are the most widely used mobile extraction and parsing tools in Australian law enforcement. The vendor publishes product documentation at https://cellebrite.com/en/products/ufed/ and https://cellebrite.com/en/products/physical-analyzer/.
Defence expert work on Cellebrite evidence considers the UFED version used, the particular extraction type selected (logical, file system or physical), the parser build used in Physical Analyzer, and whether the UFDR export reviewed by counsel represents the full extraction or a filtered subset. Where only a filtered export is disclosed, a request for the full UFED file is commonly made so that chat fragments, deleted records and unallocated space can be independently reviewed.
Magnet Axiom is a digital forensic processing platform used for both mobile and computer evidence. Reports from Axiom typically identify the artefact, source path, hash and parser. Defence review considers whether the case file can be reopened and whether the underlying forensic image is available for independent verification.
X-Ways Forensics is a file system level analysis tool commonly used for detailed computer forensic work. Defence review focuses on filter configurations, hash sets applied, and the case report template selected for disclosure.
FTK (Exterro) and EnCase (OpenText) are long standing commercial platforms that still appear in Australian matters. Open tools such as Autopsy, Plaso, Volatility and The Sleuth Kit are used to validate or supplement a commercial extraction independently. Where defence relies on open tools, the exact tool version and configuration are recorded for the tribunal.
Cryptographic hashing (MD5, SHA-1, SHA-256) underpins integrity assertions in expert reports. Each report sets out the hash of the source exhibit, the hash of any working copy, and the tool and version used to compute the hashes. Any deviation between the source hash and the hash of the copy that was examined is addressed expressly, with a defensible explanation.
ANOM was a covert law enforcement operated encrypted communications platform used internationally between approximately 2018 and 2021. Evidence obtained from that platform gave rise to a large number of Australian prosecutions under the umbrella of Operation Ironside.
Legal treatment of the admissibility of ANOM evidence has been extensive. Academic and legal commentary on the admissibility and constitutional context includes the Australian Public Law analysis of the High Court's decision in CD v Commonwealth (https://www.auspublaw.org/home/2026/2/an0m-in-the-high-court-cd-v-commonwealth-2025-hca-37-g867s), defence analysis of R v TB & CD (https://egreaves.com.au/an0m-admissibility/2023/04), the South Australian Office of the Director of Public Prosecutions' summary of Questions of Law Reserved 1 and 2 of 2023 (https://www.dpp.sa.gov.au/prosecuting-crimes/cases-of-interest/questions-of-law-reserved-1-and-2-of-20232024sasca-82-27-june-2024), and the Mondaq commentary on the High Court's ruling that evidence derived from ANOM is admissible (https://www.mondaq.com/australia/crime/1718790/high-court-rules-that-evidence-derived-from-anom-is-admissible).
Simon Smith has prepared defence expert reports in multiple Commonwealth and State matters arising from ANOM evidence, addressing the technical reliability of the platform export, the structure of the message database provided, attribution, device timestamps, and the relationship between export fields and conventional forensic artefacts on seized handsets.
This panel is a technical reference for instructing solicitors defending clients charged with possession and related offences under Divisions 474 and 473 of the Criminal Code Act 1995 (Cth) (legislation.gov.au). It describes the classification tooling and spreadsheets that commonly appear in the Crown brief, and the evidential limits that attach to each. No imagery is referenced, no links to material, no descriptive content.
PhotoDNA. A perceptual image hashing technology originally developed by Microsoft and widely used by law enforcement and online platforms to detect images that match known items in a hash database. PhotoDNA is robust to minor image alterations such as resizing, recolouring and watermarking. PhotoDNA is a one-way hash; the image cannot be reconstructed from the hash. A PhotoDNA match indicates that the file is highly likely to be a known item already recorded in the hash database. It does not tell a tribunal when the file appeared on the device, how it got there, or the intent of the person in possession.
Hash matching in general (SHA-1, SHA-256, MD5). Exact file content hashes. Any change to a file, including re-encoding or metadata edits, produces a different hash. PhotoDNA is contrasted with these in that PhotoDNA is tolerant to perceptual changes while SHA-1, SHA-256 and MD5 are not.
Project VIC. An international hash sharing and categorisation initiative. Forensic tools can query a Project VIC dataset to flag known items by hash and return a category classification without the examiner needing to view or produce the material.
Interpol Baseline. A standardised dataset of already classified material used internationally for consistency of classification between jurisdictions.
CAID and CETS. The Child Abuse Image Database in the United Kingdom and the Child Exploitation Tracking System historically used in Canadian and some Australian contexts. Naming and jurisdictional variation should be checked against the specific Crown brief.
Magnet Axiom CEM. The Axiom module for organising and categorising image and video artefacts in a case, allowing the examiner to tag items by the category definitions applicable in the relevant jurisdiction. Axiom CEM exports are the basis for most case spreadsheets used by Crown briefs and defence experts alike.
Categorisation systems used in Australia. In Commonwealth and State matters, classification typically aligns with the Interpol Baseline or the Project VIC category tiers. The defence expert's role is not to re-categorise. It is to examine the classification methodology, check how the hash match set was generated, confirm whether the items truly matched or were presumptively matched, and whether the Crown's count and classification withstand scrutiny.
Axiom case spreadsheets. The exported .xlsx file produced by Axiom's case module tabulates each artefact, its hash, its classification, its source path, and its recovery state (allocated, carved, slack and other variants). Defence experts routinely audit these spreadsheets to verify classification, deduplicate entries, and separate items carved from free space from items that were ever user accessible.
Recovery state terms. Allocated, unallocated, carved, thumbnail cache, web cache, application cache. Each has materially different evidential weight. A defence expert will make this distinction clear to the tribunal so that, for example, a thumbnail automatically generated by the operating system is not treated identically with a file that has been intentionally retained in a user folder.
Prosecution terminology. The offences most frequently instructed are possession, access, control, production and dissemination, as set out in Division 474 of the Criminal Code Act 1995 (Cth) and related State offences (legislation.gov.au Criminal Code). Division 473 contains related definitional provisions.
Simon Smith appears as an independent defence digital forensic expert in these matters when instructed by defence counsel. Work is confined to verifying classification methodology, recovery state integrity, attribution, knowledge and access issues. Opinion is provided in accordance with the harmonised expert witness code of conduct and the applicable uniform evidence legislation. To instruct the practice in a matter of this character, please complete the Case Review form on this page.
A working reference, written for Australian solicitors and counsel, to the digital forensic software products and frameworks that most frequently appear in evidence, cross-examination and expert conferences on cybercrime, data theft, corporate investigation and data breach matters. Each entry names the vendor, the purpose of the tool, and the evidentiary and cross-examination issues that regularly arise. Where a tool is routinely encountered in defence briefs by Simon Smith of Official Intelligence Pty Ltd, that is noted.
A lawyer-readable glossary of the cell-tower and telecommunications forensic terms that most commonly appear in Australian call data record subpoena material, expert reports, and cell-site analysis evidence. Each entry states the term, its plain language meaning and the principal evidentiary caveat that goes with it.
The compass bearing of the main lobe of a cell-tower sector antenna, measured clockwise from true north, typically zero to 360 degrees. Sectorised towers usually carry three sectors roughly 120 degrees apart. Azimuth, sector bearing and horizontal beam width together approximate the area a given sector looks toward. Network behaviour is probabilistic, not deterministic.
Unique identifiers for the serving sector at a point in time. ECI (E-UTRAN Cell Identifier) is used in 4G. CGI (Cell Global Identity) historically applied to 2G and 3G. LAC (Location Area Code) and TAC (Tracking Area Code) are higher level groupings. A cell ID identifies the serving sector, not a precise geographic coordinate.
One of the directional antennas mounted on a tower. A tower commonly has three sectors labelled alpha, beta and gamma or 1, 2, 3. Sector assignment at a given moment is a function of radio conditions and is not equivalent to a position fix.
The process by which an active call or data session transfers between cells or sectors as a subscriber moves, or because of load balancing, interference or radio planning decisions by the network. A handover is not a precise location fix.
The practical shrinkage or expansion of a sector's effective coverage area driven by load, interference and environment. Cell breathing means that the set of sectors that can serve a given location changes over time, even with the subscriber stationary.
Signal strength and quality measurements used by the radio layer when selecting between sectors. RSRP is reference signal received power. RSRQ is reference signal received quality. RSSI is received signal strength indicator. These metrics help explain why a device selected a particular sector but do not fix location.
A coarse distance indicator used by the network to align uplink transmissions. Useful for rough radial distance estimates from a serving sector, not for pin-point location. TA resolution depends on the radio technology in use.
Similar in principle to timing advance but used in different radio technologies. Coarse in effect. Should not be treated as a precise distance measurement without corroboration.
The effect of terrain, buildings, weather and antenna tilt on where a sector actually reaches. Critical context for interpreting any cell-site opinion. A published serving-cell record cannot be interpreted without accounting for propagation.
Network records logging call and messaging events, typically the originating and terminating identifiers, start time, duration, called number, serving cell identifier at connection, and sometimes at disconnection. CDR is not a continuous location track.
Billing-oriented records analogous to CDR but captured for charging and reconciliation. Often overlap with CDR but sometimes have different retention policies. If a lawyer sees CCR in a telco production, that is typically this charging data.
Per-event records of network signalling beyond call setup, including handovers, location updates, paging and attach/detach events. Richer than plain CDR for movement analysis but still probabilistic and subject to network-specific schema.
A network event when a device re-registers on a new location or tracking area. Useful context for inferring broad movement but not a fix.
Network area groupings that aggregate cells for paging purposes. Defence cross-examination on CDR production routinely requires these be explained to the tribunal so that a cell ID is not conflated with a discrete location.
Subscriber, device, SIM and telephone number identifiers respectively. Defence experts frequently need to explain the difference between these four to a tribunal. IMSI identifies the subscriber, IMEI identifies the handset, ICCID identifies the physical SIM card, and MSISDN is the dialable number.
The forensic discipline of reconstructing where a device was or might have been at times of interest by correlating CDR and EBM records with network topology, antenna data and propagation models. The conclusion is probabilistic and depends on the accuracy of the network provider data and on ground truth.
The vertical antenna tilt, used together with azimuth and beam width to model sector coverage. Small changes in downtilt can materially alter the geographic reach of a sector.
Independent measurement of the radio environment by driving routes with a scanning receiver, used to validate or challenge the network's claimed coverage for a sector. Drive testing is a principal method by which defence experts check Crown cell-site opinion against observed radio behaviour.
Warrant obtained datasets listing all devices that pinged a particular sector or set of sectors in a time window. Relevant to defence cross-examination on how the suspect was identified and on the presence of alternative candidates in the same dataset.
Australian telcos respond to subpoena in varying language. Practitioners commonly see CDR, EBM, provisioning records, SMS-C logs, location update logs and voicemail metadata referenced in responses. The expert report should identify which fields have been produced and which have not.
Any cell-site opinion that treats a CDR row as a precise location point should be scrutinised. Reliable opinion combines the serving-sector record with azimuth, downtilt, timing advance where available, propagation modelling and ground truth verification. Simon's expert reports consistently address these limits and do not overstate what the network artefacts support.
A working list of Australian case authorities and recent developments relevant to digital forensic evidence, computer misuse, carriage service offences and encrypted communications platforms. Entries are listed for solicitor orientation only. Each matter is considered afresh on its own facts.
A dedicated reference for solicitors advising Australian organisations about the Notifiable Data Breaches scheme, forensic assessment of a suspected breach, and the intersection between the Privacy Act 1988 and State or contractual obligations. The position taken here is consistent with the guidance published by the Office of the Australian Information Commissioner.
The Office of the Australian Information Commissioner publishes that "a data breach happens when personal information is accessed or disclosed without authorisation or is lost" (oaic.gov.au NDB). The definition captures both external compromise and inadvertent internal loss. The Privacy Act 1988 itself is at legislation.gov.au.
An eligible data breach under the NDB scheme requires unauthorised access to or disclosure of personal information, or loss of personal information in circumstances where unauthorised access or disclosure is likely to occur, and the breach is likely to result in serious harm to any of the individuals to whom the information relates.
The OAIC states that, "if the Privacy Act 1988 covers your organisation or agency, you must notify affected individuals and us when a data breach involving personal information is likely to result in serious harm" (oaic.gov.au).
Where a suspected eligible data breach has occurred, the entity must carry out a reasonable and expeditious assessment within 30 calendar days. The forensic work supporting that assessment includes scoping the categories of personal information affected, determining the population of individuals affected, identifying the likely threat vector and confirming or ruling out exfiltration.
Forensic deliverables in this practice are structured so that counsel can rely on them to justify the entity's assessment to the OAIC and, where relevant, to affected individuals.
Where the assessment concludes that there has been an eligible data breach, the entity must prepare a statement to the OAIC that meets the requirements of section 26WK of the Privacy Act 1988 (Cth), and must take reasonable steps to notify the individuals whose personal information has been accessed, disclosed or is likely to be.
Separately from the Privacy Act 1988, the following may apply and are considered as part of the assessment: mandatory reporting obligations for responsible entities under the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act); carrier and carriage service provider obligations under the Telecommunications (Interception and Access) Act 1979 (Cth) (TIA Act); and specific regulatory obligations for APRA regulated entities and ASIC regulated entities.
This section lists recent high profile Australian data breach matters at a general level. Each matter is referenced as a matter of public record, and without the suggestion that Simon Smith acted or acts for any particular party in any of them.
Forensic work in matters of this character is carried out with careful separation from any criminal prosecution and with full respect for legal professional privilege.
The following class actions and representative proceedings are listed for instructing-solicitor reference. Details are current to the verification date recorded in this section and may have moved. Always check the court file directly.
Two proceedings of note:
Baker McKenzie proceedings filed 6 February 2023 and Slater and Gordon proceedings filed 4 May 2023 were consolidated by the Federal Court on 1 August 2023, with Baker McKenzie continuing as sole solicitors for the group members (slatergordon.com.au; OAIC representative complaint notice).
The OAIC has also commenced a civil penalty proceeding against Medibank Private Ltd in the Federal Court.
Gordon Legal, in cooperation with Hayden Stephens and Associates, announced investigation of a Latitude data breach class action on 28 March 2023 and subsequently progressed proceedings in the Federal Court (gordonlegal.com.au).
HWL Ebsworth Lawyers disclosed a data breach on 8 May 2023. The OAIC opened a formal investigation and a representative complaint has been lodged through the National Justice Project in relation to National Disability Insurance Scheme participants whose information may have been affected (oaic.gov.au). No consolidated Federal Court class action has been reported publicly at the date of verification.
On 13 September 2024 the Australian Information Commissioner accepted a representative complaint against Ticketek Pty Ltd arising from the May 2024 data breach (oaic.gov.au).
MediSecure Pty Ltd disclosed a ransomware incident in April 2024 affecting data concerning approximately 12.9 million Australians. MediSecure entered administration on 3 June 2024. The OAIC issued a statement in September 2024 advising that it would not pursue a formal investigation, given the corporate status of MediSecure and the proportionality of remedies available (oaic.gov.au statement).
Dymocks Pty Ltd confirmed a data breach in 2023. The OAIC has engaged with Dymocks about the handling of personal information; at the date of verification, a consolidated class action filed in the Federal Court against Dymocks has not been publicly reported.
The MOVEit Transfer vulnerability disclosed in mid 2023 affected a number of Australian users of the product and of downstream services that relied on it. Shell was among the internationally reported entities affected. Any Australian proceedings should be verified against the Federal Court file.
The Privacy Commissioner's determination in the 7-Eleven Stores Pty Ltd biometric matter was handed down in October 2021. The determination is of continuing relevance to expert witness evidence on biometric collection and storage (oaic.gov.au determination).
Medlab Pathology, a subsidiary of Australian Clinical Labs Limited, reported a data breach in 2022. The OAIC commenced civil penalty proceedings in the Federal Court in November 2023 (oaic.gov.au).
PageUp People Ltd experienced a 2018 data incident that generated significant regulatory response in Australia and overseas. Public OAIC materials are limited; the matter is referenced for context as an early and instructive NDB scheme matter.
The 2015 Ashley Madison breach generated international litigation of precedent value for Australian matters on proof of harm and class definition.
Victorian public reporting in 2024 indicated that records held by third party service providers of Monash Health were affected by a supply chain cyber incident. The relevant statutory framework for Victorian health information is the Health Records Act 2001 (Vic) (Health Records Act 2001 (Vic)) alongside the Privacy Act 1988 (Cth).
Case Review and we will confirm conflict, scope and fee indicative before any substantive discussion.
Case ReviewQualifications, certifications, memberships and experience of Simon Smith relied on when preparing expert reports and giving oral evidence in Australian courts and tribunals.
Simon Smith has been a published Apple App Store and Google Play Store app developer since 2016.
Simon Smith has been retained as an expert witness in criminal and civil proceedings across multiple Australian state and territory jurisdictions, the Commonwealth, and New Zealand. A non-identifying summary of matters is available below for instructing solicitor reference.
Articles and interviews featuring Simon Smith of Official Intelligence Pty Ltd, verified from primary sources. Newest first.
Simon Smith, digital forensics examiner and expert witness, described the "highly detailed behavioural fingerprint" that modern connected vehicles build on every driver, in coverage of the OAIC inquiries into connected car manufacturers.
Read article ↗Simon Smith, cybersecurity expert, characterised brushing as a deceptive trade practice rather than a direct security breach and cautioned recipients about downstream identity misuse.
Read article ↗Simon Smith, CEO of AICS, discussed Facebook Marketplace scams and deterrence measures for consumers.
Read article ↗Simon Smith, cybersecurity expert, explained brushing scams as deceptive marketing tactics and warned about exploitation of leaked personal information.
Read article ↗Simon Smith gave expert commentary on payee confirmation laws and on bank customer education measures in response to the ACCC Targeting Scams figures.
Read article ↗Simon Smith argued for payee verification, blocking of B2B-only account transfers and IP location tracking as simple bank interventions that would prevent the bulk of the scam transfers he sees across his casework.
Read article ↗Simon Smith documented Australian victim losses of up to 850,000 dollars from elaborate pig butchering scams.
Read article ↗Simon Smith assisted the victim with AFCA complaint preparation and cybercrime investigation support.
Read article ↗Simon Smith warned about the accessibility of large scale SIM box equipment and its implications for telecommunications enabled fraud.
Read article ↗Simon Smith characterised WhatsApp Hi Mum style scams as becoming a daily occurrence for Australian households.
Read article ↗Simon Smith advocated for universal licence replacement and a centralised protection system for affected identity documents.
Read article ↗Simon Smith estimated potential aggregate losses based on interviews with approximately 50 victims of the alleged travel agent fraud.
Read article ↗Simon Smith spoke about gathering technical evidence to assist Australian and international law enforcement in romance scam matters.
Read article ↗Simon Smith appears in the 7NEWS Spotlight scam investigation assisting the news team in stopping a live cyber scam in action. Undated archival video file.
Read article ↗Primary source for verification: SCAMAssist media index at scamassist.com.au/media.asp. Where an outlet is paywalled or the fetch layer is blocked, dates are inferred from secondary references and flagged accordingly. Additional items under review.
Simon Smith has appeared on Australian television, radio and podcast outlets, including Sky News, the Nine Network (Today, Today Extra, A Current Affair), the Seven Network, the Ten Network, the ABC, SBS and on Australian radio. Commentary is given independently and without any retainer from a prosecuting agency. All statistics quoted in interviews are attributed to the regulator publishing them contemporaneously.
Media enquiries are received on 0410 643 121 or by email. Matters that are sub judice, or where a conflict exists with an active instruction, are declined. On-background briefings are considered where they would not prejudice a current engagement.
A curated set of accordions linking directly to the Australian authorities, expert witness codes of conduct, court rules and practice notes that arise most often in briefs relating to cybercrime, digital forensic evidence and data breach matters. Links go to the primary source. No intermediaries.
Primary Australian authorities routinely cited in this practice:
Primary expert witness codes of conduct that are most frequently annexed or applied in expert reports prepared by this practice:
A consolidated authoritative reference for instructing solicitors. Each entry links to the primary source. Coverage is grouped by jurisdiction and by legislative framework.
To brief the practice, please complete the Case Review form below. A conflict check will be completed before substantive discussion, and counsel may request a joint conference with the instructing solicitor following the conflict check.
Short commentary posts from the practice. Expert voice on practice notes, mobile and cell site evidence, encrypted messaging attribution, CAM, CSAM and CEM classification, data breach class actions and the economics of scams in Australia. Each post cites only primary Australian sources.
A brief should do more than ask whether the expert can take the matter. Before a conflict check and a scope letter go out, the instructing solicitor can save the client and the court significant time by asking a handful of direct questions that clarify what the expert can and cannot do on the evidence as it stands.
I always welcome the question of whether the proposed scope is defensible on the material disclosed. If the Crown brief is a Cellebrite UFDR export, ask whether the export is the full extraction or a filtered case report. If it is filtered, a request for the full extraction usually follows so the defence expert can audit deleted records, carved artefacts and cached thumbnails that a filtered report will not disclose. The same principle applies to a Magnet Axiom case file, to an X-Ways evidence report and to a Splunk export of cloud audit logs.
The next question worth asking is whether the expert has a real working familiarity with the tool the Crown has used, including its version at the time of examination. Tool versions matter because parser logic moves between releases. An older Physical Analyzer build will not recover the same artefacts as a newer one, and a decision based on an older build may read differently when re-examined today. A credible defence expert will state on the record the exact versions used for every step of the analysis and will not be troubled by the opposing expert stating theirs.
It is also fair to ask the expert what they will not say. If a forensic tool reports that a file was present on a device at a particular timestamp, the file and the timestamp are facts the tool asserts; attribution of that file to the accused as a matter of user conduct is a separate question that requires corroborating evidence. An expert who is clear about this distinction at the briefing stage will be clear about it in the report. The converse is also true: an expert who promises certainty on attribution before the evidence has been seen is the wrong expert.
Finally, confirm early that the expert understands the applicable Expert Witness Code of Conduct in the jurisdiction, that they will sign the appropriate declaration and that they are available for a conference of experts if one is ordered. These are small administrative questions at the briefing stage that avoid embarrassment later. If the answers are clear and the expert is comfortable with all of them, the letter of instruction is usually a formality.
Over the last year the higher courts in Australia have begun to settle on consistent language about the use of generative artificial intelligence in court documents and expert reports. The position is no longer abstract. It is now in practice notes that defence counsel and solicitors are required to read and apply.
The New South Wales Supreme Court has issued Practice Note SC Gen 23 on the Use of Generative Artificial Intelligence, which commenced on 3 February 2025 and was updated on 28 January 2025 (supremecourt.nsw.gov.au SC Gen 23 PDF). The operative paragraphs for an expert report are clear. Generative AI must not be used to draft or prepare the content of an expert report without prior leave of the court. This is the cleanest statement of the position in the national case load. An expert writing for a NSW matter needs to be ready to state on the record that no generative AI was used to draft the opinions in the report.
The Supreme Court of Victoria took a slightly different path. Rather than issuing a binding practice note in the first instance, the court released Guidelines for Litigants: Responsible Use of Artificial Intelligence in Litigation on 6 May 2024 (supremecourt.vic.gov.au AI guidelines). The guidelines set transparency and disclosure expectations and emphasise that the responsible legal practitioner must exercise independent judgment and professional skill in reviewing any final product. The Federal Court of Australia addresses the same territory through its Technology and the Court Practice Note GPN-TECH, which governs how technology is used in preparing court documents (fedcourt.gov.au GPN-TECH).
The practical consequence for expert reports is twofold. First, the opinion in the report must be the expert's own opinion, arrived at by the expert's own reasoning from the evidence, not a generative model's synthesis. Second, the reasoning steps in the report must be transparent enough that the tribunal can follow them. That is a good discipline in any event and sits comfortably with the Harmonised Expert Witness Code of Conduct annexed to the Federal Court's Expert Evidence Practice Note GPN-EXPT (fedcourt.gov.au GPN-EXPT).
My position is that the court is right to treat this carefully. An expert report is not a forum for a model to generate plausible text. The court has a duty to be assisted by the human expert, and the human expert has a duty to say what the evidence supports. Solicitors briefing experts should add one line to the letter of instruction confirming that the expert will comply with the applicable generative AI practice note or guideline. It takes thirty seconds and removes an entire category of objection.
Cell site analysis has become a cornerstone of many Australian criminal matters where a mobile device is the only consistent witness. It is also one of the most commonly overstated categories of forensic evidence in a Crown case. A defence expert who takes the time to read the subpoena material and the network topology carefully can usually offer the tribunal a much more conservative and defensible interpretation of what the records show.
The first thing to understand is that a Call Data Record is not a location. A CDR row typically records the originating and terminating identifiers, start time, duration, called number, serving cell identifier at connection and sometimes at disconnection. The serving cell is a sector on a tower, not a point on a map. The footprint of that sector is a function of azimuth, downtilt, horizontal beam width, transmit power, terrain, building density, weather and handset model. Cells breathe. The boundary between two cells moves with load and with interference. A defendant who was demonstrably in one part of a city can still plausibly have connected to the same sector that is being put up as proof they were elsewhere.
Timing advance and round trip time measurements add a coarse radial constraint. They are useful context. They are not a pin. Depending on the radio technology and the network configuration, a timing advance value can map to a distance range, and that range is measured in hundreds of metres rather than the metres a pin on a map might suggest. Event-Based Metadata records, where produced, include handovers and location updates that can add a richer pattern of likely movement, but still only a likely pattern.
Defence expert work on cell site evidence therefore tends to focus on three questions. First, what does the record actually say and was it produced correctly. Second, how ambiguous is the serving sector at the times of interest given the network and environment. Third, is a drive test or scanner survey available or worth carrying out to ground truth the claimed coverage. A well prepared defence expert report will set out each of these with appropriate caveats and will not overstate what a CDR row supports.
For the instructing solicitor the takeaway is simple. Read the Crown expert's report against the actual production from the telco. If a CDR row is being treated as a location point, that is a point of cross-examination. The Australian Signals Directorate and its Australian Cyber Security Centre publish general guidance that is useful background on why technical signals are ambiguous unless corroborated (cyber.gov.au). The rule is the same in the courtroom as in the laboratory. Do not over claim what the artefact supports.
One of the first questions in a modern criminal defence brief is what sort of extraction the Crown has relied on. The answer changes what the tribunal can take from the evidence. The three broad categories are logical, full file system and physical, and each has different evidential reach.
A logical extraction asks the phone, politely, for the content of the apps and data that the phone's operating system is willing to produce over the vendor protocol. On a modern iPhone or a modern Android handset, that is usually a subset of messages, call logs, photos, some app databases and metadata. A logical extraction is the least invasive option and the most commonly available. It is a reasonable starting point for many matters but it is not a complete picture. Artefacts that the operating system does not expose through the vendor protocol simply do not appear.
A full file system extraction goes deeper. It pulls all of the user and application data that the operating system allows a privileged process to read, including application caches, databases, SQLite stores, keychains where accessible, deleted records still held in WAL files and some system artefacts. On recent iPhones this is typically obtained via Cellebrite Inseyets or Magnet Graykey with vendor specific unlock support. On Android handsets it is typically obtained via chip specific exploits or manufacturer cooperation. The analytical difference is large. Deleted messages, cached images and fragmentary records often live in the full file system that do not appear in a logical extraction.
A physical extraction is an image of the whole non volatile storage of the device, including unallocated space. Modern handsets with strong hardware encryption make a meaningful physical extraction difficult or impossible unless the device is already unlocked. Older handsets still permit physical extraction. Where a physical extraction is available, artefacts that survive across wipes and factory resets can sometimes be recovered, though the analytical certainty about when a given artefact was created reduces as the recovery moves into carved and unallocated space.
For the instructing solicitor the practical question to ask the expert is what extraction level has been produced, what the tool version is, and what categories of artefact are therefore in or out of scope. A lot of defence argument on the reliability of mobile evidence rests on being clear about this at the start of the engagement rather than at committal.
Encrypted messaging attribution is not a solved problem in Australian courts. The ANOM prosecutions under Operation Ironside have now produced extensive appellate law on admissibility, culminating in the High Court decision in CD v Commonwealth [2025] HCA 37 (auspublaw.org analysis). Admissibility, however, is only part of the picture. Attribution of an account on an encrypted platform to a particular human being is a separate evidentiary question, and it is where a careful defence expert can often add the most value.
Platforms such as Signal, Threema and WhatsApp have different architectures and different evidential footprints. Signal leaves very little server side material, and what is accessible on a seized device is usually limited to what is decrypted into the local database at the time of the examination. Threema does not require a phone number and emphasises an identifier per device. WhatsApp relies on a phone number and retains server side metadata about routing and delivery, even though message content is end to end encrypted. ANOM, by contrast, was itself operated as a law enforcement platform and produced an export of messages as part of the investigation, with all the evidentiary consequences now worked through in the appellate line.
Attribution in every one of these cases has to do three things. First, it has to tie the account or the handle to a device. Second, it has to tie the device to a person at the material times. Third, it has to tie the person to the conduct in issue. Each of those steps can fail in practice. A phone can be shared. A handle can be handed over. A device can be imaged and then operated by a second person. Whether the device was configured with biometrics or with a passcode only, whether it was ever left with a partner or a colleague, whether the metadata of the message aligns with other records of the person's movement, all of it matters.
The authoritative technical baseline for this work sits with the Australian Signals Directorate and its Australian Cyber Security Centre (cyber.gov.au). The statutory context lies in Part 10.7 of the Criminal Code Act 1995 (Cth) (legislation.gov.au) and, where relevant, the Telecommunications (Interception and Access) Act 1979 (Cth) (TIA Act).
My view, as the independent defence expert, is that attribution based on a single artefact is rarely enough. If the Crown case rests on one exported message tied to a handle, that is a point of cross examination rather than proof. A careful defence report sets out what the exports reliably show, what inference can be drawn, and what inference cannot. That discipline is the same across all encrypted messenger platforms and their material.
Child abuse material possession and transmission cases under Divisions 474 and 473 of the Criminal Code Act 1995 (Cth) (legislation.gov.au) are among the most technically exacting defence briefs. They require the expert to think carefully about three things that are often conflated in a Crown summary: classification, recovery state and attribution.
Classification typically comes out of a tool such as Magnet Axiom Case Exemption Management or the Project VIC tagging workflow. A PhotoDNA hash match tells the tribunal that the file is highly likely to be a known item in a hash database. It does not tell the tribunal when the file appeared on the device, how it got there or whether the person in possession knew it was there. A defence report must separate the classification claim from the attribution claim.
Recovery state is the second axis. A file recovered from an allocated user folder reads very differently to a file recovered from a browser cache, a thumbnail database or unallocated space. Thumbnail caches are generated automatically by the operating system. Browser caches reflect content the browser was forced to render because a page loaded it, not always content the user sought. Carved files from unallocated space rarely carry reliable metadata about when they were present on the device. Every case spreadsheet the Crown relies on should be audited for the recovery state of each artefact, not just for its classification.
Attribution is the third axis. A file on a shared device is not proof of possession by a particular user unless the user account, activity logs and associated artefacts corroborate the presence. Windows user profile separation, Android multi user support, iOS single user assumptions, and household network context all change what an attribution conclusion can properly support. The defence expert's job is to state what the artefacts do and do not support on attribution, with careful language.
A final technical point worth making is that Axiom case spreadsheets are defensible only if the full case file is preserved. If only a filtered export is disclosed, the defence expert will usually ask for the whole case file so the classification choices and the recovery state of each artefact can be examined independently. That request is normal and should not be treated as controversial.
Australian data breach litigation is now a distinct category of civil work with its own cadence. The large breaches since 2022, Optus, Medibank, Latitude and MediSecure among them, have each produced separate proceedings in the Federal Court under several plaintiff firms. The regulatory arm runs in parallel through the Office of the Australian Information Commissioner and the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth) (legislation.gov.au Privacy Act 1988).
The Privacy Commissioner publishes that a data breach happens when personal information is accessed or disclosed without authorisation or is lost, and that covered organisations must notify affected individuals and the OAIC where serious harm is likely (oaic.gov.au NDB scheme). The statutory 30 day assessment window is where the forensic work matters most. An entity that cannot reconstruct its own timeline, or that cannot scope the categories of personal information affected, will be in a weak position when the regulator or a class action plaintiff seeks to test the adequacy of the response.
From an expert perspective, the most useful contribution in this space is a clean technical timeline that separates what the logs actually show from what hypothesis the plaintiff or the regulator is proposing. The Office of the Australian Information Commissioner notes that for the second half of 2024 it received 595 notifications, up 15 percent on the prior six months, with health providers at roughly 22 percent of notifications (oaic.gov.au NDB Jul to Dec 2024 report). Ransomware incidents accounted for approximately 24 percent of cyber incidents in that period. Those are the numbers that belong in an affidavit, not numbers I or anyone else invent.
On the class action side, instructing solicitors should engage an expert early. The lead plaintiff firms on the major Australian matters include Maurice Blackburn for Optus (mauriceblackburn.com.au), Baker McKenzie for the consolidated Medibank proceeding (following consolidation on 1 August 2023) and Gordon Legal for Latitude (gordonlegal.com.au). The work the expert does to preserve provenance of the disclosed data and the chain of custody of the imaged media is the work the tribunal will eventually rely on.
For defendant entities the message is similar. Keep the regulatory response and the forensic reconstruction on parallel tracks from day one. The 30 day clock does not stop while counsel and the forensic team argue about who owns which document.
The Australian Competition and Consumer Commission publishes Targeting Scams annually, reporting what the combined reporting agencies see. For 2023 the ACCC reported combined losses of approximately 2.74 billion dollars, a 13.1 percent decline on 2022 (accc.gov.au media release). Investment scams were 1.3 billion dollars, remote access scams were around 256 million dollars and romance scams were 201.1 million dollars. Those are the figures that belong in an expert report and they are the only figures I quote in the investment and romance scam work I have done.
What the numbers say about the underlying conduct is more interesting than the headline. Investment scams are expensive because the average loss per victim is high. Remote access scams are expensive because the victim believes they are being helped by a legitimate voice. Romance scams are expensive because the grooming phase is long. In forensic terms each of those categories has a different evidential footprint. Investment scams leave a chain of wallets and off ramps. Remote access scams leave a chain of sessions, tools and screenshots. Romance scams leave a chain of messages across multiple platforms. The expert's job in a civil recovery matter is to reconstruct that chain cleanly and to tie it to a point where a bank or an exchange can respond.
Complaints about financial services arising from these scams are channelled through the Australian Financial Complaints Authority (afca.org.au) and, where corporate conduct is engaged, through the Australian Securities and Investments Commission (asic.gov.au). Scamwatch, under the National Anti-Scam Centre, publishes an ongoing view of the consumer facing reporting (scamwatch.gov.au).
From a defence expert perspective the category that most often surfaces in criminal matters is business email compromise. The ASD Cyber Threat Report 2022 to 2023 put the Australian losses from business email compromise in 2021 to 2022 at over 98 million dollars with an average reported loss of roughly 64 000 dollars (cyber.gov.au). Those are the figures I quote when asked and they are the figures I stand on. Everything else is narrative, and narrative is for counsel, not for the expert.
A curated reference list of high profile Australian cybercrime and data breach matters, with authoritative source links for instructing solicitors. The practice does not act for the prosecution in any of these matters.
Reported unauthorised access to approximately 9.8 million customer records, leading to regulatory and civil proceedings under the Privacy Act 1988 and the Telecommunications Act 1997.
Reported compromise of approximately 9.7 million customer records. Served as a reference point for expectations of the NDB scheme and for boards considering cyber insurance, ransom payments and containment.
Reported exfiltration affecting approximately 14 million records, highlighting issues of third party identity document retention and cross border data handling.
Reported ransomware and personal information incident affecting millions of Australian electronic prescription records.
Reported third party data breach affecting sensitive Victorian patient records through a service provider, with consequences for the Privacy Act 1988 and the Health Records Act 2001 (Vic) (Health Records Act 2001 (Vic)).
Historic international law enforcement operation giving rise to Australian prosecutions in multiple jurisdictions. Extensive case law on admissibility now exists. Defence work in this area is accepted at Official Intelligence Pty Ltd.
Invoice redirection and CEO fraud continue to generate a significant portion of defence and plaintiff side instruction volume. Scamwatch reporting is the primary public source of rolling figures (scamwatch.gov.au).
The Cyber Security Act 2024 (Cth) introduced a national ransomware incident reporting obligation for certain entities. Reference: Cyber Security Act 2024 (Cth).
Two further channels led by Simon Smith, referenced here for transparency. Official Intelligence Pty Ltd remains the professional expert witness channel for instructing solicitors and counsel.
SCAMAssist is the consumer-facing victim assistance operation run under Official Intelligence Pty Ltd, covering cybercrime investigation, AFCA advocacy for financial product disputes, asset recovery support, data breach investigations and scam investigations with free case review. Official Intelligence Pty Ltd remains the professional expert witness channel; SCAMAssist is the consumer-facing channel.
Visit SCAMAssistAustralia's professional institute for cyber security. Accredited courses, chartered membership, MAICS GAICS FAICS designations. Simon Smith is the founder and Chief Executive Officer, and sits as the accreditation authority for the institute's programs.
Visit AICSOfficial Intelligence Pty Ltd is the professional expert witness channel. Instructions on digital forensic and cybercrime defence matters are accepted from solicitors and counsel. Begin with the Case Review form on this page.
Top of pageProvide sufficient detail for Official Intelligence to assess urgency, jurisdiction, and the nature of the assistance sought before responding.
Outline the nature of the matter, the party or firm involved, the jurisdiction, any hearing or expert report deadlines, and the type of assistance sought. For sensitive or time-critical matters, email [email protected] directly rather than using the web form.
A plain English glossary of cybersecurity, cybercrime and digital forensic terminology, prepared for Australian civil and criminal proceedings and restated in Australian usage for clarity. Anchor links are provided against each term so that counsel can cite a specific definition directly.
For any term that requires a formal statutory definition, the relevant Act or instrument should be consulted.
