Related sites and profiles www.ofi.com.au www.cybersecurity.com.au www.scamassist.com.au www.expertwitness.com.au www.simonsmith.com.au LinkedIn Services Official Intelligence provides digital forensic, cybersecurity, and

Scope of work. Independent expert analysis and report preparation on disputed digital evidence, computer and software disputes, cybercrime allegations, electronic fraud, mobile device forensics, network logs, cloud artefacts and encrypted messaging content. Work is carried out to the standard required by the Expert Witness Code of Conduct applicable in the relevant jurisdiction. Typical deliverables. Written expert report compliant with the applicable Expert Evidence Practice Note, supplementary or responsive reports, joint reports from conferences of experts where ordered, hash verified forensic images and affidavits of authenticity, and oral evidence in committal, interlocutory and trial hearings. Engagement stages.

Cybersecurity Investigations

Scope of work. Structured technical investigation of suspected unauthorised access, insider misuse, credential abuse and control failures. Methods are aligned with guidance published by the Australian Cyber Security Centre on managing cyber security incidents. Typical deliverables. Chain of custody register, forensic images and triage packages, timeline of attacker and internal user behaviour, scoping memorandum of confirmed and unconfirmed compromise, control gap recommendations, and a written investigation report signed by Simon Smith. Engagement stages. Intake and conflict check, emergency preservation direction, endpoint and log acquisition, analysis, scoping findings, draft report, client feedback, and final report. Where litigation is contemplated the work is conducted on a litigation hold footing from day one. Turnaround.

Data breach and cyber attack services

Scope of work. Forensic response to ransomware, credential compromise, business email compromise, invoice fraud and unauthorised exfiltration of personal information. Assessment work supports obligations under the Privacy Act 1988 and the Notifiable Data Breaches scheme. Typical deliverables. Forensic preservation of compromised hosts and mailboxes, technical scoping of affected personal information, written assessment supporting the statutory timeframe under the NDB scheme, incident timeline, and containment and remediation recommendations. Engagement stages. Intake and conflict check, issue of a legal hold, forensic acquisition, triage and initial scoping, full scoping and attribution analysis where feasible, draft assessment, review with legal counsel, and final documented assessment with technical appendices. Turnaround. Urgent preservation work commences within 24 hours.

Cyber stalking and IP tracing investigations

Scope of work. Evidence focused investigation of online stalking, doxxing, impersonation, and image based abuse. IP addresses, account metadata, platform audit logs and carrier records are reviewed, with attribution evidence preserved in a form suitable for personal safety intervention orders, civil proceedings, eSafety Commissioner complaints, and requests to platforms and telecommunications carriers. Typical deliverables. Exhibit packs comprising captured source material with cryptographic hashes, written attribution analysis, carrier and platform request letters drafted for counsel, and affidavit ready technical statements. Engagement stages. Safety first intake, preservation of volatile content, platform and carrier request preparation, forensic attribution analysis, draft report, review, and production of a final report suitable for filing as exhibits. Turnaround.

Scam investigations and assistance

Scope of work. Evidence preservation and recovery assistance for investment scams, romance scams, invoice redirection, remote access fraud and cryptocurrency theft. Reporting to Scamwatch, disputes with financial institutions and escalation to the Australian Financial Complaints Authority are handled with supporting technical documentation. Typical deliverables. Evidence dossier with hashed exhibits, cryptocurrency wallet mapping where relevant, draft dispute letters to banks and payment providers, draft AFCA complaint framing, and signed technical summary suitable for civil proceedings. Engagement stages. Intake and conflict check, evidence preservation, scam typology and attribution analysis, bank dispute drafting, AFCA framing, and closure pack for the client. Turnaround. Urgent evidence preservation within 24 to 72 hours. Written scam dossier typically within 1 to 4 weeks.

Free preliminary case review

Scope of work. A structured preliminary conversation to identify urgent evidence preservation steps, clarify timelines, and scope the forensic or expert work required. Offered without obligation. Findings from the review are documented briefly in writing and are not themselves expert evidence. Typical deliverables. Written case review note summarising relevant facts, urgent preservation recommendations, scope options, and an indicative fee range for any subsequent engagement. Engagement stages. Enquiry, conflict check, scheduled call, short written note, optional follow up scoping meeting. Turnaround. Preliminary review note typically delivered within 3 to 5 business days of the conversation. Who the service suits. Law firms considering whether a forensic or expert engagement is warranted, and private parties considering whether to instruct an expert. Referral sources.

Scam losses in Australia

The ACCC reports in Targeting Scams: report of the ACCC on scams activity 2023 that Australians lost approximately 2.74 billion dollars to reported scams in 2023, a 13.1 percent decline on 2022 ( accc.gov.au media release ; full report at Targeting Scams 2023 PDF ). I am routinely retained by defence counsel to provide independent opinion on the digital evidence arising from scam related matters, including the origin and control of the accounts involved and the reliability of attribution. To instruct on a matter of this kind, please complete the Case Review form on this page.

The same ACCC Targeting Scams 2023 report records 1.3 billion dollars in reported investment scam losses in 2023, the largest category of scam losses ( accc.gov.au ). Consumer facing guidance is published by ASIC Moneysmart ( moneysmart.gov.au ). I am routinely retained by defence counsel to provide independent opinion on the technical provenance of investment scam platforms, wallet custody, and the reliability of funds flow evidence. To instruct on a matter of this kind, please complete the Case Review form on this page.

The ACCC Targeting Scams 2023 report records 201.1 million dollars in reported romance scam losses in 2023 ( accc.gov.au ). I am routinely retained by defence counsel to provide independent opinion in matters where disputed romance scam facts intersect with civil recovery proceedings, bank dispute evidence, or criminal charges framed around facilitation conduct. To instruct on a matter of this kind, please complete the Case Review form on this page.

Cryptocurrency tracing and crypto scams

The ACCC Targeting Scams 2023 report records approximately 256 million dollars in reported losses from remote access scams in 2023, a category closely linked to cryptocurrency extraction from victims ( accc.gov.au ). I am routinely retained by defence counsel to provide independent opinion on on chain tracing, wallet cluster attribution, and the limits of attribution to a natural person. To instruct on a matter of this kind, please complete the Case Review form on this page.

Business email compromise and invoice redirection

The ASD Cyber Threat Report 2022 to 2023 records that business email compromise continued to be a significant category of reported cybercrime affecting Australian businesses, with self reported financial losses in 2021 to 2022 exceeding 98 million dollars and an average reported loss of approximately 64 000 dollars per incident ( cyber.gov.au Cyber Threat Report 2022 to 2023 ; subsequent Annual Cyber Threat Reports continue the series at 2023 to 2024 ). I am routinely retained by defence counsel to provide independent opinion on email header analysis, authentication failure, mailbox rule abuse and session token replay in BEC matters. To instruct on a matter of this kind, please complete the Case Review form on this page.

Data breaches and the OAIC NDB scheme annual trends

The OAIC Notifiable Data Breaches Report for July to December 2024 records 595 data breach notifications, a 15 percent increase on the prior six months, and 1 113 notifications for calendar 2024 in total, the highest annual number since the scheme began. The health sector accounted for approximately 22 percent of notifications ( oaic.gov.au NDB report July to December 2024 ). I am routinely retained by defence counsel to provide independent technical opinion supporting a regulated entity's NDB assessment under Part IIIC of the Privacy Act 1988. To instruct on a matter of this kind, please complete the Case Review form on this page.

Cyberstalking and technology facilitated abuse

The eSafety Commissioner has published that approximately one in two Australians have experienced technology facilitated abuse at some point in their lifetime, with domestic violence research finding that more than one quarter of domestic violence cases involve technology facilitated abuse of children ( esafety.gov.au research ; eSafety media release ). I am routinely retained by defence counsel to provide independent opinion on attribution and preservation of digital evidence in family law, personal safety intervention order and civil proceedings arising from technology facilitated abuse. To instruct on a matter of this kind, please complete the Case Review form on this page.

Unauthorised access to computer systems (s 477.1 Criminal Code Act 1995 (Cth))

Section 477.1 of the Criminal Code Act 1995 (Cth) captures unauthorised access, modification or impairment with intent to commit a serious offence ( legislation.gov.au ). The Australian Institute of Criminology Cybercrime in Australia 2024 report records that nearly half of surveyed respondents reported being a victim of at least one type of cybercrime in the prior 12 months, indicating a continuing body of offending conduct of the kind addressed by Part 10.7 ( aic.gov.au Cybercrime in Australia 2024 ). I am routinely retained by defence counsel to provide independent opinion on authentication logs, IP attribution and device attribution in unauthorised access matters. To instruct on a matter of this kind, please complete the Case Review form on this page.

Unauthorised modification of data (s 477.2 Criminal Code Act 1995 (Cth))

Section 477.2 of the Criminal Code Act 1995 (Cth) captures unauthorised modification of data causing impairment ( legislation.gov.au ). The ASD Annual Cyber Threat Report 2023 to 2024 records a substantial body of reported cybercrime incidents involving malicious modification of data across Australian networks ( cyber.gov.au ). I am routinely retained by defence counsel to provide independent opinion on forensic images, hash validation and proper attribution of the modification in s 477.2 matters. To instruct on a matter of this kind, please complete the Case Review form on this page.

Use of a carriage service to menace, harass or cause offence (s 474.17)

Section 474.17 of the Criminal Code Act 1995 (Cth) prohibits use of a carriage service in a way that reasonable persons would regard as menacing, harassing or offensive ( legislation.gov.au ). eSafety research indicates the prevalence of technology facilitated abuse in Australia is approximately one in two adults over a lifetime ( esafety.gov.au research ). I am routinely retained by defence counsel to provide independent opinion on account attribution, device custody at the relevant time and whether the content engages the statutory standard. To instruct on a matter of this kind, please complete the Case Review form on this page.

Child sexual abuse material offences (Division 474 and Division 473)

Divisions 474 and 473 of the Criminal Code Act 1995 (Cth) contain the principal Commonwealth CSAM offences, including offences in sections 474.19 to 474.24 ( legislation.gov.au ). Oversight of the broader online safety framework is conducted by the eSafety Commissioner under the Online Safety Act 2021 ( legislation.gov.au ; esafety.gov.au ). I am routinely retained by defence counsel to provide independent opinion on hash matching reliability, the provenance and timing of disputed files, tool version validity and the limits of attribution to a natural person. To instruct on a matter of this kind, please complete the Case Review form on this page.

False documents and identity fraud

Division 145 and Division 372 of the Criminal Code Act 1995 (Cth) address false and misleading information offences and identity crime offences ( legislation.gov.au ). The Australian Institute of Criminology Cybercrime in Australia 2024 report records that approximately 21.9 percent of surveyed respondents had been a victim of identity crime and misuse in the prior 12 months ( aic.gov.au ). I am routinely retained by defence counsel to provide independent opinion on document metadata, device attribution and session evidence in false document and identity crime matters. To instruct on a matter of this kind, please complete the Case Review form on this page.

Ransomware and extortion incidents

The OAIC NDB report for July to December 2024 records that malicious or criminal attacks accounted for approximately 69 percent of breaches, with ransomware representing approximately 24 percent of cyber incidents within that subset ( oaic.gov.au NDB July to December 2024 ). Separately, the Cyber Security Act 2024 (Cth) introduced national ransomware incident reporting obligations for certain entities ( legislation.gov.au ). I am routinely retained by defence counsel to provide independent opinion in ransomware matters, including scoping of exfiltration, validation of decryption claims, and technical support for the NDB assessment. To instruct on a matter of this kind, please complete the Case Review form on this page.

ANOM and encrypted platform evidence challenges

The High Court decision in CD v Commonwealth [2025] HCA 37 confirms the framework within which evidence derived from the ANOM platform is now admitted in Australian prosecutions ( auspublaw.org ). Defence analysis of R v TB and CD (SA) is available at egreaves.com.au . I am routinely retained by defence counsel to provide independent opinion on the reliability of exports from ANOM and other encrypted platforms, the structure of disclosed datasets, and the proper attribution of individual accounts or handles to a natural person. To instruct on a matter of this kind, please complete the Case Review form on this page.

Federal Court of Australia

The Federal Court of Australia regularly hears intellectual property, copyright, anti-piracy and trade mark proceedings involving digital evidence, as well as matters under the Corporations Act 2001 and proceedings brought by regulators such as the Australian Competition and Consumer Commission and the Australian Securities and Investments Commission. Expert evidence in that forum is prepared under the Expert Evidence Practice Note GPN-EXPT and the Harmonised Expert Witness Code of Conduct annexed to it ( https://www.fedcourt.gov.au/law-and-practice/practice-documents/practice-notes/gpn-expt ). Work typically involves software source code examination, network traffic analysis, domain and hosting attribution, cryptocurrency tracing and examination of platform logs.

Federal Circuit and Family Court of Australia

Family law matters frequently raise questions about monitoring software, covert location tracking, image based abuse and unauthorised access to email and social media accounts. Reports in this forum focus on the technical examination and its limits. Privacy handling is carried out consistently with the Australian Privacy Principles annexed to the Privacy Act 1988 ( https://www.legislation.gov.au/C2004A03712/latest/text ).

Supreme Court of Victoria

Cybercrime matters on indictment, complex computer misuse allegations, and civil proceedings arising from serious data breaches are seen in the Supreme Court of Victoria. Expert reports are prepared in accordance with Part 4.6 of the Evidence Act 2008 (Vic) and the Court's Expert Witness Code of Conduct, Form 44A of the Supreme Court (General Civil Procedure) Rules 2015 (Vic) ( https://content.legislation.vic.gov.au/sites/default/files/2023-12/15-103sra029%20authorised.pdf ).

County Court of Victoria

The County Court of Victoria hears a significant number of indictable Commonwealth cybercrime matters, including offences under Part 10.7 of the Criminal Code Act 1995 (Cth) ( https://www.legislation.gov.au/Series/C2004A04868 ), and related Commonwealth carriage service offences. Defence engagements often focus on the reliability of digital forensic tools, validation of hash comparison evidence and the proper attribution of user activity.

Magistrates' Court of Victoria

Summary matters, personal safety intervention order hearings and committal proceedings in the Magistrates' Court of Victoria often involve digital exhibits taken from mobile devices, CCTV, and social media. Expert evidence is provided on the authenticity, timing and attribution of that material.

New South Wales courts

The Supreme Court of New South Wales and the District Court of New South Wales hear cybercrime matters on indictment, including charges under the Crimes Act 1900 (NSW) Part 6 and Commonwealth Code offences. Expert reports are prepared consistently with Schedule 7 of the Uniform Civil Procedure Rules 2005 (NSW), the Expert Witness Code of Conduct ( https://legislation.nsw.gov.au/view/html/inforce/current/sl-2005-0418#sch.7 ).

Indictable matters in the Supreme Court of Queensland and the District Court of Queensland frequently involve telecommunications evidence, call data records and encrypted messaging. Expert evidence follows the Uniform Civil Procedure Rules 1999 (Qld) Part 5 Division 2 and the Court's expert evidence requirements ( https://www.legislation.qld.gov.au/view/html/inforce/current/sl-1999-0111 ).

South Australian courts

The Supreme Court of South Australia and the District Court of South Australia hear cyber enabled indictable matters. Reports are aligned with the Uniform Civil Rules 2020 (SA) ( https://www.courts.sa.gov.au/rules-and-forms/uniform-civil-rules-2020/ ).

Western Australian courts

The Supreme Court of Western Australia and the District Court of Western Australia receive expert digital forensic evidence in matters that commonly include allegations under the Criminal Code Compilation Act 1913 (WA) and Commonwealth offences. Rules of Court for expert evidence are set out in Order 36A of the Rules of the Supreme Court 1971 (WA).

The Supreme Court of Tasmania and the Magistrates Court of Tasmania receive evidence in matters involving computer misuse and telecommunications evidence. Reports address mobile device forensics and preservation of exhibits at a standard suitable for indictable trial.

Australian Capital Territory courts

The Supreme Court of the Australian Capital Territory and the Magistrates Court of the Australian Capital Territory hear matters that often sit at the intersection of Commonwealth regulatory conduct and local offending, where digital evidence is central.

Northern Territory courts

Matters in the Supreme Court of the Northern Territory and the Local Court of the Northern Territory commonly involve mobile device evidence, remote access fraud, and assistance interpreting call data records.

The High Court of New Zealand and the District Court of New Zealand receive cross-border expert evidence on digital forensics. Reports follow Schedule 4 of the High Court Rules 2016 Code of Conduct for Expert Witnesses ( https://www.legislation.govt.nz/regulation/public/2016/0225/latest/whole.html ).

Cloud and SaaS platforms retain sign in logs, mailbox audit entries, file access records, administrative changes and API logs. Retention periods vary by vendor and licence tier. Requests for data through legal process or authorised user consent are produced in formats that must be parsed and validated before any inference is drawn.

Cryptocurrency tracing

Tracing of Bitcoin and other on chain asset movements uses publicly available ledgers and, where instructed, commercial analytics. Wallets are mapped to clusters by address reuse, spending behaviour and known service counterparties. Attribution to a person is a separate exercise from attribution to a wallet cluster.

Open source intelligence artefacts include public social media posts, WHOIS records, certificate transparency entries, public Git history, archived pages, and breach listings. Captured artefacts are hashed and preserved with capture date, capture tool and the URL at capture. Inferences drawn from OSINT are always supported by more than one independent observation where available.

Email and business email compromise

Email evidence is examined at the level of headers, authentication results (SPF, DKIM and DMARC), audit logs from the mailbox provider, and supporting network telemetry. Business email compromise matters often involve credential stuffing, session token replay or forwarding rule abuse.

Wearables and telematics

Smart watches, fitness trackers and vehicle telematics systems retain location, motion and device interaction records. Retention and granularity varies between vendors. Reports describe the retention policy published by the vendor at the time of examination and note where a figure is an estimate rather than a directly observed value.

Commonwealth: Part 10.7 of the Criminal Code Act 1995 (Cth)

Part 10.7 of the Criminal Code Act 1995 (Cth) contains the principal Commonwealth computer offences, including serious computer offences, unauthorised access to or modification of restricted data, unauthorised impairment of electronic communications, and possession or control of data with intent to commit a serious computer offence. The full text is maintained at the Federal Register of Legislation ( https://www.legislation.gov.au/Series/C2004A04868 ). Key sections routinely instructed include: Section 477.1: unauthorised access, modification or impairment with intent to commit a serious offence. Section 477.2: unauthorised modification of data to cause impairment. Section 477.3: unauthorised impairment of electronic communication. Section 478.1: unauthorised access to, or modification of, restricted data.

Commonwealth: Part 10.6 carriage service offences

Part 10.6 of the Criminal Code Act 1995 (Cth) covers telecommunications and carriage service offences, which often accompany a computer misuse charge. The most frequently instructed section is 474.17, which concerns use of a carriage service to menace, harass or cause offence. Offences relating to child abuse material and child exploitation material appear in sections 474.19 to 474.24 and in related provisions.

Commonwealth: Telecommunications (Interception and Access) Act 1979

The Telecommunications (Interception and Access) Act 1979 (Cth) sets out the framework for lawful interception and access to stored communications, as well as the preservation regime for carrier held data ( https://www.legislation.gov.au/Series/C2004A02124 ). It is routinely considered in cybercrime matters where interception warrants or stored communications warrants are relied on by the prosecution.

Commonwealth: Spam Act 2003

The Spam Act 2003 (Cth) regulates unsolicited commercial electronic messages and is administered by the Australian Communications and Media Authority ( https://www.legislation.gov.au/C2004A01214/latest/text ).

Commonwealth: Cybercrime Act 2001

The Cybercrime Act 2001 (Cth) amended the Criminal Code Act 1995 (Cth) to introduce the modern computer offence framework and replaced Part VIA of the Crimes Act 1914 (Cth) ( https://www.legislation.gov.au/C2004A00957/latest/text ).

Victoria: Crimes Act 1958 (Vic) computer provisions

In Victoria, computer related offences sit within the Crimes Act 1958 (Vic), including unauthorised access, modification or impairment of restricted data, and unauthorised impairment of electronic communications ( https://content.legislation.vic.gov.au/sites/default/files/2025-08/58-6231aa296%20authorised.pdf ).

New South Wales: Crimes Act 1900 (NSW) Part 6

New South Wales computer offences sit in Part 6 of the Crimes Act 1900 (NSW), including unauthorised access, modification or impairment of restricted data or electronic communication ( https://legislation.nsw.gov.au/view/html/inforce/current/act-1900-040#pt.6 ).

Queensland: Criminal Code Act 1899 (Qld) Chapter 33A

Queensland computer offences are found in Chapter 33A of the Criminal Code Act 1899 (Qld), with section 408E being the most commonly instructed unauthorised use of computer offence ( https://www.legislation.qld.gov.au/view/html/inforce/current/act-1899-009 ).

South Australia: Summary Offences Act 1953 (SA) Part 4

Part 4 of the Summary Offences Act 1953 (SA) deals with offences of unauthorised access to or use of a computer system, and related provisions ( https://www.legislation.sa.gov.au/lz?path=%2FC%2FA%2FSUMMARY%20OFFENCES%20ACT%201953 ).

Western Australia: Criminal Code Compilation Act 1913 (WA)

Western Australian computer offences sit in the Criminal Code Compilation Act 1913 (WA) ( https://www.legislation.wa.gov.au/legislation/statutes.nsf/law_a146.html ).

Commonwealth: Privacy Act 1988 and the Notifiable Data Breaches scheme

The Privacy Act 1988 (Cth) incorporates the Australian Privacy Principles and, via Part IIIC, the Notifiable Data Breaches scheme. Where unauthorised access results in a data breach likely to result in serious harm, notification obligations arise ( https://www.legislation.gov.au/C2004A03712/latest/text ). The scheme is administered by the Office of the Australian Information Commissioner ( https://www.oaic.gov.au/privacy/notifiable-data-breaches ).

Commonwealth: Security of Critical Infrastructure Act 2018

The Security of Critical Infrastructure Act 2018 (Cth) imposes reporting, risk management and incident response obligations on responsible entities for critical infrastructure assets ( https://www.legislation.gov.au/C2018A00029/latest/text ).

Child abuse material offences

Child abuse material offences at Commonwealth level are located in Part 10.6 of the Criminal Code Act 1995 (Cth), including sections 474.19 to 474.24, covering possession, control, production, transmission and access using a carriage service ( https://www.legislation.gov.au/Series/C2004A04868 ). State equivalents exist in Victoria under the Crimes Act 1958 (Vic), in New South Wales under the Crimes Act 1900 (NSW), and in equivalent legislation in each other State and Territory. Forensic defence work in this area focuses on the reliability of hash matching, the provenance and timing of files, user attribution, and the limits of what can and cannot be inferred from a recovered artefact. The Office of the eSafety Commissioner publishes guidance on the broader online safety framework at the Online Safety Act 2021 ( https://www.legislation.gov.au/C2021A00076/latest/text ).

Digital Forensic IT Expert Witness Services

Secure Client File Transfer

Send and Receive confidential encrypted material

Material provided to you by Official Intelligence is collected from this page. You will have been sent a password separately. Enter it below. The same digital forensic controls apply as for material sent to us: TLS 1.3 transport, SHA-256 hash verification for chain of custody integrity, and isolated storage with strict access controls.

This service is available to local clients only

Our secure file transfer is currently unavailable for your connection.

If you are using a VPN, please disable it and reload this page, then try again.

If you have disabled any VPN and still see this message, please contact Official Intelligence and we will arrange an alternative secure method for your files.

Contact me (Australia wide)

Email:: [email protected]
Phone:: 0410 643 121

To discuss a matter, telephone 0410 643 121 or Case Review.