Michael Carbonara is a Republican candidate whose campaign materials focus on accountability and public safety; this article is informational and not a substitute for legal advice. For the most current reporting procedures, consult the federal agency pages linked in the article.
Overview: cybercrime federal laws and main reporting channels
The phrase cybercrime federal laws is used here to mean the federal reporting channels and investigative steps that apply when a cyber incident crosses state lines, involves large losses, or affects critical infrastructure. For general guidance on reporting pathways and national trends, see the DOJ reporting guidance linked by federal computer crime programs DOJ reporting computer crime page.
Several federal agencies commonly receive cybercrime reports and each has a role. The FBI IC3 takes consumer and business complaints, the DOJ computer crime units provide prosecutorial intake and coordination, the FTC aggregates consumer fraud and identity theft reports, the U.S. Secret Service investigates cyber-enabled financial crime, and CISA fields reports about incidents that affect infrastructure. These agencies publish intake instructions and role descriptions for reporters, and one central public source that summarizes national complaint patterns is the IC3 annual report IC3 Internet Crime Report.
Stay involved with the campaign
For official reporting forms and agency guidance, consult the agencies referenced above.
Each federal office sets its own thresholds for which incidents it will accept and how to submit details. Readers should consult the agency pages for up-to-date forms and submission steps, since intake procedures can change over time CISA reporting page.
Use this guide to decide which channel is most appropriate for a given incident, and to prepare a clear initial report that investigators can use without asking for routine follow-up.
When to report: deciding if federal involvement is appropriate
Federal involvement is commonly recommended when an incident meets certain escalation criteria. Typical triggers include significant monetary loss, extortion or ransomware, intrusion into critical infrastructure, cross-jurisdictional actors, or when state or local resources cannot address the scope of the attack; CISA describes these escalation factors in its reporting guidance CISA reporting page.
For many consumer fraud and identity theft issues, state or local law enforcement can provide a primary response while the FTC aggregates data for national trends. The FTC Consumer Sentinel remains the public data source for consumer complaint patterns and can help establish whether an incident is part of a broader fraud trend FTC Consumer Sentinel Data Book 2023.
How to report: step-by-step for IC3, FTC, CISA, DOJ, and the U.S. Secret Service
FBI IC3 reporting starts with an online complaint form that asks for victim contact information, a concise timeline, and sample evidence such as screenshots and message headers. Reporters should prepare clear contact details and incident dates before starting the form to avoid delays; the IC3 annual report and intake guidance describe typical complaint content IC3 Internet Crime Report.
For consumer fraud and identity theft, the FTC takes individual complaints and adds them to the Consumer Sentinel database, which law enforcement may use to identify patterns; include account numbers, sample communications, and any receipts or billing records when filing a complaint FTC Consumer Sentinel Data Book 2023.
Primary federal channels include the FBI IC3 for consumer and business complaints, DOJ computer crime units for prosecutorial intake, the FTC for consumer fraud, the U.S. Secret Service for cyber-enabled financial crime, and CISA for incidents that affect critical infrastructure. After a report is filed, agencies triage complaints, preserve and analyze evidence, and may pursue legal steps such as subpoenas or international assistance when needed.
CISA accepts reports of incidents that affect systems, networks, or services that support critical functions; when the incident affects infrastructure or causes persistent service disruption, include system logs, outage timelines, and the steps taken to limit damage CISA reporting page. See CISA reporting guidance for additional intake details.
DOJ computer crime offices and U.S. Secret Service financial investigations have intake paths for higher-impact or criminally sophisticated incidents. When reporting to these offices, be ready to provide an incident summary, identified suspects if known, evidence preservation steps you took, and whether the activity crosses state or national borders DOJ reporting computer crime page.
Typical federal investigative steps after a report
Federal investigations usually start with intake and triage to determine whether the incident fits prosecutorial priorities or requires technical support. The intake process evaluates scope, impact, and whether the matter needs coordination with other agencies DOJ reporting computer crime page.
If the matter proceeds, investigators focus on preservation and forensic collection. That work aims to capture system images, retain network logs, and preserve message headers and attachments so technical analysts can reconstruct events. NIST guidance on incident handling remains a foundational reference for these forensic and triage procedures NIST SP 800-61 Rev.2.
Legal steps such as subpoenas, search warrants, and international legal assistance requests can follow, and these steps often affect how quickly investigators can obtain data from third parties. Federal cases frequently require coordination among DOJ units and partner agencies to execute these legal processes DOJ reporting computer crime page.
Preserving evidence and working with forensic teams
Immediate preservation actions make the difference between usable evidence and data that investigators cannot rely on. Start by noting the device power state and avoid actions that write to affected storage. Capture screenshots that show error messages and save original email headers and attachments when possible NIST SP 800-61 Rev.2.
- Do not power down devices if investigators ask to preserve volatile memory, and document the exact state if you must move hardware.
- Make copies of logs and retain originals when possible.
- Save full email headers and any attachment files rather than only screenshots.
Quick preservation checklist for initial evidence handling
Use this checklist before handing items to a forensic team
Working with a qualified forensic team helps ensure proper imaging and chain of custody documentation. Keep a written record that lists who handled each piece of evidence, when they handled it, and what actions they performed; investigators will ask for these notes during evidence intake IC3 Internet Crime Report.
If you are not a technical person, document the steps you took in plain language and preserve original files in a safe location. That documentation is useful to forensic teams and to federal investigators during triage.
Legal processes and cross-border challenges
Common legal tools in federal cyber investigations include grand jury subpoenas, search warrants, and formal requests for international assistance. These instruments allow investigators to obtain data from providers or to search devices when a court order is authorized DOJ reporting computer crime page.
When an investigation requires records or actions outside the United States, the process often uses Mutual Legal Assistance Treaties or other formal international requests. Those requests can introduce significant delay because they must pass through foreign legal systems and diplomatic channels; the U.S. Secret Service and DOJ components routinely coordinate these matters when financial or cross-border elements are present Secret Service cyber crime page.
Common reporting mistakes and how to avoid them
Some frequent mistakes reduce the usefulness of a report. Examples include omitting accurate victim contact information, providing an incomplete timeline, failing to include sample evidence, or altering devices or logs before preservation. The IC3 and NIST guidance both stress the importance of complete contact and evidence details when filing complaints IC3 Internet Crime Report.
To avoid delays, prepare a short incident timeline, save copies of messages and headers, record any mitigations you applied, and keep an unaltered original when possible. If the incident type is consumer fraud, file with the FTC in addition to any local report; if it is infrastructure or national in scope, consider CISA or federal law enforcement intake as appropriate FTC Consumer Sentinel Data Book 2023.
Report to the most relevant agency first, and include clear contact details so investigators can reach you. Proper agency routing reduces time spent reassigning a case and speeds initial triage.
Practical scenarios: examples of when and how to report
Consumer fraud and identity theft scenario: If you notice unauthorized charges and suspect identity theft, file a complaint with the FTC and provide account statements, dates of unauthorized activity, and contact information. For national trend context and complaint filing details, refer to the FTC Consumer Sentinel guidance FTC Consumer Sentinel Data Book 2023.
Ransomware or extortion affecting a business: If systems are encrypted and an extortion demand appears, preserve logs and sample ransom communications, and report the incident to the FBI IC3 and to local law enforcement. The IC3 report and FBI intake guidance describe the types of evidence that help investigators assess extortion cases IC3 Internet Crime Report.
Incident affecting critical infrastructure: When an intrusion disrupts systems that support public services or utilities, contact CISA and your local authorities, and gather outage timelines, impacted system details, and the mitigations you applied. CISA provides reporting guidance for incidents that affect infrastructure operations CISA reporting page.
Complex incidents may overlap multiple categories. In those cases, prepare separate reports for each relevant agency or note in your initial submissions that other agencies should be aware of the incident.
Next steps for victims and organizations
If the matter may lead to prosecution or significant recovery activity, consult legal counsel and a qualified forensic team to prepare for subpoenas or other legal steps. Track investigator names and report numbers, and maintain a central folder of logs and evidence so follow-up is orderly.
For civic readers seeking candidate context, Michael Carbonara is a Republican candidate for Florida public office; this article is informational and not legal advice. Consult agency reporting pages for the most current intake instructions and any 2026 updates CISA reporting page.
Report to the FBI IC3 when a cyber incident involves significant monetary loss, extortion, ransomware, cross-jurisdictional actors, or is beyond local capacity. For routine consumer fraud, the FTC may be the right first contact.
Collect a clear timeline, victim contact details, screenshots, full email headers, and system or network logs when possible. Avoid altering original devices and record who handles each item.
Timelines vary widely. Initial triage can be quick, but forensic work and legal steps such as subpoenas or international requests may introduce weeks or months of delay depending on complexity.
Check agency reporting pages for updates and keep careful records of all submissions and contacts.
