That’s a mantra repeated by cybercrime experts in the Department of Justice, the U.S. Attorney’s Office and the Department of the Treasury. "We’re not the cavalry. We’re not going to come storming in and take off with your equipment," says Jessica Herrera, a federal prosecutor in the Computer Crime & Intellectual Property Section of the Department of Justice’s Criminal Division in Washington, D.C. "We’re there to work with the company, and we’ve found the best experts for examining computers are the people who operate them on a day-to-day basis."

Utenzi Corp., a data center outsourcer and corporate ISP, has worked with the FBI as a victim and other times assisting its customers who have been hit. The FBI leaves data-intensive tasks to the IS staff while its agents handle the forensic and legal aspects of a case, says Mark Nilsson, chief technology officer for the Research Triangle Park, N.C., company. "IS isn’t their core competency, and they know that. Their core is investigative."

In one instance, he explains, "we gave them the signature of the hack and some log information, and they subpoenaed logs from another ISP, traced the user, served a warrant and made an arrest."

Fear Two: Front-Page Coverage

Of all the reasons companies suffer in silence after a cybercrime, the most potent is the fear of bad publicity. Predictive System’s Rasch sketches out a nightmarish scenario, only partly in jest?"Let’s see, investigation on CNN, trial on Court TV, and conviction and sentencing on the front page of The New York Times." In all seriousness, though, he says one goal of prosecutors is to deter other would-be criminals. "If some guy goes to jail and nobody hears about it, they’re not reaching that goal."

Law enforcement officials insist they take care to keep victims’ names out of the public eye. "We’ve had plenty of cases when we wanted to blow our own horn and didn’t," says Nadel of the U.S. Attorney’s CHIP unit.

"We can’t make any absolute guarantees, but in many cases, when a criminal charge is filed, we don’t even name the victim in the indictment," says Nadel. "Unless there’s a particular reason, we usually won’t confirm that a particular company has been a victim." In fact, when CIO tried to follow up on the break at J.H. Baxter, the FBI agent who handled the case referred us to a spokesperson who wouldn’t even say whether the case was closed or ongoing.

Iverson and executives at Utenzi and Usermagnet reported no unwanted publicity in their dealings with the feds. "An organization like ours is very sensitive to having our name attached to security stories," says Utenzi’s Nilsson. "The FBI has been very discreet. We’ve not seen a hit in the press or anything."