"Change one bit, you must acquit," as Ehrenreich of PricewaterhouseCoopers likes to say when discussing the effervescent quality of digital evidence.

But who wants to mess with justice, anyway?

Whatever you do, don’t call the authorities

Skoudis remembers another instance in which a large brokerage company got a call from hackers who claimed to have planted a logic bomb that would crash the company’s computers at a certain time?unless the company paid them big bucks. The technical staff found no evidence of tampering, so the company ignored the call. Sure enough, the company’s systems, which processed millions of dollars of transactions an hour, crashed at the appointed time. The next time the extortionists rang, the company knew that the threat was real and got law enforcement involved.

Law enforcement officials can look for patterns, collect evidence and sometimes put hackers behind bars, and this doesn’t necessarily mean having your company’s name dragged through the mud. Yet most companies haven’t figured out that reporting a security breach can help not just them but also business as a whole. "When you give criminals impunity, it emboldens them," explains FBI Agent Mark Bowling in Milwaukee. "It’s simple criminal psychology."

A whopping 36 percent of companies report hacks, according to the latest study done by the Computer Security Institute and the FBI. So you’re off the hook. Someone else will fix the problem, and if you ignore hackers they will go away. Better yet, pay them off and then offer them jobs. You can trust them, right? (See number 1.)

Ignore rumors, they’ll go away

In late October 2000, a security breach at Microsoft made headlines around the world. Early reports indicated that the intrusions may have lasted up to three months. But unnamed sources soon turned into company spokespersons, and the time frame dwindled to about 12 days. In the end, careful observers were sure only that the software giant’s source code may or may not have been involved.

A year later, many experts still point to this as a classic example of what a company should not do when news of a hack becomes public information?specifically, speak with separate and conflicting voices. "When you’re hacked, you can’t let the public think you’re part of the cover-up," Schneier says.

When customers need to know about a problem, or when information about the problem is already in the press, the logical thing to do is issue a formal, factual statement about the fact that you’ve been a victim of a crime. But why not just rely on word of mouth? News will get out?and some of it might even be true.