What I learned from the FBI about working together against cyber crime

On 13 March 2025 I met Jason Lowder, Assistant Legal Attaché for Cyber at the Federal Bureau of Investigation (FBI), for the first time, and listened to his talk. It gave a rare look into how one of the world's largest law enforcement agencies works against cyber crime, and why the private sector is such an important part of that work.

Here is what I took away, and what it means for organisations in Sweden and the rest of Europe.

Who does what in US cyber security

Cyber security in the United States is split between several agencies, each with a clear role:

• The FBI (Department of Justice) is the lead investigative agency for national security cyber threats. It collects and analyses cyber threat intelligence domestically, shares it, and coordinates cyber threat investigations.
• The NSA and US Cyber Command (Department of Defense) gather foreign cyber threat intelligence, work out who is behind attacks, and secure national security and military networks.
• CISA (Department of Homeland Security) protects critical infrastructure, secures federal networks and shares analysis of threats and vulnerabilities.

The division is a useful reminder: investigating a crime, defending networks and gathering intelligence are different jobs. They need different mandates, but they depend on each other.

The FBI Cyber Division's mission

The FBI Cyber Division describes its mission as imposing risk and consequences on cyber adversaries through unique authorities, world-class capabilities and enduring partnerships, building on a century of innovation.

In practice, that means more than arrests. The FBI works to investigate and disrupt criminal groups, take down their infrastructure, seize their funds, support victims and build partnerships that make the next attack harder. Attributing an attack to the people behind it and making them pay a price is what separates law enforcement from every other part of cyber defence.

The cyber attachés: the FBI abroad

Cyber crime does not respect borders. A ransomware group may be based in one country, use servers in a second and attack victims in a third. That is why the FBI has legal attaché offices at US embassies around the world, and why some of them have special agents who focus entirely on cyber.

A Cyber Assistant Legal Attaché is a liaison officer who represents the FBI in its international work with partners. The role includes:

• Meeting partner agencies such as police, intelligence services, CERTs and national cyber security centres
• Collaborating on cases of shared interest
• Sharing best practices, training and resources
• Finding ways to say yes when partners need help
• Engaging with private sector companies
• Assisting with legal requests between countries

That last point is easy to underestimate. Getting evidence across borders is slow and complicated. Having people on the ground who understand both legal systems makes a real difference to how quickly an investigation can move.

Different goals, the same direction

The part of the talk that stayed with me the most was a simple observation about goals:

• Law enforcement's primary goal is to gather evidence and analyse it, to learn the who, what, when, where, why and how.
• The private sector's primary goal is to protect its networks, data and reputation through risk management.

Both can be accomplished by working together.

Many companies hesitate to involve the police after an attack. They worry about losing control, about publicity, or that investigators will slow down the recovery. The FBI's own guidance to victims addresses exactly those concerns: a company that has been attacked is treated as a victim, not a suspect. The focus is on the attackers, not on looking for mistakes the company has made, and investigators work to minimise disruption to the business. Recovery remains the company's job, and the investigation runs alongside it.

What cooperation looks like in practice

The talk described cooperation in three directions.

When a company has been compromised, the most valuable things it can share are:

• Indicators of compromise and the attackers' tactics, techniques and procedures
• Artifacts that have been collected, such as malware, tools and disk images
• Reports from the incident response firm, if one has been engaged

When working together on a threat, cooperation means a deeper dive into understanding the threat, sharing indicators and tactics, and discussing what can be done to disrupt or neutralise it.

From law enforcement back to the company, the flow goes the other way:

• Information about the threat that can be used to clean up and protect the environment
• Information about targeting and victims, which can reveal whether the attack was part of something bigger
• Offers of further assistance

That two-way flow is the point. A single company only sees its own incident. Law enforcement sees patterns across many victims and countries, and can sometimes warn a company before an attack is completed.

Partnerships at every level

The FBI does not do this alone. Its outreach and coordination work spans three groups:

• The private sector, through partnerships such as InfraGard, the National Cyber Forensics and Training Alliance (NCFTA), the Domestic Security Alliance Council (DSAC) and the National Defense Cyber Alliance (NDCA)
• The US government, through the National Cyber Investigative Joint Task Force (NCIJTF), where more than 30 agencies coordinate cyber investigations
• Foreign partners, through the legal attaché offices at embassies around the world

What this means for organisations in Sweden

You do not have to be an American company to benefit from this. The principles apply just as well to cooperation with the Swedish Police, national cyber security authorities and their European counterparts.

My practical advice:

1. Build the relationship before you need it. Know who you would call, and how, before an incident happens. It is much easier to make the call when you already know the people.
2. Collect evidence as part of your incident response. Logs, disk images and malware samples help both your own analysis and any investigation. Make sure your incident plan includes it.
3. Report incidents. Under NIS2, many organisations are now obliged to report significant incidents. But reporting is also how authorities see the bigger picture, and how future victims can be warned.
4. Share what you learn. Indicators and tactics shared through trusted channels make everyone harder to attack.
5. Separate the questions. "How do we recover?" and "Who did this?" are different questions. Your incident response team answers the first, law enforcement the second. You need both.

A shared fight

The most important lesson from the talk is that cyber crime is a shared problem that no company, and no country, can solve alone. Criminal groups cooperate across borders, sell services to each other and reuse the same tools against many victims. The defenders need to cooperate at least as well.

As someone who has led incident handling and security work in regulated environments, I recognise the hesitation many organisations feel about involving the authorities. But the companies that come through attacks best are usually the ones that prepared, had a plan, and knew who to call.

armsec has no affiliation with the FBI. This article reflects my own impressions from a public talk. Want help preparing your incident response plan? Talk to us.