Cybercrime Case: Rights of the Victim and the Suspect at Every Stage

A cybercrime case goes through the same stages as any criminal proceedings, but the main evidence in it is equipment and data. Below are the rights of the victim and the suspect at each stage. Which acts are cybercrimes and what sanctions apply is covered in the article on liability for cybercrime.

Report and start of the investigation

The victim’s rights arise from the moment the victim files a report of a criminal offence against them (Article 55(2) of the Criminal Procedure Code of Ukraine, hereinafter — the CPC), and the authorities cannot refuse to accept and register such a report (Article 214(4) of the CPC). How to draw up a report, what to do with the bank and how to act if the report was not registered — step by step in the article on what to do if you have become a victim of fraud.

Investigation: what each side can initiate

Investigative actions are carried out by the prosecution, and the victim and the defence can initiate them by a motion to the investigator or prosecutor (Article 93(2) and (3) of the CPC). Motions must be considered within no more than three days (Article 220(1) of the CPC), and for a full or partial refusal a reasoned resolution must be issued (Article 220(2) of the CPC); a refusal to carry out investigative actions can be appealed to the investigating judge (the second paragraph of Article 93(3) of the CPC). The victim may take part in investigative actions, ask questions and submit comments on the protocol (Article 56(2)(4) of the CPC).

A person becomes a suspect after being given a notice of suspicion or after detention (Article 42(1) of the CPC). From then on, the person has the right to have defence counsel on first demand and to meet with counsel before the first interrogation, and also to say nothing about the suspicion (Article 42(3)(3) and (4) of the CPC). If you were summoned as a witness, you have the right to the assistance of an attorney during interrogation (Article 66(1)(2) of the CPC). What to do if you have been detained is covered in the article on rights after detention.

Search and equipment

General rights during a search — the admission of an attorney, statements for the protocol, a copy of the protocol — are covered in the article on a search of a home or a search of a person, and the rules on the seizure, copying and return of equipment and the time limits for considering a motion for attachment — in the article on searches at enterprises. In brief: it is prohibited to temporarily seize electronic information systems, computer systems or their parts, and mobile terminals of communication systems (telephones). Exceptions: providing them together with the information is a necessary condition of an expert examination; they were obtained as a result of a criminal offence or are its means or instrument; access to them is restricted by the owner, possessor or holder or is connected with overcoming a logical protection system (the third paragraph of Article 168(2) of the CPC). If computer systems or their parts are seized, then at the request of the possessor copies of the information from them are left to the possessor where technically possible (the fifth paragraph of the same part), except where the circulation of the information is prohibited by law (the sixth paragraph of the same part).

A separate rule for cybercrime cases: if during a search access to computer systems or mobile terminals is found for the search of which there is no permission in the ruling, the investigator or prosecutor may search for and record data on them on the spot when there are sufficient grounds to believe that this data is important for the case (the second paragraph of Article 236(6) of the CPC).

Attachment and return of equipment

If equipment was temporarily seized during a search or inspection on a ruling of the investigating judge, the investigator or prosecutor must file a motion for its attachment within 48 hours after the seizure, in other cases — no later than the next working day; otherwise the property is returned immediately (Article 171(5) of the CPC). Attachment can be imposed on computer systems only in the cases named in the law — in particular if they were obtained as a result of an offence, are a means or instrument of its commission or have retained its traces, if providing them together with the information is a necessary condition of an expert examination, and also if access to them is restricted by the owner, possessor or holder or is connected with overcoming a logical protection system (the second paragraph of Article 170(3) of the CPC).

Non-return of temporarily seized property can be appealed (Article 303(1)(1) of the CPC), and the complaint is considered by the investigating judge (Article 306(1) of the CPC). The owner, suspect or defence counsel who were not present when the attachment was considered may ask for it to be lifted (the first paragraph of Article 174(1) of the CPC), and regardless of presence — if they prove that the need for the attachment has disappeared or that it was imposed without justification (the second paragraph of the same part).

Communications operator data: temporary access

Information from operators about communication and the subscriber can be obtained, in particular, through temporary access to items and documents on a ruling of the investigating judge or the court (Article 159(2) of the CPC). Such access to computer systems is carried out by copying the information, without seizing the equipment (the second paragraph of Article 159(1) of the CPC).

A motion for access may be filed by the parties to the proceedings (Article 160(1) of the CPC), that is, not only the prosecution but also the suspect and the suspect’s defence counsel (Article 3(1)(19) of the CPC). The victim may initiate access by a motion to the investigator or prosecutor (Article 93(3) and Article 220(1) of the CPC). Information from operators about communication and the subscriber is a secret protected by law (Article 162(1)(7) of the CPC), so a person who asks for access must also prove that this information can be used as evidence and that it is impossible to prove the circumstances by other means (Article 163(6) of the CPC).

Expert examination of equipment and data

The defence has the right to engage an expert independently on contractual terms, including for a mandatory examination (the second paragraph of Article 243(1) of the CPC). If the defence cannot engage an expert independently — for lack of funds or other objective reasons — it may ask the investigating judge to commission the examination where an expert is needed to resolve questions of significant importance for the proceedings and the prosecution has not engaged one, has put to the expert questions that do not allow a full conclusion to be given, or there are sufficient grounds to believe that the expert engaged by the prosecution will give or has given an incomplete or incorrect conclusion (Article 244(1) of the CPC). Copies of documents confirming the impossibility of engaging an expert independently are attached to the motion; a motion that does not comply with these requirements is returned by the investigating judge (Article 244(2) and (4) of the CPC). The victim initiates an examination by a motion to the investigator or prosecutor (Article 93(3) of the CPC).

End of the investigation and trial

When the prosecutor recognises the collected evidence as sufficient for an indictment, the prosecutor, or the investigator on the prosecutor’s instruction, must notify the suspect and defence counsel of the completion of the investigation and provide access to the materials, in particular the opportunity to copy the physical evidence and documents that the prosecutor intends to use as evidence in court (Article 290(1) and (3) of the CPC). The victim has the right to familiarise themselves with the materials that directly concern the offence against them (Article 56(1)(11) of the CPC), and in court — to take part in the direct examination of evidence (Article 56(3)(3) of the CPC).

We explain how to claim compensation through a civil claim in the article for fraud victims, and how to appeal a judgment — in the article on appeal and cassation.

If the offender is abroad

A request for international legal assistance is sent by the court, the prosecutor or the investigator with the prosecutor’s approval to the authorised (central) authority of Ukraine (Article 551(1) of the CPC). An attorney does not send such a request independently: the victim or the defence can only ask for it by a motion (Article 220(1) of the CPC).

The article explains how the law works and does not replace advice on a specific case. What defence and representation include is described on the page attorney in a criminal case; how to get in touch — on the page “Contacts”.

The provisions are cited as currently in force as of 13 October 2026.