The court mechanics of a cybersecurity dispute
A cybersecurity dispute — compensation for attack damage, remedying an incident's consequences, stopping an ongoing attack — is examined under the general mechanics of the Civil Procedure Code, and three elements are decisive: the proper content of the claim, the submission of electronic evidence, and, where needed, interim relief.
The claim and its content
Under Article 178, the claim indicates the court, the parties' identities and addresses — for legal persons, also an e-mail address and telephone number; the subject of the dispute; the price of the claim; the specific facts and circumstances; the evidence; the demand and legal grounds; motions; and the list of enclosed documents. The plaintiff must attach all evidence to the claim, and where this is impossible for a valid reason — so indicate and request a reasonable period. In cyber disputes this matters particularly: logs, sites and system materials are the dispute's factual base.
Electronic evidence
Article 134 lists the electronic document and the document confirmed by electronic signature among written evidence with full evidentiary force. Where a party cannot obtain evidence from the person holding it, it may petition the court for its production; the motion may even cover uniform (same-type) documents without specific requisites. The motion must be substantiated: which material circumstance is established by the evidence and what grounds the assumption that it is held by the indicated person.
Securing the claim — during an ongoing attack
Article 191 governs interim relief: the plaintiff may apply to the court indicating circumstances under which non-application of measures will impede or render impossible the enforcement of the decision or cause irreparable harm. During an ongoing cyberattack this instrument enables temporary restrictions — the court relies on the assumption that the claim may be satisfied, and that reasoning does not predetermine the final decision.
Strategic planning of the dispute
Preparing a cyber dispute begins with understanding three parallel lines. First — the subjective composition: who is the defendant — the attacking operator, the owner of the service or the infrastructure provider — and against whom which demand is realistic. Second — the evidentiary base: which documents and electronic materials confirm each fact, and which will need to be requested through the court. Third — interim measures: whether securing the claim is needed and which measure fits the specific situation. These three lines are described before the claim — and precisely they determine whether the dispute will be a simple settlement or a complex technical-expertise case. In addition, the quantitative indicators of damage — direct costs, the cost of repair and recovery, and, where provable, lost profit — must be assessed early, since the price of the claim grounds both the state fee and the arena of examination.
Procedural hygiene is decisive in cyber disputes too: the claim must be accompanied by proof of payment of the state fee and, where a representative files, by the document of authority; as many copies of the claim and annexes are submitted as there are defendants. These requirements are formally simple, yet mistakes about them cost time — and in a cyber dispute time is a question of preserving evidence: logs expire, recordings are dated, and after the moment of copying their restoration becomes harder; during an ongoing attack the first step is therefore documentation — screen captures, copies of system logs, a chronology of the incident. Fixing the evidence and obtaining it lawfully before starting the dispute therefore matters more than an emotionally strong but unconfirmed narrative.
Where the judge lacks special knowledge, the court appoints expertise by a motivated order on its own initiative (Article 162) — the analysis of digital traces is precisely such special knowledge. The parties may also commission expertise independently, submitting the conclusion at the filing or preparation stage. At the hearing the court examines and verifies the evidence (Article 225) — evidence whose examination neither party requested and the court did not conduct is deemed examined. The Legal.ge team assists in preparing a cyber dispute — from the claim to the electronic-evidence package.
Frequently Asked Questions
Below we answer the questions most frequently raised on this topic.
Does an electronic document have evidentiary force?
Yes — the electronic document and the electronically signed document defined by law carry evidentiary force.
How do I obtain evidence from a third party?
By a motion to the court — substantiating which circumstance is established and why the evidence is presumed to be with the indicated person.
Is interim relief possible during an ongoing attack?
Yes — where non-application would impede enforcement or cause irreparable harm; the necessary measure must also be substantiated.
Who appoints the expertise?
The court — by a motivated order where it lacks special knowledge; the parties may also commission it independently.
How We Help on Legal.ge
The Legal.ge team works on cybersecurity disputes: we analyse the events and their legal qualification, prepare the plan of evidence and represent your interests in court.
Write to us on Legal.ge — we will assess your case on the basis of the legislation.