FIRST Law Enforcement / CSIRT Co-operation BoF


To further co-operation between Incident Response and Law Enforcement, by the development of better understanding of organisational mission and specific requirements and producing practical trust and information-sharing protocols.


  • Develop a communication and discussion channel for matters other than specific incidents.
  • Identify and publicise appropriate communications channels for discussion of specific incidents.
  • Begin enumerating a list of the national requirements for incident reports requesting specific Law Enforcement action.
  • Bring appropriate stakeholders together for face-to-face meetings at one or more events annually to foster trust and understanding.

Expected Membership

  • FIRST Teams & Liaison Members with an interest in furthering protocols for co-operation with national and international law enforcement.
  • Interested Law Enforcement, prosecution and legislative bodies (including members of the G8 Lyon Group) with an interest in furthering protocols for co-operation with Govt, Academic and Commercial CERT / CSIRT / ISIRT functions.


John Pignataro, Citi CIRT

Mailing list:

FIRST Law Enforcement / CSIRT Cooperation SIG (LECC BoF)