Cyber Threat & Harassment

What harassment investigation covers

• Attribution of anonymous accounts, posts, or messages, where this is possible from lawful sources;
• Evidence preservation — capturing posts, profiles, and communications in a form usable by police and the courts, including forensic-grade screenshots and metadata where available;
• Takedown campaigns across platforms, search engines, and image hosts, with structured follow-up where requests are ignored;
• Pattern-of-conduct investigation — establishing whether the same offender is behind multiple incidents, or has previously targeted others;
• Coordination with solicitors for civil action — privacy injunctions, harassment injunctions, defamation claims;
• Liaison with law enforcement where the conduct constitutes a criminal offence.

When people come to us

• A campaign of online harassment is being conducted by an account whose real identity is unknown;
• A deepfake or impersonation account has been created in a person’s name;
• Confidential business material has been published online and the source needs to be identified;
• A threatening communication has been received and the sender’s identity needs to be established before reporting to the police.

Two of our guides cover the first steps in the most common situations: when someone is impersonating you online and when you think you are being followed or tracked.

Keeping a record before you contact us

Harassment cases are won or lost on the record. Under the Protection from Harassment Act 1997 the conduct must have happened on more than one occasion, and a court, the police or a platform will want to see each occasion in turn. Whatever you decide to do next, start the record now.

• Do not delete anything, and do not ask the platform to delete it before it has been captured. A removed post is gone for evidential purposes too.
• Do not reply. Engaging gives the other person more to work with and can muddy the picture of who did what.
• Capture before you block. Screenshot each message, post or profile with the address bar, the date and the account name visible. Save the original file; do not crop or annotate it. Then block or mute if you want to.
• Keep a log. One entry per incident: the date and time, the platform and account involved, what happened in a sentence, which screenshot it relates to, and anyone else who saw it.
• Keep it somewhere the other person cannot reach, such as an email account or cloud folder they have never had access to.

If a message contains a threat to hurt you or someone else, contact the police first. Bring the record to us when you are ready and we will take it from there; nothing you have kept is wasted.

How we investigate online harassment

The conduct we investigate is often a criminal offence in its own right under the Online Safety Act 2023, the Malicious Communications Act 1988, and the Protection from Harassment Act 1997. Where it relates to non-consensual intimate imagery, see our dedicated intimate image abuse guidance, which sets out free support routes you can use directly as well as what we can help with.

Our investigations operate within the limits set by the Computer Misuse Act 1990 — we do not access accounts, devices, or systems we are not authorised to access. Personal data is handled in accordance with the UK GDPR and the Data Protection Act 2018.

For our full process from first contact through to post-report support, see how we work.