A single line in a commit message, written years before anyone imagined a prosecutor reading it, is often what pushes a federal computer-crime case from “maybe” to “charged.” Not the code. The sentence next to it, timestamped and signed with an email address, explaining what the developer meant to do.
Intent is the hardest element for the government to prove in these cases. Hashes, blame data, and commit history hand prosecutors a contemporaneous paper trail written in the defendant’s own voice. If you write code for a living, or you manage people who do, the decisions below are worth thinking through before anyone sends a preservation letter.
Decide What Your Commit Messages Are Actually For
Developers write commit messages for other developers. Prosecutors read them as admissions. Two different audiences, very different stakes, and the second one shows up without warning.
The core federal statute at issue, the Computer Fraud and Abuse Act, turns on mental state at nearly every step. Did the developer act intentionally, knowingly, or recklessly? Each answer carries a different charge and a different sentence.
A commit message that reads “adding backdoor for testing, remove before prod” is funny in a code review and devastating as a grand jury exhibit. The question isn’t whether to document your work. You should. The question is whether your team’s convention rewards clear, boring, accurate messages or clever ones.
If you work on anything a federal agency might one day scrutinize, financial systems, healthcare, defense, infrastructure, the clever-message culture is a liability you can fix for free. A good federal computer crime attorney will tell you the same thing: the record you build in peacetime is the record you live with in an investigation.
Decide Whether to Preserve or Rewrite History
Git lets you rewrite history. Rebase, squash, force-push, amend. In normal engineering life, these are housekeeping. The moment you have reason to believe a dispute, investigation, or subpoena is coming, they become something else entirely.
Rewriting a branch after a preservation obligation attaches is the kind of act prosecutors describe as consciousness of guilt, and in some circumstances as obstruction. Even where the original commits survive on a colleague’s laptop or a CI server, the attempt itself becomes a story the government tells the jury. Once anything is in the air, freeze the repository, mirror it to cold storage, and route any cleanup instinct through counsel first.
Decide Who Really Wrote the Code
Attribution looks obvious until it isn’t. A commit is signed with whatever email the local git config happens to hold. Pair programming, shared machines, service accounts, and borrowed laptops all muddy the question of whose hands were on the keyboard. Prosecutors know this. So do defense experts.
Authorship can be contested through stylometric analysis, SSH key records, VPN logs, commit timing against badge-in data, and the physical location of the device at the moment of the push. Academic work on code stylometry has shown that even short fragments can be probabilistically linked to a specific developer. That cuts both ways, placing a defendant at the keyboard in one case and excluding them in another when the style doesn’t match.
If you manage a team, the question is whether you can prove who did what. Signed commits, enforced SSO, unique service accounts, and clean offboarding make attribution defensible. Shared credentials and generic bot accounts make it a mess the government gets to characterize however it wants.
Decide Whether to Talk Before You Have Counsel
When agents show up with questions about a repository, most engineers want to explain. The code is complicated, the reasoning is defensible, and surely clarifying things will shorten the ordeal. Yet, it almost never does.
Everything you say becomes a fixed statement that has to line up with every commit, every Slack message, every design doc the government later pulls. A single inconsistency, even an honest memory lapse about which branch was merged when, can be charged separately as a false statement.
The better move is to be polite, confirm your identity, and say you’d like to speak with a lawyer before answering questions. Asking for counsel preserves every other option you have.
Decide What to Do Before Anyone Asks
The work that matters most happens long before a subpoena arrives. Teams that fare best in these investigations tend to share a few habits worth copying.
None of this is about hiding anything. It’s about making sure that if an investigator ever walks through your repository, the record they find describes the actual work rather than a caricature of it. The commit history is going to tell a story either way.
The only decision left is whose version of events it supports.
