A cybersecurity and digital forensics specialist from Minnesota, whose statements have appeared in countless legal proceedings over the last three decades, is encountering scrutiny regarding his qualifications and a probe from the Federal Bureau of Investigation (FBI). Legal authorities opine that this investigation could serve as a basis for reopening various resolved cases where the expert’s testimony might have been significant.

Mark Lanterman previously worked as an investigator for the U.S. Secret Service Electronics Crimes Task Force and started the Minneapolis consulting firm Computer Forensic Services (CFS). According to the CFS website, Lanterman has spent three decades working as an expert witness in more than 2,000 cases, involving matters such as sexual harassment and workplace claims, theft of intellectual property and trade secrets, white-collar offenses, and class action lawsuits.

Or at least that was the case until last month, when Lanterman’s profile and work history were discreetly taken down from the CFS website. This action followed the Hennepin County Attorney’s Office disclosing its inability to confirm Lanterman’s educational and employment credentials to parties involved in ten outstanding cases. Furthermore, the county attorney mentioned that the FBI is presently investigating these claims.

The allegations were brought forth by Sean Harrington, an attorney and forensics investigator stationed in Prescott, Wisconsin. Harrington contended that Lanterman gave false testimony under oath on numerous occasions, asserting that he holds a Bachelor of Science and a Master’s degree in computer science from the now-closed Upsala College, and that he completed his postgraduate studies in cybersecurity at Harvard University.

Harrington’s accusations gained momentum due to investigation efforts by the law firm Perkins Coie LLP, which is representing a case where Lanterman conducted a forensic analysis on a client’s laptop. On March 14, attorneys from Perkins Coie requested the judge (PDF) to dismiss Lanterman’s testimony because neither he nor the firm could validate claims regarding his academic history.

Upsala College, situated in East Orange, N.J., was operational for 102 years before it ceased to exist in 1995 due to falling enrollment and financial issues. Perkins Coie informed the court that they had contacted Felician University, which manages the transcripts for Upsala College during the years Lanterman alleged to have obtained his undergraduate and graduate degrees. The law firm stated that Felician lacked any record of transcripts for Lanterman (PDF), and that his name was not present in any Upsala College student yearbooks or commencement programs from that time.

When reached for his comments, Lanterman admitted he had no means to verify his attendance at Upsala College, and that his “postgraduate work” at Harvard was actually an eight-week online cybersecurity course named HarvardX, which states that its certificates should not be viewed as equivalent to a Harvard degree or a certificate awarded through traditional in-person programs at Harvard University.

Lanterman has testified that his initial role post-college was as a police officer in Springfield Township, Pennsylvania, though attorneys from Perkins Coie pointed out that this position was not included in his resume. The legal team noted that when they attempted to confirm Lanterman’s employment history, “the police department responded with a narrative that would be nearly unbelievable if it weren’t backed by Lanterman’s own email communications.”

According to the filing on March 14, Lanterman underwent a deposition on Feb. 11, and the next day he contacted the Springfield Township Police Department to inquire if he could review his former personnel file. On Feb. 14, Lanterman visited the Springfield Township PD, requesting to borrow his employment record. He informed the officer he spoke to over the phone that he had recently been advised to “get his affairs in order” following a diagnosis of a severe heart condition, and that he wished to show his family his early career documentation.

Perkins Coie asserted that Lanterman departed the Springfield Township PD with his personnel file and has not returned it as he had promised.

“It is alarming that an expert from Minnesota would travel to suburban Philadelphia and abscond with a decades-old personnel file to obscure his history,” remarked the law firm. “That appears to be the most severe and reprehensible form of spoliation, and the dishonesty alone is sufficient to exclude Lanterman and contemplate sanctions.”

Harrington first reached out to KrebsOnSecurity regarding his concerns in late 2023, expressing outrage after attending a conference presentation where Lanterman showcased documents from a ransomware victim, insisting it was because they refused to engage his company for a forensic investigation of a recent breach.

“He asserts that he was involved in the Martha Stewart investigation, the Bernie Madoff trial, Paul McCartney’s divorce, the Tom Petters investigation, the Denny Hecker investigation, and numerous others,” Harrington stated. “He claims to have been invited to present to the Supreme Court, asserts he trains the ‘entire federal judiciary’ on cybersecurity annually, and is a faculty member of the United States Judicial Conference and the Judicial College — roles he obtained, partly, on a construct of deceit.”

In an interview this week, Harrington noted that court documents indicate at least two of Lanterman’s former clients raised complaints that CFS had held their data hostage over billing conflicts. In a declaration (PDF) from August 2022, the co-founder of the law firm MoreLaw Minneapolis LLC stated she hired Lanterman in 2014 to investigate multiple electronic devices after discovering that one of their paralegals had a criminal fraud background.

However, the law firm asserted that when it disputed a consulting bill that was significantly higher than anticipated, Lanterman warned them that CFS would “intensify” its collection actions if payment was not made, including “a claim and lien against the data which will result in a public auction of your data.”

“All of us were dumbfounded by Mr. Lanterman’s email,” expressed MoreLaw co-founder Kimberly Hanlon. “I had never encountered any legitimate forensic firm threatening to ‘auction’ off an attorney’s data, especially with the understanding that the data consists of confidential client information, much of which is sensitive in nature.”

In 2009, a manufacturing entity based in Wisconsin that had engaged Lanterman…for digital forensics recoiled at settling an $86,000 bill from CFS, labeling it as “exorbitant and unfounded.” The organization informed a Hennepin County court that on April 15, 2009, CFS organized a sale of its proprietary information, breaching their confidentiality agreement.

“CFS recognized and executed a Public Sale of electronic information that was entrusted to them as per the conditions of the engagement agreement,” the organization stated. “CFS provided the highest bid at the Public Sale, totaling $10,000.”

Lanterman briefly addressed a series of inquiries regarding his history (and recent heart condition) on March 24, indicating he would provide more detailed answers the following day. Those responses never came to fruition. Instead, Lanterman forwarded a recent memorandum he drafted to the court that criticized Harrington and claimed that his accuser was simply attempting to eliminate a rival. He has not replied to additional requests for comments.

“When I attended Upsala, I was a commuting student residing with my grandparents in Morristown, New Jersey, about 30 minutes from Upsala College,” Lanterman explained to the judge (PDF) overseeing a different ongoing matter (PDF) where he has provided testimony. “Due to limited financial means, I refrained from participating in social events on campus, nor did I attend graduation ceremonies. In 2023, I verified with Felician University — which retains Upsala College’s records — that they were unable to find my transcripts or diploma, a circumstance they indicated might stem from unresolved financial issues.”

Lanterman was mandated to appear in court on April 3 for the case represented by Perkins Coie, but he failed to appear. Instead, he sent a communication to the judge opting out of the case.

“I am 60 years of age,” Lanterman informed the judge. “I built my business from scratch. I am finished engaging with individuals like Sean Harrington. To be quite honest, I have been preparing to pass on my business to my children for several years. That moment has arrived.”

Lanterman’s correspondence suggests that it was his choice to retire. However, according to an affidavit (PDF) submitted in a Florida matter on March 28, Mark Lanterman’s son Sean mentioned that he had made the tough choice to request his father to retire due to the negative media scrutiny.

Mark Rasch, a former federal cybercrime prosecutor who now acts as counsel for the New York cybersecurity intelligence firm Unit 221B, noted that when an expert witness is discredited, any defendants who lost in trials significantly influenced by that expert’s findings might have grounds to appeal.

Rasch indicated that law firms proposing an expert witness have a responsibility to diligently verify that expert’s credentials, understanding that those credentials will be subject to examination.

“Federal civil procedure and evidence rules require experts to disclose every case they have testified in as an expert over the past few years,” Rasch stated. “Part of that due diligence involves reviewing the outcomes of those cases and assessing the nature of their testimony.”

Perhaps the most widely covered case featuring notable forensic evidence from Lanterman was the 2018 conviction of Stephen Allwine, who was found guilty of murdering his wife two years prior after attempts to hire a hitman on the dark web failed. Allwine is serving a life sentence and maintains his innocence, casting doubt on computer forensic evidence discovered on 64 electronic devices seized from his residence.

On March 24, Allwine requested a Minnesota court (PDF) to reconsider his case, referencing the allegations against Lanterman and his pivotal role as a witness for the prosecution.