A cybersecurity and digital forensics specialist from Minnesota, whose statements have been a part of numerous courtroom proceedings over the last three decades, is now under scrutiny regarding his qualifications and is being investigated by the Federal Bureau of Investigation (FBI). Legal analysts suggest that this investigation could provide a basis to reassess several closed cases where the expert’s input might have been crucial.

Mark Lanterman previously served as an investigator for the U.S. Secret Service Electronics Crimes Task Force and established the consulting firm Computer Forensic Services (CFS) in Minneapolis. According to the CFS website, Lanterman’s three-decade career includes expert testimony in over 2,000 cases, dealing with issues such as sexual harassment, workplace disputes, intellectual property theft, trade secret violations, white-collar crimes, and class action lawsuits.

That was the case until last month when Lanterman’s profile and professional history were discreetly taken down from the CFS website. This change occurred after the Hennepin County Attorney’s Office announced that it was informing involved parties in ten ongoing cases that they could not authenticate Lanterman’s academic and professional credentials. The county attorney also indicated that the FBI is currently looking into the allegations.

The allegations were brought forth by Sean Harrington, a lawyer and forensic investigator situated in Prescott, Wisconsin. Harrington claimed that Lanterman perjured himself multiple times during testimony, asserting that he holds a Bachelor of Science and a Master’s degree in computer science from the now-defunct Upsala College, and completed his postgraduate studies in cybersecurity at Harvard University.

Harrington’s assertions gained momentum through an investigation by the law firm Perkins Coie LLP, which is defending a case where Lanterman conducted a forensic analysis on a client’s laptop. On March 14, attorneys from Perkins Coie motioned the judge (PDF) to dismiss Lanterman’s testimony because he and they were unable to verify the details of his educational background.

Upsala College, situated in East Orange, N.J., operated for 102 years until ceasing operations in 1995 due to dwindling enrollment and financial hardships. According to Perkins Coie, they consulted Felician University, which maintains the transcripts for Upsala College from the years Lanterman claims to have received his undergraduate and graduate degrees. The law firm stated that Felician had no record of Lanterman’s transcripts (PDF), and his name was not found in any Upsala College student yearbooks or graduation programs during that timeframe.

When contacted for comment, Lanterman admitted he lacked evidence to support his attendance at Upsala College and clarified that his “postgraduate work” at Harvard was actually an eight-week online cybersecurity course named HarvardX, which specifies that its certificates are not to be considered equivalent to a Harvard degree or a certificate acquired through traditional classroom programs at Harvard University.

Lanterman has asserted that his initial post-college job was as a police officer in Springfield Township, Pennsylvania, although attorneys from Perkins Coie pointed out that this position was missing from his resume. They stated that upon attempting to verify Lanterman’s employment history, “the police department provided a narrative that would be nearly unbelievable if not for Lanterman’s own email correspondence.”

As detailed in the March 14 motion, Lanterman was deposed on February 11, and the following day he emailed the Springfield Township Police Department to request access to his former personnel file. On February 14, Lanterman visited the Springfield Township PD and inquired if he could borrow his employment records. He informed the officer he spoke to on the phone that he had been recently advised to “get his affairs in order” following a severe heart diagnosis and wished to obtain his old file to share with his family regarding his early career.

Perkins Coie reported that Lanterman left the Springfield Township PD with his personnel file and has not returned it as he had promised.

“It is astonishing that an expert from Minnesota would travel to suburban Philadelphia and abscond with his decades-old personnel file to conceal his background,” the law firm stated. “This seems to be the most severe and egregious type of spoliation, and the mere act of deception warrants the exclusion of Lanterman and consideration of sanctions.”

Harrington initially reached out to KrebsOnSecurity about his concerns in late 2023, upset after attending a conference presentation in which Lanterman exhibited documents from a ransomware victim and told listeners it was due to their refusal to hire his firm for a forensic investigation following a recent breach.

“He claims involvement in the Martha Stewart investigation, the Bernie Madoff trial, Paul McCartney’s divorce, the Tom Petters investigation, the Denny Hecker investigation, and many more,” said Harrington. “He asserts he was invited to address the Supreme Court, provides claims of training the ‘entire federal judiciary’ on cybersecurity each year, and lists himself as a faculty member of the United States Judicial Conference and the Judicial College — positions which he acquired, in part, on a foundation of deceit.”

In a discussion this week, Harrington mentioned that court documents indicate that at least two of Lanterman’s former clients complained about CFS holding their data for ransom over billing disagreements. In a declaration (PDF) dated August 2022, the co-founder of the law firm MoreLaw Minneapolis LLC stated she hired Lanterman in 2014 to evaluate several electronic devices after discovering that one of their paralegals had a criminal fraud background.

However, she stated that when the firm challenged a consulting bill that was significantly higher than anticipated, Lanterman threatened to “escalate” the collection process if payment was not made, including “a claim and lien against the data which would lead to a public auction of your data.”

“We were all astonished by Mr. Lanterman’s email,” mentioned MoreLaw co-founder Kimberly Hanlon. “I had never encountered any legitimate forensic company threatening to ‘auction’ off an attorney’s data, particularly knowing that the data consists of confidential client information, much of which is sensitive in nature.”

In 2009, a manufacturing firm based in Wisconsin that had engaged Lanterman…for computer investigation balked at settling an $86,000 bill from CFS, labeling it “excessive and unfounded.” The organization informed a Hennepin County court that on April 15, 2009, CFS organized a sale of its proprietary information, breaching their confidentiality agreement.

“CFS observed and executed a Public Sale of digital information that was entrusted to them under the conditions of the engagement agreement,” the corporation articulated. “CFS placed the highest bid at the Public Sale totaling $10,000.”

Lanterman briefly reacted to a series of inquiries concerning his history (and recent heart issue) on March 24, indicating he would provide comprehensive answers the next day. These responses never arose. Instead, Lanterman passed on a recent memorandum he composed for the court that criticized Harrington and claimed his accuser was merely seeking to eliminate a rival. He has not replied to any further requests for statements.

“During my time at Upsala, I was a commuting student residing with my grandparents in Morristown, New Jersey, about 30 minutes away from Upsala College,” Lanterman explained to the presiding judge (PDF) in a separate ongoing case (PDF) in which he has testified. “Due to limited resources, I did not engage in campus social activities, nor did I attend graduation ceremonies. In 2023, I confirmed with Felician University — which holds Upsala College’s records — that they could not find my transcripts or diploma, a circumstance they suggested may be due to unresolved financial issues.”

Lanterman was summoned to court on April 3 in the matter represented by Perkins Coie, but he failed to appear. Instead, he sent a communication to the judge withdrawing from the case.

“I am 60 years old,” Lanterman stated to the judge. “I built my business from the ground up. I am finished interacting with individuals like Sean Harrington. Frankly, I have been planning to pass my business on to my children for years. That moment has arrived.”

Lanterman’s correspondence suggests it was his choice to retire. However, according to an affidavit (PDF) submitted in a Florida case on March 28, Mark Lanterman’s son Sean indicated he made the tough choice to request his father to resign given all the negative media scrutiny.

Mark Rasch, a former federal cybercrime prosecutor who currently acts as counsel for the New York cybersecurity intelligence firm Unit 221B, stated that if an expert witness is discredited, any defendants who lost cases significantly influenced by that expert’s opinions during trial might have grounds for appeal.

Rasch noted that law firms suggesting an expert witness have an obligation in good faith to validate that expert’s qualifications, aware that those credentials will undergo cross-examination.

“Federal rules of civil procedure and evidence require experts to list every case they have testified in as an expert in recent years,” Rasch remarked. “Part of that due diligence includes reviewing the outcomes of those cases and understanding the nature of their testimony.”

Arguably the most publicized case involving crucial forensic findings from Lanterman was the 2018 conviction of Stephen Allwine, who was found guilty of murdering his wife two years earlier after attempts to hire a hitman on the dark web collapsed. Allwine is currently serving a life sentence and maintains his innocence, raising doubts about the computer forensic evidence retrieved from 64 electronic devices confiscated from his residence.

On March 24, Allwine filed a petition in a Minnesota court (PDF) to revisit his case, pointing to the allegations against Lanterman and his role as a primary witness for the prosecution.