A Minnesota cybersecurity and computer forensics expert whose testimony has featured in thousands of courtroom trials over the past 30 years is facing questions about his credentials and an inquiry from the Federal Bureau of Investigation<\/strong> (FBI). Legal experts say the inquiry could be grounds to reopen a number of adjudicated cases in which the expert\u2019s testimony may have been pivotal.<\/p>\n One might conclude from reading Mr. Lanterman\u2019s LinkedIn profile that has a degree from Harvard University.<\/p>\n<\/div>\n Mark Lanterman<\/a><\/strong> is a former investigator for the U.S. Secret Service Electronics Crimes Task Force who founded the Minneapolis consulting firm Computer Forensic Services<\/strong> (CFS). The CFS website says Lanterman\u2019s 30-year career has seen him testify as an expert in more than 2,000 cases, with experience in cases involving sexual harassment and workplace claims, theft of intellectual property and trade secrets, white-collar crime, and class action lawsuits.<\/p>\n Or at least it did until last month, when Lanterman\u2019s profile and work history were quietly removed from the CFS website. The removal came after Hennepin County Attorney\u2019s Office<\/strong> said<\/a> it was notifying parties to ten pending cases that they were unable to verify Lanterman\u2019s educational and employment background. The county attorney also said the FBI is now investigating the allegations.<\/p>\n Those allegations were raised by Sean Harrington<\/strong>, an attorney and forensics examiner based in Prescott, Wisconsin. Harrington alleged that Lanterman lied under oath in court on multiple occasions when he testified that he has a Bachelor of Science and a Master\u2019s degree in computer science from the now-defunct Upsala College<\/strong>, and that he completed his postgraduate work in cybersecurity at Harvard University<\/strong>.<\/p>\n Harrington\u2019s claims gained steam thanks to digging by the law firm Perkins Coie LLP<\/strong>, which is defending a case wherein a client\u2019s laptop was forensically reviewed by Lanterman. On March 14, Perkins Coie attorneys asked the judge<\/a> (PDF) to strike Lanterman\u2019s testimony because neither he nor they could substantiate claims about his educational background.<\/p>\n Upsala College, located in East Orange, N.J., operated for 102 years until it closed in 1995 after a period of declining enrollment and financial difficulties. Perkins Coie told the court that they\u2019d visited Felician University<\/strong>, which holds the transcripts for Upsala College during the years Lanterman claimed to have earned undergraduate and graduate degrees. The law firm said Felician had no record of transcripts for Lanterman<\/a> (PDF), and that his name was absent from all of the Upsala College student yearbooks and commencement programs during that period.<\/p>\n Reached for comment, Lanterman acknowledged he had no way to prove he attended Upsala College, and that his \u201cpostgraduate work\u201d at Harvard was in fact an eight-week online cybersecurity class called HarvardX<\/strong>, which cautions that its certificates should not be considered equivalent to a Harvard degree or a certificate earned through traditional, in-person programs at Harvard University.<\/p>\n Lanterman has testified that his first job after college was serving as a police officer in Springfield Township, Pennsylvania, although the Perkins Coie attorneys noted that this role was omitted from his resume. The attorneys said when they tried to verify Lanterman\u2019s work history, \u201cthe police department responded with a story that would be almost impossible to believe if it was not corroborated by Lanterman\u2019s own email communications.\u201d<\/p>\n As recounted in the March 14 filing, Lanterman was deposed on Feb. 11, and the following day he emailed the Springfield Township Police Department<\/a> to see if he could have a peek at his old personnel file. On Feb. 14, Lanterman visited the Springfield Township PD and asked to borrow his employment record. He told the officer he spoke with on the phone that he\u2019d recently been instructed to \u201cget his affairs in order\u201d after being diagnosed with a grave heart condition, and that he wanted his old file to show his family about his early career.<\/p>\n According to Perkins Coie, Lanterman left the Springfield Township PD with his personnel file, and has not returned it as promised.<\/p>\n \u201cIt is shocking that an expert from Minnesota would travel to suburban Philadelphia and abscond with his decades-old personnel file to obscure his background,\u201d the law firm wrote. \u201cThat appears to be the worst and most egregious form of spoliation, and the deception alone is reason enough to exclude Lanterman and consider sanctions.\u201d<\/p>\n Harrington initially contacted KrebsOnSecurity about his concerns in late 2023, fuming after sitting through a conference speech<\/a> in which Lanterman shared documents from a ransomware victim and told attendees it was because they\u2019d refused to hire his company to perform a forensic investigation on a recent breach.<\/p>\n \u201cHe claims he was involved in the Martha Stewart investigation, the Bernie Madoff trial, Paul McCartney\u2019s divorce, the Tom Petters investigation, the Denny Hecker investigation, and many others,\u201d Harrington said. \u201cHe claims to have been invited to speak to the Supreme Court, claims to train the \u2018entire federal judiciary\u2019 on cybersecurity annually, and is a faculty member of the United States Judicial Conference and the Judicial College \u2014 positions which he obtained, in part, on a house of fraudulent cards.\u201d<\/p>\n In an interview this week, Harrington said court documents reveal that at least two of Lanterman\u2019s previous clients complained CFS had held their data for ransom over billing disputes. In a declaration<\/a> (PDF) dated August 2022, the co-founder of the law firm MoreLaw Minneapolis LLC<\/strong> said she hired Lanterman in 2014 to examine several electronic devices after learning that one of their paralegals had a criminal fraud history.<\/p>\n But the law firm said when it pushed back on a consulting bill that was far higher than expected, Lanterman told them CFS would \u201cescalate\u201d its collection efforts if they didn\u2019t pay, including \u201ca claim and lien against the data which will result in a public auction of your data.\u201d<\/p>\n \u201cAll of us were flabbergasted by Mr. Lanterman\u2019s email,\u201d wrote MoreLaw co-founder Kimberly Hanlon<\/strong>. \u201cI had never heard of any legitimate forensic company threatening to \u2018auction\u2019 off an attorney\u2019s data, particularly knowing that the data is comprised of confidential client data, much of which is sensitive in nature.\u201d<\/span><\/p>\n In 2009, a Wisconsin-based manufacturing company that had hired Lanterman for computer forensics balked at paying an $86,000 invoice from CFS, calling it \u201cexcessive and unsubstantiated.\u201d The company told a Hennepin County court that on April 15, 2009, CFS conducted an auction of its trade secret information in violation of their confidentiality agreement.<\/p>\n \u201cCFS noticed and conducted a Public Sale of electronic information that was entrusted to them pursuant to the terms of the engagement agreement,\u201d the company wrote. \u201cCFS submitted the highest bid at the Public Sale in the amount of $10,000.\u201d<\/p>\n Lanterman briefly responded to a list of questions about his background (and recent heart diagnosis) on March 24, saying he would send detailed replies the following day. Those replies never materialized. Instead, Lanterman forwarded a recent memo he wrote to the court that attacked Harrington and said his accuser was only trying to take out a competitor. He has not responded to further requests for comment.<\/p>\n \u201cWhen I attended Upsala, I was a commuter student who lived with my grandparents in Morristown, New Jersey approximately 30 minutes away from Upsala College,\u201d Lanterman explained to the judge<\/a> (PDF) overseeing a separate ongoing case<\/a> (PDF) in which he has testified. \u201cWith limited resources, I did not participate in campus social events, nor did I attend graduation ceremonies. In 2023, I confirmed with Felician University \u2014 which maintains Upsala College\u2019s records \u2014 that they could not locate my transcripts or diploma, a situation that they indicated was possibly due to unresolved money-related issues.\u201d<\/p>\n Lanterman was ordered to appear in court on April 3 in the case defended by Perkins Coie, but he did not show up. Instead, he sent a message to the judge withdrawing from the case.<\/p>\n \u201cI am 60 years old,\u201d Lanterman told the judge<\/a>. \u201cI created my business from nothing. I am done dealing with the likes of individuals like Sean Harrington. And quite frankly, I have been planning at turning over my business to my children for years. That time has arrived.\u201d<\/p>\n Lanterman\u2019s letter leaves the impression that it was his decision to retire. But according to an affidavit<\/a> (PDF) filed in a Florida case on March 28, Mark Lanterman\u2019s son Sean said he\u2019d made the difficult decision to ask his dad to step down given all the negative media attention.<\/p>\n Mark Rasch<\/strong>, a former federal cybercrime prosecutor who now serves as counsel to the New York cybersecurity intelligence firm Unit 221B<\/a>, said that if an expert witness is discredited, any defendants who lost cases that were strongly influenced by that expert\u2019s conclusions at trial could have grounds for appeal.<\/p>\n Rasch said law firms who propose an expert witness have a duty in good faith to vet that expert\u2019s qualifications, knowing that those credentials will be subject to cross-examination.<\/p>\n \u201cFederal rules of civil procedure and evidence both require experts to list every case they have testified in as an expert for the past few years,\u201d Rasch said. \u201cPart of that due diligence is pulling up the results of those cases and seeing what the nature of their testimony has been.\u201d<\/p>\n Perhaps the most well-publicized case involving significant forensic findings from Lanterman was the 2018 conviction of Stephen Allwine<\/strong>, who was found guilty of killing his wife<\/a> two years earlier after attempts at hiring a hitman on the dark net fell through. Allwine is serving a sentence of life in prison, and continues to maintain that he was framed, casting doubt on computer forensic evidence found on 64 electronic devices taken from his home.<\/p>\n On March 24, Allwine petitioned a Minnesota court<\/a> (PDF) to revisit his case, citing the accusations against Lanterman and his role as a key witness for the prosecution.<\/p>\n<\/div>\n![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/03\/marklanterman-linkedin.png?resize=817%2C597&ssl=1\")
<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/03\/27-cv-12-22089-ExtrusionDiesIndustries.png?resize=1039%2C439&ssl=1\")
<\/p>\n