Keith Cutajar is one of Malta’s foremost criminal investigators in all matters digital. Through his company CY4 and its uniquely accredited laboratory, he carries out specialised investigative work for Malta’s Law Courts as well as for the private sector.

His journey into the world of criminal investigation stemmed from a particularly challenging time in his life, when his sister was the victim of a fatal traffic accident. This pivotal experience inspired him to combine his background in IT with a new-found passion for criminal investigation, with the aim of helping others seek justice.

“Of course, the sudden passing of my sister Karen was a huge blow for our family. She was very young, and her death left us in shock. As time passed, I became increasingly intrigued by the process of uncovering the truth, and decided to pursue a career that would allow me to make a difference,” Keith recalls.

Keith went on to study at the University of London, specifically at the Royal Hollaway, obtaining an MSc in Cyberterrorism, Crime and Forensics.

Upon returning to Malta, he quickly rose to lead major teams at the country’s top advisory firms, specialising in investigations into digital malpractice. In January 2023, he founded CY4 – a specialised company offering digital investigation services to businesses and individuals – and soon achieved ISO compliance under the stringent ISO/IEC27037 standard.

Over the years, Keith has served as a Court-appointed expert in the vast majority of Malta’s high-profile criminal cases involving any digital evidence. Today he is supported by the company’s uniquely skilled and equipped laboratory – the only one of its kind on the island.

“Our lab at CY4 holds unique tier-three cyber incident response and digital forensic investigations capabilities, the highest level attainable for this type of work. It enables us to conduct in-depth investigations across all types of technology, from extracting data from vehicles and mobile phones to on-site forensic work. Every investigation we carry out is backed by internationally recognised quality standards,” Keith explains.

CY4’s capabilities include accessing locked devices, and retrieving deleted or existing data from electronic equipment such as phones, tablets, servers, cloud infrastructure, and car ECUs. “Our onsite investigations can also detect the presence of tracking devices in vehicles or surveillance equipment in rooms,” he adds.

“The equipment we use, both in the lab and in the field, is world-class. It comes with exclusive support subscriptions from leading global suppliers – subscriptions awarded only to laboratories that demonstrate exceptional discipline and performance. We are proud to be among the highest-tier recipients of such support,” Keith continues.

Today, Keith leads a team of 10 full-timer and four part-timer professionals, managing a substantial caseload, much of which is entrusted to them by the Law Courts, local authorities and the private sector. Keith himself has worked on more than 1,700 inquiries – a noteworthy achievement by any standard. CY4 also supports private companies, particularly when technical expertise is needed to navigate complex digital issues.

“Often, we are called in to investigate suspected malpractice within an organisation, whether the source is internal or external. We have worked with prominent entities both locally and International, for whom we’ve produced detailed technical reports,” he notes. 

“With our technology and in-house expertise, we’re well-positioned to provide detailed insights when a company suffers a digital breach. We go beyond simply confirming an incident – we deliver reliable data and actionable information that empowers businesses to protect their interests.”

Preventive services are also a significant part of CY4’s offering. These services provide clients with clear visibility into their systems and their exposure to cyber threats. “We help them conduct internal reviews, assess vulnerabilities, and set a course to mitigate risks and prevent recurrence,” Keith explains.

CY4’s support services fall into four categories:

• Proactive services, by assisting clients during alignment and compliance to well-known industry standards such as DORA, NIS2 and ISO27001, by developing and review internal documentation, delivering training and cyber simulations, and undergoing proactive security testing.
  
  
• Monitoring and detection, offering clients peace of mind that their systems are being constantly scanned for suspicious activity.
  Preliminary investigation, initiated when an incident occurs, focusing on collecting and assessing data.
  
  
• Large-scale case investigation, involving deep technical work and specialised equipment.
  
  
• “Our proactive intelligence work includes scanning the dark web to alert clients if they’re being discussed or targeted. Our record shows we can notify clients of a potential attack within 15 minutes of a mention, allowing them to act swiftly,” Keith says.

Keith has earned recognition not only as a respected Court Expert but also as a contributor to national policy and legislation, particularly in the cyber security space. “Coming from the field allows us a deeper understanding of how cybercriminals operate, which puts CY4 in a stronger position to defend against and anticipate their moves. At its core – though at a highly sophisticated level – our role is about ensuring peace of mind, knowing your company’s data is protected,” Keith concludes.