With notable exception,[1] the defendant should typically introduce some credible evidence that (a) malware was installed on the defendant's computer; (b) by someone other than the defendant; (c) without the defendant’s knowledge.[14] Unlike the real-world SODDI defense, the apparent anonymity of the perpetrator works to the advantage of the defendant.[15]