When a company gets hacked, the break-in rarely takes place in only one location. An automated script breaches a cloud server, hops through three continents in a matter of minutes, funnels crypto cashes from crypto wallets and leaves no trace in time for the company's IT director to finish her morning coffee.
While it is easy to blame this on clever hackers, for corporate intelligence and investigators the real issue is much more mundane: Cybercrime has no borders but law enforcement does. The same goes for cybercrime tools: where criminal code executes at the speed of light, the response time of investigators is measured in bureaucratic procedures.
1. Two Very Different Clocks
A cyberattack and the subsequent investigation unfold on two very different timelines.
An attack may involve automated botnet scanning, server-jumping, log-deletion, and fund-transfer operations that take place in seconds or minutes. Meanwhile, on the response side, triage, identification of target countries, formal foreign legal requests, and obtaining records takes days, weeks, or even months to unfold.
There are three main factors that contribute to this discrepancy:
Automated Exploitation: Criminals do not manually type out each step in an attack. Instead, they use automated scanning programs that execute attacks at machine-speed.
Jurisdictional Bouncing : Bouncing an attack through multiple countries and jurisdictions also slows down investigators, since they have to deal with five different sets of laws, rules, and permissions, in order to secure evidence.
Asset Mobility: Finally, cryptocurrencies add a layer of complexity by making it possible to move, swap, and transfer funds around the world at the speed of light, long before investigators can freeze any assets.
2. The Scattered Crime Scene
In the physical world, a crime takes place inside of one location, whereas in the digital realm, an attack can take place across four different layers:
Infrastructural Layer: Infrastructural servers that route an attack in country A.
Databasing Layer: Cloud databases that store exfiltrated files in country B.
Financial Layer: Digital money and crypto wallets that move funds around in country C.
Identity Layer: User accounts and clandestine identities that originate in country D.
To identify an attacker, investigators have to trace an attack chain that may involve IP addresses, infrastructure servers, user accounts, financial accounts, and physical persons - all of which may span multiple jurisdictions. Because each police force only has authority over its own territory, investigators will need to obtain legal permissions from each country and technology company along this chain in order to follow this chain of evidence.
3. Where Time Is Lost
Cross-border investigations do not slow down because of unenthusiastic detectives. The main roadblock in cross-border investigations are not human investigators, but the sheer amount of paperwork involved in obtaining foreign legal requests. One reason why this is a bigger problem for digital evidence than physical evidence is that computer records tend to have much shorter shelf-lives than say, a physical document buried in a filing cabinet.
While it may take six months to get a formal legal request from one country's court to another, computer records may be purged and deleted after 30 days. Additionally, investigators do not have the legal right to remote access a server located in another country, since this would be a breach of foreign sovereignty, international law, and jurisdiction rules. Compounding this, the same activity may be considered entirely legal in the jurisdiction where the criminal's server is located.
All of this combines into what is called the 'fading evidence' problem: A jurisdiction may have a very strong case against a suspect, but if the target's server retention policies only last 14 days, and the foreign court order takes 180 days to take effect, it is no longer possible to recover that evidence.
4. The Operational Asymmetry
A more granular look at the problem reveals that there is a certain asymmetry between attackers and investigators
This asymmetry unfolds on three levels:Geography: Cybercriminals operate across multiple jurisdictions simultaneously. Police are limited to national borders.
Execution: Attackers use automated code to achieve rapid execution. Investigators are slowed by procedural red tape.
Rules & Constraints: Attackers have few constraints, investigators are limited by jurisdiction rules, sovereignty rules, and digital evidence rules.
Evidence Handling: Finally, while cyber attackers can alter and suppress evidence at will, investigators are required to follow evidence rules and preserve digital records for evidentiary use in court.
5. Fixing the Delay
Goverments and technology companies are working together to develop faster procedures that target specific points of delay:
Direct Access (US CLOUD Act): Qualifying foreign law enforcement agencies can request information directly from a technology company in the United States without going through the formal diplomatic process.
Preservation Orders (Budapest Convention): The 'Freeze First, Ask Questions Later' principle allows investigators to ask a foreign technology company to preserve information while the formal legal request is processed. 24/7 Rapid Access: Direct response channels that allow investigators from different countries to communicate at any time of the day or night.
Fast Track Emergency Rules (EU e-Evidence Regulation): Binding cross-border production rules that apply to all EU member states. In effect, this regulation creates a legal framework that allows European law enforcement to obtain digital evidence across borders as quickly as possible in true emergencies.
Conclusion
Digital evidence and sovereign law enforcement unfold on two different timelines. By developing faster procedures that target the points of friction, law enforcement can effectively close the velocity gap to get evidence faster without violating any legal procedures.
Sources & References
1. Budapest Convention on Cybercrime (Council of Europe CETS No. 185)
2. United States CLOUD Act (18 U.S.C. § 2713 / Public Law 115-141)
3. EU e-Evidence Regulation (Regulation (EU) 2023/1543)
BLK CORAL
← Back to insights