Cybercrime is hard to prosecute because cases fall apart at every stage between the offense and a courtroom: offenders operate from jurisdictions the United States cannot easily reach, they hide behind anonymizing tools that defeat attribution, the digital evidence they leave behind is fragile and often encrypted, the statutes prosecutors rely on were written for older technology, and the overwhelming majority of victims never report at all. The scale of the mismatch is striking. The FBI’s Internet Crime Complaint Center logged more than 859,000 complaints in 2024 with reported losses of $16.6 billion,1Internet Crime Complaint Center (IC3). 2024 IC3 Annual Report yet cybercrime prosecutions make up less than one percent of the federal caseload.2United States Sentencing Commission. Cyber Technology in Federal Crime
Attacks Cross Borders Faster Than Investigators Can
A single intrusion can involve an attacker in one country, servers in another, and a victim in a third. Each nation has its own definition of what counts as a cybercrime, its own penalties, and its own rules about what evidence its agencies can hand over. When the offender lives somewhere with weak enforcement or no interest in cooperating, the case becomes a diplomatic matter rather than a law enforcement one.
The workhorse tool for cross-border cooperation is the Mutual Legal Assistance Treaty. The United States has MLATs with dozens of countries, and they let prosecutors formally request evidence, records, and testimony in a form admissible in domestic courts.3U.S. Department of Justice. Mutual Legal Assistance Treaties of the United States The Federal Judicial Center has described the process as “time-consuming,” pointing to the required level of legal formality, limited resources in responding countries, and thin forensic capacity in some foreign agencies.4Federal Judicial Center. Mutual Legal Assistance Treaties and Letters Rogatory: A Guide for Judges Digital evidence does not wait. Logs rotate. Accounts get deleted. By the time paperwork clears, the trail may be cold.
The CLOUD Act
Congress addressed part of this in the Clarifying Lawful Overseas Use of Data Act. It amended the Stored Communications Act to require U.S.-based providers to comply with a valid warrant “regardless of whether such communication, record, or other information is located within or outside of the United States.”5Office of the Law Revision Counsel. 18 USC 2713 – Required Preservation and Disclosure of Communications and Records Before that, providers sometimes refused to produce data held on foreign servers. The law also authorized executive agreements that let approved foreign governments request data directly from U.S. companies without running every request through the MLAT queue.
The Budapest Convention
The Council of Europe Convention on Cybercrime, known as the Budapest Convention, is the most widely adopted framework for cross-border cooperation. Signatories agree to cooperate “to the widest extent possible” and can use expedited preservation orders that force another country to lock down specific data for up to 90 days while the formal request catches up.6Council of Europe. Convention on Cybercrime – Budapest, 23.XI.2001 The weakness is coverage. Several countries most often linked to cybercrime activity have never ratified it, which leaves prosecutors without a treaty channel exactly where they need one most.
Attribution Is the Hardest Part
Tracing a digital attack to a real person is usually the single hardest step in the investigation. The internet was not designed for identity verification, and criminals stack tools that exploit that. Virtual Private Networks hide a user’s real IP address. The Tor network routes traffic through a chain of volunteer-run servers. Proxy servers add more indirection. Combine them and the investigator is chasing someone in three disguises who drove through five countries before committing the offense.
Botnets make it worse. A criminal who has compromised thousands of ordinary computers can launch attacks that appear to come from a home in Ohio, a small business in Germany, and a university in South Korea at the same moment. Sorting the attacker from the innocent owners of the hijacked machines burns time, and every compromised device is another dead end.
An IP Address Does Not Identify a Person
Even a clean trace to a specific IP address does not identify who was at the keyboard. An IP address points to a device or connection at a moment in time. Households share connections across a dozen devices. Coffee shop Wi-Fi is open to anyone in range. The Supreme Court of Canada acknowledged in R v. Bykovets that IP addresses can act as a “roadmap” to a user’s identity and expose “intensely private” information, but linking one to a specific individual still takes additional investigative steps and legal process. A case built on IP evidence alone invites a defense argument that the address names a location, not a defendant.
Digital Evidence Is Fragile and Must Be Authenticated
A knife in an evidence locker does not reformat itself. A hard drive can. Files get deleted, overwritten, or altered remotely. Automated processes rotate logs and modify timestamps without any human touching the machine. Investigators work under constant time pressure, and a delay of hours in seizing or imaging a device can mean evidence is gone for good.
Authentication is the courtroom side of that fragility. Before digital evidence is admitted, prosecutors must show the file is what they say it is and has not been altered since collection. That takes meticulous records of every person who handled it, every transfer, and every analytical step. One gap in the chain gives the defense an opening to challenge reliability. For evidence that exists as easily copied strings of ones and zeros, keeping that record airtight is significantly harder than sealing a physical object in a bag.
Much of the evidence lives on private servers: email providers, cloud storage, social media, ISPs. The Stored Communications Act sets different legal thresholds depending on the type of data requested,7Office of the Law Revision Counsel. 18 US Code 2703 – Required Disclosure of Customer Communications or Records and mistakes in the request process can suppress evidence or delay a case for months. When the provider sits under a foreign government’s jurisdiction and outside the CLOUD Act’s reach, the request goes back into the MLAT pipeline with all its delays.
Encryption Can Make a Valid Warrant Useless
End-to-end encrypted messaging is designed so that even the company running the service cannot read the content. A lawfully issued warrant may produce nothing usable because the provider does not have the decryption key. Officials call this “warrant-proof” encryption, and the numbers show the scale. Of 2,297 wiretaps authorized by federal and state judges in 2024, law enforcement encountered encrypted communications in 608 instances and could not decrypt the content in 533 of them, roughly 88 percent.8Congressional Research Service. Law Enforcement and Technology: The Lawful Access Debate
The Communications Assistance for Law Enforcement Act, passed in the 1990s, was supposed to help investigators keep up with digital communications. Its scope is narrow. It covers traditional telecommunications carriers but explicitly excludes “information services” like websites and ISPs, and it does not force a carrier to build in decryption capability unless the company already has the ability to decrypt. Proposals to extend the law to modern messaging platforms or mandate law-enforcement access have stalled repeatedly.8Congressional Research Service. Law Enforcement and Technology: The Lawful Access Debate Prosecutors are working with a framework built for telephone wiretaps against a world of encrypted cloud communications.
Cryptocurrency Complicates the Money Trail
Traditional financial crime leaves a bank trail subject to reporting rules and subpoenas. Cryptocurrency transactions sit on public blockchains, which sounds transparent, but wallet identities are pseudonymous by default. Criminals layer additional obfuscation on top: mixing services that pool and redistribute funds to break the transaction chain, and privacy-focused cryptocurrencies engineered to hide transaction details.
Blockchain analysis has improved, and federal agencies have executed some high-profile seizures. But investigators are in an arms race with offenders who keep adopting new techniques. Each new obfuscation step adds hours of forensic work, and a mistake in the trace can lead to the wrong wallet holder. At trial, prosecutors have to explain all of it to a jury in terms that make sense.
The Statutes Are Older Than the Technology
The main federal cybercrime statute, the Computer Fraud and Abuse Act, was enacted in 1986. It criminalizes accessing a “protected computer” without authorization or in a way that exceeds authorized access, along with related conduct like password trafficking and transmitting damaging code.9Office of the Law Revision Counsel. 18 US Code 1030 – Fraud and Related Activity in Connection With Computers The core language reflects a world of mainframes and dial-up connections. “Unauthorized access” was intuitive when computers sat alone behind locked doors. It is far less so in an era of cloud services, APIs, and interconnected systems where the line between authorized and unauthorized use is blurry.
The Supreme Court confronted that ambiguity in Van Buren v. United States (2021), narrowing what it means to “exceed authorized access.” The Court adopted a “gates-up-or-down” approach: the question is whether the user was permitted to access a particular area of the system, not whether the user’s purpose was improper. A police officer who ran a license plate in a law enforcement database for personal reasons did not violate the CFAA because he was authorized to use the database.10Supreme Court of the United States. Van Buren v. United States, 593 US 374 (2021) The ruling settled one corner of the statute and left others open. Prosecutors can spend years litigating what the law even covers before they reach what the defendant actually did.
The broader pattern is that technology creates new forms of misconduct faster than legislatures can respond. Ransomware, deepfake fraud, AI-generated phishing, and attacks on Internet of Things devices all raise questions about whether the existing statutory language clearly applies. Defense attorneys work that seam. By the time a new provision passes, the threat has usually moved on.
Most Victims Never Report
No prosecution starts without a report, and cybercrime is dramatically underreported. Businesses weigh the reputational damage of admitting a breach against the odds of a conviction and often stay quiet. Individual victims skip reporting because the loss feels too small to justify the trouble, or because they doubt anyone can help. Even among those who do report, the volume against available investigative resources means many complaints get little follow-up. The IC3 alone triaged nearly 860,000 complaints in 2024.1Internet Crime Complaint Center (IC3). 2024 IC3 Annual Report
Put every stage together and the prosecution funnel has an enormous mouth and a narrow spout. Millions of people are hit each year. A fraction report. A fraction of reports produce viable leads. A fraction of those leads generate evidence that survives the jurisdictional, technical, and statutory obstacles. And only a fraction of that reaches a courtroom where a prosecutor has to explain the whole chain to jurors who may not have heard the term “IP address” before that morning. That is why the number of prosecutions looks nothing like the number of crimes.