Cyberspace, Jurisdiction and International Cooperation

Introduction and Context

Cybercrime rarely respects national borders. A criminal may be located in one country, use infrastructure in a second, target victims in a third, and store stolen data in a fourth. This geographical dispersion creates a central legal problem: which state may investigate, prosecute, and punish the conduct, and how can evidence or suspects be obtained from another state?

Traditional criminal law is largely territorial. A state normally regulates conduct occurring within its territory and protects persons, property, and public interests within its borders. Cyberspace complicates this principle because digital activity is distributed across networks, cloud platforms, domain registries, payment systems, and service providers operating under different legal systems.

Jurisdiction is therefore not simply a question of where a computer is located. It may depend on the location of the offender, victim, device, server, financial loss, national security interest, or legally relevant consequence. The practical response requires both domestic legal authority and international cooperation through extradition, mutual legal assistance, preservation requests, joint investigations, and trusted channels between law-enforcement agencies.

This chapter introduces the legal foundations needed by cybersecurity professionals. It does not replace the law of any particular country. Cybersecurity practitioners should always consult applicable statutes, regulations, treaties, judicial decisions, and authorized legal advisers.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain territorial, nationality, protective, passive-personality, and universal jurisdiction.
2. Analyze how cyberspace creates overlapping and conflicting jurisdictional claims.
3. Distinguish jurisdiction to prescribe, adjudicate, and enforce.
4. Explain attribution problems in cyber incidents and their legal consequences.
5. Describe extradition, mutual legal assistance, preservation, and cross-border evidence procedures.
6. Compare major international cybercrime cooperation frameworks.
7. Evaluate an international cybercrime scenario and recommend a lawful investigative strategy.
8. Identify professional, ethical, privacy, sovereignty, and due-process responsibilities.

1. Jurisdiction as a Legal Framework

Jurisdiction is the lawful authority of a state or institution to regulate conduct, decide disputes, or enforce legal decisions. Three dimensions are especially important:

These dimensions may point to different countries. For example, State A may have authority to prosecute because its citizen launched the attack, while State B may have authority because the victim and financial loss are located there. State C may control the server and therefore control access to important evidence. Each state may have a legitimate connection, but enforcement action inside another state normally requires consent or a recognized international legal mechanism.

1.1 Territoriality

Territoriality is the primary jurisdictional principle. A state regulates conduct occurring within its territory. In cybercrime, relevant territorial connections may include:

• the offender’s physical location;
• the victim’s residence or business location;
• a computer, network, or data centre located in the state;
• the location where unauthorized access occurred;
• the location of financial or operational harm; and
• the place where part of the criminal conduct was planned or completed.

Territoriality is not always straightforward. A malicious program may be executed by an offender abroad, pass through routers in several countries, and encrypt computers in a local hospital. The passing of packets through a state does not automatically establish a sufficient legal connection. Courts and prosecutors usually examine the substantive connection between the conduct and the state, including foreseeability, harm, statutory language, and relevant international principles.

Territoriality has two aspects. Subjective territoriality concerns conduct initiated within the state. Objective territoriality, sometimes called the effects principle in appropriate contexts, concerns conduct outside the state that produces substantial or legally relevant effects inside it. The scope of objective territoriality differs among legal systems and must not be assumed to be unlimited.

1.2 Nationality and Active Personality

Under the nationality principle, a state may regulate the conduct of its nationals even when they act abroad. This is often called active personality jurisdiction. It is especially important where a suspect is physically outside the victim state but is a citizen or habitual resident of another state.

Nationality jurisdiction can create overlapping claims. A suspect may be prosecuted in the state of nationality, the state of the victim, or both, subject to rules concerning double jeopardy, transfer of proceedings, and the priority established by applicable law or cooperation arrangements.

A related concept is passive personality jurisdiction, based on the nationality of the victim. It is more controversial in some contexts, but many legal systems recognize jurisdiction over serious offences committed abroad against their nationals, particularly where the conduct has a strong connection to the state.

1.3 Protective Jurisdiction

Protective jurisdiction applies when conduct abroad threatens essential interests of a state, such as national security, government systems, currency, immigration controls, or critical infrastructure. Cyber espionage, attacks on military networks, and interference with elections may raise protective jurisdiction claims.

Because “national security” can be interpreted broadly, protective jurisdiction should be applied carefully. A state should identify a clear legal basis, a substantial protected interest, and a proportionate response. Cybersecurity professionals should not infer that every foreign intrusion permits unilateral action against foreign systems.

1.4 Universal Jurisdiction

Universal jurisdiction permits prosecution of certain exceptionally serious offences regardless of the ordinary territorial or nationality connections. It is traditionally associated with offences such as piracy, genocide, and certain grave international crimes. Ordinary unauthorized access, online fraud, or ransomware is generally not automatically subject to universal jurisdiction merely because it is harmful or transnational.

Students should distinguish universal jurisdiction from broad domestic jurisdiction. A national cybercrime statute may apply to conduct outside the country, but that does not necessarily mean the offence is recognized as universally prosecutable under international law.

2. Cyberspace and the Problem of Location

A digital event has multiple locations. Consider a phishing operation:

1. The criminal writes code in State A.
2. A compromised server in State B sends messages.
3. The victim is in State C.
4. Credentials are stored by a cloud provider in State D.
5. Cryptocurrency is converted through an exchange in State E.

No single location fully describes the event. The legal analysis must separate the components of conduct and identify the connecting factors relevant to each offence.

2.1 Data Location and Data Control

The physical location of data may be difficult to determine because cloud services replicate information, move workloads, and use distributed storage. A provider may also hold encryption keys, logs, subscriber information, and content in different jurisdictions.

Physical location remains legally relevant, but it is not always decisive. Investigators must distinguish:

• content data, such as email or stored files;
• traffic or metadata, such as connection times, IP addresses, and routing information;
• subscriber information, such as account identity and payment details; and
• preservation information, which protects existing data from deletion while legal authority is obtained.

Different legal thresholds may apply to each category. A request for basic subscriber information may require less process than a request for private content, although the exact rules vary by country.

2.2 Cloud and Platform Jurisdiction

Cloud service providers often respond to lawful requests according to the location of the customer, the data, the provider entity, and the applicable disclosure law. A security team should not assume that an administrator’s technical access equals legal authority to disclose information to a foreign agency.

A responsible incident response plan should identify likely providers, retention periods, contractual contacts, and emergency disclosure procedures before an incident occurs. It should also preserve evidence lawfully and avoid altering original data.

3. Conflicts of Law and Concurrent Jurisdiction

A conflict of law occurs when different legal systems apply different rules to the same activity. Conflicts may concern whether conduct is criminal, the required mental state, available defences, privacy obligations, sentencing, evidence, or the authority to compel a company.

Concurrent jurisdiction is not necessarily a legal error. Several states may legitimately claim authority. The practical questions are:

• Which state has the strongest connection to the offence?
• Where is the evidence located?
• Where can the suspect be lawfully arrested?
• Which state has the capacity and willingness to prosecute?
• Which forum best protects victims and witnesses?
• Would prosecution in one state prevent or limit prosecution in another?
• Do treaties or domestic laws establish priority or consultation procedures?

3.1 Double Jeopardy and Ne Bis In Idem

The principle commonly expressed as ne bis in idem protects a person from being prosecuted or punished twice for the same offence in circumstances recognized by applicable law. Its operation across borders varies. Some countries recognize foreign judgments for this purpose; others do so only through treaty or domestic legislation.

Prosecutors and investigators should coordinate early where several states are considering charges. Parallel investigations may be necessary, but uncoordinated prosecutions can waste resources, create inconsistent outcomes, and threaten fair-trial rights.

3.2 Conflicting Privacy and Disclosure Rules

One country may authorize disclosure of user data while another prohibits it without a local court order. Data-protection law may restrict exporting personal information. Telecommunications secrecy rules may protect traffic data. Banking or health information may receive additional protection.

The lawful approach is not to select the least restrictive country informally. Investigators should identify the data type, applicable legal basis, provider location, requested purpose, safeguards, and cross-border mechanism. Organizations should apply data minimization and disclose only what is legally necessary and proportionate.

4. Attribution in Cyber Incidents

Attribution is the process of associating a cyber operation with a person, group, organization, or state. It is both a technical and legal problem. Technical indicators may show how an operation was conducted, while legal attribution requires evidence connecting the conduct to a legally responsible actor and satisfying the relevant standard of proof.

Investigators may examine:

• malware code and compilation patterns;
• infrastructure registration and payment records;
• command-and-control behaviour;
• account access logs;
• cryptocurrency movements;
• recovered devices and communications;
• witness testimony;
• operational mistakes; and
• intelligence from service providers or partner agencies.

An IP address is not an identity. It may identify a compromised device, a virtual private network exit node, a public network, or a proxy. Similarly, malware similarity is evidence, not automatic proof of authorship. Attribution should be expressed with calibrated confidence and supported by corroborating evidence.

Legal attribution also requires attention to mens rea, or the required mental element. A person may operate infrastructure without knowing that it was compromised. An employee may execute a command under coercion. A service provider may host criminal content without participating in the offence. The prosecution must establish the elements required by the applicable offence.

State Responsibility and Private Conduct

Attributing an operation to a state is distinct from prosecuting an individual. State responsibility may involve international law, diplomatic consequences, countermeasures, or dispute settlement, while criminal responsibility requires evidence satisfying domestic criminal procedure. Public statements should therefore distinguish technical assessment, intelligence judgment, diplomatic attribution, and courtroom proof.

5. Cross-Border Enforcement

A state generally cannot send officers into another state to search premises, seize equipment, or arrest a suspect without consent. Unilateral access to foreign systems may violate sovereignty, domestic criminal law, privacy rights, or the law governing law-enforcement cooperation.

Common lawful mechanisms include:

1. Direct cooperation with service providers, where domestic law and provider policy permit it.
2. Police-to-police cooperation, often for urgent intelligence, contact information, or preservation.
3. Mutual legal assistance, used for formal evidence gathering.
4. Extradition, used to transfer a suspect for prosecution or sentence enforcement.
5. Joint investigation teams, where participating states agree on coordinated work.
6. Controlled delivery or surveillance, where authorized by national law and international agreement.

Emergency cooperation does not eliminate legal safeguards. A request may be urgent because logs will be deleted, but investigators must still document authority, necessity, scope, chain of custody, and later admissibility.

6. Extradition

Extradition is the formal process by which one state surrenders a person to another state for prosecution or enforcement of a sentence. It normally depends on a treaty, domestic legislation, or another recognized legal basis.

Important extradition principles commonly include:

• dual criminality: the conduct must generally constitute an offence in both states;
• speciality: the person should normally be prosecuted only for the offence for which extradition was granted;
• minimum seriousness: treaties often require a threshold penalty;
• speciality of evidence and procedure: the requesting state must follow agreed restrictions;
• political-offence limitations: some treaties exclude certain political offences;
• non bis in idem: prior final proceedings may bar surrender;
• human-rights safeguards: risks of torture, unfair trial, discriminatory prosecution, or inhuman treatment may prevent or delay surrender; and
• nationality restrictions: some states do not extradite their own citizens, instead considering domestic prosecution.

Cybercrime creates special dual-criminality issues. Conduct described as “unauthorized access” in one state may be lawful security research in another if permission existed. The request should describe facts rather than rely only on offence labels.

7. Mutual Legal Assistance

Mutual legal assistance, or MLA, is a formal process through which one state requests another state to obtain evidence or perform an investigative act. It may cover:

• search and seizure;
• production of records;
• testimony or depositions;
• service of documents;
• transfer of detained persons for testimony;
• asset tracing and freezing; and
• preservation or authentication of electronic evidence.

An MLA request should be precise. It commonly identifies the requesting authority, legal basis, facts, offences, requested measures, relevant persons or accounts, time period, confidentiality requirements, urgency, and intended evidentiary use.

A Practical MLA Workflow

1. Confirm that the conduct is an offence and identify the relevant jurisdiction.
2. Preserve volatile evidence through lawful emergency or provider channels.
3. Identify the requested state, central authority, treaty, and domestic requirements.
4. Define the evidence narrowly and explain its relevance.
5. Obtain judicial authorization where required.
6. Translate and transmit the request through the proper authority.
7. Monitor execution and answer clarification requests.
8. Receive, document, authenticate, and securely store the evidence.
9. Respect use limitations and confidentiality conditions.

MLA can be slow because requests pass through central authorities, courts, translators, and service providers. Delay is especially damaging for short-lived logs. Cybercrime units should therefore combine formal MLA with lawful preservation and trusted operational contacts.

8. International Cybercrime Cooperation Frameworks

8.1 Budapest Convention on Cybercrime

The Council of Europe Convention on Cybercrime, commonly called the Budapest Convention, is a major international treaty framework. It promotes harmonization of offences and procedural powers, and it supports cooperation concerning electronic evidence. Its provisions address areas such as illegal access, illegal interception, data interference, system interference, computer-related fraud and forgery, and certain content-related offences, subject to the treaty and national implementation.

Its cooperation mechanisms include expedited preservation of stored computer data, production and search measures, extradition, and a network of available points of contact. Participation and domestic implementation vary, so practitioners must examine the law of the relevant country rather than assume identical powers.

8.2 United Nations Frameworks

The United Nations has developed international work on cybercrime and electronic evidence. The United Nations Convention against Cybercrime was adopted by the General Assembly in 2024 and provides a global treaty framework, subject to its signature, ratification, entry-into-force, and national implementation processes. Its practical effect will depend on participation, domestic legislation, institutional capacity, safeguards, and cooperation among states.

The UN framework is significant because cybercrime cooperation requires broad geographical participation. At the same time, global cooperation must address privacy, human rights, due process, state sovereignty, and the risk that vaguely defined offences could be used against legitimate expression or security research.

8.3 Regional and Bilateral Arrangements

Regional organizations may provide conventions, police networks, joint investigation mechanisms, data-protection rules, and specialized contact points. Bilateral treaties may establish faster or more tailored procedures. Domestic law may also permit limited direct cooperation with foreign providers.

A professional investigator should maintain a current jurisdiction matrix covering: treaty status, central authority, emergency contacts, preservation rules, language requirements, authentication requirements, dual-criminality rules, and restrictions on onward use.

9. Electronic Evidence and Chain of Custody

Cross-border evidence must be reliable, relevant, lawfully obtained, and capable of authentication. A chain of custody records who collected, handled, transferred, examined, and stored evidence.

For digital evidence, good practice includes:

• recording the time source and time zone;
• preserving original media and creating verified forensic copies;
• recording cryptographic hash values where appropriate;
• documenting tools, versions, and procedures;
• separating analysis copies from originals;
• maintaining access controls and audit logs;
• recording transfers between agencies and countries; and
• retaining legal authorizations and provider certifications.

A hash value can help demonstrate that a file has not changed, but it does not prove that the file is authentic, that the device was lawfully seized, or that a particular person created it. Integrity is only one part of admissibility.

10. Illustrative Case: The Meridian Health Ransomware Incident

This is a fictional educational case.

Background

Meridian Health, a hospital group in State C, suffers a ransomware attack. Patient scheduling systems become unavailable and several servers are encrypted. Investigators discover that the attackers used a remote-management account created through a cloud provider in State D. The suspected operator, a citizen of State A, appears to be living in State B. Cryptocurrency proceeds move through an exchange in State E.

Problem

State C wants to protect patients, identify the attackers, recover evidence, and pursue prosecution. However, each important source of evidence is outside State C. The hospital also holds sensitive health information, and uncontrolled disclosure could violate privacy law.

Analysis

State C has a strong territorial and effects connection because the victims, systems, and harm are located there. State A may claim nationality jurisdiction over its citizen. State B controls the suspect’s physical location and may be the only state able to arrest the person. State D may control provider records. State E may hold financial evidence.

The incident-response team first isolates affected systems, preserves volatile logs, and maintains patient safety. It avoids attempting unauthorized access to the attacker’s infrastructure. Investigators obtain domestic authorization for relevant hospital records and prepare targeted preservation and MLA requests.

The requests distinguish subscriber records, login metadata, stored communications, and financial records. They specify the account identifiers, time windows, suspected offences, relevance, confidentiality needs, and authentication requirements. A prosecutor consults the relevant central authorities and considers whether State B or State A is the most realistic prosecution forum.

Approach and Outcome

State C submits an expedited preservation request to the cloud provider through an available lawful channel and follows with an MLA request. State E freezes identifiable proceeds under its domestic process. State B arrests the suspect after receiving a valid provisional request, and the states begin extradition consultations. State A indicates that it may prosecute domestically if extradition is unavailable.

Forensic analysis links the hospital intrusion to a set of accounts, but investigators do not rely on an IP address alone. Provider records, recovered chat messages, payment records, and device evidence are combined. The final attribution is presented as an evidential conclusion with identified limitations rather than an unsupported certainty.

Learning Points

1. The victim state may have the strongest harm connection without controlling every piece of evidence.
2. Preservation should occur early because electronic records may be overwritten.
3. Extradition and MLA are separate: one transfers a person; the other obtains evidence or investigative assistance.
4. Technical indicators must be corroborated before individual attribution.
5. Health data requires strict minimization, authorization, and secure handling.
6. Cooperation planning should begin before an incident through contacts, treaties, and documented procedures.

11. Professional, Ethical, and Governance Responsibilities

Cybersecurity professionals may discover evidence during incident response, threat hunting, or penetration testing. They must distinguish authorized defensive activity from unauthorized investigation. “Hack back” operations against foreign systems can damage innocent systems, destroy evidence, expose the organization to liability, and violate domestic or foreign law.

Professionals should:

• obtain written authorization and define scope;
• preserve privacy and collect only necessary information;
• escalate suspected criminal conduct through approved channels;
• avoid public attribution before evidence is adequately assessed;
• protect victims from unnecessary disclosure;
• document decisions and uncertainties;
• preserve evidence without manipulating it; and
• coordinate with legal, compliance, law-enforcement, and incident-response personnel.

AI tools may assist with log triage, translation, malware clustering, or identifying relationships among indicators. They should not independently determine guilt, authorize disclosure, or replace legal judgment. AI-generated conclusions require human validation, provenance records, bias assessment, and protection of confidential evidence. Uploading investigative data to an unapproved external AI service may itself create a privacy or secrecy violation.

12. Contemporary Challenges and Best Practices

Challenges

• cloud infrastructure obscures data location;
• encryption limits access to content;
• providers and suspects may move across jurisdictions quickly;
• legal definitions differ between states;
• MLA processes may be slower than data-retention periods;
• attribution may be deliberately deceptive;
• privacy and surveillance safeguards vary;
• politically sensitive incidents may complicate cooperation; and
• limited resources reduce the ability of some states to respond.

Best Practices

Organizations should maintain an international response plan containing:

1. an incident-severity and legal-escalation matrix;
2. provider contacts and preservation procedures;
3. a record of data locations and contractual jurisdictions;
4. evidence-handling and chain-of-custody procedures;
5. relationships with national cybercrime agencies and sector regulators;
6. privacy and breach-notification decision criteria;
7. a process for obtaining judicial or executive authorization; and
8. after-action reviews that improve future cooperation.

Investigators should use the least intrusive lawful method that can achieve the objective, request narrowly defined data, explain relevance, preserve proportionality, and record all assumptions. International cooperation is more effective when requests are accurate, complete, translated correctly, and respectful of the requested state’s legal system.

Chapter Summary

Cyberspace creates overlapping jurisdictional connections because offenders, victims, devices, data, providers, and financial transactions may be distributed across countries. Territoriality remains the foundational principle, but nationality, passive personality, protective jurisdiction, and carefully limited effects-based reasoning may also apply. Jurisdiction to prescribe, adjudicate, and enforce are distinct, and a state’s authority to prosecute does not automatically authorize enforcement action in another state.

Conflicts of law require analysis of territorial connections, nationality, evidence, prosecutorial feasibility, double-jeopardy rules, human rights, privacy, and treaty obligations. Attribution must combine technical indicators with legally relevant evidence and should distinguish confidence assessment from courtroom proof. Cross-border enforcement normally depends on consent and formal mechanisms rather than unilateral action.

Extradition transfers suspects or convicted persons, while mutual legal assistance obtains evidence or investigative assistance. Preservation, accurate requests, authentication, chain of custody, and contact with central authorities are essential. The Budapest Convention, United Nations initiatives, regional arrangements, bilateral treaties, and domestic laws provide overlapping cooperation frameworks. Effective and ethical cybercrime investigation requires legality, proportionality, privacy protection, due process, and disciplined professional judgment.

Key Terms

Jurisdiction: Lawful authority to regulate, adjudicate, or enforce the law.

Territoriality: Jurisdiction based on conduct, persons, systems, or harm connected to a state’s territory.

Nationality jurisdiction: Authority based on the citizenship or nationality of the offender.

Passive personality jurisdiction: Authority based on the nationality of the victim.

Protective jurisdiction: Authority concerning conduct abroad that threatens essential state interests.

Universal jurisdiction: Jurisdiction over exceptionally serious offences recognized as prosecutable regardless of ordinary territorial connections.

Objective territoriality: Jurisdiction based on substantial effects produced within a state by conduct initiated elsewhere.

Concurrent jurisdiction: A situation in which more than one state has a legitimate jurisdictional connection.

Conflict of laws: Incompatibility or tension between the laws or legal procedures of different states.

Attribution: Association of a cyber operation with a person, group, organization, or state.

Mutual legal assistance: Formal state-to-state cooperation to obtain evidence or conduct an investigative act.

Extradition: Formal surrender of a person by one state to another for prosecution or sentence enforcement.

Dual criminality: The principle that conduct must generally be criminal in both the requesting and requested states.

Speciality: An extradition restriction limiting prosecution to the offence for which surrender was granted.

Preservation request: A lawful request to protect existing electronic data from deletion or alteration.

Electronic evidence: Digitally stored or transmitted information relevant to an investigation or proceeding.

Chain of custody: A documented history of the collection, handling, transfer, and storage of evidence.

Central authority: A designated national body that receives, sends, and processes formal cooperation requests.

Ne bis in idem: Protection against repeated prosecution or punishment for the same matter where applicable law recognizes it.

Effects principle: A basis for jurisdiction concerning substantial consequences occurring within a state.

Review Questions

Short Answer Questions

1. Distinguish jurisdiction to prescribe, adjudicate, and enforce.
2. Why is an IP address insufficient by itself to identify a cyber offender?
3. What is the difference between extradition and mutual legal assistance?
4. State two common requirements or safeguards in extradition proceedings.
5. Why should investigators submit preservation requests quickly?

Long Answer Questions

1. Explain how territoriality operates in a ransomware attack involving victims, infrastructure, and suspects in different countries.
2. Compare nationality, passive personality, protective, and universal jurisdiction.
3. Describe the main stages of a mutual legal assistance request for electronic evidence.
4. Discuss how privacy, sovereignty, and due process limit cross-border cyber investigations.
5. Explain the role of the Budapest Convention and emerging United Nations cybercrime cooperation frameworks.

Analytical / Application Questions

1. A citizen of State A attacks a financial institution in State B using a cloud server in State C and transfers proceeds through an exchange in State D. Identify the plausible jurisdictional claims and recommend a cooperation strategy.
2. A company receives foreign law-enforcement demands for employee email content without a court order. Analyze the legal, privacy, and governance issues the company should consider before responding.
3. Investigators attribute an intrusion to a suspect because malware resembles code used in earlier attacks and the traffic passed through the suspect’s home network. Evaluate the strength and weaknesses of this attribution and identify additional evidence needed.

Multiple Choice Questions with Answers

Question 1

Which type of jurisdiction is primarily based on conduct occurring within a state’s territory?

A. Territorial jurisdiction

B. Universal jurisdiction

C. Passive personality jurisdiction

D. Protective jurisdiction

Correct Answer: A. Territorial jurisdiction

Question 2

What is the main purpose of an extradition process?

A. To preserve cloud logs

B. To transfer a person to another state for prosecution or sentence enforcement

C. To authenticate a hash value

D. To regulate domain names

Correct Answer: B. To transfer a person to another state for prosecution or sentence enforcement

Question 3

Which statement best describes mutual legal assistance?

A. It is a formal process for states to obtain evidence or investigative assistance from one another

B. It permits private investigators to search foreign systems without consent

C. It automatically transfers a suspect between countries

D. It eliminates all privacy protections for electronic data

Correct Answer: A. It is a formal process for states to obtain evidence or investigative assistance from one another

Question 4

Why is an IP address not conclusive proof of a person’s identity?

A. IP addresses cannot be recorded

B. An IP address may belong to a compromised device, proxy, VPN, or shared network

C. IP addresses are always encrypted

D. Courts never admit network evidence

Correct Answer: B. An IP address may belong to a compromised device, proxy, VPN, or shared network

Question 5

The dual-criminality principle generally requires that:

A. The suspect has two nationalities

B. The conduct is criminal in both the requesting and requested states

C. Two victims must be involved

D. Two separate prosecutions must occur

Correct Answer: B. The conduct is criminal in both the requesting and requested states

Question 6

Which item is most directly associated with proving that digital evidence was not altered after collection?

A. A cryptographic hash value

B. An extradition treaty

C. A nationality certificate

D. A diplomatic protest

Correct Answer: A. A cryptographic hash value

Question 7

What does the speciality principle commonly restrict after extradition?

A. The state’s ability to preserve data

B. Prosecution for offences other than those for which surrender was granted

C. The victim’s ability to report a crime

D. The use of domestic cybersecurity legislation

Correct Answer: B. Prosecution for offences other than those for which surrender was granted

Question 8

Which framework is widely known for harmonizing cybercrime offences and facilitating electronic-evidence cooperation?

A. The Budapest Convention on Cybercrime

B. The Geneva Convention on Road Traffic

C. The Chicago Convention on Aviation

D. The Berne Convention on Postal Services

Correct Answer: A. The Budapest Convention on Cybercrime

Question 9

Which action is generally most appropriate when electronic logs may soon be deleted?

A. Launch an unauthorized counterattack

B. Publish an unverified attribution

C. Seek lawful preservation through appropriate channels

D. Delete affected logs to protect privacy

Correct Answer: C. Seek lawful preservation through appropriate channels

Question 10

Why must technical attribution be distinguished from legal attribution?

A. Technical evidence is never useful in court

B. Legal responsibility requires proof of relevant conduct and mental elements under applicable law

C. Legal attribution depends only on the victim’s opinion

D. Technical attribution applies only to physical crimes

Correct Answer: B. Legal responsibility requires proof of relevant conduct and mental elements under applicable law