Jurisdiction, Attribution and International Cooperation

Introduction and context

Cybercrime is often committed through infrastructure, accounts, devices and victims located in several countries. A person in State A may use a compromised server in State B to attack a company in State C, while evidence is stored by a cloud provider in State D. This creates a central legal problem: which state may investigate, prosecute and adjudicate the conduct, and how can evidence or suspects be obtained lawfully?

This chapter examines jurisdiction, attribution and international cooperation as connected problems. Jurisdiction concerns legal authority. Attribution concerns the identification and evidential linkage of conduct to a person, group or state. International cooperation supplies mechanisms through which authorities can preserve evidence, obtain data, conduct searches, transfer suspects and coordinate prosecutions.

Cybercrime law must balance effective enforcement with sovereignty, legality, privacy, due process and the rights of accused persons. Technical possibility does not itself create legal authority. A police agency may be able to access a foreign computer, but that does not necessarily mean it may lawfully do so.

Learning objectives

By the end of this chapter, a learner should be able to:

1. Distinguish territorial, nationality, protective and universal jurisdiction.
2. Explain why cybercrime produces concurrent and conflicting jurisdiction.
3. Describe the legal and technical difficulties of attribution.
4. Compare extradition, mutual legal assistance and direct cross-border data requests.
5. Explain the role of international conventions, regional instruments and police cooperation.
6. Apply a structured method to a cross-border cybercrime scenario.
7. Identify safeguards concerning sovereignty, privacy, proportionality and fair trial rights.

1. Jurisdiction in cyberspace

Jurisdiction is the authority of a state or court to regulate conduct, investigate offences and decide legal disputes. Three dimensions are commonly distinguished:

• Prescriptive jurisdiction: authority to make laws applicable to conduct or persons.
• Enforcement jurisdiction: authority to investigate, arrest, search, seize or compel compliance.
• Adjudicative jurisdiction: authority of a court to hear and decide a case.

These dimensions do not always coincide. A state may prescribe criminal liability for conduct affecting its citizens but still require foreign cooperation to collect evidence located abroad.

1.1 Territorial jurisdiction

Territorial jurisdiction is based on the location of conduct, effects or relevant infrastructure. In cybercrime, territorial connections may include:

• the offender’s physical location;
• the victim’s location;
• the location of a computer system or server;
• the place where loss or harm occurred; and
• the location where preparatory or completed conduct took place.

Many legal systems use an objective territorial principle: a state may exercise jurisdiction when conduct outside the state produces substantial effects inside it. A criminal message sent abroad may therefore fall within local jurisdiction if it causes a legally recognized domestic harm.

Server location must be treated carefully. A server may be selected automatically by a content-delivery network, and its physical location may have little relationship to the offender’s intention or the victim’s harm. Nevertheless, it can create an evidential or territorial connection under domestic law.

1.2 Nationality and personality principles

Under the active nationality principle, a state may prosecute its nationals for offences committed abroad. Under the passive personality principle, jurisdiction may be based on the nationality of the victim. The latter is more controversial when used alone, but is increasingly relevant to large-scale online fraud, identity theft and attacks on nationals.

A state may also exercise jurisdiction over corporations incorporated in, or operating from, its territory. Corporate jurisdiction raises questions about the conduct of employees, contractors, subsidiaries and cloud-service providers.

1.3 Protective and universal jurisdiction

The protective principle permits jurisdiction over foreign conduct that threatens essential state interests, such as national security, critical infrastructure or government systems. It must not be applied so broadly that every cyber incident becomes a national-security offence.

Universal jurisdiction is jurisdiction over particularly serious offences recognized as subject to prosecution regardless of ordinary territorial or nationality links. It is more established for certain international crimes than for ordinary cyber offences. Most cybercrime prosecutions therefore rely on territorial, nationality or protective connections rather than a general universal jurisdiction theory.

1.4 Concurrent jurisdiction

Several states may have legitimate jurisdiction over the same conduct. For example, a ransomware incident may involve:

• the state where the suspect operated;
• the state where the victim company is incorporated;
• the state where affected systems are located;
• the state where financial proceeds were received; and
• the state whose citizens suffered loss.

Concurrent jurisdiction is not automatically unlawful. It requires coordination to avoid duplicated investigations, inconsistent proceedings, unfair multiple prosecutions and inefficient use of resources. Prosecutorial authorities may consider the seriousness of harm, location of evidence, availability of witnesses, nationality of suspects and victims, sentencing rules and the likelihood of a fair trial.

2. Conflict of laws and legal choice

Conflict of laws arises when legal systems connect the same conduct differently or impose incompatible duties. A state may require a provider to disclose data, while the provider’s home state prohibits disclosure without judicial authorization. A company may be required to retain data under one law and delete it under another privacy regime.

Important conflict questions include:

1. Which state’s criminal law defines the conduct?
2. Which state has authority to collect evidence?
3. Which state should prosecute?
4. Which state’s privacy, interception and data-protection rules apply?
5. Can evidence lawfully collected in one state be admitted in another?

The principle of sovereignty generally prevents one state from exercising coercive investigative powers in another state without consent. Thus, foreign officers normally cannot enter premises, seize devices or compel a foreign provider directly unless a treaty, domestic law or recognized cooperative mechanism permits it.

Comity and reasonableness

International comity is the practice of showing respect for another state’s laws and institutions. It is not a universal substitute for a treaty. Authorities commonly assess the strength of the requesting state’s connection, the seriousness of the offence, the burden on the requested state and the effect on protected interests.

A reasonableness analysis may be especially important for cross-border data demands. Relevant factors include the type of data, the sensitivity of the information, the location and citizenship of affected persons, the existence of judicial review and the risk of exposing political speech or privileged communications.

Double jeopardy and ne bis in idem

The principle of ne bis in idem, or protection against being tried or punished twice for the same matter, may limit successive prosecutions. Its application differs across jurisdictions and treaties. Authorities should determine whether a prior foreign prosecution concerned the same conduct, whether it was final and whether the relevant legal instrument recognizes the protection.

3. Attribution: from technical indicators to legal proof

Attribution is the process of linking a cyber event to an actor. It has at least three levels:

An IP address is an investigative lead, not conclusive proof of identity. It may identify a router, virtual private network, proxy, public hotspot, compromised device or service provider rather than the human actor. Attribution should therefore be treated as a cumulative assessment of evidence.

3.1 Common attribution obstacles

Spoofing and routing. Source addresses and packet paths can be manipulated or obscured. Routing infrastructure may cross many states without the attacker having any meaningful connection to each one.

Compromised intermediaries. Attackers frequently use botnets, stolen credentials and infected servers. The owner of an intermediary system may be a victim rather than an accomplice.

Shared infrastructure. Malware families, hosting providers, code repositories and payment services may be used by many unrelated actors.

False flags. An actor may deliberately imitate another group’s language, tools or infrastructure. Technical similarity therefore requires corroboration.

Volatile evidence. Logs may be overwritten, cloud instances may be terminated and domain registrations may change. Preservation must occur quickly and lawfully.

Time and location uncertainty. Different systems use different clocks and time zones. Investigators must normalize timestamps and document the method used.

3.2 Attribution standards

Technical confidence and legal proof are different. Intelligence agencies may describe an attribution as “high confidence” based on classified sources and analytic judgment. A criminal court may require admissible evidence connecting the accused to the acts and mental state alleged in the charge.

A sound attribution process should:

1. preserve original evidence and metadata;
2. document chain of custody;
3. distinguish observation from inference;
4. test alternative explanations;
5. corroborate technical evidence with human, financial or documentary evidence; and
6. avoid overstating confidence.

Attribution should be expressed proportionately. “The account was used from an address assigned to the suspect’s workplace” is more defensible than “the suspect conducted the attack” unless additional evidence supports the conclusion.

4. International cooperation mechanisms

4.1 Mutual legal assistance

Mutual legal assistance (MLA) is formal state-to-state cooperation for obtaining evidence or performing investigative measures. A requesting state sends a request through the channel specified by a treaty or domestic law. The requested state then uses its own legal powers to obtain and transmit the material.

An MLA request commonly identifies:

• the requesting authority and legal basis;
• the facts and offences under investigation;
• the requested measures;
• the relevance and evidential purpose of the material;
• applicable procedural requirements;
• confidentiality needs and urgency; and
• assurances concerning use, storage and onward disclosure.

Requests may seek subscriber information, traffic data, stored content, device searches, witness interviews, production of records, seizure of assets or service of documents. The requested state may refuse assistance for reasons such as lack of dual criminality, political-offence concerns, danger to essential interests, disproportionate burden or inadequate human-rights safeguards.

4.2 Extradition

Extradition is the formal surrender of a person by one state to another for prosecution or enforcement of a sentence. Common principles include:

• dual criminality: the conduct is criminal in both states;
• specialty: the person is prosecuted only for the offence for which surrender was granted, subject to exceptions;
• double jeopardy: surrender is restricted where final proceedings already occurred;
• non-discrimination and fair trial: surrender may be refused where there is a serious risk of persecution or denial of justice; and
• proportionality: minor allegations may not justify the burdens of extradition.

Extradition is distinct from deportation or informal transfer. It usually involves judicial and executive stages and can take considerable time. Authorities should preserve evidence independently because extradition may fail even where the case is strong.

4.3 Police and operational cooperation

Police-to-police cooperation can support rapid intelligence exchange, threat identification, emergency preservation and coordination of arrests. Organizations such as INTERPOL provide communication channels and notices, but an international police communication is not itself a conviction or an automatic arrest warrant. Domestic law and due process remain applicable.

Operational cooperation is particularly valuable during coordinated disruption of botnets, fraudulent payment networks and ransomware infrastructure. It should be separated clearly from the evidential process: intelligence may generate leads, while evidence intended for court must satisfy applicable collection and authentication rules.

4.4 Cross-border data requests

Digital evidence may be obtained through several pathways:

Emergency disclosure may be appropriate where there is an imminent risk to life or serious physical harm. It should not become a routine substitute for judicial authorization. Investigators must identify whether the requested material is subscriber data, traffic data, content data, stored data or real-time interception, because legal thresholds often differ.

5. International frameworks

The Council of Europe Convention on Cybercrime, commonly known as the Budapest Convention, is a major framework for harmonizing offences, procedural powers and international cooperation. It addresses expedited preservation, production of stored data, search and seizure, trans-border access in limited circumstances and 24/7 contact points. Its effectiveness depends on implementation by participating states and compatibility with domestic rights protections.

The Convention has also influenced national legislation beyond its formal membership. Its Second Additional Protocol addresses enhanced cooperation and disclosure of electronic evidence, including cooperation with service providers and emergency procedures, subject to safeguards and implementation requirements.

Other relevant frameworks include regional instruments, bilateral treaties, UN processes and domestic central-authority arrangements. The United Nations Convention against Cybercrime was adopted in 2024 and establishes a global treaty framework, although implementation, interpretation and operational practice remain matters for states and institutions.

No framework eliminates legal differences. Investigators must verify current ratification status, reservations, designated authorities, procedural requirements and data-protection conditions before relying on a treaty.

6. A structured cross-border investigation model

A practical investigation can follow six stages:

1. Define the conduct and harm. Identify offences, victims, systems, financial loss and immediate risks.
2. Map jurisdictional connections. Record suspect, victim, infrastructure, financial and evidence locations.
3. Preserve volatile evidence. Send lawful preservation requests and secure local logs before they expire.
4. Select the least intrusive lawful pathway. Consider voluntary disclosure, domestic orders, MLA, treaty procedures or emergency channels.
5. Coordinate prosecutorial strategy. Discuss which state is best placed to lead, while protecting independent decision-making.
6. Validate admissibility and rights. Confirm authentication, chain of custody, privacy compliance, disclosure duties and fair-trial safeguards.

Illustrative application: the “Northern Relay” incident

Background. This fictional case concerns a ransomware attack against a hospital network in State C. The ransom demand was sent through an account created in State A. Command servers were hosted in State B, cryptocurrency moved through an exchange in State D, and investigators identified a rented apartment in State A as a possible operational location.

Problem. State C needs to restore systems and identify the attacker. State B’s provider will not release stored content without a formal legal request. The exchange in State D requires a court order. The apartment in State A is occupied by a person who may be either the offender or a victim whose credentials were stolen.

Analysis. State C has territorial jurisdiction because the hospital and harm are located there. State A has jurisdiction based on the suspect’s presence and possible conduct. State B has a strong evidence connection, while State D has a financial-tracing connection. The IP address linked to the apartment is not sufficient attribution because the network may have been compromised or shared.

Approach. State C immediately preserves hospital logs and requests emergency preservation from the provider. It sends an MLA request to State B for subscriber data, server logs and stored content, specifying the offence, time range and safeguards. It sends a separate request to State D concerning transaction records. State A conducts a domestic search only after obtaining the required judicial authorization and collects devices using forensic procedures. Prosecutors exchange information before deciding whether State A or State C is best placed to lead.

Outcome. Correlated logs, authenticated messages, device artifacts and exchange records establish that the apartment occupant rented infrastructure and controlled the extortion wallet. Evidence also shows that several intermediary servers were compromised, preventing investigators from wrongly accusing their owners. State C prosecutes the ransomware offence, while State A considers related unauthorized-access conduct under its law.

Learning points. The case demonstrates that jurisdiction is distributed, attribution is cumulative, preservation must be rapid, and formal cooperation is often necessary. It also shows why technical indicators must not be treated as proof of identity without corroboration.

7. Human rights, ethics and governance

Cross-border cybercrime enforcement must respect legality, necessity and proportionality. Broad data collection can expose medical records, journalistic sources, privileged communications and information about innocent third parties. Requests should therefore be specific in subject matter, time period and data type.

Key safeguards include judicial or independent authorization, notice where legally possible, secure transmission, purpose limitation, retention limits, correction mechanisms and remedies for unlawful disclosure. Authorities should consider encryption, data minimization and the security risks created by transferring sensitive evidence.

Artificial intelligence can assist with malware clustering, translation, timeline construction and prioritization of large evidence sets. It cannot by itself establish attribution or replace a court’s assessment of proof. Investigators should document training data, confidence limits, human review and possible bias. Automated systems may incorrectly associate a person with a device, language style or network pattern.

8. Challenges and best practices

Major challenges include slow formal procedures, inconsistent offence definitions, incompatible privacy laws, limited investigative capacity, cloud-service complexity, encryption, attribution uncertainty and political disagreement. The location of data may also be dynamic or distributed across multiple jurisdictions.

Best practices are to:

• maintain current contact details for central authorities and providers;
• use standardized, precise and translated requests;
• distinguish intelligence from admissible evidence;
• preserve data before seeking broader disclosure;
• consult prosecutors and privacy specialists early;
• document every transfer and transformation of evidence;
• test alternative attribution hypotheses;
• avoid unnecessary bulk collection;
• coordinate parallel proceedings transparently; and
• review treaties, reservations and domestic law at the time of action.

Chapter Summary

Cybercrime creates overlapping jurisdiction because conduct, victims, systems, suspects, proceeds and evidence may be distributed across states. Territorial, nationality, passive-personality, protective and limited universal principles provide possible legal connections, but enforcement powers remain constrained by sovereignty. Attribution is not synonymous with an IP address or malware similarity; it requires a documented, corroborated and legally admissible evidential chain. Extradition transfers persons, while MLA obtains evidence through state cooperation, and police channels support rapid operational coordination. Cross-border data requests must identify the type of data, use a lawful pathway and respect privacy and due process. International frameworks, including the Budapest Convention and newer global initiatives, improve cooperation but do not remove differences between legal systems. Effective practice combines rapid preservation, precise requests, prosecutorial coordination, technical caution and human-rights safeguards.

Key Terms

Jurisdiction: Legal authority to regulate, investigate or adjudicate conduct.

Prescriptive jurisdiction: Authority to make laws applicable to conduct or persons.

Enforcement jurisdiction: Authority to investigate, search, seize, arrest or compel.

Adjudicative jurisdiction: Authority of a court to hear and decide a matter.

Territorial principle: Jurisdiction based on conduct, effects or relevant events within a state.

Active nationality principle: Jurisdiction based on the nationality of the offender.

Passive personality principle: Jurisdiction based on the nationality of the victim.

Protective principle: Jurisdiction over conduct threatening essential state interests.

Concurrent jurisdiction: Overlapping legal authority of two or more states.

Conflict of laws: Incompatibility or competition between legal systems governing a matter.

Attribution: Process of linking cyber conduct to an actor.

Chain of custody: Record showing how evidence was collected, handled and transferred.

Mutual legal assistance: Formal state-to-state cooperation for investigative or evidential measures.

Extradition: Formal surrender of a person for prosecution or sentence enforcement.

Dual criminality: Requirement that conduct be criminal in both requesting and requested states.

Specialty: Limitation of prosecution to the offence supporting surrender.

Subscriber information: Data identifying a customer or account holder.

Traffic data: Data concerning the routing, timing, duration or source of communications.

Stored content: The substantive material held in an account or system.

Budapest Convention: Council of Europe Convention on Cybercrime and international cooperation.

Review Questions

5 Short Answer Questions

1. Distinguish prescriptive, enforcement and adjudicative jurisdiction.
2. Why is an IP address normally insufficient to prove the identity of an offender?
3. What is the purpose of mutual legal assistance?
4. Explain the principle of dual criminality in extradition.
5. Identify two safeguards relevant to cross-border data requests.

5 Long Answer Questions

1. Explain how territorial and nationality principles may create concurrent jurisdiction in a ransomware case.
2. Compare extradition, mutual legal assistance and police-to-police cooperation.
3. Discuss the principal technical and legal difficulties of cyber attribution.
4. Explain how sovereignty and comity affect investigations involving foreign cloud providers.
5. Evaluate the contribution and limitations of international cybercrime conventions.

3 Analytical / Application Questions

1. A victim company in State A is attacked from a compromised server in State B by a suspect in State C, with ransom proceeds in State D. Map the possible jurisdictions and recommend a cooperation strategy.
2. Investigators have malware code, an IP address assigned to a suspect’s home and cryptocurrency records. What additional evidence should be obtained before making a legal attribution?
3. A foreign provider refuses an informal request for message content but offers to preserve the data. Explain the next lawful steps and the safeguards that should accompany them.

Multiple Choice Questions with Answers

Question 1

Which form of jurisdiction concerns a state’s authority to make laws applicable to conduct or persons?

A. Prescriptive jurisdiction

B. Enforcement jurisdiction

C. Adjudicative jurisdiction

D. Universal police jurisdiction

Correct Answer: A. Prescriptive jurisdiction

Question 2

Why is an IP address generally not conclusive proof of a person’s identity?

A. IP addresses cannot be recorded in logs

B. An address may correspond to a VPN, proxy, compromised device or shared network

C. IP addresses always identify a corporation rather than a person

D. Courts cannot consider technical evidence

Correct Answer: B. An address may correspond to a VPN, proxy, compromised device or shared network

Question 3

What is the principal purpose of mutual legal assistance?

A. To transfer every suspect automatically

B. To replace domestic criminal law

C. To obtain investigative measures or evidence through formal state cooperation

D. To permit unilateral searches of foreign systems

Correct Answer: C. To obtain investigative measures or evidence through formal state cooperation

Question 4

Which principle usually requires that the conduct be criminal in both the requesting and requested states?

A. Specialty

B. Dual criminality

C. Comity

D. Passive personality

Correct Answer: B. Dual criminality

Question 5

What does the principle of specialty generally limit after extradition?

A. The state’s ability to preserve evidence

B. The suspect’s right to counsel

C. The offences for which the surrendered person may be prosecuted

D. The victim’s ability to report the offence

Correct Answer: C. The offences for which the surrendered person may be prosecuted

Question 6

Which item is most likely to be classified as traffic data?

A. The text of an email

B. The password used by a customer

C. The routing and timing information associated with a communication

D. A seized laptop’s operating system

Correct Answer: C. The routing and timing information associated with a communication

Question 7

What should investigators do when evidence is volatile and may soon be deleted?

A. Publish it immediately

B. Seek lawful preservation as soon as possible

C. Assume the provider will retain it indefinitely

D. Attribute the incident before collecting it

Correct Answer: B. Seek lawful preservation as soon as possible

Question 8

Which statement best describes concurrent jurisdiction?

A. Only the state where a server is located may prosecute

B. Several states may have legitimate jurisdictional connections to the same conduct

C. No state may prosecute a cross-border offence

D. Jurisdiction exists only after extradition

Correct Answer: B. Several states may have legitimate jurisdictional connections to the same conduct

Question 9

What is a major human-rights safeguard for cross-border data requests?

A. Collecting all available data without limits

B. Avoiding judicial review in urgent cases

C. Using specific, necessary and proportionate requests

D. Transferring data without security controls

Correct Answer: C. Using specific, necessary and proportionate requests

Question 10

Which statement about international police communications is most accurate?

A. They automatically constitute a criminal conviction

B. They eliminate the need to follow domestic law

C. They can support operational cooperation but do not replace legal process

D. They authorize foreign officers to conduct searches anywhere

Correct Answer: C. They can support operational cooperation but do not replace legal process