This section analyses the pathways available to states to investigate and prosecute cyber-enabled international crimes, drawing on a scenario to illustrate how these pathways might apply in practice.
As noted in the previous chapter, in practice there are several barriers to states conducting such prosecutions, including lack of jurisdiction, immunities, political will and resources. However, some states have already prosecuted cyber-enabled international crimes.
Over the last decade, there have been many incidents in which fighters in war zones have filmed graphic images – for example, featuring the torture, mutilation or beheading of civilians or combatants they have captured, or the degrading treatment of dead bodies – and posted them online. As noted in Chapter 2, it is a war crime to impose inhuman treatment or to commit outrages on personal dignity, in particular humiliating and degrading treatment. Some European states, whose domestic laws criminalize international crimes and provide universal jurisdiction over them, have prosecuted fighters operating in Iraq and Syria for posing in photos or videos with mutilated bodies. For example, in 2019, Oussama Akhlafa was convicted by a Dutch court of war crimes for both membership of a terrorist organization and degrading and humiliating treatment of dead bodies, as he had distributed a photo of himself in Syria via Facebook posing next to a deceased man hanging on a cross. Between 2016 and 2018, Finland, Germany and Sweden prosecuted a series of similar cases of war crimes for ‘outrages upon personal dignity’, in particular humiliating and degrading treatment.
Pathways to prosecution
To prosecute an international crime, it will be necessary both to identify the perpetrator and to gather evidence necessary to prove the elements of the crime. Where social media channels are used as a means of perpetrating or facilitating an international crime, various types of evidence may be useful. This includes mobile phone metadata such as upload times, usernames and log-in history; intercept/wiretap intelligence of communications between fighters; or open-source intelligence (OSINT). Examples of the latter include YouTube videos, Facebook posts, geospatial imagery or online forum comments.
Rules on the admissibility of evidence in court vary between jurisdictions. In civil law jurisdictions, for example, the inquisitorial system means that the court itself actively investigates and gathers evidence, including from the police. By contrast, in common law countries like Australia, Canada and the UK, where criminal law is tried by a judge and jury in an adversarial system, additional enquiries and further evidence (such as witness testimony) are typically needed to ensure that digital evidence is corroborated and therefore admissible. It is notable that the cases mentioned above were all prosecuted in civil law jurisdictions.
Even where states have the jurisdictional basis in their domestic law to prosecute international crimes, many currently lack expertise, experience and resources in this area.
Even where states have the jurisdictional basis in their domestic law to prosecute international crimes, many currently lack expertise, experience and resources in this area. For those states that do have jurisdiction and resources, some war crimes units are still relatively new. International crimes units within prosecution authorities are typically detached from those that focus on cybercrime. But investigation and prosecution of cyber-enabled international crimes depend on expertise from both areas, so skills and communications should be pooled across teams. Development of this kind of pooled capability would help national authorities to take a proactive approach to identifying where cybercrimes may violate international criminal law as well as domestic criminal law.
In practice, cyber means will not usually be used in isolation to commit international crimes, but rather in combination with physical means. National authorities may choose to prosecute the cyber element as part of a wider package of criminal conduct. The paragraphs below discuss the diverse sources and types of evidence that may be relevant to cyber-enabled international crimes (and in some cases, to international crimes more broadly), as well as the frameworks available for prosecutors to obtain this evidence.
Frameworks for prosecutors to obtain evidence
In Scenario 1 above, it may be possible for state A to prove the identity of the perpetrator from the images on the smartphone. While the smartphone itself may be in state A’s possession, access to the images and videos may be complicated if the fighter deleted them before being captured, or if they were stored on a server located outside the jurisdiction of state A. State A would also need to establish a lawful basis for accessing those images. In relation to the video’s dissemination, state A would need to establish how the images were distributed (for example, via which social media platform, to which audience, at what scale and with which effects). These issues would likely require cooperation between state A and other states and private actors (such as technology companies) to obtain the evidence required.
States typically cooperate with each other on the investigation or prosecution of criminal offences through mutual legal assistance. A mutual legal assistance treaty (MLAT) is an international agreement between states that facilitates cooperation on activities such as gathering evidence, locating suspects or freezing assets. Requests for assistance under bilateral MLATs are usually made through a formal letter to a central authority. However, MLAT procedures can be slow and bureaucratic, often taking months, if not years, to complete. A state receiving such requests for information may be reluctant to provide it, if it has concerns about due process or human rights in the requesting state (for example, if the requesting state enforces the death penalty for the offence in question). The receiving state may also be restricted in what it can provide under data protection law.
The Ljubljana–The Hague Convention is the first international agreement specifically designed to facilitate mutual legal assistance in relation to the prosecution of international crimes. The convention contains various provisions on exchange of evidence that are designed to bypass the bureaucracies of the MLAT system, including the spontaneous exchange of information relating to crimes and the establishment of single points of contact. Once the convention enters into force, these provisions should speed up the exchange of evidence on international crimes between states parties.
Cybercrime treaties provide another route for states to obtain electronic evidence from another state, provided that the request for evidence is within the scope of the relevant treaty. As the OTP policy paper notes, certain conduct involved in cybercrime, such as the non-consensual hacking of a computer, may also form part of a cyber-enabled international crime. Provisions on mutual legal assistance in recent cybercrime treaties are quite wide in scope – for example, the Budapest Convention on Cybercrime of 2001, which currently has 81 states parties (including the US), refers to ‘mutual legal assistance… for the purpose of investigations or proceedings concerning criminal offences related to computer systems and data’. Where there is no MLAT in place, the Budapest Convention could therefore provide a basis for states to make requests for evidence relating to cyber-enabled international crimes that concern computer systems and data. Such requests can be made on an expedited basis, if necessary, through a designated point of contact, available 24 hours a day, seven days a week.
The UN Convention against Cybercrime, which was signed in Hanoi, Vietnam in October 2025 by 71 states and the EU, could be applied to cyber-enabled international crimes as well as ordinary cybercrimes, as it refers to general principles of cooperation in relation to ‘the collecting, obtaining, preserving and sharing of evidence in electronic form of any serious crime’. The UN convention, once in force, will require states parties to build their capacity to prosecute cyber-related crimes by criminalizing behaviour relevant to these crimes – for example, making access to a computer without permission an offence – and establishing single points of contact in relation to inter-state requests for evidence. In due course, the UN convention may attract support from a wider range of states than the Council of Europe’s Budapest Convention, including those in the Global South.
The strengthening of procedures for exchanging electronic evidence under the UN Convention against Cybercrime could therefore be useful in the context of prosecution of cyber-enabled international crimes. At the same time, civil society groups continue to raise concerns about inadequate human rights safeguards in the UN convention, especially in terms of cooperation between States. Once the UN convention comes into force, it will be important that states parties implement their obligations in accordance with international human rights law.
Some states may seek to access data in the territory of other states without consent for the purpose of investigating cybercrime or cyber-enabled international crimes (for instance, by covertly gaining access to networks in another state) because relevant data is increasingly stored beyond national borders. Where evidence of a cyber-enabled international crime has been obtained in this way, several issues arise. Firstly, some states and scholars consider that obtaining information in this way could constitute a violation of international law. If so, the question arises as to whether a court would admit the evidence in court. Even if it did – for which there is some precedent – a state may be reluctant to submit the evidence to court because they may not wish to reveal how it was obtained. As the national position of the Netherlands notes, opinion is divided as to what qualifies as exercising investigative powers in a cross-border context and, ‘the manner in which the principle of sovereignty should be applied has not fully crystallised at the international level’.
Obtaining open-source digital data
In the cases prosecuted in Germany, Finland and Sweden, publicly available, electronically recorded footage of the crimes charged and online commentary by the defendants about the crimes charged were crucial to the success of the prosecutors’ case. Increasingly, NGOs and ‘citizen journalists’ also gather their own information to support accountability for international crimes.
As with more traditional types of evidence, a court would need to look carefully at the credibility of open-source digital information, including the clarity of the information presented and the nature of the organization presenting it. Where open-source evidence is in digital format, manipulation is easy to do and often hard to detect. AI tools can be used to fabricate audio recordings and digital evidence (e.g. through deepfakes) to a convincing standard, potentially undermining the credibility of video footage presented in legal proceedings and jeopardizing prosecution.
Owing to the potential for manipulation, in the scenario above, it would be necessary first to authenticate the video in the proceedings.
The difficulty sometimes of proving the provenance and reliability of open-source material means that prosecutors will often seek to corroborate digital materials with other forms of evidence such as witness testimony or intelligence reports. In the case of Bemba et al, the prosecution’s submission of photos posted on Facebook was challenged by the defence on the grounds that the images had not been properly verified. In that case, however, the Trial Chamber held that the facts had been adequately established through alternative evidence.
Another potential problem in this context is that social media companies sometimes take down content that could constitute valuable evidence where their algorithms detect a violation of terms of service. Often, these removals occur precisely because the content is deemed violent or inhumane. But when digital platforms remove content, nothing generally prevents them from preserving that content and any other relevant data for future investigations. Where there is a serious risk of international crimes being committed, platforms should preserve evidence on their own initiative.
Non-public content and non-content data
National prosecuting authorities may need information from technology companies that is not available publicly – for example, private messages sent via social media or IP history from internet platforms. The relevant evidence will often be held by one of the large US-based technology companies that dominate the market for such services (e.g. Google, Meta, Microsoft and X). However, US law prohibits technology companies in the US from being able to share certain data in response to requests from foreign governments. The Stored Communications Act (SCA) in particular contains restrictions on companies disclosing the contents of stored electronic communications, while the Electronic Communications Privacy Act 1986 (ECPA) restricts telecommunications companies from the disclosure of certain content data such as email.
Private entities may also be subject to conflicting obligations in relation to the handling of data – for example, when a company receives an order from a government in one state requiring the disclosure of data, but due to the policies of the company (e.g. on user privacy) or laws of the host state, the company is not in a position to hand over the data requested. For example, Telegram is well known for taking a strong stance on user privacy. In the context of accusations against it of enabling cybercriminals, the company changed its policy to enable the provision of some user data to law enforcement authorities, including for cybercrime investigations. Commercial and prosecutorial interests may also conflict: if, for instance, a private company providing technical assistance to a prosecuting authority in relation to one matter is implicated in one of the situations that the authority is deciding whether to investigate.
In recent years, states have developed avenues to facilitate access to information from US technology companies. The US Clarifying Lawful Overseas Use of Data Act (Cloud Act), enacted in 2018, amended the SCA to require US telecommunications companies to provide data in their possession, and to enable foreign governments to seek data directly from those companies without prior review by the US government. So far, the US has entered into bilateral agreements with two countries: Australia and the UK. The UK–US Data Access Agreement allows US and UK law enforcement agencies directly to request data held by the telecommunications providers in the other party’s jurisdiction, for the exclusive purpose of preventing, detecting, investigating and prosecuting serious crimes such as terrorism or child sexual abuse and exploitation. The agreement covers subscriber information, as well as content data.
Another route for prosecutors to gather evidence from US technology companies is through subsidiaries of those companies based elsewhere in the world, where applicable. For example, most of the major US-based technology companies have subsidiary offices in Ireland. States wishing to obtain data from those companies may be able to submit a request to the relevant authorities in Ireland (rather than to their US headquarters), which could then obtain a court order to compel the Irish subsidiary company to provide the requested information. In assessing a request, companies take into account not only Irish law (which does not contain the same restrictions on sharing content data as the US ECPA), EU law (including data protection law such as GDPR), the law of the requesting country (including compliance with the rule of law), international norms (including international human rights law), and the company’s own policies.
Some technology companies have become more comfortable with responding to government requests for non-content data on a voluntary basis, subject to consideration of legal and policy issues.
The US ECPA only applies to content data. Some technology companies have become more comfortable with responding to government requests for non-content data – such as registration data, IP history and device information – on a voluntary basis, subject to consideration of the legal and policy issues above. When a technology company is assessing whether the requesting state complies with the rule of law, it will take into account whether that state is a party to the Budapest Convention, which requires states parties to abide by certain human rights safeguards in relation to the handling of information by law enforcement authorities.
Under the EU’s e-Evidence Framework, which is due to take effect from 2026, law enforcement and judicial authorities in one member state will be able to request electronic evidence, including subscriber data, directly from a service provider in another member state. The EU’s e-Evidence Regulation requires a broad range of service providers (including internet domain name entities, internet service providers and cloud service providers) to preserve certain data categories on receipt of an order, and to disclose them within 10 days of receipt of an EU e-Production order. The Second Additional Protocol to the Budapest Convention will also enable states parties to obtain electronic data (such as subscriber information and traffic data) directly from service providers located in other countries, regardless of whether there is an MLAT in place. While the protocol is not yet in force, some of the major technology companies are already working to ensure compliance with its provisions as a matter of policy.
These rules are an improvement on the current situation, in which prosecutors must deal with a variety of company policies on disclosure and preservation of evidence. Further, those companies that either do not have a well-established preservation policy or have been refusing to comply with requests for disclosure will now have to comply. SIRIUS, an EU-funded project, helps law enforcement and judicial authorities in EU member states to access cross-border electronic evidence in the context of criminal investigations and proceedings. It has 8,000 members from the law enforcement and judicial communities, representing 47 countries worldwide, and has directly supported 70 police operations.
However, even when technology companies do hand over information requested by law enforcement agencies, those agencies may lack the capacity to deal with the volume of data provided, both in terms of storage and authentication. Some states, such as France, the Netherlands, Singapore, the UK and the US, have implemented digital evidence management systems (DEMS) that facilitate the storage, indexing and analysis of digital evidence. But many other states lack these resources.
National prosecuting authorities investigating international crimes may also seek support from the OTP. The OTP’s policy paper on cyber-enabled international crimes notes that such support may include intelligence-sharing, evidence, situation briefs, and holding strategic consultations on case selection and prioritization. Cooperation between states and the OTP is discussed in more detail in the scenarios below.
4.2 Investigation and prosecution by the ICC
