deterrence. Added to this is the need for the EU to support its Member States in the development of dual-use cybersecurity capabilities. We will only begin to turn the tide on cyber-attacks when we increase the chances of getting caught and sanctioned for committing them. Cyber-attacks should be promptly investigated and perpetrators brought to justice, or action taken to allow an appropriate political or diplomatic response. In case of a major crisis with an important international and defence dimension, the High Representative could present options for an appropriate response to the Council. One step towards improving the criminal law response to cyber-attacks was already taken with the adoption in 2013 of the Directive on attacks against information systems.59 This established minimum rules concerning the definition of criminal offences and sanctions in the area of attacks against information systems and provided for operational measures to improve cooperation amongst authorities. The Directive has led to substantive progress in criminalising cyber-attacks at a comparable level across the Member States, which facilitates the cross-border cooperation of law enforcement authorities investigating these types of offences. However, there is still scope for the Directive to reach its full potential if Member States were to implement all of its provisions fully.60 The Commission will continue to provide support to the Member States in their implementation of the Directive and currently sees no need to propose amendments to it. 3.1 Identifying malicious actors In order to increase our chances of bringing perpetrators to justice, we need to urgently improve our capacity to identify those responsible for cyber-attacks. Finding useful information for cybercrime investigations, mostly in the form of digital traces, is a major challenge for law enforcement authorities. We therefore need to increase our technological capability to investigate effectively including by reinforcing Europol's cybercrime unit with cyber experts. Europol has become a key actor in supporting Member States' multijurisdictional investigations. It should become a centre of expertise for Member States' law enforcement on online investigations and cyber forensics. The widespread practice of placing multiple of users – sometimes thousands of them – behind one IP address makes it technically very difficult to investigate malicious online behavior. It also makes it sometimes necessary, for example for serious crime such as child sexual abuse, to investigate large number of users in order to identify one malicious actor. The EU will therefore encourage the uptake of the new protocol (IPv6) as it allows the allocation of a single user per IP address, thus bringing clear benefits to law enforcement and cybersecurity investigations. As a first step to encourage uptake, the Commission will mainstream the requirement to move to IPv6 throughout its policies, including requirements in procurement, project and research funding as well as supporting the necessary training materials. In addition, Member States should consider voluntary agreements with Internet Service Providers to drive the take up of IPv6. 59 60 Directive 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems. COM(2017)474. 13