even where expedited mechanisms exist they are not always used. Human rights considerations, and the protection of civil liberties, may require judicial authorisation before evidence can be collected. The timescale involved may not meet the operational requirements of cybercrime investigations, especially if several different countries are involved. 1.20 This can create multiple practical challenges for investigators. The procedural requirements that matter most will often be those of another country, which requires close co-operation and access to fast and accurate legal assistance from the country involved. The extent to which human rights and independent judicial oversight are engaged may depend on the nature of the investigation or specific locations or types of information involved, and investigators need to ensure that they neither over- nor under-estimate these. On one hand, where the applicable law permits fast and informal co-operation it is important to use it effectively, but on the other hand where the nature of the co-operation sought does engage fundamental human rights interests it is equally important that they are not circumvented. Information that is on a public website or ‘subscriber/traffic data’ that only identify parties and locations without disclosing content may be more easily obtainable than the content of communications themselves. 1.21 These challenges are most commonly seen in the context of human rights, but they have national sovereignty and practical investigative aspects, and evidentiary aspects as well. For example, direct investigative measures can interfere with parallel criminal investigations in other countries, and most states reserve the right not to provide assistance where such investigations might be prejudiced. They may not co-operate with or allow the investigation of conduct which they themselves do not regard as criminal. Evidence collected in one country and used in another must often satisfy the legal admissibility requirements of both, and the use of digital evidence sometimes generates forensic challenges not encountered with tangible evidence. The offenders’ view 1.22 The Internet brings criminals together to share information on how to commit crimes and how to avoid detection. Increasingly, successful attacks are founded on knowledge, cooperation and deals created and shared between networks of individuals and groups. The Internet makes it possible for individuals to commit major transnational offences, but the majority of cybercrime represents new dimensions in domestic and transnational organised crime. Not only do networks permit much larger and more transnational organised criminal groups to form, they also permit entirely new organisational structures and relationships to form, challenging both legal definitions and investigative techniques. The technologies have transformed illicit markets by creating whole new digital commodities and transforming others into forms that can be more easily created or trafficked. Both identity-related crime and the creation of and trafficking in images of child abuse are pre-existing forms of criminality that have been so transformed. 1.23 Various forms of malware require much more skill to create than they do to use, which has made them a valuable commodity among offenders and at the same time opened up various forms of on-line crime to a wider and less-skilled body of offenders. The black market in malware is lively and enterprising individuals offer all levels of service for hire. One example is the infamous ‘Zeus’ application, which spreads from one device to another by various means, directing each infected device to copy specified information such as passwords or financial transaction dates, and return it to locations from which the offenders can retrieve it. In May 2011 the source code for Zeus was leaked online, allowing offenders to download, copy, and modify it for their own purposes. In December 2012, Symantec 15