EXECUTIVE SUMMARY to elements or effects of the act, or the location of computer systems or data utilized for the offence. Where they arise, jurisdictional conflicts are typically resolved through formal and informal consultations between countries. Country responses do not reveal, at present, any need for additional forms of jurisdiction over a putative ‘cyberspace’ dimension. Rather, forms of territoriality-based and nationality-based jurisdiction are almost always able to ensure a sufficient connection between cybercrime acts and at least one State. Forms of international cooperation include extradition, mutual legal assistance, mutual recognition of foreign Means of obtaining extra‐territorial evidence judgments, and informal policeto-police cooperation. Due to 4% 6% Formal MLA request the volatile nature of electronic Informal police cooperation 8% evidence, international Direct contact with service cooperation in criminal matters provider in the area of cybercrime 24/7 network point of 9% contact requires timely responses and Other the ability to request specialized investigative actions, such as preservation of computer data. 73% Use of traditional forms of cooperation predominates for Source: Study cybercrime questionnaire. Q105. (n=56, r=221) obtaining extra-territorial evidence in cybercrime cases, with over 70 per cent of countries reporting using formal mutual legal assistance requests for this purpose. Within such formal cooperation, almost 60 per cent of requests use bilateral instruments as the legal basis. Multilateral instruments are used in 20 per cent of cases. Response times for formal mechanisms were reported to be of the order of months, for both extradition and mutual legal assistance requests, a timescale which presents challenges to the collection of volatile electronic evidence. Sixty per cent of countries in Africa, the Americas and Europe, and 20 per cent in Asia and Oceania, report channels for urgent requests. However, the impact of these on response times is unclear. Modes of informal cooperation are possible for around two-thirds of reporting countries, although few countries have a policy for the use of such mechanisms. Initiatives for informal cooperation and for facilitating formal cooperation, such as 24/7 networks, offer important potential for faster response times. They are, however, under-utilized, handling around three per cent of the total number of cybercrime cases encountered by law enforcement for the group of reporting countries. Formal and informal modes of cooperation are designed to manage the process of State consent for the conduct of foreign law enforcement investigations that affect a State’s sovereignty. Increasingly, however, investigators, knowingly or unknowingly, access extraterritorial data during evidence gathering, without the consent of the State where the data is physically situated. This situation arises, in particular, due to cloud computing technologies which involve data storage at multiple data centres in different geographic locations. Data ‘location’, whilst technically knowable, is becoming increasingly artificial, to the extent that even traditional mutual legal assistance requests will often be addressed to the country that is the seat of the service provider, rather than the country where the data centre is physically located. Direct foreign law enforcement access to extraterritorial data could occur when investigators make use of an existing live connection from a suspect’s device, or where investigators use lawfully obtained data access credentials. Law enforcement investigators may, xxv