and the speed of change can outstrip the capacity of the public sector in terms of legislation, law enforcement and training. 1.54 When gaps between the reliance a state places on technology and its capacity to combat cybercrime open up, they can be discovered by offenders anywhere, not just in the country where they arise. This makes fast-developing countries a tempting target for sophisticated offenders elsewhere, as innovative industries create new vulnerabilities, criminal techniques that no longer work against more sophisticated targets may still be viable, and the lesser capacity of local law enforcement provides protection for offenders not only from domestic investigations but transnational ones as well. Specific practical implications for small developing Commonwealth countries 1.55 Cybercrime poses additional challenges for countries with small populations. Smaller countries are no less exposed to cybercrime than larger ones, but they tend to have fewer resources and smaller law enforcement and other institutions to meet the challenge, and in proportional terms they have to expend more effort and resources than larger countries to obtain the same results. Whether a small country is able to do this depends on other factors. A small country whose economy includes significant elements that would be threatened by cybercrime, such as financial services or international commerce, such as Singapore, may be willing and able to invest heavily in preventive and law enforcement capacity whereas many other small developing countries may not be. 1.56 Developing Commonwealth countries with populations of less than 1.5 million, such as Tonga, face the same general challenges as all developing countries in the need for the resources and expertise to build adequate levels of preventive, investigative and prosecutorial capacity, but they face additional challenges in maintaining that capacity. About one-half of Commonwealth member states fall into this category. For these countries, the problem is primarily one of both human and financial resources. Developing countries with small populations have smaller governance and administrative sectors and they are less likely to have technical and policy experts in academic, private sector and other resources. The development of new cybercrime laws or the conduct of a sophisticated investigation and prosecution is no more or less difficult in Tonga than it is in the United Kingdom, but the latter has large numbers of experts in all of these areas and the former does not. Infrastructures in small states are more limited, as are the personnel and expertise needed to support them. The same general pattern holds true for cybercrime-prevention capacity in the private sector: if service providers are smaller and have fewer subscribers, their ability to establish and maintain in-house expertise and capacity is less. 1.57 Small developing countries face additional challenges in developing and maintaining capacity in most areas of crime prevention and criminal justice because expertise is more difficult to develop and maintain in smaller institutions than it is in larger ones. Once specialised expertise is established in a large police force, for example, it may become largely self-sustaining as new officers brought into a large specialised unit are gradually trained and gain expertise under more senior experts, whereas in a smaller one the only way to maintain expertise may be to send officers elsewhere for the necessary training. These problems face small developing countries in other areas as well, but they are particularly acute in the area of cybercrime because of its speed, complexity, international nature, and the pace at which the technologies and criminal misuse of them is evolving. 1.58 Moreover, the small populations and isolated locations of some Commonwealth countries do not make them any less vulnerable to cybercrime. Indeed, in some respects they may well be more vulnerable to the commission of cybercrime and to its adverse 22