Cybercriminals rarely go to jail because almost every stage of catching one works against investigators: offenders hide behind anonymizing technology, operate from countries that refuse to extradite, exploit slow cross-border legal processes, generate evidence that is fragile and contested, and target victims who often never report the crime. The laws on the books are strict. The problem is getting a suspect into a U.S. courtroom in the first place.
The scale of the mismatch is the starting point. In 2024, the FBI’s Internet Crime Complaint Center took in 859,532 complaints reporting $16.6 billion in losses, a 33 percent jump from the prior year. Over five years, IC3 has logged 4.2 million complaints and $50.5 billion in reported losses.1FBI Internet Crime Complaint Center. 2024 IC3 Annual Report IC3 itself acknowledges it cannot respond to every submission; reports feed into broader FBI investigations and get shared with field offices and partner agencies.2FBI Internet Crime Complaint Center. IC3 Home Page Agents triage toward the largest-dollar cases. Most individual victims never see their case actively investigated.
Offenders Can Hide Their Identity
The internet was not designed to make users easy to find, and cybercriminals use that to their advantage. Traffic routed through a Virtual Private Network or the Tor network bounces through servers around the world, so the user’s real IP address never touches the target system. Cryptocurrencies add another layer: a ransomware operator can collect payment without ever connecting to a bank that checks identification.
Botnets make things worse. An attacker who controls thousands of compromised devices can launch operations that appear to originate from those devices, pointing investigators toward innocent people. A quieter technical problem also helps offenders stay hidden. Because the supply of traditional IP addresses has been exhausted, internet providers now use a system that lets dozens or hundreds of subscribers share a single public IP address at the same time. When investigators trace malicious traffic to that address, the provider’s own logs may not reliably identify which customer was responsible. Research into this shared-address infrastructure has found that reverse-tracking produces high rates of false positives.
None of these tools is impenetrable. Law enforcement has unmasked Tor users through timing analysis, correlating the size and timing of data packets entering and exiting the network to link activity to a specific person. German investigators reportedly achieved this multiple times during a single investigation. Those techniques require sustained surveillance of network nodes, significant computing resources, and legal authority to monitor traffic. They work in high-priority cases against known targets. They do not scale to hundreds of thousands of annual complaints.
Many Operate from Countries That Won’t Extradite
This is arguably the single biggest reason cybercriminals avoid jail. Many of them live in countries that have no interest in handing them over. Russia has long been understood to tolerate cybercriminal operations directed at foreign targets, and it has no extradition treaty with the United States. Russian leadership has occasionally signaled willingness to discuss conditional exchanges of suspects, but those discussions have never produced a functioning agreement. A ransomware operator sitting in Russia is effectively untouchable by U.S. law enforcement as long as they stay put.
Other countries present similar problems for different reasons. Some lack the legal infrastructure or technical capacity to investigate cybercrime, even when they are willing in principle. Others have political relationships that make cooperation with Western law enforcement unlikely. The result is a patchwork of safe harbors where offenders can operate with minimal personal risk.
Cross-Border Investigation Is Painfully Slow
Even when a suspect is in a cooperative country, the mechanics of a cross-border case are grinding. A cybercriminal might sit in one country, target victims in a second, and route an attack through servers in a third. Which country has jurisdiction? The answer is often unclear, and resolving it takes time that lets evidence grow stale.
The traditional tool for cross-border evidence gathering is the mutual legal assistance treaty, or MLAT. These agreements let one country formally request that another collect evidence, interview witnesses, or serve legal process on its behalf. The process is notoriously cumbersome. U.S. law enforcement cannot simply fly to a foreign country to conduct searches, question suspects, or seize documents; without the foreign government’s agreement to cooperate, prosecutors have limited options. Cooperation varies greatly from country to country, and each legal system imposes its own demands.3Federal Judicial Center. Mutual Legal Assistance Treaties and Letters Rogatory
Extradition adds another layer of delay. Even between countries with strong diplomatic relationships, the process is often protracted, politically sensitive, and subject to legal challenges at every stage.4United States Department of Justice. Justice Manual 9-15.000 – International Extradition and Related Matters
The Budapest Convention Has a Hole in It
The closest thing to a global cybercrime cooperation framework is the Council of Europe’s Convention on Cybercrime, commonly called the Budapest Convention, along with its Second Additional Protocol on enhanced cooperation and faster disclosure of electronic evidence. The Protocol provides tools for direct cooperation with service providers, faster access to subscriber and traffic data, immediate cooperation in emergencies, and joint investigations, all subject to human rights and data protection safeguards.5Council of Europe. Second Additional Protocol to the Cybercrime Convention on Enhanced Co-operation and Disclosure of Electronic Evidence Membership has been growing, with countries from Brazil to New Zealand ratifying in recent years.
The problem is who is not at the table. Russia and China, two of the countries most commonly associated with state-tolerated cybercriminal activity, have not signed the Budapest Convention. Without the participation of the countries where a large share of offenders operate, even the best cooperation framework has a gaping hole.
The CLOUD Act Helps, Partially
The United States passed the CLOUD Act in 2018 partly to speed up the evidence-gathering bottleneck. If a tech company is subject to U.S. jurisdiction, law enforcement can compel it to produce data regardless of where that data is physically stored. Qualifying foreign governments can also make direct requests to U.S.-based providers, bypassing the slow MLAT process. Federal prosecutors still need a warrant based on probable cause to obtain communications content, but the law eliminates the argument that data stored on a server in Ireland or Germany is beyond the reach of a U.S. court order. The CLOUD Act is a meaningful improvement when evidence sits on platforms controlled by U.S. companies. It does nothing when the data is held by a provider in a non-cooperating country.
Digital Evidence Is Hard to Preserve and Easy to Challenge
Even when investigators identify a suspect, building a case that holds up in court is its own problem. Digital evidence is volatile. Data can be altered, deleted, or encrypted, and it changes every time a system is rebooted or a file is accessed. Investigators must preserve evidence in a way that proves it was not tampered with between collection and trial, documenting every person who handled it and every step taken. This chain-of-custody requirement is simple in concept and extraordinarily resource-intensive in practice.
Encryption creates a separate obstacle. When a suspect’s communications or files are encrypted with strong algorithms, the contents may be effectively inaccessible without the decryption key. Investigators face a choice between trying to compel the suspect to provide the key, which raises constitutional questions, or attempting to crack the encryption, which may be technically impossible within any useful timeframe.
AI-generated media is adding a new wrinkle. As deepfake tools become widely accessible, courts are growing more skeptical of standard digital files because metadata can be stripped, timestamps can be spoofed, and file contents can be altered without leaving visible traces. A proposed Federal Rule of Evidence 707, released for public comment in August 2025, addresses AI-generated evidence directly. For prosecutors, the bar for authenticating digital evidence keeps rising while the cost of challenging it keeps falling. Defense attorneys can argue that screenshots, chat logs, or video evidence could have been fabricated with readily available AI tools, forcing the prosecution to spend more to prove authenticity.
Investigators Are Outnumbered and Outspent
The resource gap between cybercriminals and the agencies chasing them is enormous. FBI Director Christopher Wray told Congress that China alone has a hacking program larger than every other major nation combined, and that even if every FBI cyber agent and intelligence analyst focused exclusively on that single threat, Chinese hackers would still outnumber FBI cyber personnel by at least 50 to 1. The fiscal year 2025 budget request included just 12 additional positions and $7 million to enhance cyber response capabilities, against a threat that grows by double-digit percentages annually.6Federal Bureau of Investigation. A Review of the President’s Fiscal Year 2025 Budget Request for the Federal Bureau of Investigation
Local and state law enforcement are further behind. Most departments lack the specialized tools, training, and personnel to investigate anything beyond straightforward online fraud. Sophisticated attacks involving custom malware, encrypted communications, or blockchain obfuscation require expertise that simply does not exist in most agencies. Cybercriminals know this. The same attack that might draw FBI attention if it hit a Fortune 500 company will likely go uninvestigated if it hits a small business or an individual.
Most Cybercrimes Are Never Reported
You cannot prosecute a crime nobody tells you about. Research has found that nearly half of IT and security professionals were aware of a cyberattack on their organization that was never reported to the appropriate external authorities. Among the reasons: 43 percent cited fear of consequences, 36 percent assumed a report was unnecessary, and 32 percent simply forgot.
Companies also have strong incentives to handle breaches quietly. Public disclosure can damage stock prices, trigger regulatory scrutiny, and erode customer trust. Even with mandatory reporting rules expanding, including the SEC’s requirement that public companies disclose material cybersecurity incidents within four business days of determining materiality, many incidents fall below the reporting threshold or get classified in ways that avoid formal disclosure. The gap between crimes committed and crimes reported is one of the largest reasons offenders face no consequences. In many cases, nobody is even looking for them.
The Penalties Aren’t the Problem
When a cybercriminal does end up in a U.S. courtroom, the sentencing exposure is serious. Under the Computer Fraud and Abuse Act, unauthorized access to classified information can bring up to 10 years for a first offense and up to 20 years for a repeat offense. Unauthorized access for financial gain, computer fraud, and intentional damage to a protected computer each carry multi-year maximums that double for repeat offenses, with intentional damage reaching up to 20 years when the harm is serious. Simple unauthorized access without aggravating factors tops out at a year for a first offense.7Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers These charges can also stack with wire fraud, identity theft, and money laundering counts, meaning a convicted cybercriminal can face decades. The laws are not the weak link.
What’s Starting to Close the Gap
The situation is not static. Blockchain analysis has become one of law enforcement’s most powerful tools for following cryptocurrency payments. Specialized firms help agencies trace funds across multiple blockchains, identify the entities behind anonymous wallets, and freeze stolen assets before they can be cashed out. These capabilities have contributed to the seizure of billions in illicit cryptocurrency and have been central to disrupting major ransomware operations, including the takedown of the LockBit group through coordinated action by the U.S. Department of Justice, FBI, and international partners.
The regulatory landscape is shifting too. FinCEN has moved toward designating cryptocurrency mixing services as a primary money laundering concern, which would impose reporting obligations on financial institutions that interact with mixers. The goal is to cut off the tools that cybercriminals use to obscure the flow of stolen funds. On the evidence side, forensic standards that capture digital files with cryptographic hashes at the moment of creation make it harder to challenge authenticity later. And the CLOUD Act’s direct-request framework is gradually reducing the time it takes to obtain electronic evidence from U.S.-based technology companies for qualifying countries.
These improvements are real but incremental. The fundamental asymmetry remains. Attackers need to find one vulnerability. Defenders and investigators need to get everything right across technical, legal, and political dimensions. Until the countries where most cybercriminals operate are willing to cooperate meaningfully, the majority of offenders will continue to face no consequences at all.