II. From punch card attacks to the Budapest convention

As new technologies emerge, misuse soon follows, and the history of ICT is no exception. With a means of accessing more and more information, malign actors figured out ways to use networks to their advantage. Abusive operations started as soon as the technology existed, and they evolved together: the first cyberattack dates back to 1962, and it was performed via punch card to (successfully) steal all the passwords that would grant access to the MIT computer system.Footnote ¹² In the first manual on computer crime, published in 1979, the concern is palpable: in the span of the previous 8 years, the reported cases were already 669,Footnote ¹³ but the majority of incidents would not be reported to the authorities. Back then, prosecutors would “frequently refuse to accept the cases for a variety of reasons, including their lack of understanding of the technology […]. On the other hand, prosecutors and investigators indicate that victim’s records and documentation of crimes associated with computers in the business community are inadequate for effective prosecution.”Footnote ¹⁴

The first laws and guidelines to fight “cybercrime” were developed in that environment, with two main aims: reducing “the incidence of any type of crime in which a knowledge of computer technology is needed to understand the intentional acts that result in losses”; and successfully prosecuting the perpetrators.Footnote ¹⁵ This new avenue for antisocial behavior required new incriminating provisions, new methods of investigation, and a specific trial strategy. In the late 1970s and during the 1980s, a growing number of states criminalized conduct such as illegal access to data; illicit interception; damaging of data; and forgery of digital records. Some old notions, such as documents, where refurbished and newly defined to include also their digital counterpartsFootnote ¹⁶. Criminal law, however, was the “weapon of choice”: it was perceived as being the proper tool to update and extend, to contain the phenomenon.

The effort was welcome, but not sufficient. As computers started to enter private homes and the World Wide Web started to be more and more available, the devices were set to be ever more connected and numerous, multiplying the opportunity for digital misbehavior.Footnote ¹⁷ Cybercrime changed accordingly: a growing number of individuals had first-hand access to computers, hence the number of potential targets increased, and technical ability ceased to be the only relevant factor. Social engineering became a key component of the first organized phishing campaigns, that targeted the vulnerabilities of the users as well as those of the machines. Such operations became the most common and the most profitable in less than a decade, bringing danger to every doorstep.

On the legal front, the difficulties multiplied. The number of incidents was growing, but the investigation was becoming more difficult: an internet connection was enough to elude borders and complicate the inquiry. The need for a shared dictionary and better coordination emerged soon, and the Council of Europe was the first institution to rise to the challenge. In 1997, its Committee of Ministers established the Committee of Experts on Crime in Cyberspace (PC-CY), which received the mandate to draft an international convention on the subject. From its initial stages, the project was meant to be more than a regional agreement. The United States of America, Canada, Japan, and South Africa were also called to the negotiating table: the global dimension of cybercrime was emerging, and broadening the scope as much as possible seemed like an essential trait of a functioning agreement.Footnote ¹⁸

The Budapest Convention on Cybercrime was adopted in 2001 and has been an important milestone. It has been drafted to be flexible enough to serve as a widespread guideline – the Convention has currently seventy-six partiesFootnote ¹⁹ – and it has been a fundamental tool to harmonize criminal law and to raise awareness on topics that were still seen as somewhat unusual, such as the correct gathering and handling of digital evidence.

The Convention contains a set of substantive law provisions, addressing the need for a common understanding of what conducts should be criminalized in the cyber realm. The provisions cover four main areas. The first one details the offences against the confidentiality, integrity and availability of computer data and systems, which the explanatory report to the Convention calls “the basic threats”Footnote ²⁰ such as illegal access, data interference, system interference and misuse of devices. These infringements have become the “ground zero” of cybercrime: they are indeed the first situations that have been criminalized across borders, and they are the most relevant also in the domain of cybersecurity, as they aim to preserve the integrity of all ICT systems.Footnote ²¹

The other areas respond to a different logic, at least in part. They do not focus on the integrity of information and systems per se, but on “ordinary” crimes that could find a new dimension online. The second one addresses the most widespread “computer-related crimes”: computer-related forgery and computer-related fraud. The drafters of the Budapest convention were fully aware that most States had already criminalized such behaviors, online or offline: the added value of these provisions did not reside in their novelty but in their capability to provide a blueprint for harmonization. The Convention then moves to the criminalization of offences related to child pornography, which are defined as a “content-related” offence. The fight against the sexual exploitation of children online has been a signature issue, as technology has made victims more accessible to predators and has made it easier for criminals to groom or persuade children under false pretenses – i.e.: reaching out to them online by pretending to be a young girl in search of new friendsFootnote ²² – and has simplified the circulation of illicit material. Lastly, the convention focuses on the offences related to the infringement of copyright, aimed at protecting intellectual property in an age of increasing importance of intangible goods – and increasing ease in appropriating and sharing them illicitly.Footnote ²³

The other two sections of the Budapest Convention on Cybercrime contain procedural provisions focused on the correct gathering and handling of digital evidence and the mutual legal assistance (MLA) procedures needed to ensure the repression of cybercrime across borders.

As for the procedural provisions, they were conceived as a much-needed update to investigation techniques. As ICT was being used to perpetrate crimes, investigators needed to keep up, hence the Convention provided the basic notions and tools for an accurate digital investigation. Article 19 distinguished between data and physical storage for searches and seizures. It also provided for rules on the expedited preservation and disclosure of content and traffic data (Articles 16 and 17), on production orders (Article 18), on the live monitoring of traffic data, and on the interception of content data (Articles 20 and 21). This apparatus had the immediate effect of elevating forensically sound interventions to “best practice”: the somewhat mixed approaches of the past were not swept away,Footnote ²⁴ but the Budapest Convention was instrumental in raising awareness on the correct handling of digital material.

The heftier part of the Convention, however, deals with MLA (Articles 23–45), to regulate cooperation among different nations’ law enforcement agencies, prosecution services, and judiciaries. The transnational aspects of cybercrime, after all, were one of the main reasons to resort to an instrument such as an international treaty in the first place: it is only natural that the final text was specially devoted to ensuring smooth and swift cross-border cooperation.Footnote ²⁵ The text provides for a comprehensive set of general principles on MLA – including principles on extradition – as well as specific provisions that regulate the duty to help preserve, intercept, and access data abroad. Finally, the Convention sets up a 24/7 network, a system of national contact points that should ensure continuous and immediate assistance to foreign investigators, to build a permanent, reliable structure to fast-track cybercrime cases and quickly obtain aid from other nations. Among these provisions, Article 32 stirred controversy. It allows a party to access information that is either publicly available or stored in foreign territory without the authorization of other parties. Russia took issue with the provision, claiming it would infringe on state sovereignty by allowing unauthorized cross-border investigations. On these grounds, Russia has always refused to join the Budapest Convention.Footnote ²⁶

III. Mismatch of notions?

The Budapest Convention on Cybercrime has served as a watershed: it has harmonized legal frameworks, raised awareness of innovative investigation techniques, and underlined the need for close and quick cooperation almost a decade before the acknowledgment of cybersecurity as a forefront issue, at least for the European Union. Moreover, it has been at the center of countless activities held by the Council of Europe’s Cybercrime Programme Office, which has been hosting capacity-building programs and assisting countries in strengthening legislation, training, and policies related to cybercrime, as defined by the Budapest Convention. To make a long story short, the Budapest convention is widespread, highly regarded, and well-supported.

And yet, despite its success, its impact on cybersecurity has been marginal. Cyberattacks have been multiplying; their impact – economic and societal – has been growing, and it is projected to rise further. The situation might appear paradoxical, but it finds both theoretical and practical explanations.

Firstly, the Budapest Convention on Cybercrime is somewhat of a general tool, too unfocused to be effective from a cybersecurity perspective. The international instrument – and the national provisions that derived from it – is concerned with a multitude of problems: it is aimed at bridging an awareness gap on a wide variety of harmful behaviors that could manifest differently, or at a different intensity, thanks to the developments in communication technology.Footnote ²⁷ In other words, its scope is much broader than the strict “cybersecurity” area, hence: it is not specifically concerned with the question of how to preserve confidentiality, integrity, and the availability of information, which is the main essence of cybersecurity.Footnote ²⁸ “Cybercrime” has to cover a somewhat vaster, vaguer area, as the notion is not clearly definedFootnote ²⁹; it encompasses a whole range of harmful situations, that have been classified in countless ways by criminologists: according to one account, cybercrime should be classified into at least three categories.Footnote ³⁰ The first one encompasses the so-called “crimes against the machine,” such as unauthorized access to computer systems or information. The second one provides for the crimes committed “using the machine,” such as fraud, theft and extortion. The last one includes the “crimes in the machine,” which corresponds to the “content-related” section of the Budapest Convention: it includes extreme content such as child pornography, hate speech and radical material, eg, terrorist propaganda. Other authors have proposed different arrangements,Footnote ³¹ and the classifications are bound to grow ampler and more complex, but they do not seem to converge with the categories that are employed to classify cybersecurity threats.Footnote ³² As an increasing number of human activities display a digital component, as technology changes, the very same notion of “cybercrimes” is bound to change, encompassing more reproachable conducts and stigmatizing new digital harms. The same goes for the investigation techniques, that were once used in a small fraction of cases, where the digital dimension was inevitable. Nowadays, it is rare to encounter a criminal case that does not require the forensic copy of a computer; the decryption of a cellphone; or the authentication of some messages. Unexpectedly, the Budapest convention has done more to raise awareness of the investigation techniques deployed in the everyday work of law enforcement than for cybersecurity in a stricter sense.

From a cybersecurity perspective, this can lead to particularly dysfunctional consequences: the early warnings of potential cyberattacks come from crimes such as illicit access or misuse of data, that tend to be treated as minor cases (if they are treated at all). They can occur at distressing rates, but, on their own, they do not seem to be so harmful to take priority over other infringements. From the observatory of law enforcement agencies, phenomena like the sexual exploitation of children or big frauds deserve to be treated with the utmost urgency – and understandably so. Chances are that the mere crimes “against the machines” risk being left behind by the criminal justice system until they have been brought to more severe consequences, which would make them impossible to ignore.Footnote ³³

IV. A crisis of effectiveness

Let us assume that a cybercrime has occurred and that it has been harmful enough to be caught by the authorities’ radar. Let us assume it has been duly investigated and that there is a reasonable assumption regarding the identity of the perpetrator. Normally, the authorities would go forward with the process, formalizing charges and/or arresting the suspect according to the legal framework that the investigators are operating under.

If the accused happens to be on the territory of the state, the law enforcement agencies will be perfectly self-sufficient. One example will suffice: an Italian 24-year-old has been recently placed in precautionary detention, as he is accused of having repeatedly hacked the servers of the Italian Ministry for Justice, as well as almost fifty individual accounts of public prosecutors. He was allegedly able to exfiltrate dossiers and to directly follow the development of the case that was being built against him, so much so that the lead prosecutor declared that the investigative team started communicating only with handwritten notes: the old-fashioned paper letters were much harder for a skilled hacker to intercept.Footnote ³⁴ The investigators, eventually, identified the hacker; they discovered where he lived and followed through as they would have in any other case: upon the authorization of a judge, they arrested the suspect, searched the premises and they seized all relevant material that they could find – in this case: several terabytes of digitally stored information, as well as millions of digital assets. The suspect in this case has been formally charged and he will stand trial in Italy.

Often, however, things are not so easy. The nature of networks, and the internet in particular, makes it all too easy to attack systems that are located outside the nation, hence, outside the jurisdiction, beyond the physical reach of the law enforcement agency that has investigated the crime. At that point, the law enforcement agencies encounter two different types of hurdles. First, the investigation can be hindered, and the precise responsibility of an individual can become more difficult to ascertain. According to the 2024 ENISA Threat Landscape, 34 per cent of threats can simply not be attributedFootnote ³⁵ – not to an individual, a company, or a group.

Even when investigators manage to at least identify the area from which the attack came, cooperation is not always smooth. LEAs, at that point, could require the help of at least one foreign authority that should assist in locating the suspect, and in preserving all potential evidence connected to the case. The complexity of the inquiry, hence, raises, and with it the time that it requires: bringing in another authority and asking for cooperation is not necessarily a speedy process, and it does not necessarily yield results in a short time. First of all, the foreign authority must show the political will to cooperate with the investigation of another country. Within the EU, the point does not normally pose issues, but the landscape of threats is much wider than that, and the rising international tensions do not help to ensure smooth cooperation. The principal sources of the detected cyber threats are the so-called “state-nexus actors”Footnote ³⁶: they are organized groups, connected to nation-states, that are normally well-organized and well-financed. They are supposed to do their government’s bidding; hence, they enjoy a good level of protection from prosecution: they can operate with the relative certainty that they will never be surrendered to a foreign authority. The criminal justice system, in such cases, simply cannot work, which does not mean that the perpetrators – if identified – must go unpunished. Where this expression of state sovereignty fails, others could fill in: states can react with a wide variety of tools, including targeted sanctions on the individuals deemed responsibleFootnote ³⁷ for a state-sponsored cyber-counterstrikeFootnote ³⁸; it is the fast-evolving realm of cyber-diplomacyFootnote ³⁹ and cyber-warfare.Footnote ⁴⁰

State-nexus actors are not the only ones who can benefit from this kind of de facto immunity from foreign prosecution. Also group of cyber-criminals, motivated by profit, can be based in states that routinely refuse cooperation, often on the grounds of geopolitical interests and alliances. The lack of cooperation can either make the investigation impractical – making it harder to identify the offending individual or confirm suspicions – or it can make the enforcement impossible. If a sovereign nation refuses to hand over the alleged perpetrator, the criminal justice system is practically toothless: in some jurisdictions, suspects can be tried in absentia Footnote ⁴¹ but, even if the criminal proceedings ended up in a conviction, it would be very difficult – if not straight out impossible – to see the sentence carried out. In the majority of cases, the wheels of the expensive criminal justice machine would have turned to no avail, which makes alternative approaches much more convenient. The imposition of administrative sanctions does not require a complex, contradictory proceeding that ensures all the guarantees that the criminal justice system should respect. Furthermore, it does not require the cooperation of any other subject: it is a unilateral decision that puts the state (or the regional entity, such as the EU) back in control of its response. The effectiveness of the two tools appears to be the same, but the latter comes faster and at a lower cost.

V. The UN convention on cybercrime: a step towards an improved international cooperation?

Against such a background, one might believe criminal law to be a semi-abandoned tool. The assumption, however, would be wrong. International and regional organizations are renewing and reshaping the tools of criminal law and criminal procedure, with a variety of initiatives that often differ in style and overall objectives.

Many European efforts, led by the Council of Europe and the European Union, have been focused on the relationship between state authorities and service providers with at least three significant instruments: the Second Protocol to the Budapest Convention, the Digital Service Act, and the e-Evidence package. All deal with the same issue: disciplining the direct relationship between LEAs and service providers to ensure the swift disclosure and exchange of electronic evidence.Footnote ⁴² These novelties largely mirror preexisting national or regional policies,Footnote ⁴³ whereas other multilateral initiatives – which we will examine more closely – aim to face the global challenge of cyber threats with a worldwide, coordinated effort that should supersede national or regional initiatives. The endeavor is taking two, main roads: the proposal of a new international convention on cybercrime on the one hand, and the interest towards an international jurisdiction for cybercrime cases.

In 2019, the UN’s General Assembly adopted a resolution that established an “open-ended ad hoc intergovernmental committee of experts, representative of all regions, to elaborate a comprehensive international convention on countering the use of information and communications technologies for criminal purposes.”Footnote ⁴⁴ The action was led by Russia, soon followed by other states like China, North Korea, Syria and Belarus, to negotiate a new international instrument with the potential to overshadow the 2001 Budapest Convention both in scope and in political support. The negotiation at the UN level was bound to involve all countries that did not have a seat at the table in the drafting, the implementation, and the possible amendment of the European instrument, which has been criticized on multiple occasions for being more focused on countries that host ICT infrastructure – namely: the “first world” – rather than on nations that host potential victims, such as small and developing countries.Footnote ⁴⁵ The push to develop a new global standard, however, was received with alarm,Footnote ⁴⁶ fearing that the treaty could be used as a trojan horse by autocratic regimes: under the guise of fostering cooperation, they could introduce provisions aimed at hampering free speech, investigating dissidents, whistleblowers, researchers and journalists. To facilitate the negotiations, some actors suggested adopting a narrow focus: according to this perspective, the treaty should have concerned itself only with the illicit conducts that are most relevant to the cybersecurity domain, such as unauthorized access to data; unauthorized interference with the systems – with a specific aim at DDoS attacks; and unauthorized data interference, with a focus of phishing campaigns. Such a lens would have allowed the divide to be bridged between the Budapest Convention’s notion of cybercrime and the concept of cybersecurity: the criminal law layer would have had a guideline specifically aimed at conceptualizing cyber-threats as crimes, developing a blueprint on how to cooperate to prosecute them globally. Moreover, such a concentrated effort would have allowed a content-neutral discussion: the differences on what constitutes inflammatory speech, hate speech or even extremist propaganda could have been avoided.Footnote ⁴⁷ Although wise, this view has not prevailed at the negotiating table. The United Nations Convention on Cybercrime, adopted by the U.N. General Assembly on 24 December 2024, largely overlaps with the Budapest Convention.Footnote ⁴⁸ The incriminating provisions also cover conducts such as fraud (Article 13); child pornography and online child abuse (Article 14); grooming, solicitation “or making any arrangement through an information and communications technology system for the purpose of committing a sexual offence against a child” (Article 15); non-consensual dissemination of intimate images (Article 16); laundering of the proceedings of crime (Article 17). This choice has made the treaty, once again, too broad to be an effective guideline on cybersecurity, as it is not specifically concerned with its needs.Footnote ⁴⁹ Moreover, including content-related infringements has made the negotiation more contentious: cultural standards on subjects such as intimate pictures vary widely, and countries such as Iran have pushed hard for stricter provisions against the firm objections of other parties.Footnote ⁵⁰

Moreover, the procedural provisions establish powers that, according to the private sector representatives participating in the negotiations, could actively harm national security, force companies to reveal vulnerabilities, and hamper cybersecurity research. The first worry arises from Articles 29 and 30, which regulate the real-time collection of traffic data and the interception of content data. They ask the adherent states to allow the convert collection of data – to be done directly or with the assistance of a service provider. These powers can be deployed only in the investigation of “serious crimes,” and Article 24 of the U.N. Convention contains a general call to respect human rights and the principle of proportionality; to ensure the right to an effective remedy and judicial (or other independent) oversight; to establish rules to narrow the scope and the duration of the measures. However, Articles 29 and 30 do not provide for any specific guardrail: the text fails to establish a minimal common guideline in the exercise of such penetrating powers, which has led organizations such as Microsoft – as an ISP that would have to cooperate in these investigative measures – to ask for the elimination of the two articles, equating them to a “de facto blessing” of “surveillance and intelligence collecting […] under the guise of combating cybercrime.”Footnote ⁵¹

The broad definition of these investigative powers is much more worrying if one considers their scope: according to Article 23 of the draft, such procedural measures should apply not only to the offences established by the Convention, but also to other criminal offences “committed by means of an information and communications technology system,” and, even more broadly, to the collection of electronic evidence.

The second red flag has been raised about Article 28(4), which prompts the states to “empower its competent authorities to order any person who has knowledge about the functioning of the information and communications technology system in question, the information and telecommunications network, or their component parts, or measures applied to protect the electronic data therein, to provide, as is reasonable, the necessary information” to search and seize electronic data. The provision would not only force the disclosure of access credentials; it has a much broader scope than that: it would require “any person” to share information on how an IT system works, how it is built, how it is balanced and, therefore, where it is vulnerable. From a cybersecurity perspective (and from an intellectual property viewpoint as well), the provision could not be more problematic, especially at a time when a good number of cyber threats come exactly from nation-states, that would be able to leverage the measures of the convention to their benefit.Footnote ⁵²

Finally, the text does not contain safeguards for “white hat” hackers and penetration testers, which – according to the Cybersecurity Tech Accord – are “aggressively targeted” in some jurisdictions.Footnote ⁵³ The Convention does little to protect good-faith cybersecurity practitioners from criminal liability,Footnote ⁵⁴ which has caused concerns: many companies rely on their efforts to identify and fix vulnerabilities, and some jurisdictions have carved specific safeguards in legal provisionsFootnote ⁵⁵ or prosecutorial guidelines.Footnote ⁵⁶

Despite the last-minute calls for its rejection,Footnote ⁵⁷ the Convention has now been adopted and is currently open for signature: it requires forty instruments of ratification by 31 December 2026 to enter into force.Footnote ⁵⁸ According to the first declaration, the final text is a compromise that does not fully satisfy the interests of liberal democracies, which see the potential threats to fundamental rights; nor does it satisfy states such as the Islamic Republic of Iran, which objected repeatedly to the provisions that it deemed too lax. The ratification process will probably mirror the concerns of individual nations: many countries will reasonably try to minimize exposure, limiting the provisions that could be used as trojan horses while concluding bilateral treaties with nations they can trust.Footnote ⁵⁹ The space for cooperation with foreign authorities will reasonably be restricted to protect national interests, such as its security and the protection of human rights. In other words, this multilateral effort will depend on the unilateral willingness to cooperate, and given the heightened international tension, it is unrealistic to assume that this tool, alone, could mark a decisive improvement in cooperation.

VI. An international criminal court for cybercrimes?

Another set of proposals has stemmed from the need for transnational cooperation: if cyberthreats and cybercrimes are organized on a global playfield, some scholars have advocated for an ad hoc international institution, ie, an International Criminal Court for Cyberspace.Footnote ⁶⁰ The proposal is for sure authoritative and fascinating: such an institution, run effectively, could at least coordinate and direct investigations in an independent way, acting as a global watchdog rather than as the guardian of one individual nation. If taken seriously, such an effort could help reign in the “state-nexus” actors or at least provide an independent, authoritative account of the phenomenon. This new international tribunal, according to its proponents, should work as a new, additional permanent organism; it should have its statute and its jurisdictional perimeter; in other words: it should not be a mere expansion of the International Criminal Court (ICC) and its Rome Statute. The suggestion is captivating, but it does not seem feasible, at least in the short term.Footnote ⁶¹

Another similar avenue, however, has been studied for years and has recently shown some interesting developments. In particular, the discussion has been focusing on the International Criminal Court of the Hague and its mandate: can it already adjudicate cybercrime cases? At what conditions? The Rome Statute limits the scope of the ICC to “the most serious crimes of concern to the international community as a whole” (Article 5), leaving the “minor” episodes to the national authorities. Moreover, the jurisdiction only regards a narrow list of crimes: genocide, crimes against humanity, war crimes, and crimes of aggression. On the one hand, according to some scholars, the provisions can be interpreted in such a way to include cyberattacks: to all intents and purposes, they are an essential part of modern warfare, and they can be construed as “use of force,” and therefore they should be evaluated by the competent international authority.Footnote ⁶² Other voices, on the other hand, argue for an amendment of the statute: cyberattacks can have devastating effects and they should be included in the list of crimes that fall under the Court’s scope. Doing it without modifying the statute would mean adding a crime through case law: even if cyberattacks are undoubtedly part of modern warfare, their adjudication by the court would be “a novelty,”Footnote ⁶³ infringing upon the nullum crimen sine lege principle established by Article 22 of the Statute. A third position strikes quite a realistic balance: it argues that cybercrimes could already be conceived as war crimes as defined by the Statute, but this simple acknowledgment would not automatically bring results in terms of deterrence. Building a solid case would require an unshakable attribution, as well as a precise assessment of the consequences of the cyberattack: it should always clear the gravity threshold set by Article 5 and be so severe to constitute a “concern to the international community as a whole.” These two requirements are typically not easy to satisfy, which would hamper the dissuasive power of the entire system.Footnote ⁶⁴ Moreover, prosecutors could focus on different, “easier” cases rather than on an investigation that could be long, complex, and expensive, and that could very well lead to uncertain attribution.Footnote ⁶⁵

The theoretical inquiry could soon be tested. After some encouraging statements by the ICC’s prosecutor,Footnote ⁶⁶ the Berkeley Law’s Human Rights Center has filed an Article 15 communication with the ICC prosecutor’s office asserting the occurrence of cyber war crimes perpetrated by Russia on Ukraine’s critical infrastructure.Footnote ⁶⁷ The communication appears to be based on a Grand Jury Indictment unsealed in 2020 by the U.S. Department of Justice, which leveled charges against six Russian military intelligence officers allegedly responsible for a series of cyberattacks.Footnote ⁶⁸ The case, hence, could benefit from a previous investigation, carried out by a single nation, that has arrived to a precise attribution; of course, it is for the ICC prosecutor’s office to evaluate the credibility of all information that they receive, but the information has been shared, and the question has been formally asked. Reportedly, the Prosecutor’s office is considering the label of “war crimes” for the cyber-attacks against civilian infrastructure in the Russia–Ukraine war.Footnote ⁶⁹

Whatever conclusions it will reach, the investigation will surely be groundbreaking for the assessment of cyber-attacks as war crimes. From a practical point of view, however, the problem of effectiveness would not change much: a full investigation requires time; attribution and the gravity threshold pose serious issues, and, finally, even if the process would end in a conviction by the ICC, the question of enforcement would remain open. The decision would have a huge symbolic value, but it could be less significant in terms of concrete deterrence.