In cybercrime cases, the large volume of evidence, and the nature of the evidence can lead to both practical and legal problems. In cases where expert witnesses are called, the technological terms and concepts discussed can be difficult for a jury to understand. It is important therefore for evidence to be presented in such a way that explains the process and methodology an expert has used to come to a particular conclusion.

The most common obstacles to successful prosecution in cases where the offences or evidence involves cybercrime elements would be obtaining and producing that evidence in court. Digital evidence must be in a form which can be understood by judges and jurors, who in Canada are ordinary citizens who function as triers of fact. Computer evidence must be seized or otherwise obtained in a manner consistent with Canada’s constitutional Canadian Charter of Rights and Freedoms which contains privacy protections based on those of the ICCPR. Once obtained, digital evidence must often be supported by expert testimony to establish its authenticity and links to the offender or case at bar. In cybercrime investigations, a common problem is the fact that communications or data can usually be traced to a specific location or computer, but not necessarily to the individual offender who is charged with the offence. If anyone else had access to the computer, prosecutors must find evidence to establish beyond a reasonable doubt that it was the accused and not someone else who sent the communication or committed the offence. On the other hand, the nature of computers and computer networks is such that they also create and preserve many forms of forensic evidence that would not have existed in earlier forms of communication. Another challenge frequently cited by investigators is the difficulty in quickly identifying important and relevant evidence from large volumes of data, both to avoid unnecessary or excessive invasions of privacy and to avoid missing important data.

A successful prosecution would include investigators and technical experts able to quickly identify potential sources of digital evidence as the facts are uncovered, to obtain the necessary judicial authorizations and actually seize and preserve that evidence, and to find ways to effectively present it in court.

Es importante lograr la admisibilidad de las evidencias digitales y su comprensión como elementos de convicción dentro del proceso penal, sumado al conocimiento y estructura de los tipos penales referentes a los delitos informáticos.

Hardware, and where appropriate software, are to be seized from the accused as quickly as is lawfully possible, and evidence from the aggrieved party should be adequately secured

- followed by rapid evaluation by specially-trained police officers (highly-skilled staff) or external specialists (experts)

- verification and ascertainment of the time of the offence (do system time and real time agree?) and of the person(s) entitled and able to have access

- reconstruction of any deleted datasets

- establishment/reconstruction of Internet use paths

- where appropriate presentation of the underlying IT structure with non-standard case constellations

- where possible parallel to technical securing of evidence also questioning of witnesses and aggrieved parties to compare the information obtained

- storage of evidence (including the computer in case any subsequent investigations become necessary), either as an original or by mirroring hard-disks, CDs and DVDs in generally-readable formats pp. until the main hearing so that they can be submitted there without any problems; relevant data backups also in paper form where necessary

- comprehensible explanation of the technical terms for all involved in the proceedings with questioning of the (technical) investigation officer as an expert witness

- correct legal attribution of the offence/subsumption under the right element of the criminal offence

- Distinction between those involved and those not involved (important for warnings!)

- Attribution of use of the computer to a person or to several persons (particularly problematic when related to instances occurring abroad)

- Completeness of the datasets, where appropriate reconstruction of deleted datasets

- Sufficiently fast, comprehensive involvement of the providers (do they quickly comply with their obligation to cooperate?)

- Once the computer has been evaluated, the comprehensive report of the expert must as a rule be presented in the main hearing in its entirety because of the principle of oral hearings -> considerable time taken up

- Accusation relating to possession of child pornography: A large number of files have to be presented in the main hearing for inspection -> considerable time taken up

- IT specialists within the authority are frequently overtaxed; external experts are not consulted, or not until difficulties are discovered, which may however then mean that important data have not been recognised at the outset because of an incorrect assessment and are lost or wrongly evaluated (if for instance the verification of the existence of child pornographic data is unsuccessful because only standard programs are used for scanning, but the files are well hidden).

- With offences related to incidents occurring abroad: long duration of execution of international search orders for foreign banks in some cases

The cases are following the general procedures for criminal cases, according to the national law on criminal proceedings. Procedural and the substantive criminal law must at any time be updated and kept in accordance with the technical development regarding cybercrime. In that matter, it is important not to end up in a situation where the existing criminal legislation is not sufficiently up to date to the technical development. The principle of legality is particularly strong in criminal cases. The legal basis for conviction has to be sufficiently clear. Acts committed by citizens that society regards as acts that should be prosecuted, needs to be considered for implementation in the substantive criminal legislation by the Parliament.

In addition, it is important and decisive for good management of cybercrime cases, that the national courts have adequate financial means to acquire necessary technical equipment. Evidence could then be presented in an efficient and satisfactory manner for the court. In cybercrime cases, evidence is often extensive. In addition, evidence often is in digital format. Therefore, the use of up to date technical equipment is often decisive and necessary to give the court a correct, efficient, and complete overview of available evidence in cybercrime cases.

Generally the current domestic legal framework is considered as satisfactory by the courts. Successful convictions depend to a large extent on good preparation and fast and smooth international judicial cooperation. Continuous training of the judges is another important element to be taken into account. Sometimes the image created by the press of cybercriminals (especially those involved in the so-called hacking cases) deluded also the members of the court into considering even common cyber offenders as being persons with high intellectual abilities. Consequently, there is a high degree of final judgements which do not sentence the cyber offenders to imprisonment but rather to alternative measures, such as parole or conditional suspension of the execution of the punishment. Another challenge in a successful conviction is represented by the response rates to MLATs. This can create additional delays in pronouncing a final conviction.

اهم عناصر الإدانة في حال عدم وجود أدلة قاطعة بارتكاب المتهم الفعل الجرمي هو الإعتراف ، و عادة في حال عدم اكتمال الأدلة و انعقاد عقيدة القاضي بارتكاب المتهم الفعل الجرمي مما يلجأ القاضي للتبرئة ، لكن يظل جانب التعزير قائماً للقاضي .. و لكن في حال توافر الأدلة القاطعة على ارتكاب الشخص لهذا الفعل الجرمي في الحقل المعلوماتي يطبق القاضي النص النظامي المجرم للفعل ، و يسند القاضي في إثبات الأدلة في هذه الجرائم ما تقدمه هيئة الاتصالات من دعم تقني و مساندة للجهات الأمنية و التحقيق و أثناء المحاكمة كما نصت على ذلك المادة (14) و(15) من نظام مكافحة جرائم المعلوماتية

There are no specialized courts handling cybercrime in Sweden and there is no separate court structure. These crimes are handled in general courts. There is no requirement that a judge who handles these cases should be specialised in cybercrime. However, there is training for judges in this area. The training, given by the Court of Sweden Judicial Training Academy, is voluntary and will for example include the question of what information can be extracted from a computer and questions concerning jurisdiction due to the often cross border nature of the crime.

The same as for any case. There has to be appropriate evidence, presented clearly and effectively to allow the court and the jury to make their decision.