During the period of 17-19 of June 2025, the representatives of law enforcement agencies, cybersecurity entity and the private sector of Ukraine met to enhance their knowledge and sharing of information on cyberattack investigation.
This activity was conducted within the framework of the CyberUA project: Strengthening capacities on electronic evidence of war crimes and gross human rights violations in Ukraine, which is part of the Council of Europe’s Action Plan for Ukraine, “Resilience, Recovery, and Reconstruction” for 2023-2026, in collaboration with CyberEast+, a joint project of the European Union and of the Council of Europe.
Project counterparts engaged in real-time identification of online offenders and discussed good practices for the collection, securing and admissibility of electronic evidence essential for criminal prosecution. These practical, incident-based scenarios were designed to replicate real-world threats against critical infrastructure in Ukraine. Participants were guided through investigative procedures that adhere to both national legislation and international standards according to the Convention on Cybercrime (Budapest Convention) and its Second Additional Protocol, ensuring a comprehensive and compliant response.
A key component of the exercise included exploring operational implications of Ukraine’s anticipated ratification of the Second Additional Protocol (2AP) to the Budapest Convention. Participants used direct cooperation channels with service providers, including issuing preservation requests and orders in emergency, and leveraging on tools such as the 24/7 Contact Network, SIENA (EUROPOL), and others.
The activity served as a valuable platform for enhancing inter-agency communication and understanding the legal and operational frameworks for international cooperation. It helped to strengthen the participants’ ability to respond to complex cyber incidents with potential links to war crimes and gross human rights violations.
This training exercise marks a significant step in building Ukraine’s resilience and reinforcing its capability to use electronic evidence in criminal proceedings, especially in the context of Russia’s ongoing armed aggression and its associated crimes committed in cyberspace.
