And in the global search for the criminals that continued Sunday, investigators are following much the same process
that detectives in the physical world have used for decades: secure the crime scene, collect forensic evidence and try to trace the clues back to the perpetrator.
“Catching who did this is going to be very hard, and will require a level of international
cooperation from law enforcement that does not come naturally.”
The only institutional arrangement for international cooperation on cybercrime is the so-called Budapest Convention, whose membership is
largely restricted to Western democracies, said Nigel Inkster, a former assistant chief of Britain’s secret intelligence service, MI6.
Hours after the attack was first reported in Britain, where the computer systems of the National Health Service were crippled, law enforcement agencies across Europe, Asia and the United States began looking for clues
that could trace the assault to specific people or organizations.