People

# How long cybercrime cases take

Measured from first charge to sentence, across the people where the record establishes both dates.

Computed from the published tables at the August 23, 2026 research cutoff. Last reviewed August 23, 2026.

A median of 1086 days, roughly 3.0 years, from first charge to sentence. That is measured across the 37 named individuals where the record establishes both dates, out of 115 people in the index.

The spread is wide: 497 days at the fast end and 4179 at the slow end, which is more than eleven years. A median is the right summary for a distribution shaped like that, and a mean would be misleading.

## Why this takes so long

Cybercrime cases stack delays that ordinary prosecutions do not. Infrastructure sits in one country, the defendant in another, and the victims in dozens more. Extradition alone can consume years before a domestic clock starts running, and the index records 16 completed extraditions with 2 more requested and not yet resolved in the located sources.

Measured from arrest instead of charge, the median across 26 people is 990 days. The two figures are close, which suggests the long pole is what happens after the legal process starts rather than the gap between arrest and charging.

## What the sample is, and is not

This measures people whose charge date and sentence date are both established by a located source. That is a specific and biased subset. A case reaches this sample only if it finished, and only if the finish was published, which favours large prosecutions in jurisdictions that announce sentencings.

Cases still running do not appear. Cases that ended in an acquittal or dismissal mostly do not appear either, because those outcomes are rarely announced. So the real median across all prosecutions arising from these actions is likely longer than 1086 days, since unfinished cases are by definition the slow ones, and this figure can only see the ones that stopped.

## Using the number

Quote it with the denominator: a median of 1086 days across 37 people where both dates are established. Without that, it reads as a general statistic about cybercrime prosecution, and 37 people is not a general statistic about anything.

The useful comparison is not against other crime types, which this index cannot support. It is against the announcement cycle: infrastructure comes down in a day and gets a press release, and the legal consequence arrives around 3.0 years later, usually without one. Every interval here is rebuildable from the person actions table in [the data downloads](https://takedownindex.org/data).

Every figure above is derived from the published tables and can be recomputed from them. [Download the data](https://takedownindex.org/data), then read the [counting rules](https://takedownindex.org/about/counting-incidents) and the [known limitations](https://takedownindex.org/about/known-limitations) before citing any of it.