Enforcement

# Who leads cybercrime takedowns?

Agencies, courts, coordinators and technical partners, and the records where no lead was ever named.

Computed from the published tables at the August 23, 2026 research cutoff. Last reviewed August 23, 2026.

112 organizations appear across 438 recorded roles, spanning 99 jurisdictions. The interesting part is not who appears most often. It is how often nobody is designated the lead at all.

## The missing lead

76 of 105 counted incidents record an organization as lead. The other 29 do not, and that absence is deliberate rather than an oversight. Multi-jurisdiction actions are frequently announced without any authority designating a lead, and naming one would exceed the source.

Several of those records previously carried a lead attribution that was removed during re-verification, because the cited release turned out to name no lead agency. That correction is recorded in [corrections and updates](https://takedownindex.org/about/corrections-and-updates) rather than quietly applied, and it is the reason this figure is lower than a reader might expect.

## Roles are not a hierarchy

The role vocabulary distinguishes leading from co-leading, prosecuting, coordinating, investigating, and providing technical support. A coordinator is not a lead: Europol and Eurojust coordinate a great many actions they do not direct, and recording them as leads would misattribute national police work to an EU agency.

Technical partners are recorded where the release names them. Private companies do a substantial share of the analysis behind botnet actions, and the index carries them under their own role rather than folding them into law enforcement.

## Who appears most

| Organization | Roles recorded |
| --- | --- |
| Federal Bureau of Investigation | 72 |
| European Union Agency for Law Enforcement Cooperation | 50 |
| Politie (Netherlands National Police) | 21 |
| Bundeskriminalamt | 21 |
| United States Department of Justice | 18 |
| European Union Agency for Criminal Justice Cooperation | 17 |

Read this as a map of who publishes in English on stable domains, not as a ranking of who does the most enforcement. The corpus is built from public sources, so agencies that announce their work in English are structurally over-represented, and nationally led actions outside that set are under-recorded. The [coverage gaps](https://takedownindex.org/about/coverage-gaps) table records this directly, along with the language and regional skew it produces.

Every role row traces to a cited release. Browse them from [the organizations index](https://takedownindex.org/organizations), or take the join table from [the data downloads](https://takedownindex.org/data) and check the attribution yourself.

Every figure above is derived from the published tables and can be recomputed from them. [Download the data](https://takedownindex.org/data), then read the [counting rules](https://takedownindex.org/about/counting-incidents) and the [known limitations](https://takedownindex.org/about/known-limitations) before citing any of it.