So now that we understand the challenges associated with attribution, which include the evidence collected and individuals involved, where does that leave prosecution? We must understand if these actions were on behalf of a State as well as are they admissible in a court of law? If so who had jurisdiction? Do the identified parties acknowledge the venue and will participate? What are the implications to the involved parties and the rest of the world? What are the penalties if the identified parties are not willing to acknowledge or participate in process? Where are we in the legal maturity process with respect to international cyber incidents?