Attendance Report – Octopus Conference 2026 

Council of Europe, Strasbourg | 14–16 October 2026

The Octopus Conference 2026, organised by the Council of Europe in Strasbourg, brought together representatives from governments, law enforcement and prosecution authorities, international organisations, the private sector, academia and civil society to discuss current and emerging challenges relating to cybercrime, asset recovery and electronic evidence. The 2026 edition marked the 25th anniversary of the Budapest Convention on Cybercrime and focused particularly on artificial intelligence, cybercrime-as-a-service, scam compounds, foreign information manipulation, electronic evidence and international cooperation. The 2026 Treaty on Asset Recovery was also signed during the conference, leading to interesting discussions on how asset recovery can be utilised in combatting cybercrime.

Áine Hanrahan attended the first two days of the Conference (14–15 October) on behalf of Victim Support Europe. The sessions attended and discussions followed were particularly relevant to VSE’s developing work on cybercrime and scam victims, as well as wider questions around victim identification, technology, private-sector responsibility and cross-border cooperation.

Main issues and takeaways 

1. AI is increasing the scale, speed and accessibility of existing forms of cybercrime 

A recurring message throughout the Conference was that AI is not creating new categories of offending, but it is making existing criminal methods faster, cheaper, more scalable and more convincing. Examples discussed included large-scale generation and personalisation of phishing communications; automated identification of vulnerabilities; use of generative AI in ransomware and other cybercrime operations; deepfakes and synthetic content used for fraud, scams, blackmail and impersonation; and increasingly sophisticated social engineering. 

One example concerned the use of Microsoft disrupting ‘Evil tokens’ type tools and stolen authentication information that facilitates the compromise of victims’ email accounts and the extract of sensitive information such as payment details, passwords, contacts, etc. 

Deepfakes were highlighted as an especially significant development because their production has become inexpensive and accessible at scale, with apps being readily available to download and use. Speakers referred not only to conventional fraud but also to celebrity impersonation and large quantities of synthetic content appearing on mainstream platforms. These impersonations are being used to raise funds that is going toward criminal activity, with the general audience not knowing that the funds they contribute is being mis-advertised. 

AI was consistently presented as both a threat and an opportunity. The same technologies can assist authorities and other actors with identifying vulnerabilities, detecting suspicious patterns and processing large volumes of information. However, the use is limited in policing due to data challenges and lack of permissions to utilise these systems. This means policing is at a significant disadvantage comparatively to criminal organisations with regards to speed, trace and analysis.

2. Scam compounds increasingly combine cybercrime with serious human exploitation 

The session on “Scam compounds: threat to national security?” was particularly relevant from a victim perspective. The discussion demonstrated that online scam operations cannot be understood as only financial or cyber offences but with real-world consequences on the safety and well-being of human beings. Large scam operations, particularly in parts of Southeast Asia, have trafficked, deceived or forced victims into carrying out fraud and cybercrime. Many of the people trafficked are not formally recognised as trafficking victims and may instead initially be treated as perpetrators or undocumented migrants. Many victims are never identified as such, thus not receiving their rights and supports as a victim. Evidence has shown that these operations are expanding from Southeast Asia to parts of East and West Africa, with an example of a trafficked victim being moved from Cambodia to Ghana once the original operation was investigated. 

The discussions highlighted an increasingly complex victim/offender relationship, with the need for proper assessments to determine whether an individual is participating in a criminal operation is in fact a victim of trafficking or coercion. 

Other points raised included how scam compounds can relocate rapidly following enforcement action; crackdowns in one location can displace rather than eliminate human trafficking operations; organised criminal groups increasingly recruit people with professional and technical expertise with highly competitive rates comparatively to legitimate businesses and organisations; vulnerable people from across the Globe (including) Europe and elsewhere may also be targeted for recruitment or trafficking; and financial institutions and other private actors may possess relevant information that does not always reach authorities sufficiently or quickly. 

The wider message was that scams need a cross-sector response, involving law enforcement, justice authorities, consumer protection bodies, financial institutions, technology companies and victim-support actors rather than being treated solely as a policing problem. 

3. International cooperation and access to electronic evidence remain major challenges

A central theme of the Conference was the mismatch between the speed of cybercrime and the speed of traditional criminal justice cooperation.

Electronic evidence may disappear or change quickly, while requests to platforms, foreign authorities and other private entities can remain comparatively slow. Cooperation mechanisms and procedures also vary substantially between countries and regions.

The discussions therefore focused on mechanisms under the Budapest Convention, its Second Additional Protocol and the EU e-Evidence framework. The official programme specifically devoted a main session to improving cooperation with online service providers.

Key practical challenges raised included:

• Differing procedures for requesting information from service providers.
• Uncertainty over which authority or entity holds relevant information.
• Lack of harmonised data-retention arrangements, creating the risk that evidence disappears.
• Legal and practical barriers to cross-border data sharing.
• Fragmentation between different organisations dealing with the same case.
• The need for clearer escalation routes and operational protocols.

The overall message was that legal instruments are only useful when they become operational in practice. Authorities need clear procedures, trained personnel, established points of contact and trusted relationships with relevant private-sector actors.

4. Public-private cooperation is indispensable 

Private actors now hold much of the information needed to understand and disrupt contemporary cybercrime. Several discussions therefore centred on cooperation between law enforcement, prosecutors, online platforms, technology companies, financial institutions and other service providers. At the same time, uncertainty remains about responsibility and changing data protection laws. AI systems themselves cannot bear legal responsibility; accountability ultimately needs to attach to legal entities and individuals. 

Participants also highlighted the need to better understand how private-sector information can lawfully be used in investigations concerning offences that have not yet fully materialised, particularly where AI is used to identify risks or suspicious patterns

5. Foreign information manipulation is increasingly treated as a systemic threat 

Sessions and workshops also considered foreign information manipulation and interference (FIMI), including AI-assisted disinformation and political influence operations. 

The discussion emphasised that manipulation is increasingly accessible to a wider range of actors, both individual and criminal networks; capable of being conducted at very large scale; highly specialised and targeted; and faster than previous forms of influence activity. 

AI-generated personas, automated accounts and synthetic content can make campaigns significantly more difficult to identify. Speakers described foreign interference as moving from an “emerging” risk towards a systemic threat to democratic systems. 

A useful analytical framework presented during the workshop involved six stages: 

Detection → Narrative → Network → Indicators → Attribution → Response 

An important theme was that criminal law cannot provide the entire solution. Responses also require resilient democratic institutions, cooperation with researchers and civil society, public awareness and respect for human rights.

6. Cybercrime increasingly requires a victim-centred dimension

Although much of the Conference naturally focused on investigation, evidence, prosecution and international cooperation, a number of discussions point towards issues directly relevant to VSE.

In particular:

• •People apparently involved in criminal operations may themselves be victims.
• •Scams can involve sophisticated manipulation of individuals over lengthy periods.
• •The consequences of scams extend well beyond financial loss.
• •Increased disruption of criminal infrastructure does not itself provide support to those already harmed.
• •Responsibility across complex digital ecosystems can be unclear, leaving victims uncertain about where to report, whom to contact and what remedy is available.
• •Responses need to consider the psychological and social consequences of cyber-enabled crime alongside investigative priorities.

These points reinforce the importance of bringing the victim-support sector more systematically into cybercrime policy discussions, alongside law enforcement and private-sector actors.

There also appears to be significant scope for VSE to contribute a specifically victim-centred perspective to debates that currently remain heavily oriented towards investigation and prosecution. Future work could examine early victim identification; support and referral following platform or financial-sector detection; the treatment of persons who are simultaneously victims and apparent offenders; responsibilities of online service providers towards victims; and cross-border access to support and remedies.