Network anonymity makes it difficult to attribute findings to a particular individual
Often is volatile, therefore communication has to be intercepted as it occurs.
May span cities, networks, and multiple countries.
Different locations will have different local time, creating additional barriers for timeline assembly.
Lost evidence may be impossible to recover.