Anonymous, invisible and guilty: Punishing the cyberspace offender

What happens when crime is committed in cyberspace by invisible offenders? Can we inflict punishment on elusive data thieves, and on automated processes like Robodebt?