If and IP address of a phone was used as evidence in court and that was the real only part of evidence the prosecution had, would that alone be enough evidence to prosecute the defendant?

  • I don't understand the scenario. An IP address alone would be insufficient. But surely you mean an IP address linking the accused and the offences? That may be sufficient - it depends on what comprises the links. E.g. The accused has an internet account with the ISP. The ISP assigned the IP to the accused's account during the period. During the period the IP address was involved with these offences. etc. What evidence would be reasonably likely to persuade the court beyond reasonable doubt that the accused committed these offences. – Lag Jun 30 '20 at 18:58
  • Pretty much what you said, if an IP address of a mobile was assigned and certain crimes happened during this time. Then would it be enough? – Remmmie Jun 30 '20 at 19:37
  • I think you are going to have to give more detail. Any crime has a number of legs that have to be proven before a conviction is possible. Linking an individual an individual to the crime is only one of them. Without knowing what crime is alleged we can't help. – Paul Johnson Jun 30 '20 at 21:33
  • By the way the title of your question is different from the body of your question. – Lag Jul 1 '20 at 6:20
  • Why is it? Haha. I asked if it was an admissible piece of evidence, the same as the body of the post. – Remmmie Jul 1 '20 at 7:15

When a crime is committed over the Internet the prosecution has to establish a link between the crime and the accused, usually via an IP address. Typically they get the IP address from the computer targeted in the crime (e.g. a server which is the target of a hack).

The IP address identifies the computer that the targeted computer was talking to. This is usually the computer being used by the perpetrator, but it may not be: the perp may have used another computer as a relay in order to hide their tracks. (BTW a smartphone is just a small computer).

Given an IP address the police will identify which Internet Service Provider owns that IP address and ask them which subscriber was using it at the time. ISPs are required to keep records of IP address assignment for this purpose, and they are usually accepted as accurate by courts. However these are just normal business records, and they have been known to be in error.

(These days the police are helped by the fact that IP addresses do not often change, so its quite possible that when they seize the device they find it still has the IP address in question, making mistakes less of an issue)

Once they have the subscriber identity the next step for the police is to question the subscriber to find out if the subscriber was the perpetrator or if it could have been someone else; questions like "Does any one else use your phone?" get asked.

The prosecution will also have to establish that the phone wasn't being used as a relay by someone else. This can be done by a forensic examination to confirm that malware capable of relaying a connection is not present.

If the prosecution can establish that the IP address was leased to the subscriber's device, the subscriber was the only person to use the device, and there is no relay malware present, then that part of their case is complete.


Just an IP address is not even enough evidence to establish a reasonable suspicion that a crime had been committed, you would need substantial amounts of other evidence: the matter would not even get to court just based on knowing an IP address.

For the sake of argument, let us suppose that there is evidence proving that a crime was committed, that the crime involves some internet interaction such as visiting a website, that the website logged a supposed IP address, and investigations establish that the IP address was assigned by a reputable ISP at that time to the suspect.

The Code for Crown Prosecutors gives detailed guidance on the question of when to prosecute. Most important in terms of evidence is that there must be sufficient evidence to provide a realistic prospect of conviction. At trial the government must overcome the highly reasonable doubt that the IP address was spoofed, and must overcome the reasonable doubt that the accused was in control of the device at the alleged time of the crime. If the prosecution has evidence directly indicating that the IP address was spoofed or the person was not in control of the device, the suspect should not to be prosecuted. The prosecutor must also weigh the sufficiency of the evidence, especially the fact that people commonly share devices and IP spoofing is not an unusual happenstance.

  • If say browsing history was retrieved from the ISP/phone carrier, would that then be enough evidence or would there have to be proof that said person was the one that went onto it? – Remmmie Jun 30 '20 at 16:47
  • What is IP spoofing? – Remmmie Jun 30 '20 at 23:56
  • If it’s spoofed, it won’t be able to use the Internet will it? – Remmmie Jun 30 '20 at 23:56
  • @Remmmie: The idea here is that some other device copies your IP address to commit a crime without being traced. Your ISP will likely have logs showing whether that happened or not. – MSalters Jul 1 '20 at 23:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.