If and IP address of a phone was used as evidence in court and that was the real only part of evidence the prosecution had, would that alone be enough evidence to prosecute the defendant?

  • I don't understand the scenario. An IP address alone would be insufficient. But surely you mean an IP address linking the accused and the offences? That may be sufficient - it depends on what comprises the links. E.g. The accused has an internet account with the ISP. The ISP assigned the IP to the accused's account during the period. During the period the IP address was involved with these offences. etc. What evidence would be reasonably likely to persuade the court beyond reasonable doubt that the accused committed these offences.
    – Lag
    Jun 30 '20 at 18:58
  • Pretty much what you said, if an IP address of a mobile was assigned and certain crimes happened during this time. Then would it be enough?
    – Remmmie
    Jun 30 '20 at 19:37
  • I think you are going to have to give more detail. Any crime has a number of legs that have to be proven before a conviction is possible. Linking an individual an individual to the crime is only one of them. Without knowing what crime is alleged we can't help. Jun 30 '20 at 21:33
  • 1
    By the way the title of your question is different from the body of your question.
    – Lag
    Jul 1 '20 at 6:20
  • Why is it? Haha. I asked if it was an admissible piece of evidence, the same as the body of the post.
    – Remmmie
    Jul 1 '20 at 7:15

When a crime is committed over the Internet the prosecution has to establish a link between the crime and the accused, usually via an IP address. Typically they get the IP address from the computer targeted in the crime (e.g. a server which is the target of a hack).

The IP address identifies the computer that the targeted computer was talking to. This is usually the computer being used by the perpetrator, but it may not be: the perp may have used another computer as a relay in order to hide their tracks. (BTW a smartphone is just a small computer).

Given an IP address the police will identify which Internet Service Provider owns that IP address and ask them which subscriber was using it at the time. ISPs are required to keep records of IP address assignment for this purpose, and they are usually accepted as accurate by courts. However these are just normal business records, and they have been known to be in error.

(These days the police are helped by the fact that IP addresses do not often change, so its quite possible that when they seize the device they find it still has the IP address in question, making mistakes less of an issue)

Once they have the subscriber identity the next step for the police is to question the subscriber to find out if the subscriber was the perpetrator or if it could have been someone else; questions like "Does any one else use your phone?" get asked.

The prosecution will also have to establish that the phone wasn't being used as a relay by someone else. This can be done by a forensic examination to confirm that malware capable of relaying a connection is not present.

If the prosecution can establish that the IP address was leased to the subscriber's device, the subscriber was the only person to use the device, and there is no relay malware present, then that part of their case is complete.

  • You seem to indicate that it is possible for "forensic examination to confirm that malware capable of relaying a connection is not present". We have seen what this looks like in reality with the pegasus hack, and certainly on android it seems to me impossible, and infeasible on iphone.
    – Dave
    Jul 27 at 8:32
  • This would be something for the defence to raise by cross-examining the expert and/or doing their own forensics on the device. I know this kind of argument is used where PCs are being analysed; I have to admit I don't know the status of this kind of forensics on mobile devices. However this is peripheral to the original question. Jul 27 at 9:34

Just an IP address is not even enough evidence to establish a reasonable suspicion that a crime had been committed, you would need substantial amounts of other evidence: the matter would not even get to court just based on knowing an IP address.

For the sake of argument, let us suppose that there is evidence proving that a crime was committed, that the crime involves some internet interaction such as visiting a website, that the website logged a supposed IP address, and investigations establish that the IP address was assigned by a reputable ISP at that time to the suspect.

The Code for Crown Prosecutors gives detailed guidance on the question of when to prosecute. Most important in terms of evidence is that there must be sufficient evidence to provide a realistic prospect of conviction. At trial the government must overcome the highly reasonable doubt that the IP address was spoofed, and must overcome the reasonable doubt that the accused was in control of the device at the alleged time of the crime. If the prosecution has evidence directly indicating that the IP address was spoofed or the person was not in control of the device, the suspect should not to be prosecuted. The prosecutor must also weigh the sufficiency of the evidence, especially the fact that people commonly share devices and IP spoofing is not an unusual happenstance.

  • If say browsing history was retrieved from the ISP/phone carrier, would that then be enough evidence or would there have to be proof that said person was the one that went onto it?
    – Remmmie
    Jun 30 '20 at 16:47
  • What is IP spoofing?
    – Remmmie
    Jun 30 '20 at 23:56
  • If it’s spoofed, it won’t be able to use the Internet will it?
    – Remmmie
    Jun 30 '20 at 23:56
  • @Remmmie: The idea here is that some other device copies your IP address to commit a crime without being traced. Your ISP will likely have logs showing whether that happened or not.
    – MSalters
    Jul 1 '20 at 23:42
  • @Remmmie Spoofing means putting a fake "from" IP address on the outgoing header of the IP packets. However this is of very limited use to hackers because it means that the sender can never get any replies from the machine they are trying to hack. (Note: this is not the same as email headers; its a lower level). It is useful in DoS attacks where you put the target as the "from" and send a request to a DNS server, which then sends a lot more data to the target. If you want to receive info from the other machine it is useless. Jul 27 at 9:30

Is an IP address of a phone an Admissible piece of evidence in court?

A business record or other record or testimony regarding the IP address of a phone is admissible evidence if it is otherwise relevant and no other rule of evidence (e.g. attorney client privilege) keeps out the record or testimony.

An IP address itself isn't "evidence" it is a fact which someone might prove with evidence, but has no tangible existence of its own that could be presented to a court. The evidence would be something informing the court of the IP address.

If and IP address of a phone was used as evidence in court and that was the real only part of evidence the prosecution had, would that alone be enough evidence to prosecute the defendant?

This question is inherently unanswerable. You can't know if evidence is sufficient to prosecute the defendant if you don't know what the defendant is being prosecuted for doing.

If the defendant was being prosecuted for possessing a phone capable of Internet access while incarcerated contrary to prison regulations, then, yes, this might be sufficient to prosecute someone.

If the defendant was being prosecuted for something else, one would have to know what the elements of that charge were.

Also, in practice, IP addresses of phones don't exist in a vacuum. Any criminal prosecution would involve more factual context related to some alleged crime than the mere fact that someone owned a phone with a particular IP address. Some particular conduct would be linked to that IP address at a particular time, and that conduct would somehow be linked to some crime.

Not the answer you're looking for? Browse other questions tagged or ask your own question.