If police obtained a search warrant to seize a suspect's electronics on suspicion of illegal material on their hard drive on account of them having access logs that the suspect viewed such material, (by, for instance seizing the servers of the web host and looking through its database to find the access logs of its visitors) if they are unable to find anything are they still able to land an indictment just from the access logs?

Added bit: What if as well the user had a user account on the website linked to an email address that identifies him/her, but no evidence of possessing any illegal content upon seizure (nor any evidence on his/her computer that he/she had registered, just the appearance of a personally identifying email address on the seized database)? And to muddy things further, suppose the website wasn't dedicated to showing illegal content but just hosted some (maybe with a legally negligent set of site rules), so it would be hard to conclusively state that the user was seeking out that illegal material.

Update to question

I recently stumbled upon this news article, which seems to purport that police aren't able to make arrests from an online footprint alone. Here are some relevant excerpts:

During the tour in February, Carly Yoost demonstrated the system, starting with a dashboard that showed a list of the "worst IPs" in the United States, ranked by the number of illegal files they had downloaded in the last year from nine peer-to-peer networks.

The software is able to track IP addresses — which are shared by people connected to the same Wi-Fi network — as well as individual devices. The system can follow devices even if the owners move or use virtual private networks, or VPNs, to mask the IP addresses, according to the Child Rescue Coalition.

Clicking on an IP address flagged by the system lets police view a list of the address' most recent downloads. The demonstration revealed files containing references to a child's age and graphic descriptions of sexual acts.

On top of scanning peer-to-peer networks, the Child Protection System also monitors chatrooms that people use to exchange illegal material and tips to avoid getting caught.

The information exposed by the software isn't enough to make an arrest. It's used to help establish probable cause for a search warrant. Before getting a warrant, police typically subpoena the internet service provider to find out who holds the account and whether anyone at the address has a criminal history, has children or has access to children through work.

Does anyone have any sources corroborating this statement? The consensus on the answers on this question is that arresting someone in this case is possible, but difficult. Here, it seems to suggest that what seems like fairly substantial evidence is not enough without a search.

  • 1
    Access logs can be trivially faked...
    – user28517
    Commented May 7, 2021 at 22:46
  • @Moo Does this mean that it wouldn't be able to justify an indictment alone?
    – walstack
    Commented May 7, 2021 at 22:55
  • @Moo Can credit card information be trivially faked too? I was under the impression that that landed people convictions during Operation Ore in the UK even when police weren't able to find any child abuse images on peoples' computers, so I wasn't sure if this set precedence for access logs being taken as evidence too.
    – walstack
    Commented May 7, 2021 at 23:04
  • Do you have a specific jurisdiction in mind? Commented May 7, 2021 at 23:10
  • 1
    Legal procedures vary greatly around the world; is there a particular jurisdiction you want to know about? In some places, it may be that there are no fixed rules about what is or isn't sufficient evidence for an indictment, and it's always decided case-by-case by a grand jury. Commented May 8, 2021 at 5:45

2 Answers 2


The legal standard for an indictment is "probable cause". This is the same as the standard for an arrest, an arrest warrant, a wiretap, or a search warrant.

A conviction, of course, is subject to the much more demanding, proof beyond a reasonable doubt standard.

Access logs along could provide probable cause for an indictment, even though they would probably not, standing alone, constitute sufficient evidence to convict.

Also, the existence of the search warrant shows that a judge already found that there was probable cause that a crime was committed before the access logs were even reviewed, so there has to be some other evidence beyond the access logs out there and the access logs are corroborating the probable cause that was already found to exist against someone.

It bears noting that federal grand juries almost without fail indict, although in some local state court systems, especially in rural areas (mostly in the Southeast U.S. since the West rarely uses grand juries and the North has higher standards of professionalism, especially in urban areas), where the quality of the law enforcement and prosecutorial work is lower, near automatic indictments are not a reality.

  • Why do you think the article says "The information exposed by the software isn't enough to make an arrest." then? You're saying it is enough -- as if they can get a search warrant they can get an arrest warrant.
    – walstack
    Commented May 11, 2021 at 0:49
  • @walstack For a search warrant it is probable cause the evidence showing a crime was committed is present at that location. For an arrest warrant and an indictment it is probable cause that the person arrested committed a crime. But in most cases, the two would heavily overlap, since most locations searched are associated with someone in particular or with a few people some of whom can be easily ruled out.
    – ohwilleke
    Commented May 11, 2021 at 14:18
  • So, in this case, the search warrant indicates that there is probable cause that there is evidence of a crime committed at that location? So they're saying that they have probable cause that there will be incriminating evidence at that location due to the information exposed by the software, but not that someone committed a crime until they find that evidence and who it belongs to? Doesn't that go against what you're saying? If they can't get probable cause that the person committed the crime if nothing was found from a search, then an arrest warrant can't happen from that search alone?
    – walstack
    Commented May 11, 2021 at 17:21

This was significantly expanded in response to the comments.

The answer on this depends on the rules of evidence (which vary from jurisdiction to jurisidiction), on the technology, and on the understanding of the technology by a prosecutor, judge, or grand jury. If the understanding is flawed, any competent defense attorney should point this out.

There is the famous quote that a grand jury will even indict a ham sandwich, ascribed to a New York judge. More interesting is if the indictment will lead to a conviction.

  • Data on the suspect's computer.
    When you delete a file from your desktop, the data isn't gone. The computer is merely told that the memory space may be overwritten at need. There are tools which do overwrite files, but that is just the beginning -- if the data was opened by a program like an image viewer, a copy was made in memory and the operating system might temporarily save it somewhere. If the data was downloaded from the web, it would arrive in chunks and those chunks might be saved in a temporary file before assembly.
    Then there is the browsing history. With many web browsers, you will see visited links in one color and unvisited links in another. That data is somewhere. Websites save cookies, and the "do you want that?" buttons are a legal requirement, not a technical one.
    The only way I personally can think of to really, truly erase data on my computer is to physically trash the HD or SSD -- there may be less drastic ways, but I would not bet on out-foxing a forensic technician with what I know. And I work in the IT sector myself.

But the comments clarified that you want to know what happens without the suspect's computer.

  • Access logs on the server.
    That's actually a quite specific term for a certain kind of server log. "IP whatever has sent a HTTP/HTTPS request to the following uri with the following parameters, we replied with the following status code and message size."
    Anybody with administrator access to the server could alter that entry. So you need testimony from the server owners that the access log is genuine and that they have no indication of being hacked, and that they did follow professional procedures to avoid being hacked. Otherwise just anyone could have written that line. (This gets interesting if the server owners have a massive stake in the outcome of the case ...)
    Once you have the IP from such an access log, the next step is to ask the phone company which real customer used that IP at the specific time. (There have been cases where information from the phone company was sloppy, and got challenged in court. Some admin scribbling answers down by hand and transposing digits, for example. Well-run phone companies have gotten better than that.)
    In a civil case where the standard is "preponderance of evidence" or something like that, such a chain might be enough. For a criminal case, it looks iffy.

  • Database entries on the server.
    The server might decide to save certain data separately from the access logs. Logs are usually organized by date and time and help with maintenance, they are not as useful for operations.

    • IP addresses. That's not very useful for website, but they might get saved as documentation in case the operator is accused of spamming. "Look, we recorded some request from this URL. Wasn't it yours at the time?"
    • Emails and credentials. Much more relevant for the website operator, but they control what is and isn't written in the database. So the mere fact that a suspect's email shows up might be enough for a search warrant, but usually not for a conviction.
  • Fraudulent use of email accounts.
    Organized crime puts a lot of energy into stealing and misusing mail accounts. The usual purposes are either to send spam and malware or to defraud the owner, either directly or indirectly.
    So even if the email address of the suspect shows up in a database, and if it is marked as "double opt-in successful," that's not conclusive evidence that the suspect ever logged in.

  • Comparison with credit cards.
    There is a lot of credit card fraud going on, but credit cards accounts are real money. Reasonable consumers can be assumed to check their credit card statements, and to dispute fraudulent charges. So if the credit card company says that the providers of illegal content charged the credit card owner and that the card owner did not dispute the charge, many jurisdictions will that consider significant evidence.

  • When you say "there might be a case", does that mean "there might be a case" even with no evidence of any illegal content on the suspect's computer? What if the user had a user account on the website linked to an email address that identifies him/her, but no evidence of possessing any illegal content upon seizure? And to muddy things further, suppose the website wasn't dedicated to showing illegal content but just hosted some of it.
    – walstack
    Commented May 8, 2021 at 11:03
  • Suppose that the user has no records on his/her computer of registering though, just the appearance of his/her email address on the database.
    – walstack
    Commented May 8, 2021 at 11:23
  • @walstack, reputable websites require some form of double-opt-in (e.g. "click on the link in the email if that is really you"). But just the records on the criminal site, with nothing on the suspect's computer, sounds like something a competent defense attorney should demolish easily. There are hacks every day where criminals steal customer databases. Altering them would be almost as easy, it is just no business model for hackers.
    – o.m.
    Commented May 8, 2021 at 14:10
  • Would one be able to land an indictment if there was a double-opt-in for the website in this case, with nothing on the suspect's computer? Or is it just too hard to prosecute due to the possibility of hacking and spoofing.
    – walstack
    Commented May 8, 2021 at 14:51
  • 1
    @walstack, it all depends on the jurisdiction, the quality of the prosecution and the defense lawyer, and so on. If a search warrant is executed, one would expect to find devices with incriminating data. Absence of evidence is no evidence of absence, but absence of evidence after a competent search could tell the prosecution to spend their budget and man-hours on other cases.
    – o.m.
    Commented May 8, 2021 at 15:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .