Can someone be indicted for possession of illegal material through access logs alone?

Question

If police obtained a search warrant to seize a suspect's electronics on suspicion of illegal material on their hard drive on account of them having access logs that the suspect viewed such material, (by, for instance seizing the servers of the web host and looking through its database to find the access logs of its visitors) if they are unable to find anything are they still able to land an indictment just from the access logs?

Added bit: What if as well the user had a user account on the website linked to an email address that identifies him/her, but no evidence of possessing any illegal content upon seizure (nor any evidence on his/her computer that he/she had registered, just the appearance of a personally identifying email address on the seized database)? And to muddy things further, suppose the website wasn't dedicated to showing illegal content but just hosted some (maybe with a legally negligent set of site rules), so it would be hard to conclusively state that the user was seeking out that illegal material.

Update to question

I recently stumbled upon this news article, which seems to purport that police aren't able to make arrests from an online footprint alone. Here are some relevant excerpts:

During the tour in February, Carly Yoost demonstrated the system, starting with a dashboard that showed a list of the "worst IPs" in the United States, ranked by the number of illegal files they had downloaded in the last year from nine peer-to-peer networks.

The software is able to track IP addresses — which are shared by people connected to the same Wi-Fi network — as well as individual devices. The system can follow devices even if the owners move or use virtual private networks, or VPNs, to mask the IP addresses, according to the Child Rescue Coalition.

Clicking on an IP address flagged by the system lets police view a list of the address' most recent downloads. The demonstration revealed files containing references to a child's age and graphic descriptions of sexual acts.

On top of scanning peer-to-peer networks, the Child Protection System also monitors chatrooms that people use to exchange illegal material and tips to avoid getting caught.

The information exposed by the software isn't enough to make an arrest. It's used to help establish probable cause for a search warrant. Before getting a warrant, police typically subpoena the internet service provider to find out who holds the account and whether anyone at the address has a criminal history, has children or has access to children through work.

Does anyone have any sources corroborating this statement? The consensus on the answers on this question is that arresting someone in this case is possible, but difficult. Here, it seems to suggest that what seems like fairly substantial evidence is not enough without a search.

Answer 1

The legal standard for an indictment is "probable cause". This is the same as the standard for an arrest, an arrest warrant, a wiretap, or a search warrant.

A conviction, of course, is subject to the much more demanding, proof beyond a reasonable doubt standard.

Access logs along could provide probable cause for an indictment, even though they would probably not, standing alone, constitute sufficient evidence to convict.

Also, the existence of the search warrant shows that a judge already found that there was probable cause that a crime was committed before the access logs were even reviewed, so there has to be some other evidence beyond the access logs out there and the access logs are corroborating the probable cause that was already found to exist against someone.

It bears noting that federal grand juries almost without fail indict, although in some local state court systems, especially in rural areas (mostly in the Southeast U.S. since the West rarely uses grand juries and the North has higher standards of professionalism, especially in urban areas), where the quality of the law enforcement and prosecutorial work is lower, near automatic indictments are not a reality.

Answer 2

This was significantly expanded in response to the comments.

---

The answer on this depends on the rules of evidence (which vary from jurisdiction to jurisidiction), on the technology, and on the understanding of the technology by a prosecutor, judge, or grand jury. If the understanding is flawed, any competent defense attorney should point this out.

There is the famous quote that a grand jury will even indict a ham sandwich, ascribed to a New York judge. More interesting is if the indictment will lead to a conviction.

• Data on the suspect's computer.
  When you delete a file from your desktop, the data isn't gone. The computer is merely told that the memory space may be overwritten at need. There are tools which do overwrite files, but that is just the beginning -- if the data was opened by a program like an image viewer, a copy was made in memory and the operating system might temporarily save it somewhere. If the data was downloaded from the web, it would arrive in chunks and those chunks might be saved in a temporary file before assembly.
  Then there is the browsing history. With many web browsers, you will see visited links in one color and unvisited links in another. That data is somewhere. Websites save cookies, and the "do you want that?" buttons are a legal requirement, not a technical one.
  The only way I personally can think of to really, truly erase data on my computer is to physically trash the HD or SSD -- there may be less drastic ways, but I would not bet on out-foxing a forensic technician with what I know. And I work in the IT sector myself.

But the comments clarified that you want to know what happens without the suspect's computer.

• Access logs on the server.
  That's actually a quite specific term for a certain kind of server log. "IP whatever has sent a HTTP/HTTPS request to the following uri with the following parameters, we replied with the following status code and message size."
  Anybody with administrator access to the server could alter that entry. So you need testimony from the server owners that the access log is genuine and that they have no indication of being hacked, and that they did follow professional procedures to avoid being hacked. Otherwise just anyone could have written that line. (This gets interesting if the server owners have a massive stake in the outcome of the case ...)
  Once you have the IP from such an access log, the next step is to ask the phone company which real customer used that IP at the specific time. (There have been cases where information from the phone company was sloppy, and got challenged in court. Some admin scribbling answers down by hand and transposing digits, for example. Well-run phone companies have gotten better than that.)
  In a civil case where the standard is "preponderance of evidence" or something like that, such a chain might be enough. For a criminal case, it looks iffy.

• Database entries on the server.
  The server might decide to save certain data separately from the access logs. Logs are usually organized by date and time and help with maintenance, they are not as useful for operations.

  • IP addresses. That's not very useful for website, but they might get saved as documentation in case the operator is accused of spamming. "Look, we recorded some request from this URL. Wasn't it yours at the time?"
  • Emails and credentials. Much more relevant for the website operator, but they control what is and isn't written in the database. So the mere fact that a suspect's email shows up might be enough for a search warrant, but usually not for a conviction.

• Fraudulent use of email accounts.
  Organized crime puts a lot of energy into stealing and misusing mail accounts. The usual purposes are either to send spam and malware or to defraud the owner, either directly or indirectly.
  So even if the email address of the suspect shows up in a database, and if it is marked as "double opt-in successful," that's not conclusive evidence that the suspect ever logged in.

• Comparison with credit cards.
  There is a lot of credit card fraud going on, but credit cards accounts are real money. Reasonable consumers can be assumed to check their credit card statements, and to dispute fraudulent charges. So if the credit card company says that the providers of illegal content charged the credit card owner and that the card owner did not dispute the charge, many jurisdictions will that consider significant evidence.