united-kingdom police court
Is an IP address of a phone an Admissible piece of evidence in court?
<p>If and IP address of a phone was used as evidence in court and that was the real only part of evidence the prosecution had, would that alone be enough evidence to prosecute the defendant?</p>

<p>Just an IP address is not even enough evidence to establish a reasonable suspicion that a crime had been committed, you would need substantial amounts of other evidence: the matter would not even get to court just based on knowing an IP address.</p>
<p>For the sake of argument, let us suppose that there is evidence proving that a crime was committed, that the crime involves some internet interaction such as visiting a website, that the website logged a supposed IP address, and investigations establish that the IP address was assigned by a reputable ISP at that time to the suspect.</p>
<p><a href="https://www.cps.gov.uk/publication/code-crown-prosecutors" rel="nofollow noreferrer">The Code for Crown Prosecutors</a> gives detailed guidance on the question of when to prosecute. Most important in terms of evidence is that there must be sufficient evidence to provide a realistic prospect of conviction.
At trial the government must overcome the highly reasonable doubt that the IP address was spoofed, and must overcome the reasonable doubt that the accused was in control of the device at the alleged time of the crime.
If the prosecution has evidence directly indicating that the IP address was spoofed or the person was not in control of the device,
the suspect should not to be prosecuted. The prosecutor must also weigh the sufficiency of the evidence, especially the fact that people commonly share devices and IP spoofing is not an unusual happenstance.</p>

<p>When a crime is committed over the Internet the prosecution has to establish a link between the crime and the accused, usually via an IP address. Typically they get the IP address from the computer targeted in the crime (e.g. a server which is the target of a hack).</p>
<p>The IP address identifies the computer that the targeted computer was talking to. This is usually the computer being used by the perpetrator, but it may not be: the perp may have used another computer as a relay in order to hide their tracks. (BTW a smartphone is just a small computer).</p>
<p>Given an IP address the police will identify which Internet Service Provider owns that IP address and ask them which subscriber was using it at the time. ISPs are required to keep records of IP address assignment for this purpose, and they are usually accepted as accurate by courts. However these are just normal business records, and they have been known to be in error.</p>
<p>(These days the police are helped by the fact that IP addresses do not often change, so its quite possible that when they seize the device they find it still has the IP address in question, making mistakes less of an issue)</p>
<p>Once they have the subscriber identity the next step for the police is to question the subscriber to find out if the subscriber was the perpetrator or if it could have been someone else; questions like &quot;Does any one else use your phone?&quot; get asked.</p>
<p>The prosecution will also have to establish that the phone wasn't being used as a relay by someone else. This can be done by a forensic examination to confirm that malware capable of relaying a connection is not present.</p>
<p>If the prosecution can establish that the IP address was leased to the subscriber's device, the subscriber was the only person to use the device, and there is no relay malware present, then that part of their case is complete.</p>

<blockquote>
<p>Is an IP address of a phone an Admissible piece of evidence in court?</p>
</blockquote>
<p>A business record or other record or testimony regarding the IP address of a phone is admissible evidence if it is otherwise relevant and no other rule of evidence (e.g. attorney client privilege) keeps out the record or testimony.</p>
<p>An IP address itself isn't &quot;evidence&quot; it is a fact which someone might prove with evidence, but has no tangible existence of its own that could be presented to a court. The evidence would be something informing the court of the IP address.</p>
<blockquote>
<p>If and IP address of a phone was used as evidence in court and that
was the real only part of evidence the prosecution had, would that
alone be enough evidence to prosecute the defendant?</p>
</blockquote>
<p>This question is inherently unanswerable. You can't know if evidence is sufficient to prosecute the defendant if you don't know what the defendant is being prosecuted for doing.</p>
<p>If the defendant was being prosecuted for possessing a phone capable of Internet access while incarcerated contrary to prison regulations, then, yes, this might be sufficient to prosecute someone.</p>
<p>If the defendant was being prosecuted for something else, one would have to know what the elements of that charge were.</p>
<p>Also, in practice, IP addresses of phones don't exist in a vacuum. Any criminal prosecution would involve more factual context related to some alleged crime than the mere fact that someone owned a phone with a particular IP address. Some particular conduct would be linked to that IP address at a particular time, and that conduct would somehow be linked to some crime.</p>
