Federal investigators frequently use IP addresses to identify the internet connection associated with suspected online criminal activity. That information may then be used to obtain a search warrant for a home, computer, cell phone, or other electronic device.
But an IP address and a person are not the same thing.
An IP address may help investigators identify an internet account or connection associated with a residence. It does not necessarily establish which person used that connection, which device was used, or who committed the alleged crime.
Federal criminal defense attorney Michael J. Petro has more than 35 years of criminal defense experience and represents individuals facing federal investigations involving search warrants, computers, electronic evidence, and internet activity.
What Is an IP Address?
An Internet Protocol address, commonly called an IP address, is a numerical address used in Internet communications.
Federal investigators may identify an IP address associated with suspected criminal activity and then obtain subscriber information from an internet service provider.
That subscriber information may lead investigators to a particular residence.
The distinction is important:
An IP address can identify an internet connection associated with a location without necessarily identifying the particular person or device responsible for the activity.
Several people and numerous electronic devices may use the same internet connection.
How Federal Agents Use IP Addresses
An IP address can become an important investigative tool in federal cases involving internet activity.
Investigators may:
- Identify an IP address associated with suspected criminal activity
- Determine the internet service provider associated with the address
- Obtain subscriber information
- Identify the physical address associated with the account
- Conduct additional investigation concerning the occupants
- Seek a federal search warrant for the residence
- Seize computers, phones, storage devices, and other electronic evidence
The IP address may therefore provide the investigative link between online activity and a physical location.
United States v. Featherly
The Seventh Circuit addressed this issue in United States v. Featherly, 846 F.3d 237 (7th Cir. 2017).
An investigator discovered that an internet service account was being used to share files containing child sexual abuse material. Investigators identified the IP address being used and determined that the internet service provider had assigned it to Jesse Featherly’s service account at his residence.
An FBI agent obtained a warrant to search the residence.
The search resulted in the discovery of illegal images, and Featherly was subsequently charged with federal receipt and possession offenses.
Featherly challenged the search warrant. He argued that the warrant affidavit inaccurately suggested that the IP address identified a particular computer when, more precisely, the IP address was associated with the modem providing internet service to the residence.
What the Seventh Circuit Decided
The Seventh Circuit upheld the search warrant.
The court concluded that the connection between the IP address and the modem servicing Featherly’s residence provided sufficient probable cause to justify the search.
The court recognized that another person could conceivably connect to someone else’s modem via a wireless network. But that possibility did not eliminate probable cause under the circumstances presented in Featherly.
The court emphasized that probable cause did not require certainty about who used the internet connection. The question was whether there was a fair basis to believe that evidence of the crime would be found at the location to be searched.
An IP Address Does Not Necessarily Identify the Person Who Committed the Crime
This is an important distinction in defending internet-based criminal cases.
Probable cause to search a residence is not the same as proof beyond a reasonable doubt that a particular person committed a crime.
A residence may contain:
- Multiple occupants
- Family members
- Roommates
- Visitors
- Multiple computers
- Cell phones
- Tablets
- Smart televisions
- Gaming systems
- Other internet-connected devices
A wireless network may also potentially be accessible to people other than the person whose name appears on the internet service account.
The fact that investigators traced online activity to an IP address associated with a residence does not, standing alone, necessarily establish who performed the activity.
That distinction can become important after the search when prosecutors attempt to connect particular digital evidence to a particular defendant.
IP Addresses and Federal CSAM Investigations
IP address evidence is frequently encountered in federal investigations involving child sexual abuse material (CSAM).
Investigators may identify suspected CSAM activity through:
- Peer-to-peer file-sharing networks
- Online platforms
- Electronic service providers
- Cyber tips
- Undercover investigations
- Other digital investigative techniques
An IP address associated with the activity may then be traced to an internet service provider and subscriber.
Investigators may use that information, together with other evidence, to seek a warrant for the subscriber’s residence.
Attorney Petro represents individuals facing federal CSAM investigations and prosecutions. Learn more about federal child sexual abuse material defense.
Peer-to-Peer Investigations
Peer-to-peer networks allow computers to communicate and exchange files directly with other computers participating in the network.
Federal investigators may use specialized investigative software to identify IP addresses associated with computers allegedly making suspected illegal files available for sharing.
Investigators may record information concerning:
- The IP address
- Date and time
- Files allegedly available
- Hash values
- Network information
- Downloaded portions of files
- Other technical data
The defense should carefully examine how this information was collected and how investigators connected the observed activity to the residence ultimately searched.
The Search Warrant Affidavit Matters
A search warrant is generally evaluated based upon the information presented to the judge in the supporting affidavit.
In an IP address investigation, the affidavit may describe:
- How investigators identified the suspected activity
- How the IP address was obtained
- The date and time associated with the activity
- How the subscriber information was obtained
- The address associated with the internet account
- Additional surveillance or investigation
- The investigator’s training and experience
- Why investigators believe evidence will be found at the residence
Defense counsel should examine the affidavit carefully rather than simply assume that the government’s technical description is accurate.
Challenging the Connection Between an IP Address and a Residence
The government must establish a sufficient nexus between the alleged criminal activity and the place it wants to search.
Depending upon the circumstances, the defense may examine:
- Whether the IP address was correctly identified
- Whether the date and time information was accurate
- Whether the correct subscriber was identified
- Whether the IP address was dynamic
- Whether the service provider’s records were interpreted correctly
- Whether the physical address was accurate
- Whether multiple people used the internet connection
- Whether the wireless network was secured
- Whether another person could have accessed the network
- Whether investigators conducted additional surveillance
- Whether the information supporting the warrant had become stale
The existence of an IP address does not eliminate the government’s obligation to establish probable cause for the particular place it seeks to search.
Dynamic IP Addresses
Some internet service providers use dynamic IP addresses, meaning the IP address assigned to a subscriber can change.
That makes accurate date and time information particularly important.
Investigators must connect the IP address observed during the alleged activity to the subscriber assigned that address at the relevant time.
An error involving the IP address, timestamp, time zone, subscriber records, or other technical information can potentially affect the reliability of that connection.
Multiple People May Use the Same Internet Connection
One of the fundamental limitations of IP-address evidence is that the subscriber is not necessarily the user.
A household internet account may be registered in one person’s name while being used by several other people.
For example, a home may include parents, children, roommates, guests, or other individuals with access to the wireless network.
This creates two separate questions:
First: Was there probable cause to search the residence?
Second: Can the government prove which person actually engaged in the alleged criminal activity?
Those are not the same legal question.
The Seventh Circuit’s decision in Featherly concerned probable cause to search the residence. It should not be interpreted as establishing that an IP address automatically proves the identity of the person responsible for the online activity.
Search Warrants for Computers and Electronic Devices
Once agents enter a residence, they may seize computers, cell phones, external hard drives, flash drives, tablets, and other electronic devices authorized by the warrant.
Those devices may later undergo forensic examination.
Digital forensic evidence may include:
- Internet history
- Search terms
- Downloads
- File-sharing activity
- Emails
- Text messages
- Photographs and videos
- File metadata
- User accounts
- Deleted files
- Cloud storage information
- Login information
- Device usage records
This evidence may become important in determining not merely what was present on a device, but who actually possessed, controlled, downloaded, viewed, or distributed particular material.
A Search Warrant Can Be Challenged
The issuance of a warrant does not necessarily end the Fourth Amendment analysis.
Defense counsel may examine whether:
- Probable cause supported the warrant
- A sufficient nexus existed between the alleged crime and the residence
- Information in the affidavit was stale
- The warrant was sufficiently particular
- Investigators exceeded the scope of the warrant
- Material information was omitted from the affidavit
- Material statements in the affidavit were false or misleading
When appropriate, these issues may be raised through a motion to suppress evidence.
Franks Challenges to a Search Warrant
A particularly important issue can arise when a warrant affidavit contains materially false statements or misleading omissions.
Under Franks v. Delaware, 438 U.S. 154 (1978), a defendant may, under appropriate circumstances, challenge a warrant affidavit based upon deliberately or recklessly false statements or omissions that were material to the probable-cause determination.
Featherly itself involved a requested Franks challenge.
Featherly argued that the affidavit improperly stated that investigators had identified the IP address of a particular computer when the IP address more precisely identified the internet connection associated with the modem.
The Seventh Circuit concluded that there was no intentional falsehood and that the wording was not material to probable cause because the IP address had been traced to the internet service account at Featherly’s residence.
But the case demonstrates why the precise language of a digital search-warrant affidavit matters.
Probable Cause Is Not Proof Beyond a Reasonable Doubt
A search warrant requires probable cause.
A criminal conviction requires proof beyond a reasonable doubt.
The distinction can be especially important in digital cases.
Evidence may be sufficient to justify searching a residence even though substantial questions remain about:
- Who used the internet connection
- Who controlled a particular device
- Who downloaded a file
- Who knew the file was present
- Whether the defendant had access to the device
- Whether another household member was responsible
- Whether the government’s forensic evidence establishes knowing possession or receipt
Defense counsel should therefore continue examining attribution and identity even when a court determines that the original search warrant was supported by probable cause.
Defending Federal Cases Involving IP-Address Evidence
Federal cases involving IP addresses and digital evidence can require analysis of both constitutional law and computer evidence.
An effective defense may require review of:
- Search warrant affidavits
- Internet service provider records
- Subpoena returns
- IP logs
- Router and modem information
- Peer-to-peer investigative records
- Forensic computer reports
- Cellebrite or other forensic extractions
- File metadata
- User profiles
- Passwords
- Search histories
- Download records
- Evidence concerning other users of the network or devices
The central question should not simply be whether the government identified an IP address.
The defense should determine what that IP address actually proves—and what it does not prove.
Experienced Federal Digital Search Warrant Attorney
Michael J. Petro has more than 35 years of criminal defense experience representing individuals facing serious federal investigations and prosecutions.
Federal cases involving IP addresses, computers, cell phones, and other electronic evidence can raise complex questions about probable cause, search warrants, digital forensics, identity, possession, and the Fourth Amendment.
The Seventh Circuit’s decision in United States v. Featherly demonstrates that an IP address associated with a residence can provide probable cause to search under appropriate circumstances. But probable cause to search a residence does not automatically establish that a particular person committed the alleged crime.
If you are facing a federal investigation involving an IP address, computer search, digital evidence, or search warrant, contact federal criminal defense attorney Michael J. Petro to discuss your case.