Reply to post: Re: A narrow search is good

Here's US Homeland Security collaring a suspected arsonist after asking Google for the IP addresses of folks who made a specific search

doublelayer Silver badge

Re: A narrow search is good

But it is probably not going to be the most successful result. Take the evidence described in this article:

1. He searched for the address.

2. His phone was near the crime scene but he doesn't live there.

3. His truck was speeding away from the scene right after.

Maybe it's just me, but it seems logical to proceed through the evidence in the opposite order. First check security cameras and find vehicles that are speeding away right after the arson. If "speeding away from the scene" from the article really means conspicuous driving, that's not going to produce many suspects. Run each one and see if there's a reason for their vehicle to be there, and when you find a person who doesn't live or work nearby, check whether there's more evidence on that person in particular. This means checking phone location records on that particular person (if you can't establish an alibi for having the car there).

The problem with this approach is that the order of evidence is opposite to the ease of hiding that evidence. He could hide the lookup by searching for a nearby address, by browsing through a map, by driving down a day early, all these being very easy. He could only hide his phone location history by getting a burner phone or not bringing a phone at all, which is doable with a little more effort. Getting a car that isn't connected to him is by far the hardest task. In future investigations, it might make sense to start with that kind of evidence.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon