Europol published the SIRIUS Electronic Evidence Situation Report 2025, read the announcement and the report. According to the summary the investigating authorities are mainly interested in  connection logs, telephone numbers and IP addresses used at registration.

IP address
Hopefully, the investigating authorities realise that many law-abiding citizens also use VPNs to protect themselves against adtech companies, criminals, ill-advised surveillance laws and data retention requirements, and the like. Furthermore, people don’t always use the same IP address at home; they also go online at work, in cafés and restaurants, at the homes of people they visit, and so on. The question is what value that IP address has. To me, its value seems limited.

And then there’s the matter of criminals’ IP addresses:
– A really stupid criminal simply uses their home IP address.
– A slightly smarter criminal uses a VPN.
– A really clever criminal uses the IP address of a home user who isn’t using a VPN, so that the user is forced to prove their innocence.

Let’s hope that Europol and their digital friends understand that