If television has taught the public anything, it’s that catching a cyberstalker takes about thirty seconds in a dark van with lots of blinking lights and headphones, a hoodie, some scrolling green text, and (if we’re lucky) an overly enthusiastic keyboard smash. In reality, proving a digital harassment campaign means dismantling a maze of third-party silos, ephemeral logs, and obfuscated hardware. But beware, O vaunted detective, for while the hoodie may be optional, the subpoena is not.

Stalking itself is nothing new. Human nature doesn’t change, but the tools do, and today’s stalker can carry a location tracker the size of a cookie and an app store’s worth of spyware dressed up as “parental monitoring.” Fortunately, the laws and forensic tools are finally, bit by painstaking bit, catching up.

For decades, prosecutors have been stuck squeezing 21st-century digital abuse into 20th-century harassment statutes. (The usual caveat: I’m a forensic examiner, not a lawyer, and these statutes vary a good deal from state to state. Your department, not mine.)

1. Criminalizing the Hardware, Not Just the Threat

One of the biggest hurdles in older cyberstalking cases was proving a “credible threat” of physical injury. No explicit threat, often no case.

Newer statutes are shifting the focus from verbal threats to the unauthorized deployment of surveillance technology. Laws banning non-consensual GPS or electronic tracking (like slipping an AirTag into a coat pocket), installing stalkerware on someone’s device, or deploying automated mass-messaging tools give prosecutors objective, physical acts to charge. You don’t have to guess what a text message meant when you can show who registered the tracker or when the monitoring app landed on the phone. An AirTag, for example, carries a serial number that Apple associates with the Apple ID that paired it, and that link can be obtained through legal process.

The cookie, it turns out, has a return address.

For you forensic folks, it’s useful to keep in mind that an AirTag is a Bluetooth-based tracker, not a miniature GPS receiver. And that stalkerware may implicate unauthorized-access or interception laws, depending on its operation and the jurisdiction. But neither installed software nor a nearby tracker automatically identifies the perpetrator. Serial numbers, account associations, installation artifacts, and provider records may help establish that connection. A Bluetooth encounter is a lead, not a signed confession.

2. Lowering the Bar to “Substantial Emotional Distress”

Statutes are also broadening the definition of harm. The federal stalking statute, 18 U.S.C. § 2261A, already reaches conduct that causes, or would reasonably be expected to cause, “substantial emotional distress,” and a number of states have moved in the same direction. Recognizing that a cyberstalker’s primary weapon is psychological erosion, these laws give weight to emotional distress, economic ruin, and reputational destruction.

This opens the door to prosecution in cases involving:

• Orchestrated online mobbing campaigns (like coordinated doxxing or swatting).
• Non-consensual image sharing or weaponized reputation destruction across professional and social networks.
• Relentless digital isolation, where a person’s accounts are repeatedly compromised, locked, or spoofed to sever their personal and professional lines of communication.

3. The Forensic Evolution: Multi-Platform Correlation

On the investigative side, the digital trail can now run far beyond a single exported chat log. Proving, or disproving, a stalking campaign means stitching scattered artifacts into a coherent timeline:

• Device Sync Artifacts & Cloud Logs: Correlating timestamps across messaging apps and their cloud backups to tie messages to a specific device and, where location data survives, to a specific place.
• API and Service-Provider Metadata: Access logs, IP addresses, and account-recovery records. VPNs and burner apps hide a lot, but people get tired and one login from home Wi-Fi can undo months of hiding.
• Authentication and Access Timestamps: Showing not just what was sent, but when an account was accessed, from where, and with what client application.

Wait, doesn’t all this correlation just help one side?

No, and this is the part that never makes the TV episode, doggone it. The same correlation that builds a case can take one apart. Accounts get spoofed. A shared family tablet gets blamed for what someone else typed. A neighbor or just someone parked nearby can piggyback onto an unprotected wifi network. A careful timeline shows who was holding the device and who wasn’t, and that surely matters to the defense every bit as much as to the prosecution.

What This Means for Litigators

Whether you represent the state, the accused, or someone seeking a civil protective order, relying on a single smoking-gun screenshot is a losing game. The strongest positions are likely to be built on patterns: device logs, carrier records, and system metadata correlated into a narrative that holds up under grueling cross-examination.

It is useful to note that overworked law enforcement may not have the resources to follow up every citizen’s concern or complaint that they are victims of the kind of cyberharassment we’ve been discussing here. They’re likely to require some more substantive evidence beyond what that citizen thinks is happening. The same goes for finding counsel to handle their case.

While the tools and laws are sharper than they used to be, the question remains whether your intake process captures those volatile records, through prompt device imaging and preservation requests to the platforms, before automated retention schedules make them disappear. Some providers keep certain logs for weeks or months, not years. Gone, gone, gone.

Have you seen prosecutors or civil attorneys in your area use these newer tool-based or emotional-distress statutes yet? I’d like to hear how it’s playing out in your practice.

Questions about digital attribution, device artifacts, or analyzing electronic communication patterns? Burgess Forensics examines system logs, mobile artifacts, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com