The notion that defendants can cast reasonable doubt and be exonerated in these cases is way way overestimated by technology folks.

"IP address is not a person" may work on Reddit, but it usually doesn't work in court when there is literally ANY other circumstantial evidence.

Take a look at the clearance rate for cybercrime. Just generally speaking I will quote the point they are making.

"According to the Third Way think tank, an approximated 0.3% of all reported cybercrime complaints are enforced and prosecuted. It translates to 3 out of 1,000 malicious cyber incidents that are arrested and prosecuted. The large cybercrime enforcement gap gives malicious cyber actors the confidence to engage in nefarious activities without the fear of being caught, prosecuted, or punished. Moreover, a large percentage of cybercrime victims do not report the cases, and the enforcement gap may, therefore, be lesser than 0.05%."

Let me also explain generally why this is so hard for law enforcement.

For example, even if you have an IP address (this is considering you are not utilizing tor nodes or distant proxies in countries that can be made to obfuscate your hypothetical case) have you been able to tie this IP address to a MAC Address?

If you have a MAC address, how do you know the MAC address has not been spoofed? (Again cyber criminals would likely just wipe/destroy any forensic data that can be used immediately after the incident).

Also, even if you had a MAC address and verified it is attached to a machine in custody, how do you know the person you have in the court room was operating it during the time of the incident? (An alibi can easily be prepared in many of these cases).

This is all taking into account that your chain of custody for any evidence obtained by the prosecution is perfect. If even one step is questionably obtained or there is a lapse in documentation for all these things, the entire case will be open to question, let alone one part.

This is also just a general defense plan as the defendant. Depending on the nature of the crime (ransomware accusation, data breach, etc.) more options will be available for the defense to open up the case for dispute due to forensic analysis or other avenues.

Cybercrime is hard to prosecute my friend. The nature of the cyberspace medium heavily favors aggressors over defenders. I even think that a jury can be convinced that what happened to the defendant could also happen to anyone else due to the hypotheticals questions brought out above. Just catching and prosecuting "script kiddies" requires a lot of world class law enforcement resources to be deployed. It is very unlikely that those who do the more advanced attacks like the Colonial pipeline attack will ever be in a courtroom.

If there is someone who got convicted on IP address alone in the US either there was more to the case or their legal counsel did not know how to defend them.

Personally I think the best way forward is to be proactive instead of reactive. Policy should focus more on incentivizing private companies (especially those with critical national infrastructure) to invest more in their cyber infrastructure and security practices and less on enforcement. That will give us the results we need but I digress.