Cyberstalking evidence should help a reviewer understand repeated conduct, its context and its effect on your safety. This guide focuses on recording a pattern across accounts, platforms and offline incidents while keeping observations separate from assumptions about identity or legal liability.
If the situation feels urgent, start with safety
If you are in immediate danger in the United States, call 911; elsewhere use the appropriate local emergency service. The Department of Justice advises reporting stalking and stalking-related incidents or threats to local police. You do not need to prove the exact offense, identify every account or complete a chronological packet before contacting someone for help. [1]
Avoid confronting a suspected stalker to test whether they control an account. Do not send a new message to provoke a reply for the record. Changes such as blocking, account shutdowns or device settings can have different safety consequences in different situations. A victim advocate can help you consider options, especially when the person may have access to your devices or accounts.
If you suspect monitoring, use a safer device or trusted support channel to seek advice before making changes that could alert the person. A documentation plan should reduce the burden on you, not require constant exposure to harmful content. Set boundaries around checking messages and consider a trusted helper who understands what to preserve and when to seek urgent assistance.
What a pattern-focused record should show
A useful record explains the sequence of events, not only the most alarming individual message. Record repeated contacts, attempts through new accounts, references to your location, impersonation, threats, unwanted communications through other people and relevant offline incidents. Do not decide in advance that every event came from the same person. Keep the evidence for any connection visible.
SPARC explains that incident documentation can help tell the story, assess risk and identify safety options. Its documentation logs and victim handbooks provide a starting point if you do not want to design a form. You can keep a paper log or a protected digital file; consistency and safe access matter more than a particular application. [2]
Record what you observed, what someone else reported and what you infer in separate terms. For example, an unfamiliar account mentioning a private detail is an observation worth retaining. The conclusion that a specific person controls it needs additional support. Similar wording or close posting times may suggest a lead, but do not establish shared control or a criminal agreement.
Federal cyberstalking law: context, not a diagnosis
The federal stalking statute, 18 U.S.C. § 2261A, includes provisions concerning use of interactive computer services and other facilities of interstate or foreign commerce. The text involves specified intent and a course of conduct with particular fear or substantial-emotional-distress conditions. It is not a rule that any upsetting online exchange automatically becomes a federal crime. [3]
In the same chapter, § 2266 defines course of conduct as a pattern of two or more acts evidencing continuity of purpose. Two messages alone do not prove all the elements of an offense. Intent, the required effects or expected effects, jurisdiction, legal interpretation and constitutional protections still matter. State or tribal law may provide different definitions, procedures or remedies. [4]
Use the statute to understand why a chronology and context may matter, not to assign guilt in your log. Do not rewrite your experience to fit a legal checklist or treat software's statute mapping as a legal opinion. A qualified attorney can assess the facts, relevant jurisdiction, available protections and deadlines. Police and prosecutors make their own assessments; a documented pattern does not guarantee a particular response.
Build a chronology with stable incident identifiers
For each event, give the entry an identifier, date, time and time zone if known. Include the platform or physical setting, account handle or other source identifier, the exact link where available, a short factual description, supporting filenames and the collection date. Note whether the time came from the service, your device or your own recollection.
Use separate fields for source publication time, the time you saw it and the time you captured it. That distinction matters when a platform shows relative times or an event is discovered days later. If an event's date is uncertain, say so. Do not assign a precise timestamp merely to make the timeline look complete.
Record boundaries and subsequent contacts accurately. If you previously asked for no contact, preserve the actual message and surrounding context; do not assume that every situation requires sending one now. An advocate or attorney can advise about safe boundaries. Link later incidents to the earlier entry where relevant, but avoid turning the log into an argument. A reviewer should be able to follow both the sequence and the source material.
Connect accounts carefully and preserve context
Capture visible profile details along with the specific content. If you see a handle change, preserve the observation and note when it happened. Keep links and platform identifiers where available, but do not assume a display name is a legal identity. Accounts can be copied, shared or compromised. Treat unverified identity connections as hypotheses, not facts.
When the same phrase appears across accounts, retain the actual instances and their contexts. Do the same with a shared link, an image or a repeated reference to private information. Explain what is similar without claiming that similarity alone proves coordination. Avoid public accusations or publishing a person's address as part of your investigation.
Include relevant replies, including your own. PEN America's documentation guidance stresses preserving the full relevant exchange. If a conversation includes a phone call or in-person incident, record your contemporaneous recollection and any lawful supporting material separately from platform captures. Recording laws vary; seek legal advice before recording conversations and do not covertly install monitoring tools to create evidence. [5]
Document effects and changes without overstating them
Keep a separate impact note when conduct affects your safety, work, routines or wellbeing. Record concrete details in your own words: an appointment missed, a route changed, a supervisor notified or a period when you were afraid to leave home. You do not need to disclose every private detail to every recipient, and you should not exaggerate or invent effects to satisfy an imagined threshold.
If someone else witnessed an incident or received a message about you, note who can describe what they personally saw. Ask them to retain their own originals rather than rewriting their observation in your voice. A second person's recollection is not identical to your direct observation; preserving that distinction helps later review.
Capture escalation as a change in behavior, not an automated severity score. A new reference to your location, a move from public comments to direct contacts, or an offline approach can be important context. Do not rely on a quiet period or a software low-risk label as proof that danger has passed. Discuss your situation with an advocate or appropriate authorities.
Keep collection, reports and legal requests distinct
Your private evidence file records what you can access lawfully. A platform report asks a service to assess its rules. A police report asks authorities to assess the situation. Obtaining a provider's account records may require legal process; personal collection software does not substitute for that process. If information is disappearing, tell counsel or law enforcement promptly rather than assuming a deleted account can later be reconstructed.
Save report confirmations, reference numbers, the material submitted and any response. For Discord, the official guidance describes reporting messages and profiles and warns against misleading or coordinated mass reports. YouTube's policy describes reporting harassment, threats and related violations. Use the current platform process, avoid repeated malicious reports and do not wait for a platform outcome before seeking urgent help. [7] [8]
For a professional handoff, prepare a concise overview, a chronology, a source index and selected items illustrating the pattern. State what is urgent and what help you are requesting. Ask how the recipient accepts sensitive files and retain the package you sent. Do not publicly upload a complete archive containing addresses, intimate material or other people's private communications.
Protect the archive and understand tool limits
Keep collected originals separate from annotations and redactions. Retain a protected backup where appropriate and plan who can recover it safely. A transfer log should identify recipients and versions. If a legal matter is underway or anticipated, ask counsel before deleting potentially relevant material. Local encryption helps with some storage risks but does not secure an unlocked device, unsafe backups or every external service.
Pilotlight is local, encrypted casefile and evidence-preservation software that turns online harassment into a timestamped, statute-mapped case file. The product describes macOS on Apple Silicon, an encrypted vault, online-platform capture and coordination analysis. It can be evaluated as an organizational aid, not a proof of stalking, identity or admissibility. Its use of your own model API keys requires checking which features send case material to external providers. [9]
The product advertises a 14-day trial. Its stated $300/month per-state price is for a law-firm partner listing, not a verified individual software price. No purchase is necessary to start a log or contact support. Federal Rule of Evidence 901 concerns authentication, but a technically organized file does not settle every legal issue. This guide has not been attorney-reviewed, is not legal advice and does not replace an attorney, victim advocate or law enforcement. [6]
Reference / FAQ
Questions & answers
How many incidents prove cyberstalking?
There is no simple number that proves the offense. Federal law defines a course of conduct as two or more acts evidencing continuity of purpose, but other statutory elements and legal interpretation also matter. State law may differ. Record the pattern accurately and seek qualified advice.
Can similar posts prove that two accounts are the same person?
Not by themselves. Similar text, timing or images can be useful observations, but accounts may be copied or controlled by different people. Retain the supporting material and label identity connections as unconfirmed unless you have a reliable basis.
Should I contact the person to tell them to stop?
Do not contact someone solely to improve your evidence. Whether a boundary message is safe or appropriate depends on the situation. A victim advocate or attorney can help assess options. Preserve any earlier boundary communications without assuming you must send a new one.
What if an account or post has already disappeared?
Keep any original captures you already have and record when you discovered the disappearance. Clearly separate memory from retained material. Do not invent quotes or assume software can recover deleted content. Tell counsel or law enforcement if important records may require prompt legal process.
Sources & limitations
Primary sources reviewed November 8, 2026. Vendor claims are attributed, not independently verified. Links may change. No attorney review or forensic/security audit has been performed.
- U.S. Department of Justice — stalking and getting help
- SPARC — documentation logs and victim handbooks
- 18 U.S.C. § 2261A — stalking
- 18 U.S.C. § 2266 — definitions
- PEN America — documenting online harassment
- Federal Rule of Evidence 901 — authentication
- Discord — reporting abusive behavior
- YouTube — harassment and cyberbullying policy
- Pilotlight — product, platform and partner listing