Actions
I remember reading some polish news how police caught a guy who was doing something illegal (uploaded some cp or made a threat I don't remember). They checked that this thing was uploaded/posted at certain hour in the night and then checked that only this one dude over there was connected to TOR at this time and he got jailed pretty fast.