Binary blobs running on user boxes can collect direct, identifiable, evidence. Spying an IP address from afar that may or may not be proxied/NAT'd is flimsy circumstantial evidence at best.

Honeypot, but that doesn't hold up since torrenting movies is so wide spread already.