[jlgaddis]

Yeah, you could claim that. Then, they search your computer and find no traces of malware but they find a copy of the Tor Browser Bundle. Now what?

Besides, law enforcement never just "takes your word for it". I've got a lot of friends in law enforcement and -- as far as "suspects" go -- they'll pretty much (attempt to) verify every claim you make.

[cookiecaper]

Plausible deniability/difficulty of conviction means that LEOs rarely pursue cases where that would apply. I agree once they open an investigation, they'll verify the claim; I'm saying that crimes that have high acquittal rates and/or low prosecutorial uptake will get less attention from the police because it's frustrating/difficult/wasteful to spend a lot of time on things that don't usually pan out.

I don't know how the system works in Belarus so I understand it may not really matter there. The point is that it's going to be difficult to prove that the accused made an intentional connection to Tor as long as the accused and/or his/her lawyer has some technical literacy and knows what to say.