Who controlled the account?¶
id: "AI-011" title: "Who controlled the account?" series: "Accounts and Identity" content_type: "video-script" status: "draft" owner: "IF Digital"
Who controlled the account?¶
Script¶
An account may be registered in one person's name and used by several others.
The more useful question may be: who controlled it?
Control means the practical ability to access the account, change its settings, recover it, exclude other users or decide how it was used.
That person is not always the registered account holder.
Someone who knows the password may be able to use the account, but they may not control it fully.
The person who controls the recovery email address, telephone number or multi-factor authentication method may have greater control because they can reset the password and lock everybody else out.
An administrator may control an organisational account without posting content themselves.
An offender may compromise an account and take control away from its legitimate holder.
Look for evidence of control.
Who changed passwords?
Who added or removed recovery details?
Who enabled multi-factor authentication?
Who created new sessions, revoked old ones or changed account permissions?
Which devices remained trusted?
Who received security alerts and recovery messages?
Account-control events often matter more than ordinary logins because they show who could govern access.
Timing is critical.
Control can change.
The legitimate holder may control the account in January, lose it in February and recover it in March. A single description of the account may therefore be misleading unless it is tied to the relevant period.
Do not confuse control with responsibility either.
A person may control an account but allow somebody else to use it. Another person may perform the specific act being investigated.
Control helps you understand opportunity and authority.
It does not automatically prove authorship of every message or action.
The investigator's job is to establish who had practical control at the relevant time and what that control allowed them to do.
Registered holder, user and controller may be the same person.
They may also be three different people.