Who was actually using the account?¶
id: "AI-012" title: "Who was actually using the account?" series: "Accounts and Identity" content_type: "video-script" status: "draft" owner: "IF Digital"
Who was actually using the account?¶
Script¶
You know which account was involved.
You may even know who registered it and who controlled it.
You still need to answer the most important attribution question.
Who was actually using the account when the relevant activity happened?
Do not start with the name on the account.
Start with the event.
Fix the date and time as accurately as possible. Confirm the time zone. Identify what action occurred and what records were created.
Then work outward.
Which session performed the action?
Which device, application, browser or IP address was associated with that session?
Was the device used by one person or shared?
Was the account already logged in?
Could the action have been automated?
Other activity can help identify the user.
Were personal accounts accessed from the same device at the same time?
Did the content contain knowledge, language or images linked to a particular person?
Were there messages arranging the activity before it happened?
Did location, CCTV, access-control or witness evidence place somebody with the device?
No single feature should be treated as magic.
An IP address does not identify the typist.
Possession of a device does not prove every action on it.
Writing style can support an inference, but it is rarely conclusive by itself.
The strongest attribution usually comes from several independent strands pointing in the same direction.
Also test the alternatives.
Who else knew the password?
Who else had physical access?
Could the account have been compromised?
Could a saved session have allowed access without entering the password?
Could software have generated the event?
You are not required to invent remote possibilities with no evidential basis.
But you should address realistic alternatives before making a firm attribution.
The account identifies the digital space in which the activity happened.
The surrounding evidence identifies the person.
Always build the conclusion from the relevant event, the session, the device and the wider circumstances.