Who was responsible for the activity?¶

This is the point where the technical evidence has to be joined with the wider investigation.

An account can tell you who registered it, who controlled access and which session performed an event. Responsibility asks a broader question: who did what, who knew what, and who directed or authorised the activity?

Start with the conduct you are actually investigating¶

Be specific.

Did somebody:

• send the message;
• approve the payment;
• create the advert;
• configure an automated rule;
• instruct another person;
• provide access;
• move the proceeds; or
• control the wider operation?

Different people may sit behind different parts.

Map the roles rather than collapsing them¶

A useful working view might be:

Role	Question
Registered holder	Whose details were recorded?
Creator	Who set the account up?
Controller	Who could recover, secure or delegate it?
User	Who performed the specific event?
Director / organiser	Who instructed, approved or coordinated the activity?
Beneficiary	Who gained from the outcome?

One person may fill several roles. Or they may be split across several people.

Join technical evidence with the rest of the case¶

Provider and device evidence may tell you:

• which account and session were involved;
• which device was used;
• when events occurred;
• how access was controlled.

Wider evidence may add:

• communications;
• payment flows;
• location;
• access records;
• planning;
• witnesses;
• explanations;
• post-event behaviour; and
• who benefited.

Do not let technical caution flatten strong evidence¶

If several independent records point to the same person, say so.

A device, account session, payment, communications and real-world conduct all agreeing may provide strong circumstantial evidence.

Equally, do not let the account name do work that the evidence has not done.

The practical point is: responsibility comes from the combined evidence of conduct, knowledge, authority and control — not simply from whose name appeared on the account.