How should I present uncertainty in cloud attribution?¶

Present uncertainty in cloud attribution openly and in proportion to the evidence.

Evidential caution: that acknowledging uncertainty weakens the investigation.

What this means¶

Cloud attribution often involves several layers.

The provider may identify an account. Logs may identify a session, application, device record and connection. Wider evidence may then link those technical elements to a person.

State which layer is established and which remains inferred.

These may include account sharing, compromise, delegated applications, automation, remote access, shared networks or several linked devices.

Then explain what evidence supports or weakens each alternative.

It also shows that the attribution was tested rather than assumed.

Avoid numerical confidence percentages unless there is a defensible method behind them. Clear qualitative reasoning is usually more transparent than unsupported precision.

Where the evidence supports several stages with different strength, describe them separately. The account may be strongly identified, the device moderately linked and the individual only tentatively attributed.

Evidential limits¶

Use language such as consistent with, supports, likely, cannot exclude or cannot determine where appropriate.

Do not use vague caution where the evidence is strong, but do not remove uncertainty merely to make the conclusion sound decisive.

Explain the realistic alternative explanations.

Where the evidence cannot distinguish between two explanations, say so.

A clear uncertainty statement helps managers, prosecutors, courts and other reviewers understand the actual evidential weight.

Uncertainty should be attached to the specific point that is uncertain. Do not weaken the entire account of events merely because personal attribution remains unresolved.