What is account sharing?¶
The practical answer¶
Account sharing is the use of one account by more than one person, whether authorised, tolerated or prohibited.
The key evidential caution¶
The dangerous assumption is that a shared account can still identify the individual who performed each action.
It may not.
Accounts may be shared because of:
Key points¶
- poor practice
- shift work
- technical limitation
- emergency access
- team administration
- contractor arrangements
- deliberate concealment
What investigators should establish¶
Investigators should establish:
Key points¶
- who knew the credentials
- who was permitted to use the account
- which devices and locations were involved
- whether individual sessions can be distinguished
- what authentication applied
- whether personal sub-identifiers or approvals exist
A shared account weakens personal attribution.
It does not make the activity unusable.
Device records, timing, physical access, command history, communications and witness evidence may still identify the operator.
Evidential limits¶
Do not assume the formal account owner was present or aware.
Likewise, a person claiming an account was shared should be required to explain the practice and identify possible users.
Where shared accounts are unavoidable, other controls may still provide attribution, such as terminal identifiers, shift logs, approval codes, command history or application sub-accounts. Preserve those secondary identifiers before concluding that individual attribution is impossible.
Shared-account use may itself breach policy or weaken controls. Report that control failure separately from the question of who performed the disputed action. Poor accountability should not be used either to accuse the account owner or to abandon the investigation.
Operational takeaway¶
Treat shared-account records as activity by a common identity, and build personal attribution from device, session, timing and contextual evidence.