What evidence may support insider attribution?¶
The practical answer¶
Insider attribution should be built from several independent sources rather than one account or device record.
The key evidential caution¶
The dangerous assumption is that workplace access makes attribution straightforward.
It may not.
Relevant evidence¶
Useful evidence may include:
Key points¶
- account and session logs
- device identifiers
- physical-access records
- work schedules
- communications
- search and file activity
- approval records
- removable-media use
- cloud and email records
- financial evidence
- witness accounts
- admissions
- patterns of concealment
Investigators should compare whether the person had:
- access
- opportunity
- knowledge
- motive
- control of the device or session
- a link to the recipient or benefit
- behaviour consistent with the action
No single factor is usually decisive.
A person may have motive but no access.
They may have access but no personal control of the session.
They may control the account but act under instruction or coercion.
Evidential limits¶
Do not overstate behavioural indicators such as working late, resigning or showing dissatisfaction.
Practical interpretation¶
Where several indicators point towards one person, test whether they are genuinely independent. Device location, account use and network address may all derive from the same shared workstation. Evidential strength comes from different sources that corroborate one another, not from counting repeated versions of one event.
Attribution should also account for shared offices, delegated work and assistants acting on behalf of senior staff. A device or account may be personally assigned while routine access is performed by others. Test formal ownership against actual working practice.
Operational takeaway¶
Build insider attribution from account, device, physical, communication and contextual evidence, and test alternative users, compromise, coercion and automation.