What is personal attribution?¶

Personal attribution is the conclusion that a particular person performed, directed, controlled or knowingly participated in the activity.

Evidential caution: that a named account, device or subscriber is enough.

What this means¶

Personal attribution may be supported by:

control of the relevant device;

use of the account or session;

physical or remote presence;

communications;

instructions;

payment;

motive and opportunity;

possession of credentials;

knowledge of incident-specific facts;

admissions;

witness evidence;

behaviour consistent with the activity.

No single indicator is usually decisive.

A person may own the device but not control the session.

They may control the account but act under coercion.

They may pay for infrastructure but not operate it.

They may direct the activity without personally typing commands.

direct action;

control;

instruction;

assistance;

benefit;

knowledge.

Those are different roles.

Where several people may have used the same account or device, report the alternatives and explain what further evidence is needed.

Personal attribution may also be role-based. One person may configure infrastructure, another may operate it and another may receive the benefit. The report should state whether the evidence supports direct execution, direction, assistance or control rather than forcing every participant into one description.

Where personal attribution remains contested, identify the alternative user or controller that the evidence permits. The task is not merely to support one suspect, but to test whether another person, shared access, remote control or automation provides a credible explanation. The operational takeaway is:

Attribute activity to a person only where account, device, session, communication and contextual evidence combine to support that conclusion.

================================================================================

What to check or do next¶

• Investigators should distinguish:
• Do not allow technical labels to obscure evidential gaps.

Evidential limits¶

It may not be.