What does an ISP subscriber result actually establish?¶
title: "What does an ISP subscriber result actually establish?" card_id: "IP-029" status: "complete" source_document: "https://docs.google.com/document/d/1OGvEmC2kxg4tD2w4RlKeNBTw4DP54o5qfiOyAFLVPQ0/edit?usp=drivesdk"
What does an ISP subscriber result actually establish?¶
A provider has returned a subscriber’s name and address for the IP address you supplied.
What does that actually establish?
Usually, it means the provider’s records show that the relevant public IP address was allocated to a particular customer connection or account at the specified time.
For a fixed broadband service, that may be an account associated with a particular home or business connection.
For a mobile service, it may be an account, SIM or network session associated with a particular customer.
Where CGNAT was involved, the result may have been produced by matching the public IP address, timestamp, source port and protocol against the provider’s translation records.
But the result is still an allocation record.
It doesn't normally mean that the provider witnessed the activity being investigated. The provider is matching the connection details supplied in the enquiry against its own network records.
The result may establish that the activity recorded by another system appears to have passed through a connection allocated to that subscriber.
It doesn't automatically establish which device generated the activity.
Several devices may have been connected through the same router. A household connection could be used by family members, visitors, smart devices or somebody using the Wi-Fi without permission.
A business connection may be shared by hundreds of employees, visitors and networked systems.
The named subscriber is also not necessarily the person who was using the connection. They may simply be the person who entered into the contract or pays the bill.
Even where only one person normally uses the connection, the result doesn't by itself prove that they performed the activity deliberately—or at all. A device could have been remotely accessed, compromised or operating automatically.
The accuracy of the result also depends on the accuracy of the information used to obtain it. The IP address, timestamp, time zone and any required source-port information must refer to the same recorded event.
The provider’s response should therefore be described carefully.
It may support a connection between an event and a subscriber account or internet connection. It doesn't, without further evidence, identify the device, the user or the person responsible.
Moving beyond the subscriber normally requires corroboration from other sources. That might include account records, device examination, local network records, communications, CCTV, payment information or admissions.
An ISP subscriber result can be an important step in attribution—but it is a step in the chain, not the end of it.