Who is likely to hold the useful records?¶
title: "Who is likely to hold the useful records?" card_id: "IP-074" status: "complete" source_document: "https://docs.google.com/document/d/1DLWuCzNFwUalAYsZyLk5Nmee8RR7uIGXQqTwhqWTwoE/edit?usp=drivesdk"
Who is likely to hold the useful records?¶
Who is likely to hold the useful records?¶
Once an IP address has been classified, the next question is often:
“Who is likely to hold the useful records?”
The answer depends on what you are trying to establish.
The platform that recorded the activity may hold the original event, account and session records.
An internet provider may hold information showing which customer connection was allocated a public address at a particular time.
A mobile provider or CGNAT operator may hold translation or session records needed to distinguish customers sharing an address.
If the address belongs to a workplace, school or other organisation, the useful records may sit inside that organisation rather than with its upstream internet provider.
The provider may identify only the organisation’s connection. Internal DHCP, Wi-Fi, authentication, firewall or proxy records may be needed to identify a device or account.
For hotel or public Wi-Fi, records may be divided between the venue, a managed Wi-Fi company and the internet provider.
A VPN or proxy operator may hold incoming and outgoing connection records, account information or payment data—if those records were created and retained.
A cloud or hosting provider may be able to connect an address with a customer account, virtual machine or service instance.
The customer using that hosted system may hold separate application or access logs.
No single organisation should be assumed to hold the entire attribution chain.
One party may hold the activity record. Another may hold the network allocation. A third may hold the local device or account information.
The organisation named in a public lookup is therefore not automatically the correct—or only—data holder.
Start with the precise question the enquiry needs answered.
Are you trying to identify a subscriber connection, a hosted account, a local device or the user of an online account?
The useful records are held by the organisation that could observe and record that particular relationship.
Finding the correct data holder means matching the investigative question to the system capable of answering it.