Is the proposed enquiry necessary and proportionate?¶

title: "Is the proposed enquiry necessary and proportionate?" card_id: "IP-110" status: "complete" source_document: "https://docs.google.com/document/d/1gl0sKBv0Hj9UlwEkNs5nrOPRWKRo4D3vz-PTGq8C5DY/edit?usp=drivesdk"

Is the proposed enquiry necessary and proportionate?¶

IP-110 — Is the proposed IP enquiry necessary and proportionate?

Before pursuing an IP address, be clear about the question you need the enquiry to answer.

Are you trying to identify a subscriber connection, locate urgent evidence, link events, test an account holder’s explanation or identify the next data holder? “Find out who used the IP” is too vague and may promise a result the records can’t provide.

Necessity asks why the enquiry is needed. What offence, harm or safeguarding concern is being investigated? What material fact could the result establish? Could the same question be answered through a less intrusive or more reliable source?

Proportionality asks whether the likely benefit justifies the intrusion, scope, cost and delay. A targeted request for one precisely timed connection is different from seeking every user of a large public network over several days. The seriousness of the matter, the risk, the quality of the starting data and the likelihood that useful records exist all affect that balance.

Consider the whole route, not just the first request. A VPN or cloud address may require several enquiries across different organisations and jurisdictions before reaching another intermediary. If the missing source port or vague timestamp means the first provider can’t distinguish a customer, the route may offer little realistic value.

Define the minimum data needed. Limit the time window, identifiers, accounts and record types to what can answer the question. Record why wider material is required if the enquiry genuinely can’t be narrowed.

Review the position as results arrive. A justified first request doesn’t automatically justify every later step. New evidence may increase the need, reveal a more focused route or show that further IP enquiries won’t materially advance the case.

The technical question and the investigative justification should match. A proportionate enquiry has a defined purpose, a realistic evidential outcome and a scope no wider than necessary. Approval or lawful authority doesn’t make the result stronger than it is: even a properly justified subscriber or account response still needs careful interpretation and corroboration before it can identify the person responsible.