How do I move from a connection to a device, user and responsible person?¶
Attribution is a chain of separate questions. An IP address may begin the chain, but it does not skip the stages between infrastructure and responsibility.
The chain¶
- Event: What did the original system record, and when?
- Connection: Which provider, household, business, mobile session, VPN or hosted service matched it?
- Device or account: Which private address, Wi-Fi association, server, session or account was involved?
- Control: Who could use that device, connection or account at the time?
- Responsibility: What evidence supports knowledge, intent and responsibility for this particular act?
Each answer may come from different records. A shared laptop, compromised account, remote administrator, malware or automated process may break an apparently simple chain.
How to report it¶
State what each result establishes and what remains open. “The provider associated the public address with a household” is different from “the suspect used the device”, which is different again from “the suspect was responsible for the act”.
The point to remember
Connection evidence can lead to infrastructure; infrastructure evidence can lead to a device or account; combined evidence is needed before drawing a conclusion about a person’s responsibility.
