How should attribution from logs be worded?¶

Move in stages from recorded technical identity to the evidence linking it to a person. The wording should match the strength of control evidence and the realistic alternatives that remain.

State the system fact before the personal inference¶

Identify the account, device, address and session in which activity was recorded. Then explain corroboration such as device possession, authentication method, subscriber or physical-access records, communications and behaviour surrounding the event.

A strong link to account ownership may still be weaker for control of one particular session.

Calibrate the conclusion¶

Shared credentials, remote access, compromised sessions, automation and administrator action may materially weaken attribution. Where supported, language such as “consistent with use by” or “the combined evidence supports attribution to” makes the inferential step visible.

Absolute statements should be reserved for evidence that genuinely excludes the important alternatives. Record which facts are direct observations and which depend on specialist or contextual interpretation.