How should alternative explanations for messaging activity be assessed?¶

Messaging evidence may support one obvious interpretation while other realistic explanations remain possible.

Evidential caution: that the first plausible explanation is automatically the correct one.

What this means¶

Then identify the attribution steps needed to reach the proposed conclusion.

Consider realistic alternatives such as shared accounts, linked devices, delegated access, compromise, automation, copied content, number reassignment, device transfer and synchronisation.

Test each explanation against timing, device possession, login activity, account-security records, message content, conduct and independent witnesses.

Document both supporting and contradicting material.

Avoid absolute technical claims where the records do not justify them.

Where the issue is disputed, identify what additional evidence would strengthen or weaken the attribution.

Where the issue is disputed, identify what additional evidence would strengthen or weaken the attribution.

What to check or do next¶

• Start with the event the records actually prove: the account action, device activity, message status or provider event.
• Do not generate speculative possibilities without an evidential basis. The alternative should be technically possible and connected to facts in the case.
• Look for evidence that would distinguish between the competing explanations.
• Preserve the source and collection method so another investigator can test the same conclusion.
• Preserve the source and collection method so another investigator can test the same conclusion.

Evidential limits¶

An alternative does not have to be proved before it is considered. But a bare assertion should not outweigh strong, consistent evidence.

In reports, explain why the preferred interpretation is supported and what uncertainty remains.