How should a messaging account be linked to a device or person?¶

Build three separate links: the message to its account, the account event to a device or session, and that device or session to a person at the relevant time.

Preserve each bridge¶

Account evidence may include stable IDs, registration, numbers, recovery and provider events. Device evidence may include application databases, tokens, linked sessions, notifications and login artefacts. Join the disputed message through IDs and timing rather than a familiar display name.

Personal control may be supported by possession, passcode or biometric evidence, location, witnesses, access patterns, admissions, surrounding conduct and knowledge within the content.

Test alternatives and timing¶

A number identifies a service, not necessarily its user. A seized device may have been borrowed, shared or remotely accessed, and an account compromised through a linked web session. Possession after the event does not prove control when it occurred.

Record the source and strength of each link and retain uncertainty rather than using one weak association to complete the whole chain.