Skip to content
Skip to main content
Messaging, Social Media & Telecoms Operational Explainer

What can messaging records prove about a person?

Messaging activity can be attributed to a person when evidence connects the relevant account, device or session and event time to that person's control. An account label, subscriber record or seized handset is only part of that chain.

Build attribution for the specific event

First establish the account-level action. Then identify the endpoint or session involved and who could access it at the time. Useful evidence can include possession, unlock or biometric activity, passcode knowledge, location, login history, witness accounts, admissions and contemporaneous conduct.

Message content may add support through distinctive knowledge, relationships or references to recent events. These contextual features should be assessed alongside technical evidence rather than treated as self-authenticating.

Test realistic alternatives

A registered customer need not be the user; a device recovered from a home need not have been controlled by one resident throughout. Consider sharing, delegation, compromise, remote access and automation where facts make them realistic.

Build a timeline around the disputed event, not merely general ownership before or after it. Explain each evidential link and any unresolved alternative. The strength lies in independent strands converging, not in converting a technical association into personal certainty.

The point to remember

Attribute a message to a person only through a time-specific chain connecting the account event, endpoint and human control while testing realistic alternatives.

Reference: MSG-107Messaging, Social Media & Telecoms