How should uncertainty about message authorship be reported?¶

Report the proven account or device event first, then explain the evidence connecting it to the proposed author, realistic alternatives and the uncertainty that remains.

Separate event from personal attribution¶

State whether the service recorded an account sending the message, the content was present on a device, or a provider associated activity with a session. Then identify the links to the person: possession and access, endpoint and login records, location, witnesses, content knowledge and conduct.

This makes clear where direct records end and inference begins. A strong attribution can be expressed firmly without pretending that an account label is a verified human identity.

Explain material alternatives proportionately¶

Shared use, linked-device access, delegation, compromise or automation should be addressed when they have a factual and technical basis. State which evidence supports, weakens or leaves each material explanation unresolved. Do not give every theoretical possibility equal weight.

Use wording consistent with the applicable reporting framework and explain its basis rather than relying on an unexplained confidence label. Identify evidence that could resolve a remaining issue. The result should let the reader see both why the attribution is persuasive and precisely where its limits lie.