How do I distinguish infrastructure from responsibility?¶
Infrastructure identifies systems and providers. Responsibility concerns who controlled, used, authorised, knew about or benefited from the activity.
A domain may be registered to one person and administered by another. An IP address may belong to a cloud provider. A hosting account may belong to an agency. A platform may host user-created content.
Ask what each record actually identifies¶
Does the record identify:
- the provider;
- the customer account;
- an administrator login;
- a payment beneficiary;
- a device;
- a publishing account; or
- a person who carried out the relevant act?
Each is a different evidential step.
Use precise wording¶
It may be accurate to say that a domain resolved to infrastructure operated by a provider. It may not be accurate to say that the provider hosted “the offender’s website”.
It may be accurate to say an account changed configuration. It may not be accurate to say the named account holder personally made the change.
Move towards responsibility through corroboration across access records, devices, communications, payments and content, while testing shared access, stolen credentials, delegated administration and compromise.
Key takeaway
Do not collapse technical association into personal responsibility. Attribute the specific action through corroborated evidence.