Anonymous online conduct is the source of an increasing volume of defamation, harassment, and threat matters. Counsel routinely asks the threshold question: can you tell us who is behind this account?
The honest answer is: sometimes, depending on what they did. The attribution landscape:
What's usually possible. Posts that include identifying information — specific knowledge only certain people would have, photos with location metadata, distinctive writing patterns — can often be tied to a real-world identity through circumstantial and forensic-linguistic analysis. Account-creation artifacts (recovery email, recovery phone, device fingerprint at creation time) sometimes connect anonymous accounts to identified ones through platform-side records obtainable by subpoena.
What's sometimes possible. Cross-platform linkage. People reuse usernames, phrases, profile photos, and posting patterns. Linkage analysis across platforms can establish that an anonymous account on one site is the same person as an identified account elsewhere.
What's rarely possible without civil process. Direct technical attribution to a specific person at a specific IP address generally requires subpoenas to the platform and (frequently) to the ISP. The attribution chain has multiple weak links.
What's almost never possible. Attribution of an account that was carefully created with operational security — new email, new phone, VPN, no cross-platform reuse — without significant investigative work and luck.
We provide realistic scoping conversations before counsel commits to John Doe litigation.