Military Defense Investigation Knowledge Base
Military Defense Investigation Authority Publication
Authority Publication No. DI-132
Attributing Computer Activity in Cases Involving Shared Systems, Remote Access, or Stolen Credentials
Independent Military Defense Investigations
Supporting Attorneys, Service Members, and Families
Publication Date: August 24, 2026
────────────────────────────────────────
Executive Summary
Attributing computer activity in military investigations requires separating the human user from the account, device, session, and network activity recorded by digital systems.
A username or login record may establish that an account was used, but it does not necessarily identify the human being who performed the activity. That distinction becomes especially important when systems are shared, remote access is enabled, or credentials may have been compromised.
DI-132 explains how defense investigators can preserve and evaluate forensic images, login and audit logs, system time, remote-access and VPN records, cloud and authentication records, shared-account practices, credential compromise, malware evidence, physical access, work schedules, and independent user activity.
The publication's practical example involves a prohibited file accessed under the accused's username on a shared workstation with remote access enabled. The logs identify the session and device, but additional evidence is required to identify the human user.
The purpose is not to reject digital evidence automatically. It is to trace every attribution conclusion to the original technical source, reconstruct chronology and access, corroborate identity independently, and accurately state the limits of what the digital evidence establishes.
DI-132 explains how defense investigators distinguish account, device, session, and network activity from proof identifying the actual human user in cases involving shared systems, remote access, or stolen credentials.
Who Should Read This Publication?
Military Defense Counsel
Use the underlying digital records and documented attribution limits to identify additional discovery, expert consultation, evidentiary issues, cross-examination areas, and litigation strategy.
Defense Investigators
Preserve digital sources, map accounts and custodians, reconstruct access and system chronology, compare technical records with physical access and work schedules, and trace attribution conclusions to original evidence.
Service Members
Understand why activity under a username or on a device does not automatically establish who performed the activity, particularly when systems are shared or remote access and credential compromise are possible.
Qualified Digital-Forensics Experts
Review forensic images, logs, system-time information, authentication and remote-access records, malware or compromise evidence, and clearly defined questions when counsel requests specialized analysis.
Families
Understand why preserving lawfully available account notices, schedules, communications, device information, and other records may matter, while leaving evidence acquisition, forensic handling, and technical interpretation to counsel, investigators, and qualified experts.
Companion Video
This companion video expands on the investigative concepts presented in this Authority Publication through additional explanation, practical examples, and professional investigative insight.
About Michael West
The investigative guidance presented throughout these Authority Publications is based upon decades of professional experience conducting military, federal, criminal, civil, and private investigations. The principles discussed in these publications are drawn from real investigative work involving complex cases, witness development, evidence analysis, and factual case preparation.
Michael West has served as a Special Agent with the United States Air Force Office of Special Investigations (AFOSI) and the Department of Defense Inspector General, conducted federal background investigations, and spent decades working as a licensed private investigator supporting attorneys, businesses, service members, and private clients. Throughout his career, his work has focused on identifying facts, locating witnesses, analyzing evidence, and strengthening the factual foundation of legal cases through independent investigation.
The Military Defense Investigation Knowledge Base was created to share that investigative experience in a practical, understandable format. Its purpose is to help attorneys, service members, and families better understand the investigative process, ask more informed questions, and recognize opportunities where independent investigation may strengthen the defense.
Important Information
This Authority Publication is provided for educational and informational purposes and is intended to help readers better understand military defense investigations and the investigative process. It is based upon professional investigative experience and is designed to provide practical investigative insight rather than legal advice.
Every military case is unique. The investigative strategies, factual issues, and legal considerations applicable to one case may not apply to another. Readers should consult with a qualified attorney regarding legal rights, legal strategy, and decisions involving their individual circumstances.
Nothing contained in this publication should be interpreted as creating an attorney-client relationship or an investigator-client relationship. References to investigative techniques, procedures, or case examples are provided solely to illustrate investigative principles and should not be considered legal guidance.
Effective military defense is strengthened by informed legal representation supported by thorough factual investigation. The purpose of these Authority Publications is to help readers better understand that investigative process so they can communicate more effectively with qualified legal counsel and make informed decisions throughout the military justice process.