When an online defamation matter reaches an attorney, one of the first questions is often deceptively simple: Who is actually behind it?
A client may have screenshots, usernames, URLs and months of abusive or defamatory content. They may be convinced they know who is responsible. But suspicion is very different from evidence that can support legal action, and this is precisely the gap that online defamation investigations are designed to close.
This becomes particularly difficult when the perpetrator is operating through anonymous social media accounts, newly created email addresses, pseudonymous websites, fake personas or accounts created specifically to attack the client.
At Rexxfield, these are the types of matters we regularly investigate. Our role is not simply to find information about a suspected individual. We work backwards from the available digital evidence to determine whether apparently anonymous activity can be connected to a real person, organisation or coordinated group.
For attorneys, that distinction matters.
Anonymous Does Not Necessarily Mean Untraceable
People engaging in online defamation often assume that creating a new username, email address or social media account makes them anonymous. In practice, online identities rarely exist completely independently.
A person may reuse a username somewhere else. They may use the same profile photograph, writing style, contact details or biographical information across different platforms. An anonymous account may interact with another account controlled by the same person. Historical content may also reveal information that has since been deleted.
Sometimes the most useful evidence is not contained in the defamatory post itself. It comes from the wider digital footprint surrounding the account.
In some cases, there may also be opportunities to identify or obtain IP address information associated with the activity. IP evidence can be particularly valuable because, when lawfully obtained and combined with other investigative information, it may help establish the location, internet connection or infrastructure used by the anonymous actor and ultimately assist in attributing the activity to an individual. Depending on the circumstances, obtaining subscriber information connected to an IP address may require legal process, which is one reason investigative work and an attorney’s discovery strategy can work particularly well together.
This is why an attribution investigation is generally much broader than simply examining a username. We may look at relationships between accounts, historical activity, publicly available records, domains, websites, infrastructure, IP and other technical indicators, archived material, timing patterns and other digital identifiers. Individually, these indicators may mean very little. Together, they can begin to establish a much clearer attribution picture.
We have documented this pattern in depth in our analysis of finding the real identity behind fake social media accounts, and in cases involving a single platform such as tracing who runs an anonymous Twitter/X account.
The Difference Between a Suspect and Establishing Attribution
Attorneys often approach us with a likely suspect already in mind. That can be extremely useful to an investigation. We do not assume the client’s theory is correct, but having a suspected individual gives us another avenue through which we can test the attribution.
Rather than looking only for information that supports the client’s suspicion, we look for evidence that can rule the suspect in or rule them out. Depending on the circumstances and what is legally permissible, this can include open source intelligence, technical analysis and lawful social engineering techniques designed to test whether the suspected individual can be connected to the anonymous activity.
This can be particularly valuable where IP address evidence is involved. If an investigation lawfully identifies an IP address associated with the anonymous activity and we also have a suspected individual, investigative techniques may provide an opportunity to determine whether that individual can be associated with the same IP address. Where that connection can be independently established, it may remove the need to subpoena an internet service provider merely to identify the subscriber associated with the IP address. Counsel can then evaluate the combined evidence and determine whether further legal process is necessary.
Suppose, for example, an anonymous account repeatedly attacks a company’s CEO and the client believes a former employee is responsible. Similarities in language or posting times may be interesting, but on their own they are usually weak attribution evidence. If additional investigation connects the anonymous account to an IP address and lawful investigative techniques independently associate the suspected individual with that same IP address, the attribution picture becomes considerably stronger.
We still look for further corroboration. The anonymous username might connect to an older forum account, that account may reference a location associated with the suspect, or historical profiles may reveal employment, biographical or other information consistent with that individual. The significance comes from multiple independent indicators pointing toward the same person, rather than any single clue being treated as conclusive.
For attorneys, this approach can be particularly valuable because identifying and testing a suspected individual may provide a faster route to attribution than beginning immediately with third party discovery. It is also why we caution against filing based on suspicion alone. We discuss this issue further in our article on identifying anonymous bad actors to avoid John Doe lawsuits.
AI Has Made Online Defamation Easier to Scale
Artificial intelligence is adding another layer to these investigations. A perpetrator can now generate large volumes of convincing content very quickly. AI can help create defamatory articles, social media posts, fabricated conversations, fake personas and even synthetic images, audio and video.
That does not necessarily make the human operator invisible. Our AI-focused investigative work increasingly looks at separating synthetic content from the evidence surrounding its creation and distribution.
An AI generated post may contain little attribution value in its wording. But the account publishing it still has a history. The website hosting it may have infrastructure. The person distributing it may make operational mistakes. Accounts may interact with each other in patterns that reveal coordination.
AI changes the content. It does not eliminate the human activity around the content.
The FBI has warned that criminals are using generative AI to increase the scale and credibility of fraudulent and deceptive activity, while the Federal Trade Commission has addressed impersonation and AI enabled deception. For counsel, both are useful background when synthetic identities or content become part of a case.
Evidence Preservation Should Start Early
One of the most frustrating situations we encounter is when potentially valuable evidence has disappeared before an investigation begins.
A client takes a screenshot, but the original post is later deleted. An account changes its username. A website disappears. Profile information is modified. Comments or interactions that could have helped connect accounts are removed.
Screenshots are useful, but they are not always enough. Where litigation is contemplated, attorneys should consider preservation as soon as possible. Depending on the matter, that can include capturing URLs, timestamps, account identifiers, surrounding conversations, webpages and other contextual information.
Preservation also gives investigators more material to work with. A screenshot cropped to show only a defamatory statement may remove exactly the contextual information needed to investigate where it came from.
Investigation and Legal Discovery Should Work Together
Private investigation does not replace subpoena power. There are situations where information held by a platform, internet provider, domain registrar or other third party may only be obtainable through appropriate legal process.
But this does not mean counsel must begin litigation completely blind. Pre-litigation investigation can help identify likely actors, uncover related accounts, preserve evidence and establish which platforms or entities may hold relevant records, and our subpoena preparation work is often the bridge between investigative findings and formal legal process.
That can make subsequent discovery considerably more focused. Rather than issuing broad requests in the hope that something useful appears, counsel may be able to pursue specific accounts, dates, identifiers or relationships already identified during the investigation.
There is also a practical issue: legal process takes time. During that period, accounts may continue publishing content or disappear entirely. Investigative work can often begin immediately.
What Attorneys Should Expect From Online Defamation Investigations
Well-run online defamation investigations should do more than provide a collection of search results. We aim to explain the evidentiary significance of what we find.
That means separating confirmed facts from analytical conclusions, explaining relationships between digital identities, documenting relevant evidence and being clear about the strength and limitations of attribution.
In litigation related matters, this becomes particularly important because the investigation may later be scrutinised by opposing counsel or the court. We therefore approach these matters with the assumption that our methodology and conclusions may eventually need to be explained.
When to Engage an Investigator
Timely online defamation investigations are often the best time to act, earlier than attorneys expect. If the defendant is anonymous, evidence is disappearing, multiple accounts appear coordinated or the client has only a theory about who is responsible, an investigation before filing can significantly clarify the case.
It may confirm the client’s suspicions. It may identify an entirely different individual. Or it may show that there is not yet enough evidence to responsibly attribute the conduct. All three outcomes are valuable.
At Rexxfield, our online defamation investigations support attorneys, companies, executives and individuals dealing with harassment and anonymous actors internationally.
When the person behind an online attack is unknown, the objective is not to guess who they are. It is to build the strongest evidence available to determine who is actually behind the screen.
How Rexxfield Can Help
This article is the first in a three-part series on online defamation investigations for attorneys handling anonymous harassment matters. Read next: Pre-Litigation Investigations in Online Defamation Cases and How to Identify an Anonymous Online Harasser Before Filing a Lawsuit.
If you are representing a client dealing with anonymous defamation, harassment or coordinated online abuse, Rexxfield can assist with evidence preservation, attribution investigation and litigation support. Engaging early can help counsel understand what evidence exists, what can be established independently, and where legal action against an anonymous online user may or may not be viable.
