Legal-Philosophical Question:

[kitsune]

I can't find the forum on law ...

How does one prove ownership of an online account?

[Rhu]

Most online accounts are owned by the service provider. Read your EULA.

[kitsune]

I mean who owns the messages? Let's say there's a social networking account with the username Rabbit and it's attached to e-mail address rabbit@yahoo.com. Rabbit writes and sends messages to other users. Let's say Rabbit did something illegal and the service provider doesn't want to own the online account, regardless of what was written in the EULA. How does the person who committed the crime get caught and punished? How does the law 'prove' Mr.Predator is the person who committed the crime? How does the law prove Mr.Predator owns these two online accounts?

[kitsune]

There is a part two to this: Let's say Mr.Curious is an young amateur hacker and gains access to Rabbit's online social networking account. Mr.Curious is playing around, has no idea what is in this account. He changes the e-mail address to woohoo@yahoo.com. Now, how the hell does Mr.Curious prove his innocence - he didn't write those messages, he didn't seduce those women out into the woods and he didn't chop off their heads?

[Ptah]

This seems to be less a question about ownership and more a question about liability?

[Senseye]

I'm pretty sure there is legalese that while the service provider "owns" the account they are not responsible for the content of the account.

As far as the hacker question (or who is the primary user of the account issue) it's a bit more of a sticky wicket. In a real hard core investigation there are probably some degree of logs kept by the service provider which might indicate I/P's used to access the account, the original email address (and who owns that) etc. A good hacker could probably cover all his tracks but I'm not an expert.

The onus would likely be on the accuser to prove you did use the account (you would just deny it was you) and if they could not produce enough evidence otherwise, you would be fine.

Your scenario of an innocent hacker co-opting the account of an actual criminal is pretty unlikely. I think most cases are likely to revolve around an actual criminal denying he was behind an account used for nefarious purposes.

[kitsune]

That, too. IP addresses are unreliable if access was hidden behind a VPN. That is, unless the VPN provider keeps a history of which real IPs were tunneled to which fake IPs during certain timeframes. (Is the use of a VPN in general legal/illegal?) I've always wondered why browsers don't collect and divulge MAC addresses in addition. Or do they nowadays?

[Perdix]

I cryptographically sign important emails using a curve25519 algorithm. It's great for proving ownership of digital assets.

[kitsune]

^ I assume with a curve25519 signature, both parties need a key? How would you set something like that up?