Internet Architecture and Legal Terminology

Introduction

Cyber law operates at the intersection of legal rules, human conduct, and technical systems. A legal complaint may describe an unauthorised access, unlawful interception, data breach, impersonation, or online publication. Yet each event occurs through technical components: devices, networks, servers, cloud services, applications, identity systems, and records. A person who investigates or adjudicates a cyber incident therefore needs more than legal vocabulary. They must understand what technically happened, which entities controlled the relevant systems, what evidence was created, and how confidently that evidence connects an act to a person or organisation.

The Internet is not a single machine or centrally controlled network. It is a global system of interconnected networks operated by governments, telecommunications providers, cloud companies, universities, businesses, and individuals. Information is divided into packets, addressed using numerical and human-readable identifiers, routed through multiple systems, and processed by services that may be located in several jurisdictions. This structure creates legal complexity. A user may be in one country, an application provider in another, a cloud data centre in a third, and an affected person in a fourth.

This chapter introduces the technical foundations needed to connect cyber events with legal responsibility and evidence. It explains network architecture, cloud computing, online platforms, encryption, digital identity, metadata, and distributed systems. It also introduces legal terminology commonly used when describing responsibility, jurisdiction, attribution, admissibility, preservation, and chain of custody. The objective is not to train a network engineer. It is to provide sufficient technical literacy for sound legal analysis and responsible professional practice.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Describe the basic structure of the Internet and the movement of data across networks.
2. Distinguish devices, networks, protocols, applications, cloud services, and platforms.
3. Explain how encryption, authentication, digital identity, and metadata function.
4. Identify why distributed systems complicate location, responsibility, and evidence.
5. Use important cyber-law terminology accurately, including attribution, jurisdiction, intermediary, preservation, and chain of custody.
6. Relate technical records to legal questions without treating a single log or identifier as conclusive proof.

1. The Internet as an Interconnected System

A network is a group of computing devices connected so that they can exchange data. A local area network may connect devices in an office, while a wide area network connects sites across cities or countries. The Internet is a network of networks. No single organisation owns or operates the entire Internet, although particular organisations control important parts of its infrastructure.

A typical online transaction involves several layers:

• Endpoint: The user’s phone, computer, tablet, server, or Internet-of-Things device.
• Access network: The Wi-Fi network, mobile network, or broadband connection that links the endpoint to an Internet service provider.
• Routing infrastructure: Routers and autonomous systems that forward packets between networks.
• Name and addressing services: Systems such as the Domain Name System (DNS) and Internet Protocol (IP) addressing.
• Transport and application protocols: Rules that support reliable delivery, web communication, email, file transfer, and other services.
• Application and data services: Websites, mobile applications, databases, content delivery networks, and cloud platforms.

Data is commonly divided into packets. Each packet contains control information, such as source and destination addressing, and a portion of the data being transmitted. Packets belonging to one communication may take different routes and may be reassembled at the destination. Consequently, the physical route of a communication is not necessarily visible to the user, and the apparent location of a service may differ from the location of its hardware.

Figure: A simplified path from an endpoint to an online cloud or platform service.

1.1 Addressing and naming

An IP address identifies an interface on an IP network for communication purposes. IPv4 addresses are commonly written as four decimal numbers, while IPv6 uses a longer hexadecimal representation. An IP address is not automatically a personal identity. It may identify a router, a shared connection, a virtual machine, a public hotspot, or a temporary assignment. Many users may appear online through one public address because of network address translation (NAT).

The Domain Name System translates human-readable names, such as a website domain, into network addresses. DNS records may identify servers, mail services, or other resources. A domain name registration can provide useful investigative information, but registration information may be private, inaccurate, protected by a proxy service, or unrelated to the person who used the service at a particular time.

1.2 Protocols and layers

A protocol is an agreed set of rules for communication. The Transmission Control Protocol (TCP) supports ordered and reliable delivery in many applications. The User Datagram Protocol (UDP) provides a simpler transport mechanism without the same delivery guarantees. The Hypertext Transfer Protocol (HTTP) supports web communication, while HTTPS generally means HTTP protected by Transport Layer Security (TLS).

Layered architecture is important legally because different actors may control different functions. A telecommunications provider may control access records; a domain registrar may control registration information; a platform may control account and content records; and a cloud provider may control infrastructure logs. A technical description should therefore identify the relevant layer rather than refer vaguely to “the Internet.”

2. Cloud Computing and Online Platforms

Cloud computing provides on-demand access to computing resources over a network. Those resources may include processing power, storage, databases, networking, software, and analytics. Cloud systems are often elastic: resources can be created, scaled, moved, or deleted rapidly. They are also commonly multi-tenant, meaning that one physical environment may serve many customers through logical separation.

The principal service models are:

These divisions are not absolute. The applicable contract and service documentation determine the actual allocation of responsibilities. The “shared responsibility model” is therefore both a technical and legal concept. A customer may be responsible for poor access controls even when the provider is responsible for physical security. Conversely, a provider may remain responsible for failures within infrastructure under its control.

Cloud evidence may include access logs, authentication events, virtual-machine records, object-storage history, database audit logs, application logs, billing information, and support records. Logs may be distributed across regions and services. Retention periods, time synchronisation, configuration settings, and legal holds can affect whether records remain available.

An online platform is a service that enables users to create, store, search, exchange, or publish information or transactions. Examples include social networks, marketplaces, payment services, collaboration systems, and content-hosting services. Platforms usually mediate interactions through accounts, application programming interfaces, recommendation systems, moderation tools, and automated detection. Their legal position varies by jurisdiction and by the nature of the activity. A platform may be an intermediary, a controller or processor of personal data, a publisher in some circumstances, or a direct participant in a transaction.

3. Encryption and Its Legal Significance

Encryption transforms readable information, called plaintext, into an unintelligible form, called ciphertext, using an algorithm and a key. Decryption reverses the process for an authorised party. Encryption can protect confidentiality, support integrity, and contribute to authentication, but it does not by itself prove that a particular person created or transmitted content.

Two broad forms are important:

• Symmetric encryption: The same secret key is used, subject to the algorithm’s design, for encryption and decryption. It is efficient for large quantities of data, but the parties must establish and protect the shared key.
• Asymmetric encryption: A key pair consists of a public key and a private key. The public key may be distributed openly, while the private key must be protected. Key pairs support encryption and digital signatures.

A digital signature is generated using a private key and can be verified using the corresponding public key. Properly implemented signatures can provide evidence of integrity and key possession. They do not automatically prove the human identity of the private-key holder. If a private key is stolen, shared, or poorly protected, attribution requires additional evidence.

A cryptographic hash produces a fixed-length value from input data. A small change in the input normally produces a different hash. Investigators use hashes to compare copies of files and demonstrate that a file has not changed since a documented point in time. A hash is not encryption: it is generally designed to be one-way and does not provide confidentiality.

TLS protects data in transit between specified endpoints, but protection may terminate at a server, proxy, content delivery network, or security gateway. End-to-end encryption is stronger in the sense that only the communicating endpoints are intended to access plaintext, although endpoint compromise, backups, screenshots, metadata, and account recovery processes may still expose information. Legal analysis should ask what was encrypted, where encryption terminated, who controlled the keys, and what records remained visible.

4. Digital Identity, Authentication, and Attribution

Digital identity is the collection of attributes and credentials used to represent an individual, organisation, device, or service in a digital environment. An account name, email address, device certificate, biometric template, cryptographic key, or government-issued digital credential may contribute to an identity. None should automatically be treated as equivalent to a verified human identity.

Authentication is the process of verifying a claimed identity. Common factors include:

1. Something the user knows, such as a password.
2. Something the user has, such as a security token or registered phone.
3. Something the user is, such as a biometric characteristic.
4. Sometimes, a contextual factor, such as a location or trusted device.

Authorisation determines what an authenticated identity is permitted to do. A person may be authenticated successfully but not authorised to access a file. Conversely, a stolen session token may allow access without the attacker knowing the password.

Attribution is the process of connecting a technical event to a particular actor. It is usually an inference based on multiple sources: account records, device data, IP information, authentication events, payment records, communications, witness evidence, and motive or opportunity. An IP address alone is ordinarily insufficient to establish attribution. Shared devices, compromised accounts, malware, remote access, VPNs, proxies, and inaccurate clocks can all weaken an inference.

Identity providers and single sign-on systems create additional dependencies. An identity provider may authenticate a user for several services, meaning that compromise of one credential can affect many systems. Security logs should record not only a username but also authentication method, device, timestamp, session identifier, and relevant risk signals where lawfully collected.

5. Metadata and Digital Evidence

Metadata is information about data. A document may contain its author field, creation date, revision history, or software version. A photograph may contain camera information, location coordinates, and capture time. An email may contain routing headers, message identifiers, sender and recipient fields, and time information. Network systems may record addresses, ports, protocols, volumes, and connection times without recording the complete content.

Metadata can be highly valuable because it helps establish sequence, relationships, system use, and provenance. It can also mislead. Device clocks may be wrong; software may preserve or alter fields; a user may edit metadata; time zones may be misunderstood; and a platform may rewrite information during upload or processing. Metadata should therefore be corroborated with independent sources.

Digital evidence includes electronically stored information capable of supporting or refuting a fact in issue. Relevant properties include:

• Authenticity: Whether the evidence is what it is claimed to be.
• Integrity: Whether it has remained complete and unaltered.
• Reliability: Whether the system and process that produced it operated dependably.
• Relevance: Whether it tends to prove or disprove a legally material fact.
• Provenance: The history and source of the item.
• Admissibility: Whether applicable procedural and evidential rules permit its use.

A log entry is not necessarily a direct observation of a human act. It may be generated by software, copied between systems, or derived from synchronised events. Investigators should record the source, acquisition method, time zone, system configuration, hash or other integrity measure, and persons who handled the evidence.

6. Distributed Systems and the Problem of Location

A distributed system consists of multiple computing components that cooperate across a network. Databases may replicate data across regions; content delivery networks may cache content near users; microservices may process one transaction through many independent services; and cloud orchestration may move workloads between hosts.

Distribution improves resilience and performance but complicates legal analysis. A single transaction may produce records in several jurisdictions. A user may access content from one location while the data is stored elsewhere and a support team operates in another country. Copies may persist in backups or caches after an account holder deletes the original.

Important concepts include:

• Replication: Maintaining copies of data on multiple systems.
• Caching: Temporarily storing data closer to users to reduce delay.
• Availability zone or region: A provider-defined geographical or infrastructure area.
• Microservice: A relatively independent service performing a particular function.
• Eventual consistency: A design in which replicas may temporarily differ before converging.
• Fault tolerance: The capacity to continue operating despite component failures.

Eventual consistency matters when records are collected immediately after an incident. Two systems may show different states at different times, not necessarily because one is false, but because updates have not yet propagated. Investigators should preserve the source, collection time, and system context of each record.

Distributed architecture also affects responsibility. A platform may rely on a payment provider, identity provider, hosting provider, analytics service, and content delivery network. Contracts, technical controls, statutory duties, and actual operational control must be examined together. A formal contract may allocate responsibilities, but it does not automatically resolve every question of negligence, statutory liability, or criminal participation.

7. Core Legal Terminology for Technical Events

Jurisdiction

Jurisdiction is the lawful authority of a court, regulator, or other institution to hear a matter, regulate conduct, or enforce a decision. Cyber incidents often create territorial problems because conduct, infrastructure, victims, and effects may be distributed across countries. Jurisdiction may be based on territory, nationality, the location of effects, contractual consent, or other rules of the applicable legal system.

Applicable law and conflict of laws

Applicable law identifies which legal rules govern a dispute or conduct. Conflict-of-laws analysis may be required when more than one legal system has a plausible connection. Terms of service may contain governing-law and forum clauses, but such clauses may be limited by mandatory consumer, privacy, employment, or criminal law.

Intermediary

An intermediary is an entity that enables communication, hosting, transmission, search, payment, or access between other parties. Examples include Internet service providers, hosting companies, domain registrars, marketplaces, and social platforms. Legal protections and duties vary according to the entity’s role and the jurisdiction.

Data controller and data processor

In data-protection frameworks, a controller generally determines purposes and means of processing, while a processor handles personal data on behalf of a controller. Terminology and duties differ among laws. A service provider’s label in a contract is not always decisive; actual functions and decision-making may matter.

Preservation and disclosure

Preservation is the safeguarding of potentially relevant information against loss or alteration. Disclosure is the lawful provision of information to an authorised person or authority. A preservation request may protect records while formal legal process is obtained, but preservation does not necessarily authorise access to content.

Chain of custody

Chain of custody is the documented history of collection, transfer, storage, examination, and presentation of evidence. It should identify who handled an item, when, why, how it was protected, and what changes, if any, occurred. A gap does not automatically make evidence worthless, but it may affect weight, reliability, or admissibility.

Due process and proportionality

Due process requires fair and lawful procedures, including appropriate authority, notice or opportunity to respond where applicable, and independent decision-making where required. Proportionality asks whether a measure is suitable, necessary, and balanced against the rights and interests affected. These principles are important in surveillance, account restriction, data requests, and content removal.

8. Applied Case: The Compromised Marketplace Account

This is an illustrative fictional case.

Background

A small online marketplace reports that a seller’s account was used to change bank details and redirect payments. The seller denies making the changes. The marketplace operates a web application hosted in the cloud, uses a separate identity provider for staff access, and relies on a payment processor in another country.

Problem

The central questions are whether the account was accessed without authorisation, who made the changes, whether the marketplace or seller failed to apply reasonable security, and what evidence can be obtained lawfully.

Analysis

The marketplace first preserves application logs, account-change records, authentication events, support tickets, and relevant database snapshots. It records the collection time, system time zone, source system, collector, and integrity controls. Investigators discover that the change was made from a previously unseen device using a valid session token. The IP address belongs to a residential provider and is shared through network address translation.

The evidence does not establish that the seller personally made the change. A later review shows that the seller’s browser had a malicious extension capable of stealing session tokens. A second log shows that multi-factor authentication was completed several hours earlier from the seller’s normal device, but the bank-detail change used the stolen session without a new authentication challenge.

The marketplace also examines role permissions. The seller was authorised to edit product listings but not expected to alter settlement details without additional verification. The application nevertheless allowed the change using the ordinary session. The cloud provider confirms that its infrastructure logs show no unauthorised administrative access.

Approach and solution

The marketplace suspends settlement changes, resets sessions, requires reauthentication and stronger verification for payment changes, and notifies affected parties according to applicable law. It seeks records from the identity provider and payment processor through appropriate legal and contractual channels. Investigators correlate application, identity, device, and payment records rather than relying on the IP address.

Outcome

The evidence supports a conclusion that the account was likely compromised and that the payment change was made by an unauthorised actor. It does not, by itself, identify the actor as the person associated with the residential IP address. The marketplace’s control design is also relevant: its failure to require step-up authentication for a high-risk change may create regulatory, contractual, or civil-law issues depending on the governing law and facts.

Learning points

1. A valid credential or session does not necessarily mean that the legitimate user acted.
2. An IP address is an investigative lead, not automatically a human identity.
3. Attribution requires correlation of independent evidence.
4. Cloud-provider logs may show infrastructure status but not all application-level activity.
5. Security design and legal responsibility are connected through control, foreseeability, duties, and applicable law.
6. Evidence should be preserved before systems are reset or records expire.

9. Governance, Ethics, and Best Practices

Technical capability does not itself create legal authority. Accessing a system, collecting personal data, intercepting communications, or disclosing records requires a lawful basis. Organisations should define retention periods, access permissions, incident-response procedures, logging practices, and escalation routes before an incident occurs.

Good practice includes:

• Maintain accurate system clocks using reliable time-synchronisation methods.
• Record time zones and timestamp formats in reports.
• Use least privilege and separate administrative duties.
• Protect logs from unauthorised alteration and restrict access to them.
• Enable stronger authentication for high-risk actions.
• Document cloud regions, subprocessors, retention arrangements, and legal-request procedures.
• Preserve original evidence and examine working copies.
• Collect only information necessary for a defined lawful purpose.
• Avoid unnecessary disclosure of victims’ personal information.
• Distinguish facts, technical inferences, assumptions, and unresolved possibilities in reports.
• Obtain specialist advice when evidence may be used in litigation or criminal proceedings.

Artificial intelligence can assist with log classification, anomaly detection, translation, and document review. However, automated outputs may contain false positives, hidden assumptions, or incomplete context. An AI-generated conclusion is not a substitute for source evidence, a documented method, or human legal judgment. Organisations should preserve relevant model inputs, output versions, review decisions, and access controls when AI materially influences an investigation.

Challenges and Limitations

Internet architecture changes rapidly. Virtualisation, encryption, privacy-enhancing technologies, anonymisation services, satellite connectivity, edge computing, and automated deployment can obscure traditional boundaries. Technical evidence may be incomplete because logs were never enabled, overwritten, generated by a compromised system, or held by an overseas provider.

Legal categories may also lag behind technology. A service that appears to be a neutral intermediary in one transaction may exercise substantial control in another. A cloud provider may be an infrastructure supplier for one purpose and a processor of personal data for another. Careful analysis therefore requires attention to actual conduct, contractual relationships, technical control, statutory definitions, and the facts of the particular case.

Technical certainty and legal proof are different standards. A forensic analyst may conclude that an event is highly consistent with a particular sequence, while a court or regulator must apply its own evidential and legal standards. Responsible professionals should communicate confidence levels, identify alternative explanations, and avoid overstating what a record proves.

Chapter Summary

The Internet is a network of interconnected systems rather than a single centrally controlled entity. Online activity passes through endpoints, access networks, routing systems, naming services, protocols, cloud infrastructure, applications, and platforms. Each layer may create evidence and may be controlled by a different organisation.

Cloud computing uses shared and distributed resources, creating a shared responsibility model. Encryption protects confidentiality and integrity but does not automatically establish human identity. Digital identity involves accounts, credentials, devices, and attributes; authentication verifies a claimed identity, while authorisation determines permitted actions. Attribution requires correlation of multiple reliable sources.

Metadata and logs can establish timing, relationships, provenance, and system activity, but they must be interpreted critically. Distributed systems complicate location, jurisdiction, consistency, and responsibility because data and processing may occur across regions and providers. Legal analysis must therefore address jurisdiction, applicable law, intermediaries, controllers and processors, preservation, disclosure, due process, proportionality, authenticity, integrity, and chain of custody.

The most reliable cyber-law analysis connects technical facts with legal rules without treating a single identifier as conclusive. It identifies who controlled each system, what the system actually recorded, how evidence was preserved, what alternative explanations exist, and which legal authority governs the proposed action.

Key Terms

Authentication: Verification of a claimed digital identity.

Authorisation: Determination of what an authenticated identity is permitted to do.

Attribution: Connecting a technical event to a particular actor through evidence and reasoning.

Cloud computing: On-demand network access to shared computing resources and services.

Digital evidence: Electronically stored information relevant to a legal or investigative question.

Digital identity: Attributes and credentials representing a person, organisation, device, or service online.

Distributed system: Multiple networked components cooperating to provide a service.

Domain Name System (DNS): A naming system that translates domain names into network information.

Encryption: Transformation of plaintext into ciphertext using an algorithm and key.

Hash: A fixed-length value calculated from data, commonly used to check integrity.

Intermediary: An entity that enables transmission, hosting, search, payment, or access between parties.

IP address: A network address used to identify an interface or endpoint for Internet communication.

Jurisdiction: Legal authority to regulate conduct, hear a matter, or enforce a decision.

Metadata: Information describing or associated with other data.

Preservation: Safeguarding potentially relevant information against loss or alteration.

Protocol: Agreed rules governing digital communication.

Replication: Maintaining copies of data on multiple systems.

TLS: A protocol commonly used to protect data in transit.

Chain of custody: Documented history of evidence handling from collection to presentation.

Shared responsibility model: Allocation of security and operational duties between a cloud provider and its customer.

Review Questions

Short Answer Questions

1. Why is an IP address not necessarily proof of a particular person’s identity?
2. Distinguish authentication from authorisation.
3. What is the difference between encryption and hashing?
4. Define metadata and give two examples.
5. Why can distributed systems create jurisdictional problems?

Long Answer Questions

1. Explain the main layers involved when a user accesses a cloud-hosted application and identify the types of evidence each layer may create.
2. Compare Infrastructure as a Service, Platform as a Service, and Software as a Service, including their legal and security implications.
3. Explain how digital signatures, authentication records, and device information may contribute to attribution, and identify their limitations.
4. Discuss the importance of preservation, integrity, provenance, and chain of custody in the use of digital evidence.
5. Explain how encryption protects information while still leaving certain forms of metadata visible or discoverable.

Analytical / Application Questions

1. A person denies sending an abusive message, but the platform log records a successful login from the person’s home IP address. What additional evidence should be examined before attributing the message to that person?
2. A cloud customer discovers that two replicas show different account states after a suspected attack. Analyse technical and legal explanations for the discrepancy and recommend investigative steps.
3. A marketplace allows a user to change payment details after password authentication alone. Analyse the possible security, governance, and legal issues using the shared responsibility and proportionality concepts.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the Internet?

A. A single computer controlled by one international authority

B. A network of interconnected networks operated by multiple entities

C. A private network used only by governments

D. A database that stores every online message permanently

Correct Answer: B. A network of interconnected networks operated by multiple entities

Question 2

What is the primary function of DNS?

A. To encrypt all web traffic

B. To translate domain names into network information

C. To verify a person’s biometric identity

D. To create backups of cloud data

Correct Answer: B. To translate domain names into network information

Question 3

Which statement correctly distinguishes authentication from authorisation?

A. Authentication determines permissions, while authorisation encrypts data

B. Authentication verifies a claimed identity, while authorisation determines permitted actions

C. Authentication creates metadata, while authorisation creates IP addresses

D. Authentication applies only to networks, while authorisation applies only to legal proceedings

Correct Answer: B. Authentication verifies a claimed identity, while authorisation determines permitted actions

Question 4

What is a cryptographic hash most commonly used to help demonstrate?

A. That a file’s contents have remained unchanged

B. That a user definitely created a file

C. That a communication was never intercepted

D. That a cloud provider owns the data

Correct Answer: A. That a file’s contents have remained unchanged

Question 5

Why is an IP address generally insufficient by itself to prove human attribution?

A. IP addresses are never recorded by networks

B. An IP address may represent shared, temporary, translated, or compromised access

C. IP addresses contain no numerical information

D. An IP address identifies the legal owner of every device automatically

Correct Answer: B. An IP address may represent shared, temporary, translated, or compromised access

Question 6

Under the shared responsibility model, which statement is most accurate?

A. The cloud provider is always responsible for every customer security failure

B. The customer is always responsible for physical data-centre security

C. Security duties are allocated between provider and customer according to the service and arrangements

D. Neither party has security responsibilities after data is uploaded

Correct Answer: C. Security duties are allocated between provider and customer according to the service and arrangements

Question 7

Which property concerns whether digital evidence is what it is claimed to be?

A. Authenticity

B. Availability

C. Elasticity

D. Compression

Correct Answer: A. Authenticity

Question 8

What does chain of custody primarily document?

A. The commercial price of cloud storage

B. The history of collection, handling, storage, and examination of evidence

C. The route of every packet across the Internet

D. The algorithm used to generate a password

Correct Answer: B. The history of collection, handling, storage, and examination of evidence

Question 9

What is a characteristic challenge of distributed systems?

A. They cannot use databases

B. They always store data in one physical location

C. Replicas or services may be located across systems and jurisdictions

D. They eliminate the need for authentication

Correct Answer: C. Replicas or services may be located across systems and jurisdictions

Question 10

Which measure is most appropriate when a platform permits a high-risk change to payment details?

A. Require stronger or step-up authentication for that action

B. Disable all logging to protect privacy

C. Treat the user’s IP address as conclusive proof of identity

D. Allow the change without recording the event

Correct Answer: A. Require stronger or step-up authentication for that action