Cross-Border Defamation Claim: Evidence to Preserve First

When someone asks for help with an online defamation dispute, the first instinct is usually to chase the network address behind the post. That is the wrong end of the problem. Begin with the publication itself: the exact words, where they appeared, the period they were available and the context around them. A VPN address may eventually become one line in the record, but it cannot replace the record of what was said, and a case built on an exit address instead of a preserved publication has nothing to argue about.

Start with the publication, not the network

Preserve the original page or message and a dated copy made in a way you are permitted to make it. Record the URL, the account name shown, the visible publication date, and any edits, deletions or reposts you observed, including the time you observed each one. If the material is in a thread or a comment, keep the surrounding posts, because the meaning of a sentence usually depends on what sits next to it.

Do not republish the allegation more widely in order to document it. A private capture, a link for your adviser and a note of who has already seen it are usually enough, and amplifying the statement can create new problems that have nothing to do with the original post. Save relevant notices and responses as they arrive, with their own timestamps. If the statement was made in a private group or a direct message, keep the surrounding messages that show who was present and what they were replying to.

Keep the capture method alongside the capture. A saved page is only useful if someone can later say how it was obtained, when, from which address, and whether it rendered the same content a reader would have seen. Logged-in pages, personalised feeds and cookie banners all change what a screenshot proves, and a capture that cannot explain its own provenance is the most common weakness in a self-assembled file.

What a preserved record needs to contain

The minimum set is short and most people miss half of it. The exact text, unedited, including spelling and punctuation. The URL and the platform or site. The visible date plus the time and timezone of your capture. The account identifier as displayed. Any edit history the platform shows. The context: title, thread, quoted material, images.

Then add integrity that survives a handover. Store the capture in a form you can hash, and record the hash with the timestamp so a later copy can be shown to be identical:

sha256sum defamatory-post-2026-11-03.html
# 9f2c...  defamatory-post-2026-11-03.html

Two copies in two places, one of them not on the device you browse with. That is not paranoia; it is the difference between "I remember it said" and a file you can hand to someone in six months.

Three questions the evidence cannot answer

The publication record answers what was said and when. It does not answer who is legally responsible, which court should hear the dispute, or what can actually be enforced. Those are separate questions with separate evidence, and each one needs its own answer rather than an inference from the others.

A display name, an account and an observed network address are three different identifiers. If you propose a connection between them, write down the basis, and keep the uncertainty visible instead of resolving it in the summary. An adviser can work with "these three events are consistent with one person"; they cannot repair a record that quietly asserted it.

What a VPN address can and cannot add

If you hold service records, retain their timestamps, timezones, observation points and the account events that sit beside them. A shared exit address may serve many people, and an account itself can be shared or compromised. Neither possibility establishes what happened in one case, and neither can be excluded by looking at the address alone.

That is the distinction between correlation and misattribution that the privacy analysis in RFC 6973 treats as separate concerns. Applying it to a dispute is simple: state what was observed, then state what additional inference would be required to get from that observation to a person. If the second part needs facts you do not have, the record should say so.

Where the dispute crosses borders, forum questions become concrete preparation rather than abstract worry. The England and Wales media and communications protocol, for example, asks a claimant to identify the publication, the exact words, the context, the alleged meaning and the harm, and to explain why that jurisdiction is the appropriate forum when the parties are elsewhere. Those are useful headings for your own file even in a different jurisdiction, but they do not decide which law applies.

Assemble the package your adviser asks for

Put four sections in one folder: the publication record, the harm you can evidence, the identifiers you actually have with their basis, and the open questions you could not resolve. Add a one-page chronology with timezone-marked dates, because the first thing anyone competent will do is rebuild the sequence of events.

Ask about deadlines early. Limitation periods and procedural steps differ by jurisdiction and by the nature of the statement, and a well-preserved file that arrives after a deadline is still late. Ask also what you should not do next, since further contact with the publisher can affect both the evidence and the dispute.

Then keep the network evidence in its place. It is one observation among several, it belongs in the identifiers section, and it should be labelled with what it does not prove. That discipline is what makes the file useful to a lawyer, a platform process or a court, and it is the part you can do correctly before anyone gives you legal advice.