Timing Correlation Between Events and Logs

Event timing, access logs, VPN or Tor connection times, login history, cloud edit history, file timestamps, drafts, and scheduled posts can connect separate activity.

Anonymity does not break only because of what you wrote.

When you posted. When you accessed. When you replied. Which time slots you are active in.

This kind of time information also creates the impression that the same person is involved.

Timing correlation is the idea of linking activities that appear separate through matches in time among events, posts, access logs, file creation times, communication records, and similar information.

This article organizes the risk that multiple records are checked against the same timeline, including posts immediately after events, access logs, VPN connection times, and file creation or modification times.

Routine posting times and daily-rhythm bias are covered in "Correlation Between Posting Time and Daily Rhythm."

Temporal Closeness Becomes a Clue

Timing correlation means inferring that multiple actions are related to the same person or same activity because they are close together in time.

For example, a real-name account is active every day around 23:00. An anonymous account also posts every day shortly after 23:00. They react to the same topic in the same order.

This alone cannot prove who the person is. However, when combined with other information, it becomes material for correlation.

Time is information that is easy to check against other logs. That is why it should not be treated lightly.

Posting Time Reveals Daily Rhythm

Posting time reveals a person's daily rhythm.

Morning commuting time. Lunch break. After work. Late night. Long posts only on days off.

By themselves, these look like common actions. However, if they continue for a long time, they become patterns.

When an anonymous account is active in the same time slot every day, daily rhythm becomes visible. If it overlaps with the activity times of a real-name account or past account, the impression that the same person is involved becomes stronger.

When thinking about anonymity, check not only content but also the time slot of posts.

Posts Immediately After Events Connect With Place

Time also connects with place.

If you make a detailed post immediately after a demonstration, gathering, meeting, internal company event, school event, or local event, candidates narrow to people who were there.

For example, suppose you anonymously post unpublished meeting content immediately after it ends. Not only the content but also the posting time itself becomes a clue.

"Who knew at this time?" "Who could post to the internet at this time?" "Who was within a movable range from this place?"

This kind of narrowing happens.

In posts immediately after events, detail also becomes a problem.

If you write the sequence, statements, seating, route of movement, or internal confusion that only someone on site would know, you are seen as a participant or related person. The earlier the posting time, the more candidates narrow to "people who knew at that point."

For high-risk publication, do not only delay the post; reduce details that reveal you were on site.

It Is Also Checked Against Communication Logs

Timing correlation is not only a problem with public posts.

Communication logs, access logs, VPN connection times, Tor connection times, login history, cloud edit history, file modification times, and similar records are also time information.

Time becomes an axis connecting different kinds of records.

Even if content is encrypted, the fact of when communication happened may remain. This point is also covered in the article on communication logs.

Shifting the Time Slot Is Not Enough

Slightly shifting posting time does not make you safe.

Even if you post 30 minutes later every time, the pattern remains if the same rhythm remains. Habits also remain, such as posting only late at night, writing long posts only on holidays, or reacting only immediately after specific news appears.

For anonymity, reducing actions that can be correlated is more important than simply shifting time.

In especially high-risk situations, think about points like these.

• Do not use the real-name side and anonymous side in the same time slot
• Do not publish detailed content immediately after an event
• Do not search related topics on a real-name account before and after posting
• Check file creation times and modification times too
• Avoid fixing long-term activity rhythms too much

What matters in time countermeasures is not mechanical shifting, but avoiding adding more axes for correlation.

If you delay by one hour in the same way every time, the delay itself becomes a habit. Even if you schedule posts in batches only late at night, daily rhythm remains if work time or reply time is the same.

If you think about anonymity, look separately at publication time, work time, login time, and file modification time. Even if you adjust only the posting time visible on the surface, the logs behind it become material for correlation if they are concentrated in the same time slot.

Be Careful With Scheduled Posts and Drafts Too

Scheduled posting lets you adjust the posting time visible on the surface. However, scheduled posting alone does not make timing correlation disappear.

Draft creation time, schedule-setting time, login time, and file upload time may remain separately. For someone who can see service-side or internal organizational logs, not only publication time but also work time becomes a problem.

Scheduled posting can be effective in some cases. However, it is a way to change only the time visible from outside, and it does not erase all time information.

Time Clues to Check Before Publication

Before publication or before anonymous activity, check clues related to time.

Time remains in more places than the person may realize. Looking only at the time displayed on the posting screen is not enough.

Summary

Timing correlation is the idea of linking separate activities to the same person or same event through matching times or behavior rhythms.

Posting time, access time, login history, VPN connection time, file modification time, cloud history, and similar information become clues.

When thinking about anonymity, not only what you wrote but also when you acted matters. In particular, caution is needed when real-name and anonymous activity times overlap, or when you post detailed content immediately after an event.

Time becomes an axis connecting multiple logs. When thinking about anonymity, you need to check not only content, place, and accounts, but also time correlation.

Related tools

Related articles

• Behavioral correlation —Correlation Between Posting Time and Daily Rhythm
• Behavioral correlation —What is account separation?
• Behavioral correlation —Correlation patterns that break anonymity
• Behavioral correlation —What Is Place Correlation?
• Behavioral correlation —What is account correlation?
• Behavioral correlation —Anonymity for activists