- Lexical features – analysis of word choice
- Syntactic features – analysis of writing style, sentence structure, punctuation, and hyphenation
- Structural features – analysis of structure and organization of writing
- Content-specific words – analysis of contextually significant writing such as acronyms
- Idiosyncratic features – analysis of grammatical errors, this is the most important factor to take into account because it has a high accuracy of author identification
Think that this is not something that LE pays attention to? Think again I say. There have been multiple cases where LE has used write print techniques to help catch and sentence people. Here are a few examples:
We all understand the case of OxyMonster, including his magnificent beard, but did you know that LE used write print to help indict him? It is true.
“Open source data revealed that VALLERIUS has Instagram and Twitter accounts. Agents compared the writing style of “OxyMonster” on the Dream Market forum while in senior Moderator role to the writing style of VALLERIUS on his public Instagram and Twitter accounts. Agents discovered many similarities in the use of words and punctuation to including the word “cheers;” double exclamation marks; frequent use of quotation marks; and intermittent French post.”
Lesson learned? Do not use the exact same writing style for your darknet activities as you use for your clearnet activities, in particular pay close attention to your use of common phrases, and punctuations. Also as a side note: limit the amount of reference material that LE can use as comparison text, you do not want to find yourself in jail showers because of your political Twitter post, now do you?
Here is another example from the book American Kingpin, about how a DEA agent investigated the writing style of DPR from a unique perspective.
“For one, Dread used the word “epic” a lot, which showed that he was likely younger. He also used emoji smiley faces in his writing, though he never used a hyphen as the nose, writing them as 🙂 rather than the old-fashioned :-). Yet the one attribute about DPR that stood out to Jared was that rather than writing “yes” or “yeah” on the site’s forums, Dread instead always typed “yea.”’
Lesson learned here? Pay attention to the little things that add up. If you usually reply with “ok” to people, maybe try to reply with “okay” for your darknet activities. Again, I want to mention that you should NEVER use words or phrases from the darknet [even if they are not in public post] for clearnet purposed, and vice versa. DPR used frosty as the name for his silk road servers, and for his YouTube account, which helps convince LE that DPR was in fact Ross Ulbricht.
