Online paedophile tactics exposed in forensic linguistic study

The deceptive methods of a sex offender who abused several children online have been exposed by academics at Aston University to help police catch other predators.

The study is the first of its kind to use forensic linguistic analysis to investigate real-life conversations between a convicted sex offender and his victims.

Analysing online web chats with more than 20 victims aged as young as 12, the authors looked at how the offender – a man in his early 20s who pled guilty to more than 40 charges related to grooming, blackmail and distributing indecent images of children – befriended boys and girls using 17 different fake identities before coercing them into sending indecent images of themselves or engaging in other sexual acts via webcam.

Researchers show that by analysing the 'linguistic moves' of the offender – the functional units of conversation – the study could help police trace the true identity of the offender and prevent future crimes as the offender lets slip information about himself in an attempt to build a relationship with the child.

A senior officer at the National Crime Agency said threats posed by the dark web mean police cannot rely solely on technology to investigate cybercrime, and are turning to forensic linguistic research like this to identify offenders through their use of language.

Emily Chiang, a Ph.D. candidate at Aston University's Centre for Forensic Linguistics and lead author of the study, said: "This study looks at online instant messaging conversations between a convicted child sex offender and several of his victims. The offender adopted several different identities with different characteristics – some would be male, some female, one worked for a modelling agency – and I wanted to compare each of these in terms of linguistic moves."

Chiang identified 19 'moves' ranging from 'greetings', 'rapport' and 'maintaining conversation' to 'initiating sexual topics', 'meeting planning', and 'extortion'.

A common early move was for the offender to build rapport by asking questions such as 'asl?' (age, sex, location?) and 'wuu2' (what are you up to?) to build relationships and trust. Victims often employed their own strategies to mitigate the abuser's advances, for example:

'im busy atm [at the moment] lol im always busy soz x'

This sometimes led to more sexually motivated moves. Sexual rapport building was often used by the offender to establish a sexually orientated relationship. A prominent strategy was to inquire about sexual history and preferences, examples including:

'ever been with a girl?'

'i wear like really skimpy outfits haha'

"Most research in this area relies on transcripts between offenders and adults posing as children, as done by undercover police officers or so-called 'paedophile hunters'. But we found that significant linguistic variations between how offenders talk to real-life victims and adult decoys online. Some actual victims in our study were seen in some circumstances to be willing to go along with, or even initiate sexual topics, which 'decoy' children don't tend to do. Some victims would resist sexual advances, which provoked even more coercive moves from the offender," Chiang said.

The study also examined how the offender tried to force victims to send images or messages by threatening to disseminate previously obtained pictures or videos of the victim.

In this scenario, many victims resisted the extortion, but on some occasions it led to complying with the offender's demands. Victims were found to resort to bargaining, begging, and expressing fear and vulnerability, with examples including:

'[webcam] wnt work. Ill meet you instead and do whatever'

'im scared for my life here…'

'im fuking 12 ffs [for fuck's sake]'

"Sexual extortion is only very briefly mentioned in most research into child sexual abuse, and is not a well-understood practice", Chiang added. "This could be because the data provided by decoy adults posing as children has not evoked this behaviour. The validity of using such data as a proxy for true online sexual abuse data has been called into doubt by this study, at least for some research questions."

Interestingly, not all of the 17 personas adopted engaged in aggressive sexual pursuit. Chiang found one identity, a 19-year-old male labelled P12 in the study, was far more concerned with being a 'friend' to the victim.

Chiang said: "P12 seemed to stand out from the rest of the group. This persona engaged in abusive behaviour but spent a lot more time using 'rapport' moves, and engaging in sexual topics far less frequently. Where P12 did engage in sexual moves, they were typically far later in the conversation.

"This is not to say the offender doesn't seek some sexual interaction using P12, but perhaps he is in fact aiming for a role closer to 'boyfriend' in these interactions.

"Other studies have shown the early introduction of sexual topics is a common trait in grooming conversations. This could indicate the offender's motive when performing as P12 is not the same as in typical abuse conversations, such as those performed by his other identities.

"This is significant because it could be that the offender was using P12 as his home identity – the one used to converse as his true self. When checked against police records, much of the information the offender revealed about himself as P12 was verified as true."

Working towards a 'police-able' dark web

The study will assist police officers in tracking down the true identity of dark web users who share and view child abuse imagery whilst protected by relative anonymity. Home secretary Amber Rudd recently pledged £9m to help combat criminals who exploit the dark web, which is notoriously difficult to police due to the heavy encryption involved.

Steve Walsh, Head of Dark Web Intelligence at the National Crime Agency, said: "Today criminals are able to exploit formidable encryption to progress crime via the cyber domain—it masks their identity, shields their communication and secures their digital devices from forensic examination.

"In meeting this challenge law enforcement cannot rely solely on technical solutions. Approaches based on the offenders' behaviour, not just their use of technology, need to factored in to investigations of cybercrime.

"As this work from Aston University's Centre for Forensic Linguistics shows, forensic linguistic analysis is one of the behavioural approaches that can be exploited to enhance the prospects of attributing identity to offenders hiding behind online anonymity and to identify where an offender is exploiting multiple online personas. It may also assist in gauging the threat that an offender poses."

Professor Tim Grant, Director of the Centre for Forensic Linguistics at Aston University, said: "Over the last five years or so we have been examining online sexual abuse conversations to assist police investigations through analysis of language.

"There is very little linguistic research in this area – the studies that exist come mostly from areas like psychology and criminology. Yet considering that abuse practices like online grooming and sexual extortion happen through language, there is a lot that linguists can offer.

"This research has become increasingly important with the rise of the dark web, a strongly encrypted version of the internet which can defeat traditional computer forensics. Here, one thing that is available is language data and this means forensic linguistics has a growing importance in successfully policing the dark web.

"At Aston, we prioritise research that has clear, direct benefits to society. Emily's study is an important step forwards in helping us understand how criminals operate online and how to prevent them from hiding under the veil of anonymity."