Forensic linguistics: what can words actually prove?

Someone leaves an anonymous message. A suspect uses the same unusual phrase in an old email. You see the two texts side by side in a documentary, and suddenly the words seem to settle the case. But what has actually been established: a resemblance, a likely author, or the truth of what the message says?

Short version

Forensic linguistics applies the study of language to investigations and legal questions. It can examine who may have written a text, what a message means and how questioning affects an account. Those are different tasks. An authorship match does not show that an allegation is true, and a supposedly suspicious pronoun does not establish a lie. Ask what material was compared, how the method was tested and what other evidence supports the conclusion.

What does forensic linguistics actually study?

It studies language where language matters to an investigation or a legal dispute. That might mean comparing anonymous writing with known samples, examining an apparent threat, or looking at the wording of a question and its answer. The Aston Institute for Forensic Linguistics describes a field that reaches beyond identifying writers into language and the justice system.

For a reader of true crime, the distinction matters because the story usually arrives already arranged around a suspect. A narrator can place a strange sentence beside a photograph and make the association feel obvious. The actual linguistic question needs to be narrower: is the phrasing distinctive, does it occur elsewhere, and what would count against the proposed explanation?

Consider three questions about an anonymous note. Who wrote it? requires comparisons with other writing. What does it mean? requires its wording and context. Did the event described happen? requires evidence about the event. The same note can help with all three questions without answering any of them conclusively.

The graphic separates the tasks deliberately. Identifying a likely writer would not make every sentence in the note accurate. Equally, a clear threat can deserve serious attention even when its author is still unknown.

How can analysts compare writing?

They can examine recurring patterns: punctuation, spelling, word combinations, sentence construction and the distribution of features across texts. Stylometry is the statistical study of writing style. It asks about patterns across material, rather than treating one vivid expression as a signature.

An n-gram is a sequence of neighbouring elements, such as letters or words. In an explicitly imaginary message, “leave the parcel outside,” two-word sequences include “leave the,” “the parcel” and “parcel outside.” Counting such sequences across samples can reveal similarities that a casual reading misses. None of those combinations identifies a person by itself.

The comparison material is as important as the technique. An informal message is a poor match for an edited job application if the analyst is trying to measure the writer’s usual habits. Standard workplace wording can also create similarities between different people. Before deciding that a pattern belongs to one author, ask whether it belongs to the topic, the setting or the person who edited the text.

This is the same observation-versus-explanation problem we use in case analysis: finding matching punctuation is an observation; concluding that one person wrote both texts needs further support.

What does a 98.5% result really mean?

A 2020 authorship experiment reported 98.5% accuracy for idiosyncratic features with 40 writers. Its dataset contained 120–200 English-language tweets per writer, with a 70/30 training-and-test split and messages pooled into samples. A separate character n-gram result of 97% used only ten writers. These are different experimental conditions, not interchangeable scores.

That is encouraging research, but it does not mean that an analyst can identify the writer of one anonymous sentence with 98.5% confidence. The test compared known candidates. A real investigation may be missing the actual author, may have uneven samples, or may involve a message written together with someone else.

Imagine a comparison system with samples from four housemates. If a visitor wrote the note, picking the closest housemate would still produce a name. Unless the procedure can recognise that none of its candidates fits, the answer can sound much more decisive than the question allowed.

There is another distinction to keep in view: a study’s overall accuracy is not the probability that a particular suspect wrote a particular message. To assess the latter, you would need information about the competing possibilities and how likely these similarities are under each one. A headline percentage does not provide that information.

Is statement analysis the same as lie detection?

No. “Statement analysis” can mean examining an account’s content, but the label also appears in claims that certain words expose deception. It is worth asking which named method a commentator means before accepting a conclusion.

A 2021 meta-analysis of content-based credibility methods reviewed 71 studies. It found support, with important qualifications, for differences between experienced and fabricated accounts using Criteria-Based Content Analysis and Reality Monitoring. The findings varied, and research bias mattered. SCAN did not show reliable discrimination.

These results concern particular procedures and study conditions. They do not validate every online rule about pronouns, missing details or changes in tense. Nor does a group difference tell you where to draw a dependable line between one truthful witness and one deceptive witness.

The earlier 2016 review included 56 studies and 3,429 participants. It reported a standardized effect size, Hedges’ g, of about 1, with a 95% confidence interval of 0.78–1.27. That is not an accuracy percentage. Its I² value of 92.48% indicated that study effects varied widely. The useful question is why results differ across settings, rather than how to turn that average into a verdict on a clip.

What did researchers find about SCAN?

SCAN stands for Scientific Content Analysis. Its name sounds reassuring, but a name cannot replace a test. Bogaard and colleagues examined 234 statements in a 2016 study: 117 truthful and 117 fabricated. The tested SCAN criteria did not reliably separate the groups.

That result gives you a concrete reason to challenge a video that treats a missing pronoun as a dependable sign of guilt. Ask for testing of that particular rule, in the kind of account being discussed. An account of an upsetting event is not necessarily comparable with a rehearsed laboratory story or a short prepared statement.

The negative finding also has a boundary. It does not show that comparing authorship is pointless, or that language cannot help explain a disputed message. Those are different tasks. Rejecting an unsupported lie-detection claim should make the question more precise, rather than end the examination of the text.

Why did language matter in the Unabomber investigation?

The FBI’s account of the Unabomber investigation describes a 35,000-word manifesto, a family lead and comparisons with earlier writing. Language helped investigators connect material and support a search warrant. Theodore Kaczynski was arrested in April 1996, and the cabin search produced physical evidence.

The sequence matters. The investigation did not begin and end with a commentator recognising a suspicious sentence. There was extensive writing to examine, other material to compare it with, a lead to investigate and evidence recovered through the search.

This is an illustration of language contributing to an investigation. It is not a blind experiment measuring how often the same approach would accuse the wrong person. A successful historical investigation can show what a method contributed without establishing its error rate across future cases.

The comparison worth making with an online mystery is the amount and variety of material. A long manifesto and earlier writings offer very different opportunities from a cropped message containing twelve words. Both involve language; that does not make them equally informative.

Can one sentence prove a confession or an alibi?

Take an invented interview answer: “I was home by 8:15.” A video might call it evasive because the speaker has not said where they were before then. But the missing period means something different depending on the question. “What time did you get home?” and “Where were you between seven and nine?” invite different answers.

The sentence gives you a claim to test: the person was home by a stated time. A timestamped arrival record might support it; another reliable record might contradict it. The wording alone does not establish the journey home, what happened earlier, or whether any omission was deliberate.

Now imagine the interviewer follows up: “So you admit being there?” The meaning of “there” depends on the previous exchange. If the available clip starts with the reply “yes,” you need to know what the speaker was agreeing to. A caption calling it a confession cannot supply the missing question.

This is where language analysis can be useful without claiming to read minds. It can make an ambiguity visible, identify what an answer actually commits the speaker to, and show which assertion needs checking. It cannot replace the check.

What happens when a message has been edited or translated?

Editing can remove a qualification, a question or the start of a quotation. A transcript can omit overlap, interruption or uncertainty about an indistinct word. A translated version can introduce word choices that belong to the translator rather than the original speaker.

The sentence “she said I would regret it” attributes words to someone else. Cropping it to “I would regret it” loses that attribution. Before discussing the meaning, you need the full sentence; before treating it as someone’s distinctive style, you also need to know who produced the wording you are reading.

The practical consequence is simple: keep different versions apart. An original message, a police summary, a subtitle and a narrator’s paraphrase are not four independent accounts. They may all descend from the same source, with changes made along the way.

If the original recording or text is unavailable, that is a limitation to carry through the discussion. It should not quietly disappear because one version is easier to quote.

What should you ask about an expert conclusion?

Start with the actual question. Was the expert asked about authorship, meaning, or the truth of an account? Then look at the material supplied and the method used. A conclusion about meaning should not silently become a conclusion about who typed the message.

A useful report lets you follow the comparison. It explains which features matter, which alternatives were considered and where the material is insufficient. If the account presents only matching examples, ask whether there were differences and how they affected the result. Similarities selected after a suspect is known can be persuasive without being distinctive.

Be careful with language that changes between the report and the retelling. “Consistent with” does not mean “could only have been written by.” “The text contains a threat” does not, by itself, settle the author’s identity or every element of a criminal offence. Whether evidence is admissible or sufficient depends on the actual proceeding and its law.

You do not need to reproduce an expert’s entire analysis to ask these questions. You need enough information to understand the step from material to conclusion, and enough openness to recognise when that step has not been shown.

Which question should you bring back to the recording?

Return to the anonymous message at the start. Instead of asking whether it “sounds guilty,” choose a claim you can examine: which writing samples match, what the complete conversation says, or whether the event described has independent support.

That change makes the discussion more useful. You can disagree about a proposed author while agreeing on what the message literally says. You can take an apparent threat seriously while acknowledging uncertainty about who sent it. You can also identify an unsupported allegation without pretending that every linguistic method is worthless.

The last time we checked the research and source material for this article was October 9, 2026. If a new claim catches your attention, bring the exact wording, its context and the evidence behind it. The words are a starting point for a question, not an excuse to skip the rest of the investigation.