Ransom Note Analysis: Features, Authenticity, and Attribution

Someone who writes a genuine ransom or extortion demand has a specific goal: get compliance. Everything in the text serves that goal or is irrelevant to it. This functional logic produces predictable register features. The genuine demand is directive (here is what you will do), procedural (here is exactly how you will do it), deadline-bounded (you have until X), and harm-specifying (if you fail, Y follows). Emotional content is either absent or tightly controlled, because emotion signals the writer's state rather than directing the reader's action.

• Imperatives and directives: genuine demands use instruction syntax. 'Do not contact the police.' 'Leave the money in a bag at the following location.' The verb is in base form or imperative mood.
• Concrete procedural specification: amounts, denominations, locations, and times are specified because the extortionist needs the recipient to execute correctly. Vague demands are harder to satisfy and harder to collect on.
• Harm specification: the threat of harm is present but not elaborated. The extortionist does not need to describe harm in detail; they just need the recipient to believe it is credible.
• Identity concealment: genuine notes often show active steps to avoid identifying language: generic pronouns, suppression of regional or social dialect markers, avoidance of proper names.

Notes that deviate significantly from these features invite scrutiny. A demand that runs to two and a half pages (the Ramsey note ran to 369 words), incorporates film references, uses an unusually literary register, and includes emotional content addressed to the parents of the victim fits poorly into the genuine-demand template. Length alone is suspicious: genuine kidnap demands are short, because longer texts create more identification risk.

Fabricated notes have a characteristic problem: the writer knows what they think a ransom note should contain (from films, news coverage, and cultural schemas) but does not know what genuine extortion communication actually looks like. They tend to over-write: more detail about harm, more emotional content addressed to the victim's family, more dramatic language, more literary references. They also tend to include information that only an insider would have, because they are an insider.

The JonBenet Ramsey ransom note from December 1996 is the most studied example of this kind of analysis. The note was found in the family home the morning JonBenet was discovered missing. Its unusual features, which have been analysed by multiple linguists over the intervening years, include its exceptional length for a ransom demand, references to the 1988 film Dirty Harry and the 1994 film Speed, its elaborate farewell construction, and emotional language directed at the parents that goes well beyond what an extortionist would need. These features do not prove who wrote it, but they are inconsistent with an external author who was focused on getting paid.

If the authenticity question raises attribution possibilities, the analyst needs writing samples from the candidate author. What makes a good comparison corpus for a ransom note analysis is more demanding than it might appear.

1. Volume
   Stylometric methods require sufficient text to produce stable frequency measurements. A ransom note of 300 words compared against three emails totalling 150 words will produce unreliable results. The comparison corpus should be substantially larger than the test text, preferably by a factor of 10 or more.
2. Comparability of medium
   Writing style varies with medium and purpose. A comparison of formal business letters against an informal note will detect register difference, not the author's idiolect. The ideal comparison sample is informal personal writing: text messages, handwritten letters, diary entries, emails to friends.
3. Temporal proximity
   Language changes over time. Comparison samples from years before or after the note may miss vocabulary shifts, changing syntactic preferences, or life events that affected the writer's style. Contemporaneous samples are preferred.
4. Avoidance of style suppression
   A suspect may have deliberately attempted to mask their writing style in the note. The analyst should compare not just content features but sub-lexical features (punctuation, capitalisation, spelling choices) that are harder to consciously suppress and that the writer may not have known to modify.

There is also the question of negative evidence. A comparison corpus that shows the candidate consistently uses a feature that is absent from the note, or never uses a feature that appears in the note, can be as informative as a match. The honest report presents both the similarities and the differences, not just the features that support the preferred conclusion.

Computational stylometry, which uses frequency profiles of function words, character n-grams, and syntactic patterns to attribute authorship, performs well on long texts from large corpora. Its performance degrades as texts get shorter. A ransom note of 200-400 words falls well below the threshold at which standard Burrows Delta calculations are reliable. The frequency measurements are too noisy to produce stable results.

What analysts have instead for short texts is a set of qualitative and semi-quantitative tools: identification of idiolectal markers (unusual spellings, characteristic phrases, punctuation habits, discourse-structure preferences), comparison of syntactic constructions that the author uses consistently, and analysis of vocabulary that is distinctive but not so rare as to be the product of coincidence. The question is always whether the feature is distinctive enough, and shared between the note and the known samples frequently enough, to be probative rather than coincidental.

The appropriate conclusion for a short-text attribution exercise is almost always probabilistic and qualified, not definitive. A report that says 'the note was written by X' without qualification on the basis of a 300-word text is overclaiming the method's capability. A report that says 'features of the note are consistent with the writing of X and inconsistent with Y's known style, but the text length limits the weight of this conclusion' is epistemically honest and more likely to survive cross-examination.

Contemporary extortion operates across email, messaging apps, dark-web forums, and encrypted channels. The forensic linguistic questions are the same: authenticity, attribution, and interpretation. But the new mediums add complications. Email and messaging carry metadata that needs to be assessed for provenance before the text is analysed. An email purportedly from an external extortionist that has a header consistent with the victim's own mail server is already raising authenticity questions before the text is even read.

Sextortion, in which a person is threatened with the release of intimate images, has produced a large volume of scripted, often template-based extortion messages sent at scale with minimal personalisation. These raise attribution questions of a different kind: not who wrote this individual message, but whether the pattern of messages links to an organised group, a geographic origin, or a campaign already known to law enforcement. Corpus analysis of multiple instances is more productive here than single-text stylometry.