Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.
The 2.5-page ransom note in the 1996 JonBenet Ramsey murder is one of the most analysed questioned documents in American forensic history. This topic examines what features analysts studied, why the note's characteristics are linguistically unusual, and why the case became a textbook lesson in the risks of small corpora and analyst bias.
Last updated:
On the morning of 26 December 1996, Patsy Ramsey called 911 to report that her six-year-old daughter JonBenet was missing and that she had found a ransom note on the staircase of their Boulder, Colorado home. The note demanded $118,000 for JonBenet's safe return. Hours later, JonBenet's body was found in a basement storage room in the same house. She had been strangled. No one has been charged with the murder. The ransom note remains the most extensively analysed questioned document in the case, and the linguistics around it produced both a cautionary tale and a set of genuinely important methodological lessons.
The note is linguistically peculiar in ways that are obvious even to a non-specialist. At roughly 375 words, written on paper from inside the house and beginning with a discarded first line on a separate sheet, it is far longer than typical criminal ransom communications and far more theatrically composed. Analysts who examined it over the following years brought competing conclusions, and the case produced at least one high-profile retraction. The reasons for that retraction teach more about the method than any successful attribution would.
This topic analyses the note's features, walks through what the attribution attempts found and where they went wrong, and uses the case to illustrate two principles that apply to all forensic authorship work: the danger of small comparison corpora and the specific risk of context bias, where prior investigative assumptions contaminate an analyst's conclusions before the analysis even begins.
Everything about the note was wrong in ways that tell you something.
Genuine ransom notes are pragmatic documents. They identify the victim, state a demand, specify a method of contact or drop, and warn against calling police. They are typically short: most real ransom communications run between 50 and 150 words. The Ramsey note runs to approximately 375 words, makes a specific demand of $118,000 (matching the father John Ramsey's annual bonus that year), references the attachment the writer claims to have for the family, and includes an extended series of threats and assurances spread across paragraphs.
Two physical facts about the note are also unusual. It was written on paper from a pad found in the house, and a practice start was found on an earlier sheet. This strongly suggests the note was written inside the house on the night of the crime, rather than being brought pre-prepared by an intruder. Writing a ransom note on-scene while a victim is present (or deceased) is behaviour inconsistent with how professional kidnappers operate.
A single author, multiple voices, and two borrowed lines from Hollywood.
The note opens with 'Mr. Ramsey', uses the phrase 'foreign faction' as the claimed sender's identity, and moves through bureaucratic warnings about 'law enforcement countermeasures' to emotional appeals about JonBenet's safety. The tonal incoherence is diagnostic: no single social or professional context produces all of these registers naturally. An analyst looking at the note cold would predict an author who was performing multiple voices, drawing from different cultural and media sources rather than writing from a stable professional identity.
Two specific phrases attracted consistent attention across multiple analyses. The line 'Don't try to grow a brain, John' echoes a villain's line from the 1994 film Speed. The demand figure of $118,000 corresponds almost exactly to John Ramsey's annual bonus, a figure the author would have known from inside knowledge, but its oddness as a kidnap demand amount also resonates with the climactic figure in the Clint Eastwood film Dirty Harry (1971). Neither reference conclusively identifies an author, but together they suggest a person drawing on specific film knowledge in a way that sits oddly in the genre of genuine criminal communication.
A confident attribution, then a public withdrawal, and the reason both happened.
Don Foster, who had achieved public notice for identifying Joe Klein as the anonymous author of Primary Colors, was contacted by the Boulder Police Department in 1997 and asked to analyse the note. He compared it with writing samples from multiple candidates and concluded that Patsy Ramsey's known writing showed the closest stylistic match, citing features including specific phrase patterns and register habits.
Several years later, Foster publicly retracted this attribution. His own account of the retraction is candid: he had been briefed on the investigative focus on Patsy Ramsey before conducting his analysis. He acknowledged that this prior context may have influenced which features he weighted and how he read ambiguous matches. The comparison corpus available from Patsy Ramsey's known writing was also limited in scope: holiday letters and personal correspondence do not represent the full range of an individual's style or create a stable enough baseline for a confident attribution of a 375-word anomalous text.
Why the Ramsey case belongs on every forensic-linguistics reading list.
The Ramsey case is a field-defining cautionary study for three connected reasons. First, the comparison corpora for the primary suspects were small, meaning the estimated stylistic profiles had wide confidence intervals. A feature that appears to be distinctive in a 3,000-word reference corpus may be entirely uncharacteristic when the author writes 30,000 words. Second, the note itself is short and written in an unusual, performance register that may not reflect the author's default style at all.
Third, and most importantly for the profession, the case shows that analyst confidence and result accuracy are not the same thing. Foster's initial attribution was stated with the kind of assurance that comes from pattern recognition and expert experience. But experience cannot substitute for a validated error rate. The features he identified as distinctive were not subjected to a base-rate check against a population corpus, so it was never established how often those same features appear in the writing of people who definitely did not write the note.
| Methodological problem | Consequence in this case | Standard remedy |
|---|---|---|
| Small comparison corpus | Feature estimates have wide confidence intervals; over-fitting to the available sample | Require minimum corpus size; report confidence intervals, not point estimates |
| Context bias (pre-analysis briefing) | Analyst selectively weights features consistent with pre-formed suspect hypothesis | Blind analysis protocol; no suspect information before analysis is complete |
| No base-rate check | Claimed distinctive features may be common in the general population | Cross-check features against a large independent corpus before claiming distinctiveness |
| Register mismatch | Comparison between normal writing and performed genre may not measure the same idiolect | Match the genre of questioned document and reference corpus where possible |
How a retraction changed practice more than most successful cases.
The Ramsey case contributed materially to the development of more explicit validation standards in forensic linguistics. Foster's retraction was unusual in the field at the time: most contested attributions are simply disputed rather than withdrawn by the original analyst. The public nature of the withdrawal forced a profession-wide conversation about what standards of evidence should apply before an analyst submits findings to an investigation.
The European Network of Forensic Linguists and the International Association of Forensic Linguists have since developed guidelines that explicitly address corpus size requirements, blind-analysis protocols, and the reporting of uncertainty. These guidelines post-date the Ramsey case by enough that the case can plausibly be counted among its catalysts. A case that produced no reliable attribution nevertheless advanced the method by demonstrating concretely what happens when methodology is not rigorous enough.
What is the primary reason the Ramsey ransom note is considered forensically unusual?
Test yourself on Forensic Linguistics with free, timed mocks.
Practice Forensic Linguistics questionsSpotted an error in this page? Report a correction or read our editorial standards.