Disguised Writing and Anonymous Letters

The most common disguise technique is changing the overall slant of the writing. A right-handed writer with a natural forward slant may deliberately write with a vertical or backward slant. This is achievable for short samples, but maintaining it across a long document is cognitively demanding, and writers typically revert to their habitual slant under time pressure or when writing long, familiar words. The reversion is partial and gradual, not binary, producing a characteristic "slant drift" pattern where the disguised slant is most consistent at the beginning of the document and drifts toward natural at the end.

Writing with the non-dominant hand (opposite-hand writing) is a more radical disguise strategy. Most people assume the resulting writing is unattributable, but research by Huber and Headrick (1999) shows that fundamental proportional relationships between letter elements are largely preserved in opposite-hand writing, because they are encoded in the writer's mental representation of letters, not in the muscle-memory of the dominant limb. A writer whose natural letter 'a' has a loop-to-body ratio of 1.2 in dominant-hand writing tends to produce a similar ratio in opposite-hand writing, even though the execution is much more irregular.

Block capitals are a widely used disguise because they eliminate cursive connections and letter form variation. However, even block printing retains the writer's characteristic proportions within letters (height-to-width ratio, baseline alignment), spacing patterns (inter-letter and inter-word spacing), and terminal stroke habits (whether final strokes of letters tend to turn upward, downward, or terminate flat). These features are subtler but examinable.

Simulated foreign script is an attempt to disguise the writing as belonging to a different script system, for instance, a Latin-script writer who attempts to imitate Arabic or Devanagari letterforms. The result is almost always detectable as a simulation because the writer has no genuine command of the target script's stroke sequence, pen-lift positions, or proportion conventions. The strokes follow the visual outline of the foreign characters but are constructed in the wrong order and with the wrong pen direction, producing a distinctive "drawn rather than written" quality.

A critical insight from the SWGDOC (Scientific Working Group for Forensic Document Examination) and the European Network of Forensic Science Institutes (ENFSI) Document Examination Working Group guidelines: no single disguise feature, in isolation, is evidence of disguise or of attribution. The same systematic ACE-V method applied to natural writing governs disguised-writing examination, with the additional step of assessing intra-document variation as an indicator of disguise effort. The examiner must assess the entire document, including the variation within the document, against a hypothesis that the writer was applying disguise. Disguised writing shows more intra-document variation than genuine writing and tends to show a distinctive "effort signal" (heavier pressure, slower pen speed, more deliberate pen lifts) that is absent in natural, undisguised writing.

Proportion ratios within and between letters are among the most robust features because they reflect the writer's spatial template for each letter, a template encoded in long-term memory rather than short-term motor habit. If a writer's letter 'h' consistently has a stem height that is 1.8 times the body height across their natural writing, the same ratio tends to persist in disguised writing, opposite-hand writing, and block-capital writing. This persistence is the practical foundation for the examiner's ability to attribute even heavily disguised writing when adequate exemplars are available.

Baseline habit (the tendency for writing to ascend, descend, or remain level across an unlined surface, and the characteristic curvature of the baseline on lined surfaces) is another robust feature. Baseline habit is partly postural and partly cognitive, meaning it reflects both the writer's physical position and their spatial organisation of the writing task. Changing slant does not change baseline habit. Switching hands increases baseline irregularity but preserves the general direction tendency.

Terminal stroke habits, the characteristic way in which a writer ends the final letter in a word, are particularly individualising and are difficult to suppress. A writer who habitually extends the final stroke of a word rightward and slightly upward will tend to produce the same pattern in disguised writing, because it occurs at the end of the word where attention is released. Similar persistence is found in initial stroke habits (the approach stroke before the first letter of a word) and in the spacing and alignment of punctuation marks relative to the text.

Spelling and punctuation idiosyncrasies survive most disguise strategies entirely, because they reflect educational background, regional conventions, and cognitive habits rather than physical execution. A writer who consistently uses comma splices, who habitually misspells "receive" as "recieve," who uses "he" as a gender-neutral pronoun, or who applies double quotation marks inside parentheses in a consistent way, will reproduce these habits in disguised writing unless they are aware of them and actively suppress them, which requires conscious monitoring of every word while simultaneously managing the physical disguise.

On 1 March 1932, Charles Lindbergh's 20-month-old son was kidnapped from the family home in Hopewell, New Jersey. A ransom note was left on the nursery windowsill, written in a distinctive style with unusual spelling, punctuation, and phrasing: the idiosyncratic spelling of "anyding" for "anything," "gute" for "good," "haus" for "house," and other German-influenced phonetic patterns; three connected interlocking circles in the left margin as a symbol; and a distinctive overall style combining block lettering with cursive elements.

Over the next several weeks, more than a dozen subsequent ransom notes were exchanged, all bearing the same three-circle symbol and all displaying the same German-influenced spelling patterns. Handwriting examiners employed by the FBI and by the New Jersey State Police compared these notes against each other and against writing samples obtained after the arrest of Bruno Richard Hauptmann (a German-born carpenter in the Bronx) in September 1934.

Eight handwriting examiners (including Albert Osborn, Albert D. Osborn, and John Tyrrell) testified at the 1935 trial that Hauptmann wrote the ransom notes. Their key findings included: a distinctive formation of the letter 'x' in both the ransom notes and in Hauptmann's known writing; the German-influenced phonetic spellings reproduced in both; specific proportion relationships in certain letters; and the slope characteristics of the capital letters. Hauptmann was convicted and executed in 1936.

The case has remained controversial for three interconnected reasons. First, the exemplar collection: Hauptmann's exemplars were partly produced under dictation by the investigators, meaning some exemplars may have been unconsciously or deliberately shaped by the investigation's expectations. Second, the absence of a verifiable error rate or proficiency standard for the examiners at the time: the eight examiners had been selected partly on reputation, not on demonstrable performance metrics. Third, the convergent nature of the evidence: the linguistic patterns (German-influenced spelling) were potentially consistent with any German immigrant in the area, not uniquely with Hauptmann.

In the US context, the Lindbergh examination is now taught as both the exemplar of what handwriting evidence can demonstrate (consistent, multiple independent features across a large sample of ransom notes) and as the cautionary model for what it cannot demonstrate without appropriate scientific controls (quantified error rate, blind exemplar collection, documented comparison protocol). The National Commission on Forensic Science's 2016 report on handwriting examination cited the Lindbergh case in its discussion of the need for proficiency testing and blind verification.

Theodore Kaczynski conducted a bombing campaign targeting university academics and airline personnel from 1978 to 1995. His communications, including threatening letters and the 35,000-word manifesto published in the Washington Post and New York Times in September 1995, were typewritten and gave no handwriting evidence. The investigation turned on forensic linguistic analysis of the manifesto and the letters.

FBI forensic linguist James Fitzgerald, working with outside consultant Roger Shuy of Georgetown University, identified a cluster of linguistic features in the manifesto that were diagnostic: the recurrent use of the phrase "cool-headed logician," the consistent use of "leftism" and "leftist" with specific definitional connotations, particular syntactic patterns in conditional clauses, and the consistent use of "willingness" as a mass noun rather than a count noun. These features, taken individually, were unremarkable; their consistent co-occurrence across the full corpus of communications was the evidential finding.

Kaczynski's brother David read the manifesto after its publication and recognised the style and specific phrases from years of personal correspondence. He contacted the FBI. The subsequent examination compared the manifesto against Kaczynski's academic writings (he had a PhD in mathematics from the University of Michigan) and personal letters. The linguistic overlap was extensive: specific word choices, syntactic preferences, and ideological formulations appeared in both the manifesto and in pre-Unabomber writing from Kaczynski's academic career.

Kaczynski pleaded guilty in 1998, so the linguistic evidence was never subjected to full adversarial examination at trial. However, the case established forensic linguistics as a major contributor to anonymous-communication investigations. In the UK, the conviction of Jeremy Bamber for the White House Farm murders (1986, convictions upheld on appeal in 2002) turned partly on linguistic analysis of a telephone call transcript. In India, the forensic linguistics discipline is developing within the CFSL network, with the Hyderabad lab's questioned-documents division having documented methods for dialect and register analysis in threatening correspondence since approximately 2010.

Anonymous threatening correspondence cases differ from forgery cases in one structural respect: in forgery, the questioned document impersonates a person who wants to deny authorship; in anonymous-letter cases, the writer wishes to deny authorship of a document written in their own hand. The examiner is therefore looking not for discrepancies between a questioned and a genuine writer, but for correspondences between an anonymous document and a suspect's exemplars.

Case intake for a threatening-letter examination begins with evidence handling that preserves both physical and biological evidence. Anonymous correspondence may carry fingerprints, touch DNA from envelope sealing, postmark information, and indented writing from sheets previously overlying the letter, in addition to the handwriting itself. The AFIS (Automated Fingerprint Identification System) search and touch-DNA examination of the envelope flap and stamp are typically conducted before the document is examined for handwriting, because the handling required for document examination can degrade or contaminate these other evidence streams. In the US, the FBI's Questioned Documents Unit works in close coordination with the FBI's latent-print and DNA units on threatening-correspondence cases. In the UK, the National Document Examination Unit (formerly part of the Forensic Science Service, now within accredited private providers) follows a similar multi-discipline protocol.

Linguistic pre-screening is applied before handwriting examination in many jurisdictions to narrow the suspect pool. A behavioral science profile (threat assessment) evaluates whether the language of the threat indicates specific knowledge of the target, escalating intent, or a grievance pattern that can be connected to a population of suspects through investigative means. This profiling approach, developed at the FBI Behavioral Analysis Unit and adopted by the UK National Threat Assessment Centre and various European equivalents, does not produce identification evidence, but it narrows the field of comparison writing that must be obtained.

When suspect exemplars are obtained, the comparison protocol for anonymous-letter examination follows the same fundamental principles as signature examination: a minimum exemplar set covering the type of writing in the anonymous document (cursive, block, or mixed), contemporaneous if possible, on the same type of surface. The SWGDOC guidelines for handwriting examination specify that exampler-collection officers must not allow suspects to see the questioned document before providing exemplars, to prevent the suspect from tailoring their exemplar writing to match or diverge from the document.

In Indian casework, the CFSL network has documented several high-profile threatening-letter examinations, including correspondence in extortion cases in Mumbai and kidnapping cases in Delhi, where the combination of handwriting comparison with dialect and spelling analysis allowed attribution to be recommended to the court. The Indian Supreme Court has consistently held (under Bharatiya Sakshya Adhiniyam s 39, formerly Indian Evidence Act s 45) that the forensic document examiner's opinion requires adequate exemplars and a documented comparison methodology to be admissible as expert opinion.

Contemporary anonymous-letter casework integrates at minimum three analytical streams. The questioned-documents examiner assesses physical handwriting features, paper and ink, ESDA examination for additional impressions, and forensic imaging. The forensic linguist conducts authorship analysis: comparing the syntactic, lexical, and pragmatic patterns of the questioned text against suspect exemplars and, if a named suspect is identified, against a corpus of that suspect's known writing. The behavioral analyst assesses threat type, escalation risk, and the psychological consistency of the communication with suspect profiles. These streams feed into a single case strategy that determines which comparisons are conducted and in what order.

The ENFSI (European Network of Forensic Science Institutes) Language Analysis Working Group has published guidelines for forensic linguistic analysis of questioned documents in multiple European languages, including standards for corpus construction, comparative analysis methodology, and the reporting of conclusions. In the US, the International Association of Forensic Linguists (IAFL) has developed parallel guidelines. The convergence of European and American professional standards in this area reflects the globalisation of the underlying methodology: the same statistical approaches to authorship attribution (Burrows' Delta, principal component analysis of function-word frequencies, neural-embedding author-verification models) are being applied to English, German, French, Dutch, Spanish, and increasingly to Arabic and Chinese.

The tension between authorship analysis and civil liberties is sharpest in jurisdictions where linguistic profiling is used to narrow a suspect pool before physical evidence is available. Courts in Germany (under the Bundesgerichtshof's 2010 and 2014 rulings on forensic linguistics in criminal proceedings) and in England (following the Criminal Procedure Rules Part 19 requirements for expert evidence) have developed increasingly specific requirements for the documentation, validation, and confidence-level reporting of linguistic authorship opinions. These requirements are now being incorporated into the guidelines of national forensic science institutes.