Linguistics and Threat Assessment:

How the Analysis of Language Can Assist in Preventing Workplace and Campus Violence

Julia Kupper and Stephen White
Spring, 2023

In this feature, our colleague and guest contributor, Julia Kupper, introduces tactical and forensic linguistic methodologies – a promising aid in investigating language evidence for the risk of targeted violence across various populations of concern.

This selected quotation is from the targeted violence manifesto of Patrick Crusius, who carried out a mass shooting at a Walmart in El Paso, Texas, in August 2019, killing 23 and injuring 23 others. Shortly before the act of violence, the perpetrator announced his attack on the imageboard 8chan where he also published his hate-filled, anti-immigrant manifesto. Crusius had researched and selected this specific store because it was “target rich” with largely Hispanic shoppers and easily accessible with limited security measures, a “soft target.”

Crusius’ words communicate a realization to take personal action now – expressing an obligation, necessity, and exaggeration to attack – and signaling desperation and distress. This “time imperative for violent action” is an example of Last Resort behavior, a proximal risk factor included in the Terrorist Radicalization Assessment Protocol, or TRAP-18 (Meloy, 2018). Analyzing the language of concerning communications with such increased specificity can assist in detecting early warning indicators before an act of targeted violence occurs. A few definitions are first in order for those less familiar with linguistic analysis.

What is linguistics?

Linguistics, the scientific and systematic study of language, consists of specific branches, such as sociolinguistics (language in a social context), dialectology (dialects), morphology (word structures), syntax (sentence structure), phonology (speech sounds), semantics (meaning of language), and historical linguistics (history of languages). It should not be mistaken with psychology (the study of the mind, especially as it affects behavior), graphology (the study of handwriting), statement analysis (the study of the accuracy of words), or the translation or interpretation of documents.

What can be considered language evidence?

Any type of written or spoken communication can be analyzed as raw intelligence or can become complicit in a criminal context. Examples include:

1. Threatening communications (terrorist, workplace, campus, or criminal threats)

• Hateful voicemails
• Menacing text messages
• Targeted violence manifestos

2. Stalking or bullying materials

• Stalking letters
• Bullying emails
• Intimidating social media posts

3. Extortion or fraud documents

• Bomb threats
• Phishing emails
• Ransom demands

What is tactical linguistics?

Meloy, Hoffmann, Deisinger, and Hart (2021) note that the word threat has two distinct meanings in the English language:

1. A perceived possibility of harm (i.e., potential danger, hazard, risk)
2. A statement conveying an intention to cause harm (i.e., a menacing utterance).

Traditional threat assessment and management tend to focus on the first meaning and examine different types of threats or concerning behaviors from an investigative or psychological perspective, for instance as practiced by law enforcement, mental health specialists, and corporate or private security professionals, who often work collaboratively. Tactical Linguistics, however, is primarily concerned with the second meaning by analyzing more specifically the language of concerning communications, and in this way contributing to a preventive, threat assessment and case management approach.

This can be in the form of concepts cited from Kupper & Meloy (2021):

1. Conducting an initial assessment of language by analyzing the level of concern for risk in an emerging threat, searching for the presence of evidence-based warning behaviors and other risk indicators (this can be an instant, on-the-spot analysis if a decision needs to be reached quickly; a written report would usually follow)

• In a recent study, Kupper & Meloy (2021) tested if a behavioral-based threat assessment instrument, such as the TRAP-18, can be applied to extremely limited data. Thirty written and spoken manifestos authored by lone-actors that planned to or committed a targeted attack between 1974 and 2021 were analyzed. Findings indicate that 17 out of 18 TRAP-18 warning indicators were identified in these communications, regardless of what an external investigation may have revealed about the cases.
• This was applied in the field when a targeted violence manifesto was posted on a social media platform along with a picture of a handgun and ammunition. The message included intent for a mass shooting against a specific workplace and minorities, and articulated grievances and homicidal intentions for committing the attack. However, a closer look at the language of the threat revealed that the text was lacking textual substance, suggesting that the content did not reflect its apparent purpose.

2. Completing a tactical analysis of violence and risk of violence patterns by assessing the language of several concerning communications from the same subject (short-term investigation)

• In a recent report on a terrorist attack that occurred in Bratislava, Slovakia in October 2022, Kupper, Rękawek & Kriner (2023) examined the perpetrator’s language across different text types, including a targeted violence manifesto, a suicide note, over 250 Tweets, and post-attack but pre-suicide comments on an imageboard (4chan) and Twitter. The assessment of the empirical evidence concluded that the role of militant accelerationist milieus (e.g., Terrorgram) was central to the attacker’s radicalization and subsequent mobilization.
• A recent case example involved a linguistic threat analysis of four concerning letters that had been sent to a prominent singer by a subject of concern. In order to assess the case, a diachronic analysis was conducted to examine if the language of the author had changed or evolved over time relating to the level of threat.

3. Performing a strategic post-incident or post-investigation examination by comparing the language of subjects that committed similar attacks to detect trends or lessons learned that can be used to prevent future acts of violence by other individuals of concern (long-term implications)

• In another study, Kupper et al. (2022) identified content patterns across different types of communications that were composed prior to or during seemingly unrelated, international acts of far-right terrorism that occurred between 2011 and 2022. The language evidence was comprised of targeted violence manifestos and live-streams, mass casualty attack announcements on digital platforms (e.g., 4chan and 8chan), and writings on equipment (e.g., firearms) that were utilized during the incidents. They were able to show how crucial the online far-right ecosystem is for these would-be attackers, and how the varying forms of illicit communications escort copycats on their pathway to violence, underlining that interconnectivity is a risk-enhancing factor.

What is forensic linguistics?

Although the lines are fluid between Forensic and Tactical Linguistics, the adjective forensic most prominently refers to the application of scientific knowledge to the investigation of crime or legal problems. Forensic Linguistics in its broadest sense is the intersection between language, crime, and law. Two forensic linguistic methodologies that can be valuable in a threat mitigation environment are Forensic Authorship Analysis and Linguistic Author Profiling.

1. A Forensic Authorship Analysis identifies the author(s) of anonymous, questioned, or disputed texts by determining and comparing distinct language features that occur more or less regularly within a writer’s text and that might distinguish the individual from others. This can involve characteristics such as vocabulary, grammar, sentence structure, punctuation, or any type of mistakes.

• A recent case included several extortion emails that were sent to the C-suite of a prominent software company. These were compared to an online posting from a dark web chat room to determine if it was possible that the concerning communications were authored by the same person or not. After identifying rare, shared features across all of the texts, it was concluded that they could have originated from the same writer.

2. A Linguistic Author Profile attempts to establish social and demographic clues of a writer based on one or multiple communications, for instance, age, gender, geographical origin, educational background, occupation, or political affiliation. This technique is often applied to anonymous communications to aid initial investigations and narrow down a list of potential suspects. It is in no sense a psychological assessment but an attempt at socially profiling the author of a text.

• This analysis was recently applied to more than 70 threatening letters that were received by different employees at a company over three years, ranging from board members, senior management, and lower-level workers. The communications were sent from numerous locations but always focused on the same victim. After deducting a forensic authorship analysis that determined it was possible that all letters were authored by the same person, an author profile was created. Due to the amount of language evidence at hand, it was possible to compose a relatively accurate socio-demographical profile of the writer, who likely worked at the business.

Conclusion and implications

In organizational settings, tactical and forensic linguistic methods and strategies can be applied to a variety of concerning communications, for instance:

• Defamation or harassment letters addressed to officials or executives
• Stalking communications addressed to employees or students
• Threatening or hate letters sent to entities or individuals
• Cyber-bullying profiles and messages on social media
• Bomb threats made against a company or university

As language is a central component of human behavior, the analysis of linguistic evidence “left of bang” can assist multi-disciplinary threat mitigation teams in evaluating the level of an emerging or active threat. Assessing communications authored by anonymous or known subjects of concern can help investigators refine their opinions of the level of risk posed by any given scenario, and inform how cases are prioritized for further or specific interventions, or what degree of monitoring should be considered.

Returning to the case of the El Paso Walmart attack, the perpetrator was an outsider who had no known relationship to that workplace. He was not an employee or former employee, or a “customer” (e.g., consumer, patient, or client), or someone fixated on a target personally known to him. Approximately two-thirds of mass attacks in workplaces are carried out by individuals that fall into one of these three categories. The other roughly one-third are committed by outsiders, such as Crusius, who select certain worksites because they are either more densely populated or are frequented by individuals in a hated group. In many cases, the selected sites are both – densely populated with members of a specific hated group (White, 2021). A U.S. Secret Service study of 27 mass attacks in public places in 2018 found that 30% of the attackers subscribed to a belief system associated with violence-justifying ideologies. In addition, 70% of these incidents occurred in places of business, including office buildings, warehouses, bars and restaurants, health care facilities, and municipal centers (Alathari et al., 2019). Although attacks by unidentifiable outsiders are less frequent, they typically result in more fatalities (White, 2021). This is a nightmare for security professionals who oversee the safety of those who work at, frequent, or inhabit these everyday spaces.

Although outsiders and other types of lone actors will typically shift to tactical secrecy as the time of their planned attack approaches, they may also hint at or “leak” their intentions in various ways, including in what they write, post, send, or utter. Threat assessors seek to identify an edge, especially in high-concern cases. Tactical and Forensic Linguistics can complement more traditional investigations, enhancing our ability to interpret written or spoken data. Writers and speakers often make decisions subconsciously about the kind of language they use – and our knowing eyes may tell us more than the author might realize.

Julia Kupper can be reached at info@juliakupper.com.

References

Alathari, L., Blair, A., Carlock, A., Driscoll, S., Drysdale, D., & McGarry, J. (2019). Mass attacks in public spaces – 2018. United States Secret Service, National Threat Assessment Center. https://www.secretservice.gov/sites/default/files/2020-04/USSS_FY2019_MAPS.pdf

Kupper, J., Rękawek, K., & Kriner, M. (2023). Terrorgram’s First Saint: Analyzing Accelerationist Terrorism in Bratislava. The Accelerationism Research Consortium. https://www.accresearch.org/reports-1/terrorgrams-first-saint

Kupper, J., Christensen, T. K., Wing, D., Hurt, M., Schumacher, M., & Meloy, J. R. (2022). The contagion and copycat effect in transnational far-right terrorism: an analysis of language evidence. Perspectives on Terrorism, 16(4), 4—26. https://www.universiteitleiden.nl/binaries/content/assets/customsites/perspectives-on-terrorism/2022/issue-4/kupper-et-al.pdf 

Kupper, J., & Meloy, J. R. (2021). TRAP-18 indicators validated through the forensic linguistic analysis of targeted violence manifestos. Journal of Threat Assessment and Management, 8(4), 174–199. https://doi.org/10.1037/tam0000165

Meloy, J. R. (2018). The operational development and empirical testing of the Terrorist Radicalization Assessment Protocol (TRAP–18). Journal of personality assessment, 100(5), 483-492.

Meloy, J. R., & Hoffmann, J. (Eds.). (2021). International handbook of threat assessment (2nd ed.). Oxford University Press. https://doi.org/10.1093/med-psych/9780190940164.001.0001

White, S. (2021). Workplace targeted violence: assessment and management in dynamic contexts. In J.R. Meloy & J. Hoffmann (Eds.). International handbook of threat assessment (2nd ed.). Oxford University Press. https://doi.org/10.1093/med-psych/9780190940164.001.0001