Skip to content

Illustration by Security Management

Practical Forensic and Tactical Linguistics in Investigations

Language is a central component of human behavior. It is universal because everyone uses it but also individualistic because everyone has his or her own style and way of expressing him or herself. Linguistics is the scientific and systematic study of language and its structure, and it consists of specific branches, such as sociolinguistics (language in a social context), syntax (sentence structure), and semantics (meaning as an element of language).

In its broadest sense, forensic linguistics is the intersection between linguistics, crime, and law, the latter including law enforcement, judicial matters, legislation, disputes, or other proceedings within the law. The adjective “forensic” most prominently refers to the application of scientific knowledge to the investigation of crime or legal problems. Forensic linguistics is not to be confused with psychology (the study of the human mind and behaviors), graphology (handwriting analysis), statement analysis (the study of the accuracy of words), or the translation or interpretation of documents.

A forensic linguist compiles scientific analyses of language evidence to support different types of inquiries and, for instance, collaborates with law enforcement agencies. Any type of written or spoken language can be analyzed as raw intelligence or become evidence if it is complicit in a criminal context. Examples include bomb threats, ransom demands, hate mail, suicide notes, and threatening emails.

In contrast to forensic work, which assists investigative authorities with inquiries into crimes after they have occurred, tactical linguistics is a pre-incident approach that assists in preventing crimes and that can be applied in a threat mitigation environment.

The analysis of language when dealing with terrorism and other types of violent threats “left of bang” has become a promising aid for investigating the threat of targeted violence across various populations of concern. In a risk management setting, concerning communications are analyzed to determine the severity, probability, immediacy, credibility, and complexity of a threat that could indicate an intent or risk for violence, harm, or disruption.

To intervene before an act of violence occurs, linguistic threat analyses can be applied to written and spoken communications, for instance leakage in the form of terrorist, school, or criminal threats—such as terrorism manifestos, stalking letters, intimidating online postings, and homicide or suicide threats.

Although acts of targeted violence are difficult to predict, largely due to their low base rates (i.e., they are statistically rare events), it has become apparent that subjects who embark on a pathway to violence consistently exhibit warning behaviors that alert threat assessors to engage in the management of an emerging threat.

Although acts of targeted violence are difficult to predict, it has become apparent that subjects who embark on a pathway to violence consistently exhibit warning behaviors.

Particularly when dealing with large quantities of data—such as hundreds of threatening online postings directed towards a company by a subject of concern—structured professional judgment tools can assist in aggregating and analyzing language evidence. These include the Terrorist Radicalization Assessment Protocol (TRAP-18) or the Communications Threat Assessment Protocol (CTAP-25). These instruments can be applied to a variety of linguistic data, including targeted violence manifestos, threatening communications, and stalking materials.

By merging the fields of linguistics and threat mitigation and analyzing preattack warning behaviors and intended actions through a language lens rather than a psychological or investigative perspective, concerning communications can be assessed with increased specificity. This in turn can aid in a preventive threat assessment and case management approach, helping investigators to refine their opinions on the level of risk by any given scenario and advise on the degree of monitoring that should be considered for a subject of concern.


Julia Kupper is a tactical and forensic linguist based in Los Angeles, California. As a consultant, she works with threat assessment teams and law enforcement agencies, and supports inquiries by scientifically analyzing language evidence. As an independent researcher, Kupper studies targeted violence, terrorism, and suicide communications to enhance the prevention and mitigation of different types of violent threats. For more information on tactical and forensic linguistics, visit her website,, which includes numerous studies on the subject.