Who's At The Keyboard? Authorship Attribution in Digital Evidence Investigations
Carole E. Chaski · 2005
In some investigations of digital crime, the question of who was at the keyboard when incriminating documents were produced can be legitimately raised. Authorship attribution can then contribute to the investigation. Authorship methods which focus on linguistic characteristics currently have accuracy rates ranging from 72 % to 89%, within the computational paradigm. This article presents a computational, stylometric method which has obtained 95 % accuracy and has been successfully used in investigating and adjudicating several crimes involving digital evidence. The article concludes with a brief review of the current admissibility status of authorship identification techniques. Section 1: The Need and Available Methods In the investigation of certain crimes involving digital evidence, when a specific machine is identified as the source of documents, a legitimate question is, “Who was at the keyboard when the relevant documents were produced? ” For example, consider the following scenarios, drawn from actual cases. 1. A government employee wrote e-mails to his supervisor in which he disparaged her racial heritage. After he was terminated for cause, he sued the federal