Stylometry and Cyber Forensics

by IP Doctor

The Telegram app exceeded 500 million active users by 13 January 2021. There was a surge in the use of Telegram over the past few years, and one of the driving force is the surge in the number of initial coin offering projects by blockchain and cryptocurrency projects especially during the 2017-2019 period. A Telegram group can support up to 200,000 users, and it is common to see Telegram groups that have thousands of users. For example, the Binance (a prominent cryptocurrency exchange) Telegram group has more than 160,000 users as at 15 January 2021.

However, it is not uncommon for such large scale community to have atrocious users within. Some classes of nefarious users include imposters, scammers, hackers and unethical users in general. Consequently, torts and crimes may occur within a Telegram community. Some nefarious users choose to hide their identity within the Telegram communities using an anonymous account while others would use multiple accounts (clones). The identification of an atrocious person is critical in the Courts. For criminal cases, the public prosecutor needs to know who to charge. It may be easy for public prosecutors to obtain a Court Order or subpoena to compel the platform owner to hand over the atrocious person's account details. However, for torts, in particular defamation cases, it is a lot more complicated. A lot more so for self-litigants.

One step towards identifying a pseudonymous user is the correlation of their other accounts (if any). While this paper uses Telegram as the platform and the input data are Telegram messages, the same technique can be adapted to other communication and social media platforms such as Whatsapp, Signal, WeChat, Facebook, LinkedIn, Instagram, Discord, Discussion Forums, and more. This project involved the use of computational stylometry in the novel identification of clone accounts.

Resources needed