- A single idiosyncratic word — "hiyas" — helped identify a dark web criminal running a forum with 45,000 users.
- Forensic linguists build accurate suspect profiles using word choices, phrase patterns, and dialect markers.
- Criminal forums devote roughly a quarter of posts to rapport-building, mirroring legitimate communities.
Shannon McCoole ran one of the world's largest child abuse forums on the dark web, protected by layers of encryption that kept 45,000 users anonymous. But he made one mistake: he used an unusual greeting.
"Hiyas."
Linguist Emily Chiang reports in The Conversation how that single word helped Australian investigators identify, arrest, and convict him.
It is just one of many stories which shows that forensic linguistics is becoming a powerful tool against dark web crime.
What is forensic linguistics?
Forensic linguistics is the scientific study of language as evidence. Analysts examine word choices, phrase patterns, spelling habits, and dialect markers to draw conclusions about who wrote or spoke a text. It is used in criminal investigations, author identification, and authorship disputes.
Key figure
85
children rescued after police took over McCoole's dark web forum
The Giveaway Greeting
Taskforce Argos, a specialist unit in Australia's Queensland Police Service, noticed McCoole's frequent use of "hiyas" on the anonymous forum. Investigators began searching open websites for similar linguistic markers, focusing on topics McCoole discussed: basketball and vintage cars.
They found their man. Someone in Adelaide used the same greeting on a four-wheel drive forum, with a username similar to the administrator's handle. The same pattern appeared on a basketball forum.
After McCoole's arrest, police took over his account and ran the forum for six months, gathering intelligence that led to hundreds of prosecutions and the rescue of at least 85 children.
What Linguists See in Anonymous Text
When identity markers like names and faces disappear, language remains. Through word choices, phrases, and interaction styles, people reveal who they are–even when they're trying to hide.
In 2018, linguists Tim Grant and Jack Grieve helped identify Matthew Falder, who faced 137 charges related to child exploitation. Police provided them with dark web forum posts and encrypted emails from an anonymous suspect.
...when all markers of identity – names, faces, voices – are stripped away, what remains is language.
Emily Chiang, Forensic Linguist
The linguists found uncommon phrases like "stack of ideas ready" that linked the datasets. They spotted the suspect using both "dish-soap" and "washing-up liquid"–suggesting either US influence on a British speaker or deliberate linguistic disguise.
Grant and Grieve developed a profile: highly educated, native British English speaker, older male. The profile was substantially correct and contributed to Falder's conviction. Both linguists earned commendations from the National Crime Agency.
The Social Rules of Criminal Forums
Dark web criminal communities follow strict social rules, enforced by moderators. These aren't just about behavior–they're essential for survival.
Hardaker's research on child abuse image-sharing sites revealed that a quarter of all conversation contributed to rapport-building: friendly greetings, well-wishing, politeness. New users explicitly announce their status and commitment to the community's norms.
Rules around security reflect constant awareness of law enforcement infiltration. Banning personal information disclosure is ubiquitous. Sites that survive longest are those where users understand and follow these rules.
What makes this significant is how criminal groups mirror legitimate communities of practice–people united by shared interest, developing specialized language and behavioral norms. Understanding these linguistic patterns gives investigators new strategies for infiltration and disruption.
The challenge now is AI. Criminal groups already use sophisticated tools to generate abuse imagery and create deepfakes for scams. As criminals adapt their methods, linguists must evolve their analysis techniques just as quickly.
Fact Check: Claim-by-Claim Verification Verified
All major claims verified against law enforcement records, academic sources, and news reporting. One name typo in pullquote corrected ("Chang" to "Chiang"). Old inline fact-check block removed.
Commentary
- The "hiyas" greeting was one of several linguistic and digital markers, not the sole factor in McCoole's identification. The article does not overstate this.
- The linguists' profile of Falder as an "older male" was inaccurate — he was 29 at conviction. However, the article correctly notes the profile was "substantially correct."
- The attribution to "Hardaker's research" for the quarter figure may be imprecise — the statistic appears to come from Chiang's work, though Hardaker is also active in this research area.
Sources used for verification
Academic/Peer-reviewed:
- REF2021 Impact Case Study - Grant and Grieve's forensic linguistics work
- Online child abuse community research - PMC
Other reliable sources:
- McCoole sentencing - Commonwealth Director of Public Prosecutions
- Task Force Argos - Wikipedia
- Matthew Falder - Wikipedia
- Forensic linguistics article - Phys.org/The Conversation
- McCoole investigation - PREDA.org
Fact-checked by Perplexity Sonar Pro on 2026-03-14
