Dr Stacy Cecchet
Forensic & Operational Psychologist
Beyond the Username: Integrating Linguistic Analysis, Contextual Intelligence, and Machine Learning to Profile Unknown Subjects in Dark Web Child Exploitation Communities
Online child sexual exploitation investigations are increasingly defined by volume, severity, anonymity, and limited attribution. Reports of online enticement increased by more than 300% from 2021 to 2023. In 2025 alone, the CyberTipline received 21.3 million reports involving 61.8 million images and videos. Severity is also escalating, with Category A content - penetration, bestiality, and sadism - rising from 17% in 2020 to 29% in 2024. On the dark web, an estimated 2% of hidden services are dedicated to child sexual exploitation, yet those sites account for up to 83% of dark web traffic.
In many dark web investigations, language is one of the few consistent artifacts available. This presentation introduces a proof-of-concept process that combines contextual linguistic analysis, behavioural analysis, OSINT review, and machine learning-assisted pattern recognition to support unknown-subject profiling in dark web child sexual exploitation communities.
The process analyzes chat content, forum posts, behavioural disclosures, linguistic patterns, and open-source indicators to generate testable hypotheses related to geolocation, socioeconomic status, education level, vocational functioning, cultural or religious indicators, marital or family status, access to children, and risk of hands-on offending or escalation. The goal is to evaluate whether this approach can reduce analytic time, improve lead prioritization, support rapport-based interview planning, and assist investigators in obtaining admissions and identifying additional victims.
The presenters will describe the current validation process using law enforcement data involving offenders arrested from a dark web child sexual exploitation forum. Known-offender chat, post, and OSINT data are analyzed to generate structured profiles, then compared against known offender characteristics.
This proof-of-concept is designed to help investigators turn anonymous language into actionable leads - accelerating offender identification, strengthening interview strategy, supporting confessions, and helping identify and recover victims sooner.
Sensitive Content
Restricted Access
From International Intelligence to Domestic Arrest: A Green Butterfly Sheet Follow-Up
This presentation serves as a direct follow up to the GREEN BUTTERFLY SHEET investigation, examining what happens after an initial international disruption-and how intelligence uncovered in a global operation can lead to decisive local enforcement outcomes.
Building on material identified during the Green Butterfly Sheet investigation, investigators traced the downstream impact of that intelligence to a related offender operating domestically. The session highlights how proactive victim identification, international information sharing, and financial intelligence can extend beyond the first arrest, enabling law enforcement to identify additional offenders and disrupt ongoing harm.
The presentation focuses on the transition from international intelligence development to lawful domestic investigation, outlining the challenges posed by encrypted environments, anonymous online identities, and the absence of immediate safeguarding indicators. It explores how investigators adapted their strategies, applied layered judicial authorities, and coordinated technical, investigative, and operational resources to progress the case without compromising evidentiary or legal integrity.
Attendees will gain insight into how complex online investigations rarely conclude with a single offender and why follow on investigations are critical to fully disrupting exploitation networks. The session reinforces the importance of global collaboration, patience, and adaptability-and demonstrates how international cases can generate enduring protective impact when intelligence is actively pursued beyond its initial endpoint.