

Since traces are more often than not considered as silent witnesses, considering words as traces is not obvious. The analysis of ‘words as traces’ in the forensic context raises many questions about the objectivity, reliability, and reproducibility of the methods used to analyse language traces. We investigate how these remnants can help to answer general questions: (1) “What kinds of fake documents are sold?”, (2) “Can we distinguish types of sellers based on their selling activities or profiles?”, (3) “Can we link distinct vendors based on language traces similarities?”. In this study, we investigate language traces resulting from the publication of illegal ads posted by vendors to reconstruct their activities and get insight into the online market for fake documents. Language trace may result from illicit acts that can be committed through language, such as threats, defamation, or even an apology for terrorism. It is the remnant of an action which is the writing of an illegal or litigious text by an author with an informative potential on its source, but also on the illicit activity itself.

The one we focus on is called by Renaut and colleagues (2017) the “language trace”.

These traces can be apprehended from several forensic perspectives. We focus on the textual data present in HTML traces collected on the WHM cryptomarket. It was then one of the most active cryptomarkets on the Dark Web, 1 until its closure in October 2021, with nearly five hundred thousand users and almost three thousand sellers. The marketplace chosen for this research is the ‘White House Market’ (WHM) cryptomarket, still active at the moment of the study from January to June 2021. The market for fake documents has found its way to extend to online marketplaces.

This paper will refer to ‘fake documents’ as forgeries of identity document and secure documents. This makes fake secure documents a hot product for the illicit market. They are a particular type of ‘secure document’ such as travel documents, banknotes, or diplomas, which can be defined as a document giving legal or commercial function and value to the holder and having the property of allowing the confirmation of its veracity, validity, and authenticity as a genuine document. But identity documents are not the only documents used for obtaining benefits and are thus not the only ones affected by forgeries. Document fraud is thus a convenient solution, sometimes the only one, to get past identity checks and controls and access to the places or services sought. This makes them highly attractive assets for individuals deprived of such benefits. In addition to granting rights to their rightful holder, they can confer trust, authority, benefits, and responsibilities. Identity documents are required for many everyday activities such as subscribing to a telephone service, taking out a loan from a bank, crossing borders, or buying alcohol.
