I'm Unique, Just Like You: Human Side-Channels and Their Implications for Security and Privacy

Overview: Matt Wixey, Lead Security Researcher for PwC UK's cybersecurity practice and former London law enforcement researcher, explores human side-channels and their applications in cyber attribution, security, and privacy. Drawing analogies to physical side-channel leakage in computing hardware (such as acoustic, optical, and electromagnetic emissions), the presentation examines how humans unintentionally leak distinctive behavioral traits through writing and digital interaction. Wixey covers three distinct human side-channels—forensic linguistics, behavioral signatures, and cultural captures—highlighting their historical origins and forensic applications.

Key Topics: - Conceptualizing humans as biological computing systems with unintentional behavioral side-channel emissions - The origins of forensic linguistics: Jan Svartvik's 1968 analysis of the 1949 Timothy Evans / John Christie murder case - Core components of stylometry: spelling, orthography, grammar, lexicon, idioms, and function words - Practical author attribution methodologies: transitioning from manual textual analysis to computational statistics and SVMs

Technical Details: The presentation establishes that traditional cyber attribution identifiers—such as IP addresses, MAC addresses, and ISP subscriber logs—are easily obfuscated, spoofed, or routed through anonymization networks. Similarly, broad heuristic correlations such as mapping adversary activity to regional time zones fail to resolve identities down to individual operators. Wixey proposes evaluating human side-channels: subtle, unintentional biometric and psychological leakages embedded in human output. Grounded in personality psychology and behavioral theory, consistent individual habits emerge from distinct educational backgrounds, cognitive habits, and cultural exposures, generating measurable artifacts across digital text and computer interaction.

The talk examines the discipline of forensic linguistics, tracing its foundations to Swedish linguist Jan Svartvik's 1968 landmark re-examination of the 1949 Timothy Evans case. Evans had been convicted and executed in 1950 for the murder of his wife based on purported verbatim confession transcripts. Svartvik demonstrated through grammatical and lexical analysis that the statements contained two distinct authorial voices, proving police officers had drafted the incriminating passages; the victim was later granted a posthumous pardon when serial killer John Christie was identified. Modern forensic linguistics focuses on authorship attribution via stylometry, which evaluates five linguistic dimensions: spelling and orthography, syntactic grammar, lexical richness, idiosyncratic idioms, and function word distribution.

Stylometric attribution ranges from accessible, manual observation to advanced machine learning pipelines. Investigators can construct comprehensive textual corpora from target authors, extract quantifiable features (such as average sentence length, vocabulary density, and punctuation frequencies), and classify texts using Support Vector Machines (SVMs) or computational statistical models. Stylometry has successfully unmasked anonymous authors in academic plagiarism cases, authenticated historical documents like the Federalist Papers, identified J.K. Rowling writing under the pseudonym Robert Galbraith, and attributed criminal extortion notes. Crucially, Wixey emphasizes that effective forensic linguistics does not require complex deep learning: practitioners can rapidly profile anonymous cyber threat actors by tracking idiosyncratic punctuation, repeated spelling irregularities, and regional phraseology across underground forums.

Key Takeaways: Digital investigators and threat intelligence teams should incorporate stylometry and forensic linguistics into cyber attribution workflows to unmask anonymous threat actors who spoof network-layer metadata. Effective linguistic analysis can be achieved without advanced machine learning by systematically cataloging unusual spelling habits, punctuation quirks, and idiomatic phrases. Privacy-conscious individuals and whistleblowers must recognize that linguistic habits represent identifiable side-channels requiring conscious sanitization or automated style-masking tools to preserve anonymity.

(AI summary — Gemini Flash)