In early June, Ouest-France opened a new lead in the Dupont de Ligonnès case. Given that XDDL was posting under two usernames on a forum, Arnaud Wajdzik wondered whether, just possibly, he might have had a third account.
This hypothesis (enriched with new elements in this article) makes for an excellent case study in terms of methodology. Because an investigation, whether or not it is based on open-source research (OSINT), rarely rests on immediate certainty. It consists instead of formulating hypotheses, then following them, until they are either disproved or, on the contrary, lead to new elements. This process can be summed up by the following diagram:
Investigation diagram
The starting point: linguistic similarities
By analysing the style of the forum's other authors (the way they write, punctuate, their verbal tics, and so on), the author isolates one account: Epsilon. Like Chevy and Ligo, the two known accounts of XDDL:
- he too overuses exclamation marks (!!!!!!!) and question marks;
- he too WRITES IN CAPITALS in the middle of sentences, sometimes to EMPHASISE a single word;
- he too likes to garnish his demonstrations with the expressions «CQFD» and «Non-exhaustive list».
At this stage, it is a lead. It grows stronger when the aforementioned Epsilon mentions (and spells in exactly the same way!) three kings of the Old Testament whom XDDL cites in private correspondence drawn from a judicial document that was never published. Fairly niche, especially given that in 15 years and among more than 6,500 members, Epsilon is the only one to mention King Baasha on the forum!
This is obviously not proof, merely a lead that is gaining substance. To return to the diagram mentioned earlier, the task is now to test the hypothesis “Epsilon is XDDL's account” against the elements of the investigation, asking each time whether it fits or not. This is where the technical elements come into play.
Testing the hypothesis against the elements of the file
On the forum in question, it is possible to view all of an account's posts. On the profile page of the user Epsilon, the total number of posts is 1,169. When you click on “Search the user's posts”, only 1,080 remain. Perhaps this difference is explained by the deletion of certain messages? We could run the test to understand where the difference comes from, but let us first concentrate on the 1,080 messages.
The content has already been analysed by the author of the Ouest-France investigation. However, the latter did not look into the posting times? Yet these are timestamped and make it possible to apply a new filter to the hypothesis “Epsilon = XDDL”.
With the help of AI, a chronological table listing the dates and times of all the posts is quickly drawn up.
And so?
In its investigation published four years ago, Society explains that, on 6 April, XDDL's phone remained switched off all day, apart from around thirty minutes from 9:45 p.m., a window during which he received a call.
WHAT about Epsilon's activity that day? A single post... at 9:58 p.m.! Right in the window, then.
Dates of Epsilon's posts
With this discovery, the true-crime enthusiast gets carried away and concludes that Epsilon really is XDDL's account.
But irrationality must not prevail, and the cool-headed analysis of the technical elements must remain the rule, notably that of the famous post shown here:
Epsilon's post, 6 April 2011 at 9:58 p.m.
A hypothesis: arguments and counter-arguments
If it really is his username, this presupposes that, while on the phone (the call lasts 25 minutes, between 9:45 p.m. and 10:10 p.m.), XDDL is seized by an irrepressible urge to defend the memory of Houphouët-Boigny and writes a long message, all while taking the time to put words in italics and bold. Here, it no longer quite fits.
A second setback for the Epsilon = XDDL hypothesis: a message posted on 7 April at 1:22 p.m., when, according to Society magazine, the phone remained offline or switched off “until 5:20 p.m.”.
Supporters of the Epsilon hypothesis may counter that:
- The message of 6 April could have been drafted while the phone was in airplane mode, then sent at 9:58 p.m.;
- The message of 7 April could have been posted from another phone or a computer. After all, even in hiding, nothing prevents XDDL from having several devices;
- Perhaps Society is mistaken in stating that the phone remained switched off throughout 7 April.
The real issue: managing uncertainty
So, what to make of it? The aim of this post is not to reach a verdict, but only to illustrate the investigative methodology, in the course of which an analyst is constantly confronted with uncertainty and must systematically imagine the scenarios/elements for and against the hypotheses they develop.
This work is all the more important given that we are all liable to fall into a confirmation bias, which consists of unconsciously selecting the elements that reinforce an initial intuition while downplaying those that weaken it. In the present case, this bias might have consisted of taking an interest only in the post of 6 April while setting aside that of the 7th.
Shortly after the Ouest-France article, the Nantes prosecutor ordered new checks. The IP addresses may yet speak.
In the meantime, the Epsilon hypothesis remains exactly what it is: a hypothesis.
CQFD