https://theintercept.com/2017/09/06/how-right-wing-extremists-stalk-dox-and-harass-their-enemies/
September 6 2017,
4:24 p.m.
Chat logs obtained from
message boards used by neo-Nazis and other far-right groups show a concerted
effort to compile private information on leftist enemies and circulate the data
to encourage harassment or violence.
The messages were obtained by
an anonymous source, who infiltrated and gained the trust of white nationalists
and other right-wingers, and has been leaking the material to Unicorn Riot, a “decentralized media
collective” that emerged from leftist protest movements.
The chat logs originate from
various web discussion communities hosted by the provider Discord and closed to
the public. The communities, which have names like “Vibrant Diversity,”
“Ethnoserver,” “Safe Space 3,” “4th Reich,” and “Charlottesville 2.0,” range
from having 36 users to 1,269 users. The most active, with nearly a quarter
million messages over seven months, is “Vibrant Diversity,” a neo-Nazi
community forum that includes a channel called “#oven,” where users share
racist memes. The 4th Reich server, the second most active, has 130,000
messages over the course of four months and includes a channel called
“#rare_hitlers,” where users share propaganda posters and other glorified
media from Nazi Germany. The “Charlottesville 2.0” server, which contains
35,000 messages, is where the “Unite the Right” hate rally in Charlottesville
was organized.
This article is based solely
on chat logs from a community called “Pony Power” (Unicorn Riot published
the logs yesterday). The Pony Power server has 50 users, and the chat logs
contain just over 1,000 messages, posted over the course of 10 days and ranging
in topic from far-right politics to advice about digital and operational
security to debates about the legal limits of online behavior. The
primary activity on the Pony Power server is posting private information,
like names, photos, home addresses, and phone numbers of dozens of anti-fascist
activists.
Victims of the outings, also
known as “doxing,” described reactions ranging from terror to anger to
annoyance, and have variously turned to friends and family for support and
locked down their accounts. They said the Pony Power doxing campaign is just
the latest in a series of online efforts by neo-Nazis and their allies to
marginalize their opponents. The information compiled on Pony Power hasn’t yet
been distributed to the larger right-wing extremist community. However, doxing
efforts associated with prior online hate campaigns have forced
targets to leave
their homes
in the face of death threats, rape threats, and other forms of harassment. And
those attacks were mounted even before President Donald Trump came to power on
the back of racist attacks against his predecessor, Mexicans, and Muslims, and
before he embraced white nationalists and encouraged violence against
protesters at campaign rallies.
People chatting on the Pony
Power server spoke openly, as though behind closed doors, often using offensive
slurs. So be warned, some of the following conversations are hard to stomach.
Scope of the harassment
campaign
During the 10-day span that
the Pony Power chat logs cover, from August 17 to 27, so-called alt-right
members collected private information from over 50 anti-fascist activists from
the states of California, Florida, Illinois, Iowa, Maryland, Massachusetts,
Minnesota, Missouri, Nebraska, North Carolina, South Dakota, Texas, Virginia,
and Washington.
The information collected
often included photographs, social media profiles, home address, phone numbers,
email addresses, date of birth, driver license numbers, vehicle information,
place of employment, and in one instance, a social security number. The
justification for doxing normally put forward in Pony Power was that the
targets were part of loosely structured far-left groups known as
antifa, or anti-fascists, which has put up some of the most militant opposition
to the far right; or they’re judged sympathetic to antifa; or they’ve been seen
at protests deemed “communist” by the the far right.
The members of Pony Power
often brainstorm methods to increase the effectiveness of their harassment
campaigns. One user called “oxycolton” wrote, “We’ve had a lot of people dox
antifags but it doesn’t hold,” apparently meaning that the information is lost,
in part because they don’t yet have a database to keep track of everything.
“Klaus Albricht,” the most
prolific user on the server, suggested a way to accelerate doxing efforts. “We
need to separate states by regions and have a set amount of people work on it
by region of doxxing antifa, and then work on other regions, or have multiple
different teams per region.”
Although this group has
collected private information on over 50 anti-fascist activists, it’s unclear
how much of it has been made available to the wider right-wing extremist
population. “Lupus_Dei – NC” asked if they should post the dox of an enemy to
Gab, a social network for hate
speech, or if they should wait until they have a full database. User
“B1488” responded, “Full database. Dont want to go out all half-cocked.”
Selecting targets
As the neo-Nazis and their
allies were preparing for the “Say No to Marxism” rally in Berkeley on August
27, local anti-fascists were busy organizing a counterprotest. Albricht posted
a flier for this counterprotest and asked, “So who is going to be there to
stand up against Antifa? This is a good chance to dox them so we can have an
idea who they are.” He suggested looking at the counterprotest Facebook page
and doxing everyone who was attending, as well as everyone who liked the post.
The crew on Pony Power did not
just target antifa; anyone who engaged in activism against racism seemed to be
fair game. “Lupus_Dei – NC” posted a link to the Safety Pin Box, which describes
itself as “a monthly subscription box for white people striving to be allies in
the fight for Black Liberation.” With the link, Lupus_Dei posted the message,
“These white allies need doxing.”
Organizations that research
hate groups, like the Southern Poverty Law Center, and any leftist groups that
work against fascism, were also mentioned as potential targets.
Some of the users feel that
doxing anyone that disagrees with their politics isn’t effective enough, and
that they need to focus on bigger fish. The user “NSJW” suggested that
they should dox journalists and the leadership of activist groups. The next
day, NSJW pointed out a specific journalist that they want to dox because the
journalist wrote an op-ed NSJW disagrees with.
User “zayl777” suggests doxing
“Marxist professors.”
A few days after zayl777’s
comment, Albricht wrote, “It’s time we start mapping out the liberal teachers
of universities,” because many people who join antifa come from liberal universities.
Harassing a 22-year-old
college student because of her shirt
A user asked, “Can we get a
doxx on this?” and linked to the Facebook page of a 22-year-old college
student. In her cover photo, the student is wearing a shirt that says “punch
more Nazis,” and the photo itself is framed with the words “good night
alt-right.”
“That woman looks Jewish,”
someone commented.
“Fuck, she looks as Jewish as
Barbara Shekel,” someone else added.
During this conversation,
Albricht described how he tricks suspected antifa members into revealing their
IP address by sending them a malicious link. “What happens is the person goes
through our link to an actual website, and from there this website logs the IP as
it redirects the person without them knowing through their IP tracking
website,” he wrote. “It’s perfect to capture these people’s IP addresses from
now on.” IP addresses can sometimes be used to ascertain someone’s approximate
or specific physical location.
Two hours later, Albricht says
he has almost completed doxing the woman. “That one is very active. I have
found loads of information. Expect a IP if I can get her dumbass to click the
link,” he wrote. “Also there is 2 other people who admitted that they liked her
shirt, and that they are either getting one or already have one, so I will be
getting their dox too just for future reference if you’d like?”
Then he listed the target’s
full name, age, current address, college major and the university she attends,
and her username on several social media sites.
“I never clicked the link
because it seemed hella sketch,” the woman told me when I reached out to her.
The Intercept has granted her anonymity because she’s a victim of a harassment
campaign.
“Basically some random guy
messaged me on Facebook saying that members of 4chan (a popular hub for troll
campaigns) or the ‘alt-right,’ don’t remember which he said, were doxing people
who had admitted to being antifa and I should check out this link for details,”
she continued. “I checked out his profile, and it was just full of ‘alt-right’
propaganda, so I was like yeah, OK not falling for that and didn’t click the
link and instead just blocked him.”
I asked why she thinks Pony
Power users might be doxing her. “I’m not going to rallies or like super
connected to any main antifa work,” she said, “so my best guess would be
because I told some Nazi sympathizers on Twitter to go fuck themselves, because
I’m a member of more left-leaning and antifa-supporting Facebook groups, and
because I’m more vocal on Twitter about my distaste for Nazis.”
Since I contacted her, the
woman has locked down all of her online accounts. She has also warned friends
who commented on the photo in which she wears the anti-fascist shirt. “I’m
annoyed because I’m going to have be paranoid about everything that I do for a
while now, and annoyed because I haven’t even done that much to warrant a
doxing, aside from probably just hurting the feelings of someone in the ‘alt-right,’
” she said.
“I’m also terrified because
they have my address, and it’s not just myself who’s at risk, but now also my
parents who live here as well,” she told me.
Harassing a survivor of the
Charlottesville terrorist attack
On August 12, Emily Gorcenski,
a data scientist from Charlottesville, was walking with a group of
counterprotesters away
from Emancipation Park, where the hate groups were rallying. That’s when a
high-speed car, driven by right-wing extremist James Alex Field Jr., plowed
into the counterprotesters, killing Heather Heyer and injuring 19 others.
“I was there when the attack
happened,” she wrote
in an op-ed for The Guardian. “Despite the president deeming me — a transgender
woman — unfit for military service, I ran toward the attacker with a weapon. I
was ready to engage him if he tried to hurt more people.”
On August 17, NSJW posted a
link to Gorcenski’s page on a website dedicated to discussing how best to troll
victims (the website was not Pony Power), and said “Gorcenski was at the Cville
rally, the torch march the night before as well.”
Twenty minutes later, the user
“SleepingInRlyeh,” wrote, “Found Gorcenski’s power word (pre-tranny name).” And
15 minutes after that, he posted her home address, links to her website and
social media profiles, and a photograph.
Gorcenski told me that she’s
been dealing with harassment since well before the “Unite the Right” rally. In
March or April, she says that users on the aforementioned website dedicated to
trolling discovered the name she went by before Emily, and she sent me a
screenshot of transphobic harassment on Twitter from July.
“As far as being a target
goes, it sucks,” she told me. “These folks are evidently dangerous, as seen
from the events of August 11 and 12. … At the same time, I am accustomed to
online harassment and the more energy they pour into me, the less they spend on
other folks.”
An armed neo-Confederate from
Gainesville, Florida
A Pony Power user called
“adolphus (not hitler)” was mostly a lurker, only posting a total of three
messages on Pony Power. When another user “ox” posted dox on several alleged
anti-fascists from Gainesville, Florida, adolphus responded, “Everything @ox is
posting are all key figures in Gainesville antifa. I lost my job because of
these faggots so any help is appreciated.” Later on, adolphus stated, “lost my
job because I was at [the “Unite the Right” rally in Charlottesville] so I’ve
got some scores to settle with my local antifa.”
All told, Pony Power users
posted private information, including home addresses, on 10 alleged Gainesville
antifa activists.
It’s not clear who is behind
the adolphus account, but the case of Jim O’Brien, a 44-year-old man also from
Gainesville, Florida (like adolphus), gives one example of the sort of alleged
activity for which far-right activists were arrested during the rally. O’Brien
was charged with carrying a concealed handgun. A few days later, he, like
adolphus, was fired
from his job, which in his case was at North American Roofing Services. “We do
not support the extremist activities that were on display in Charlottesville,
Va. over the weekend or any other similar activity,” a memo from his former
company states. “We promote a culture of inclusion and diversity.”
According to Southern Poverty
Law Center’s Hatewatch blog,
“Footage from the rally appears to show O’Brien, marching with the League of
the South, punching a woman repeatedly in the face.” League of the South is a pro-slavery,
neo-Confederate hate
group.
The Intercept tried calling
and messaging Jim O’Brien, but he did not respond. According to his court
documents, he’s not allowed to leave the state of Virginia until his case
is resolved. His trial is scheduled for September 22.
Right-wing figures like
O’Brien have been targeted by leftists for outing that in many ways resembles
the doxing Pony Power conducted against anti-fascists. For example, opponents
of neo-Nazis identified another far-right figure at the Charlottesville rally
where O’Brien was arrested: Peter
Cvjetanovic, who appeared bearing a torch at the University of Virginia
march. Now that his fellow University of Nevada, Reno students know that
Cvjetanovic is a self-described white
nationalist, they’ve pressured their school to expel him (university
officials said they will not expel him, even though they “unequivocally reject”
the views espoused during the rally), and he’s chosen to resign from his
on-campus job to avoid trouble.
Anti-fascist activists also
publicly identified Cole
White, another participant in the Charlottesville rally. Since he was
outed, he has lost his job at Top Dog, a hot dog restaurant in Berkeley,
California.
But there’s an important
distinction between doxing by neo-Nazis and antifa. Neo-Nazis target nearly
anyone who vocally disagrees with their political worldview — which essentially
means anyone who isn’t a racist white person and is public about their views.
Antifa activists only target
members of hate groups, a small but growing subset of American society that
Trump refuses to condemn, responsible for mounting terrorist attacks against
mosques, black churches, transgender women, and people of color.
“Confirmation that antifa is a
Jewish organization”
Michael Novick, a 70-year-old
retired school teacher who lives in the Los Angeles area, has been doing
anti-fascist activism for over 50 years. In the 1960s, while studying political
science at Brooklyn College, he was elected student body president. He was
expelled from that position when he staged a sit-in at the registrar’s office,
demanding that they open admissions for black and Puerto Rican high school
graduates.
In 1987, at the age of 40, he
started the Los Angeles chapter of what would later become the activist group
Anti-Racist Action, but only after spending “many decades fanning the sparks of
resistance and particularly trying to encourage people of European descent like
myself to break with and help uproot and overturn white supremacy and
imperialism.”
Because Novick is one of the
few people publicly associated with Anti-Racist Action, he has been “threatened
many times over many years by various neo-Nazis and fascists.” Last February,
when anti-feminist activist Milo Yiannopoulos’s scheduled talk at University of
California, Berkeley sparked anti-fascist protests, Novick told me that he
received “another spate of death threats,” including a threat to attack “the
women in [his] life” — even though he wasn’t in Berkeley that day.
After users of the Pony Power
chat server discovered that Novick ran several anti-fascist websites, they
decided that he must be the leader of antifa. Albricht announced, “We have our
lead guys.” They imagined an organizational chart of antifa, with Novick at the
top. “Michael is behind what we know as the power structure,” Albricht said.
“Let’s get some more info.”
A few minutes later, Albricht
posted the dox, proclaiming “I am very certain he started the movement.”
And then Pony Power members
stumbled upon what they considered a breakthrough, a YouTube video of Novick
speaking at the 2011 Los Angeles Housing & Hunger Crisis Conference in
which he says, “I’m of Jewish decent.” This was just the proof that the
right-wing extremists needed. “We have confirmation that Antifa is a Jewish organization,”
Albricht announced.
“Everybody has certainly
always known I am Jewish,” Novick told me. “My father came to the U.S. in the
early 30s as a teenager from Poland, and most of his family (many aunts, uncles
and cousins) were wiped out by the Nazis either in Bialystok during a ghetto
rebellion or in the camps.”
Back in Pony Power, excited
about the group’s discovery, Albricht wrote: “Thank you! Now let’s tear these
kikes apart!” Members immediately began spreading the idea that Novick, a Jew,
was the leader of antifa, and they began making up an organizational chart of
antifa that placed Novick at the top, with other antifa leaders reporting back
to him.
“There is no antifa command
structure. There is no organization antifa, so there is no organizational
chart,” Novick told me. “Some antifa are Jewish. Hardly surprising, given the
level of anti-Semitism displayed by the fascists and neo-Nazis.”
When I asked Novick how he
felt being a target of a far-right harassment campaign, he assured me that he
had support. “I am obviously not happy to be in their crosshairs,” he said,
“but I have many comrades and colleagues locally and nationally who have and
will continue to support and defend me and have been aware of the most recent
and previous threats.”
Is doxing legal?
During the course of doxing,
Pony Power members became concerned that they were engaging in illegal
activities, for example, by sending malicious links, such as the 22-year-old
college student, to learn their victims’ IP addresses.
While IP tracking like this is
simple to pull off, the technique itself is similar to a criminal hacker tactic
called spearphishing, in which an attacker sends a message in hopes that the
target will click a link and visit a site that tricks them into handing
over login credentials.
Other techniques used by Pony
Power members included querying domain name registration records, as well as
DNS servers, which convert domain names into IP addresses.
Members of Pony Power were
worried about violating the Computer Fraud and Abuse Act, a broad law
frequently used to prosecute hackers, and about inviting criminal conspiracy
charges. In one particularly lively discussion between Albricht and NSJW, they
argue about exactly what laws they might be violating, and how wise it is to
discuss it on a server where there might be infiltrators.
“You guys should NOT be
talking about anything that violates the CFAA,” NSJW states. “You will get
fucked on conspiracy charges quick if you’re not careful.
Albricht responded, “meh, if
they were to raid this group, that would be the least of our worries seeing as
doxxing is illegal.”
(It’s unclear why the Klaus
Albricht’s name changed to “Klaus Schmidt” and his profile picture changed, but
an examination of the chat logs show that this is the same user.)
“I don’t see anything here
that would be a CFAA violation,” Nate Cardozo, senior staff attorney at the
Electronic Frontier Foundation told me. “Using WHOIS, using historical DNS
services, using reverse DNS … The closest thing that I can see to a CFAA
violation would be the phishing, where they’re trying to collect IP addresses.”
While the Pony Power doxing
doesn’t appear to be in violation of the CFAA, Cardozo left open the
possibility that they were violating state harassment or cyberbullying laws.
“The CFAA is designed to
criminalize hacking,” Cardozo said. “These guys aren’t hackers. They’re just
trolls.”
Anti-harassment resources
If you’re worried
right-wing extremists will come after you, here are a few resources to
help you scrub your online presence.
Feminist Frequency’s Speak Up and Stay Safe(r)
guide
Equality Lab’s anti-doxing
guide for activists facing attacks from the “alt-right”
A Techlicious blog
post about removing yourself from people search directories
Top photo: White nationalists,
neo-Nazis and members of the “alt-right” exchange insults with
counterprotesters as they attempt to guard the entrance to Emancipation Park
during the “Unite the Right” rally Aug. 12, 2017 in Charlottesville, Virginia.
