Jun 17, 2018
#TrollTracker: Journalist Doxxed By American Far Right
How the United States far right sought to silence a journalist
On June 1, Huffington Post reporter Luke O’Brien published a scoop: the identity of the person behind far-right American Twitter account @AmyMek, a highly influential, but hitherto anonymous, user with over 230,000 followers.
In response, O’Brien was trolled by other far-right and anti-Islam users, with posts including death threats. The targets included not only O’Brien himself, but colleagues, family members, and a number of unrelated men named “Luke O’Brien” whose personal details were posted online.
At the height of the campaign, O’Brien’s own Twitter account was briefly suspended, after opponents accused him of inciting violence and encouraging self-harm.
The broad outlines of the campaign have already been reported. In this post, we analyze two specific features of the campaign: the attempt to have O’Brien blocked from Twitter and the attempt to publish his personal details.
The incident underlines the methods of the US-based far right, and their determination to silence, or intimidate, those who expose them.
It also underlines the difficulty all social platforms face, as harassment groups coordinate on one platform for actions on another.
Mixed Reviews — Praise and Threats
O’Brien identified the human operator behind @amymek, a highly influential account most noteworthy for its sweeping anti-Islam and anti-migrant sentiments, as a New York woman named Amy Mekelburg.
His investigation linked her to an anti-Islam website which posted the names, photos and contact details of individuals accused, without evidence, of collaborating with jihadi terrorists.
Sharing contact information in this way is known as “doxxing.”
It is important to note that O’Brien’s post did not doxx the @amymek user, in the sense of revealing address, email or telephone details; the closest geographical information given was the New York district in which she lived.
However, even before publication, Mekelburg tweeted a string of posts to say that O’Brien’s investigation had resulted in her husband losing his job at wrestling entertainment giant WWE, and put her at “great personal risk.”
The Huffington Post article confirmed WWE’s decision to fire Mekelburg’s husband. After publication, right-wing activist Mike Cernovich tweeted screenshots from the Huffington Post comments section to argue that Mekelburg was receiving death threats:
There are no circumstances under which death threats can be justifiable; @DFRLab condemns them at all times.
However, the comments referenced by Cernovich were posted to the Huffington Post comments page, not directly to @amymek’s Twitter handle. While reprehensible, they do not, therefore, appear to constitute targeted personal harassment, as would be the case if they had been sent to her.
According to a machine scan of mentions of the @amymek account handle from May 31 to June 4 using the Sysomos online tool, the great majority of mentions were positive. Of the 100 most retweeted tweets, 88 were posted by @amymek and her supporters; the top ten alone gathered over 60,000 retweets.
A search for posts made by @amymek between May 31 and June 5 revealed one tweet in which she spoke of showing O’Brien “proof on my social media that my safety is in jeopardy.” This was tweeted on May 31, before the Huffington Post article was published; it therefore does not provide evidence of threats subsequent to, or resulting from, the publication. No other post by Mekelburg provided any evidence of direct threats over that period.
Sadly, given the nature of social media, it was entirely credible that some users did post threats to Mekelburg. However, there was no evidence to suggest a coordinated, large-scale, and targeted harassment campaign, of the kind which Mekelburg’s own website appeared designed to facilitate.
There is significantly more evidence of a coordinated campaign against O’Brien. According to a separate Sysomos scan, mentions of his Twitter handle, @lukeobrien, spiked around the time of publication, topping 70,000 mentions, most of them in the first 24 hours. This was only a quarter of the volume of posts to mention @amymek.
As with Mekelburg’s account, not all the traffic was hostile. The most-retweeted post over the entire period praised O’Brien’s reporting; O’Brien’s own tweet promoting his article garnered almost 2,000 retweets.
Half of the ten most retweeted posts, however, were hostile; of the one hundred most-retweeted, 80 were hostile, often aggressively so.
A significant number of tweets included threats of doxxing, physical, professional, or financial harm. A number were deleted or suspended; those which were archived preserve a flavor of the attack.
The volume and aggression of hostile traffic directed at O’Brien far outweighed the hostility directed at Mekelburg. While some was organic, there is evidence on both Twitter and other platforms that some of the harassment was orchestrated.
Targeted Harassment
Some Twitter posts suggest an intention to harass — for example, by posting the telephone number and email address O’Brien showed on his Twitter profile and website.
Some comments were oblique, predicting harassment, without calling for it.
Others were more direct, urging their fellows to tweet to the Huffington Post, and providing more telephone numbers.
Much more explicit traffic was conducted on fringe social media platform Gab, seen as a haven for users whose comments were too extreme for Twitter.
One user, apparently in Europe, called for a general campaign of doxxing against journalists, with the comment, “harassment would be easy.”
Some Gab users called for a full-scale stalking campaign; others called for violence.
Others began scouring the internet to identify O’Brien’s home, workplace, family, personal relationships, and educational history. One conversation on 4chan’s notorious /pol/ (“politically incorrect”) channel focused on an effort to find O’Brien’s home address. A user with the (we assume) alias “Hitler Himself” posted a link to online repository Ghostbin, showing what he apparently thought was O’Brien’s New York address.
The Ghostbin page gave, not only two addresses, but a telephone number and O’Brien’s supposed girlfriend’s name.
“Hitler Himself” later admitted that the details were incorrect — and that he had therefore shared an unrelated stranger’s personal details.
That did not stop a newly-created Twitter account called @Luke43753290 posting the screenshot to O’Brien with the comment, “This is fun,” in what was clearly an attempt at intimidation.
These posts, and others like them, went far beyond O’Brien’s own exposé of @AmyMek’s identity and background: they attempted to expose his address and contact details, those of his family and friends, and his behavior patterns.
Not all were accurate; one conversational thread on Gab focused on the effort to identify Luke O’Brien’s real name, apparently not realizing that it is, in fact, Luke O’Brien.
Nevertheless, the publication of O’Brien’s professional contact details, and those of his colleagues, was clearly intended to trigger a campaign of harassment online and by telephone; the attempted publication of address details appears to move that incitement from the online sphere to the real world.
Collateral Damage
At least as disturbing as the attacks on O’Brien was the manner in which users on the fringe sites posted photographs and sensitive information about other men called “Luke O’Brien.”
As well as addresses and phone numbers, these included photographs…
… including family members …
… and even the floor plan of an apartment.
A number of Mekelburg’s supporters also posted angry tweets to military analyst Luke O’Brien, who is of no relation to the reporter at Huffington Post.
Judging by incorrectly identified O’Brien’s replies, the trolls had picked on the wrong O’Brien in more than one sense; nevertheless, the case highlights the danger of collateral trolling.
These Luke O’Briens bore no relation to the Huffington Post author; their personal details were exposed by aggressive internet trolls with the avowed intention of triggering harassment.
While this shows the trolls’ lack of forensic skill, it also shows the indiscriminate nature of their attacks, and the real threat they can pose to innocent bystanders.
Silence and Suspension
While these calls for harassment were ongoing, a number of @AmyMek supporters attempted to summon more formal reprisals against O’Brien, calling for him to be reported to the police, the FBI, or Twitter’s enforcement arm — @TwitterSupport.
These attempts were tightly focused. A machine scan of posts mentioning O’Brien’s handle and that of @TwitterSupport shows how traffic surged in the night of June 1–2, before dropping off again sharply.
Traffic using this combination of handles was even more uniformly hostile to O’Brien; of the ten most-retweeted posts, only one, from O’Brien himself, defended his point of view.
The main driver of this traffic was Laura Loomer, a self-styled former “operative” at Project Veritas, a right-wing outlet which attempted to entrap Washington Post journalists when they were reporting on accusations of underage sex against Republican candidate Roy Moore in Alabama in December 2017.
Loomer’s claim was that O’Brien was “inciting violence” against @AmyMek, “in violation of” Twitter’s terms of service, and doxxing @AmyMek on the platform. She also claimed that O’Brien’s followers were sending @AmyMek death threats.
The claim of “inciting violence” was based on a post in which O’Brien had responded to critics with the phrase, “Get stuffed, fascists.” In British English, the phrase “get stuffed” is a mildly improper piece of slang, considered innocuous and amusing enough to feature in, among others, comedy series “The Black Adder.” It is not obscene, let alone threatening.
For those unfamiliar with British slang, however, it could sound more sinister. Loomer interpreted it as incitement to rape.
Other users also copied @TwitterSupport and Twitter’s founder, Jack Dorsey (@Jack), with a variety of complaints about O’Brien, or simply a forwarding reference.
Other users were even more explicit, urging @AmyMek’s supporters to report the tweet as targeted harassment and provided step-by-step instructions on how to do so. On at least one occasion, another user replied to claim that they had reported the article to the FBI.
These posts generated substantial traffic: over 5,000 mentions, almost all of them within a 24 hour span. The intent was clearly to trigger some form of Twitter sanction against O’Brien.
On this occasion, the tactic failed. There is no indication that Twitter Support was taken in by the many demands.
Subsequently, however, O’Brien responded to another round of criticism with a tweet inviting his critic to “DDT yourself.”
DDT is a professional wrestling move; O’Brien had been tweeting about @AmyMek’s husband, a former employee at World Wrestling Entertainment, who lost his job as a result of O’Brien’s investigation into @AmyMek’s tweets.
However, by far the most common use of DDT is as the name of a lingering pesticide; in a Google search, all the top ten results referred to the pesticide. Critics interpreted O’Brien’s post as an invitation to self-harm, which is also banned under Twitter’s rules. The most influential of these was Jack Posobiec, a self-styled “Slav-right” activist.
Other users took up the call, copying Twitter’s main handle, @Twitter, to accuse O’Brien of encouraging suicide.
At least one account claimed that it had reported O’Brien to Twitter for allegedly encouraging self-harm.
This time, the reports appear to have been successful: O’Brien’s account was temporarily blocked. A screenshot posted to website BernardMedia.org showed a message from Twitter to O’Brien, announcing that his post had violated the ban on promoting self-harm.
The response to the temporary shuttering exposed a number of other accounts which had apparently reported him for “encouraging suicide”, including these.
The block on O’Brien’s account was shortlived, and his DDT post was not deleted. Nevertheless, it does appear that the large-scale reporting of the tweet did achieve the effect which @AmyMek’s supporters had intended, temporarily taking O’Brien offline.
Conclusion
The attack on O’Brien illustrates a number of trends. First, and most obviously, is the coordinated aggression of the American far right and its supporters: O’Brien and his colleagues faced a targeted campaign of harassment, both online and in their daily lives, together with threats of physical violence, because of their work in identifying a Twitter user who had herself doxxed other Americans in the past.
It also shows the organic interconnection between different platforms. Users on 4chan and Gab discussed how to target O’Brien and his colleagues on social media, by telephone and in real life. On several occasions, content which surfaced on one channel was then shared on the others.
This cross-platform coordination is an inescapable aspect of online trolling, and one which the platforms have yet to tackle.
The attack also shows the capabilities, and limitations, of Twitter’s enforcement teams. Mekelburg’s supporters pushed hard for O’Brien to be suspended because of his “get stuffed” tweet, generating over 5,000 tweets in the process, but they failed to achieve the desired effect. Evidently, the volume of complaints is not enough to trigger a suspension if the complaints themselves are frivolous.
By the time this report was written, on June 11, several of the accounts which had targeted O’Brien most aggressively had also been suspended — showing the limitations on the most extreme forms of trolling.
However, the complaints about the “DDT” tweet did achieve their effect. This is, perhaps, understandable, since the use of “DDT” in a wrestling context is niche at best; but it shows Twitter’s continued vulnerability to manipulation, especially in cases which are both highly nuanced and highly charged.
Above all, the incident underlines the need for more effective monitoring of, and response to, such massive attacks. This is a challenge which goes beyond any one platform. Trolls coordinate across many platforms to silence their adversaries; the platforms should work together to address the problem of trolls.
Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
Follow along for more in-depth analysis from our #DigitalSherlocks.
