The Online Abuse Playbook

There’s a well-defined pattern to how marginalized people are attacked online. If we can understand it, we can help stop each other from participating.

These steps that enable abuse are followed both by deliberately malicious groups as well ostensibly well-intentioned people who don’t realize their actions could lead to unintended consequences. Hopefully, having a record of the process can be a useful resource in reducing the repetition of this pattern.

1: A community forms

A loosely-aligned online community will form, typically around a topic or issue that they’re passionate about. This can be political, like supporters of particular ideologies or political figures, or simply cultural, like fans of a media product like a movie or a band. In all these examples, it’s important to remember that many of these behaviors can be used both for good and bad, whether helping good-faith efforts to hold the powerful accountable or as part of hostile efforts to harm vulnerable people. The effect a community has on those with less power or privilege is what reveals the true nature of its intentions.

2: The community has a grievance

The galvanizing moment for a community to realize that it is a community is typically when they feel affronted. Prior to that moment, they may have been aware of each other’s presence and their reinforcement of values, but there was no catalyst for intentional organization. For example, in a subset of the Star Wars fan community, a galvanizing grievance was the deprecation of some parts of the shared story universe as being canonical, which then escalated to absurd heights in response to the change. In other cases, it’s the identification of a person or complementary community with which the group disagrees.

3: The community organizes

Faced with a shared grievance, the community starts to form structures of organization. Organization can happen in public, as in hashtags on public services like Twitter or Instagram and it can take place in private or semi-private venues, as in closed Facebook groups, subreddits, Slack channels or mailing lists. In larger communities, there will be multiple places for organizing, both public and private, based on the level of engagement and participation that each community member wants to participate in.

4: A community identity forms

As hashtags are used to organize, and names are chosen for the public and private community venues, the community will start to form an identity and will often adopt a name. Because the galvanizing event is usually a grievance, the identity name is often a reclamation of an epithet or criticism made by the oppositional group or individual.

5: Community leaders emerge, unacknowledged

As a natural byproduct of organizing in these public and private channels, individuals who want to help organize will emerge as leaders. As community identity solidifies, those who (consciously or unconsciously) recognize that a power structure is being created will start to jockey for leadership positions or prominence in the community. And of course, leadership status is often bestowed upon community members who have reputation that they bring over from other realms, such as having a pre-existing large network of followers, or being a celebrity or media figure in another domain. One of the most unusual but consistent traits of truly spontaneous online community formation is that leaders will often deny that they’re leaders. This can be both about a strategic desire to appear egalitarian while growing the community as well as genuine ignorance about the way online communities work. The denial of leadership happens in positive communities, where leaders may not want to seem presumptuous or arrogant by claiming leadership.

6: The community starts to take action

Now that an infrastructure is in place, a community will begin acting on the issue or topic that inspired its formation in the first place. Many times the ideas of what actions to take will arise from relatively anonymous community members, either spontaneously or in response to cultural events outside the community. The most actionable ideas then make their way into the private or semi-private channels where core community members gather, and are amplified by community leaders. In some cases, less prominent members of a community can elevate themselves to leadership status by advancing specific actions that the community rallies around.

7: A response

Now that the community has found a target and taken action, they’ll get some acknowledgement. In rare cases, the response will be effective and will de-escalate the situation, causing the community to either calm down or for its energy to fizzle completely, resulting in the community fading away. Typically, though, the response from the community’s target is defensive, and results in an escalation of the conflict.

8: Targets are identified

In the process of community conflict, there’s typically a very flawed identification of community targets. Correctly identifying who’s responsible for a particular grievance requires a deep knowledge of systems thinking, often requiring literacy about institutions or systems whose very inscrutability helped inspire the conflict in the first place. Given their imperfect model of the problem, the community gloms on to whomever is most visible or vulnerable as a target of their ire. Many times this is someone only tangentially related to the target organization, or someone who has no real position of power in an institution, but who has made themselves visible by trying to defend against the community’s action. In other cases, the target is someone picked specifically for their symbolic meaning to the community, as a representative of the greater issue that galvanizes them; this often happens without regard to whether the person actually has control or agency over the issue.

9: Leaders direct the community to attack

Now that the community has identified a target, its leaders (who deny that they are leaders, see #5) will direct the community to focus on that person or institution by making them hypervisible. As outlined in “What Is Public?”, a community will shift information that is merely accessible into being broadly disseminated, while wrapping it in a context that exaggerates, distorts, or sometimes intentionally misrepresents the target. On Twitter, this can take the form of quoting other tweets or “hate-retweeting” them, and on Tumblr, YouTube and other networks, this often takes the form of shared screenshots. Entire media properties like Twitchy exist simply to practice this pattern of behavior. Because the leaders deny they are leaders, this act of making a target hypervisible is seen as innocent, or at least not intentionally malicious.

This is the most clear phase of the cycle: Look for a relatively minor person’s words taken out of context and used as proof of the villainy of an entire community. In many cases, the leader is genuinely unaware of the implications of telling their community to focus on a target, as they may not interact with the anonymous community members who lurk in their channels.

10: The Pile-On

Once a web community has decided to dislike a person, topic, or idea, the conversation will shift from criticizing the idea to become a competition about who can be most scathing in their condemnation. (See “10 Rules of Internet”.) The tactic here is for the community to use any publicly-accessible information about the person as ammunition for attacking them, and to delegate the worst attacks to the most anonymous members of the community. These footsoldiers in an online attack are people who generate multiple, anonymous throwaway accounts, and whose participation in the private or semi-private organizing channels is largely as lurkers, not coordinators. This gives the leaders additional plausible deniability about their culpability for inciting the pile-on.

11. Escalation

At this point, the targets of the community’s attack will usually begin to rally their own supporters. Those helping to defend the target may either simply offer voice their support or, if they are particularly organized, may follow steps that are a mirror of the attacking community. This is typically the point where the conversation is elevated into whatever media covers the affected communities. When the press or media that cover the issue present an even-handed “see both sides” version of the dispute, this has the effect of just amplifying the hypervisibility that the community wanted to inflict on its target. Put more simply: The community knows that getting the press to show up will make things even more unbearable for their target, and embolden the anonymous attackers. Because of the economic factors discussed in “What Is Public”, media outlets will generally participate in this escalation, even if they know it will amplify abuse of marginalized targets who are singled out by a community, especially because it follows the same pattern they’re familiar with from positive accountability efforts.

12. Crossing the line

Once hypervisibility of the target is achieved, the community shows what it was truly about. In a positive community, leaders recognize their responsibility early and provide meaningful, effective actions for community members to take, along with (implicit or explicit) consequences for those who transgress by abusing their targets.

In a toxic community, achieving hypervisibility for the target catalyzes the worst abuses. The anonymous members of a community carry out these abuses, which can include doxing, threatening a target with violence, hacking and destroying financial or online accounts, SWATing or other physical threats. Even without those egregious abuses, the simple onslaught of abuse can be overwhelming for a target, particularly if they are emotionally vulnerable. This wave of attacks usually engenders the first serious backlash against the community. Leaders of malignant communities follow a standard defense:

• “Our community has no leaders, everyone just participates.”
• “I can’t be responsible for what my followers do.”
• “How do we know that the attacks didn’t really come from the other side?”
• “What about this person in our community who was also attacked?”

One of the reasons these defenses are so effective is that very few people who write about or report on these issues are versed in this overall pattern. In addition, as discussed in “The Immortal Myths of Online Abuse”, the typical process of dealing with abusive behaviors online makes the evidence of those abuses invisible, and while this makes sense from a process standpoint, it has the effect of gaslighting the targets by hiding the actual threats or other offenses from public view.

13: Chaos

Once a target’s life has been disrupted or even ruined, or a target institution has been affected, the community works to reinforce its intentions. The formerly minor players in the community who were most effective in attacking the target will earn recognition or status from community leaders, whether that takes form of subtle recognition on public networks, like favorites or likes, or as more explicit acknowledgement on private networks, like praise or compliments on closed communication channels. This encourages the community to repeat from step #8, where new targets are identified.

Another common pattern that emerges at this time is opportunists from other communities arrive. Whether that’s groups who see the target as a common enemy, or griefers who just enjoy causing trouble to anyone who’s under fire online, these new entrants participate by making things worse for everyone involved. Many times this kicks off another media cycle and a wave of incriminations and finger-pointing that heighten tensions between the community and its target, helping to inspire the cycle to repeat as well.

14: Detente

Most of the time (in all but the most doggedly awful communities), the cycle will repeat a few times and then reach a lull as people tire of the tension and stress. Some of the more reasonable or less affected members of both the community and the target’s online circle will sometimes make overtures of reconciliation or at least call for a cessation in the fighting. In other cases, detente will break out when one of the leaders (who aren’t identified leaders) suffers a “real world” loss or a larger world event interferes. Typically this period of detente either lasts until the cycle repeats or until the original community has a schism of its own, where the same tactics are deployed against former allies.

The Lesson

Now that we know the pattern, we can use our knowledge to break the cycle. Identify when peers in your community are playing a role in this kind of cycle and ask them to consider explicitly voicing their unwillingness to participate in processes that can abuse people. And when the leaders of your community refuse to acknowledge their leadership or take responsibility for what their ostensibly innocent actions can cause, nudge them toward being more mindful of their impact.

I’m the cofounder of Makerbase, a community for people who make apps and websites. Join us! Thanks to Darwin Bell for the images.