Visualizing Cyber Harassment
Content warning: this blog contains racist and anti-semitic language and terminology associated with sexual assault.
Harassment campaigns by swarms of trolls online are disruptive and destructive to their targets’ lives, but what these campaigns actually look like is somewhat nebulous. The people in the crosshairs of a troll campaign sometimes get bombarded with death and rape threats. They may also get bombarded with a flood of notifications that disrupts their social media feeds and device usage for the duration of the bombardment. But since the brigading is mostly confined to the target’s private screen, the public has no real way to understand the scale of the activity or the size of the swarm.
The difficulty in understanding what a troll swarm looks like creates several problems:
- Social media companies can shrug off the effects of abusive trolling campaigns as non-issues and deflect responsibility for the widespread cyber harassment that regularly occurs on their platforms.
- The lack of any point of reference makes it hard for others to empathize with people being targeted with trolling campaigns. Family members, friends and employers don’t understand what the victims are coping with or how to offer helpful support.
- The general public misunderstands the scale of the problem.
Unless you are the target, cyber harassment is difficult to understand and I have found it’s also difficult to visualize.
I collected data over several months in 2019 to analyze part a trolling network on Twitter that some researchers have referred to as The Shed. The network includes several personas that operate pseudonymous accounts. They cycle through iterations of similar usernames and profile photos making it possible to identify them when they re-spawn on new accounts. I am not able to identify the operators of these accounts based on publicly available Twitter data, but it is possible to visualize the scale of their community by focusing on the account proliferation of the various personas.
The fact that there are several people operating many different accounts and constantly re-spawning on new accounts makes it difficult to quantify the digital footprint of this trolling community. Instead of a fixed group of known users, it’s more like a hydra that is constantly regenerating new heads.
These trolls engage in what I categorize as Sybil attacks: attempts to subvert a peer-to-peer network by creating a large number of pseudonymous identities and then using them to gain a disproportionate influence and game reputation systems. They’ve been engaging in this behavior for several years and have targeted journalists who report on the far right.
The targets of this kind of brigading on social media are on the receiving end of what is comparable to a denial of service attack; fielding massive amounts of traffic from a multitude of sock puppet accounts, not knowing who they are or how many real people are actually operating the accounts. When the wave of traffic involves death and rape threats or diffusion of the target’s home address, this kind of campaign not only disrupts the target’s social media usage, it can also negatively affect their personal safety and mental health.
The scale of this kind of attack can increase exponentially on platforms like Twitter where the barrier to create new fake accounts is very low. Advising a target “don’t feed the trolls” or disabling notifications is not sufficient in cases where trolling campaigns carry on for weeks or months.
What I observed in this trolling community over the course of several months in 2019 in some ways resembled typical IRL social networks. Some personas are 1–2 degrees of separation away from each, some personas come and go. It’s a community that is always in a state of flux — much like any social circle of friends. There is a core group of users that seemed to be a constant presence in the network during the time I collected data, and several other trolling communities that are adjacent to/crossover each other.
Due to the complexity and constant fluctuation of their network, visualizing their digital footprint was extremely challenging, so I focused on 5 personas associated with this community whose prolific Twitter activity was obvious and thus easier to track.
Spicci
One of the main personas in this trolling network goes by the nickname Spicci. He’s a man from the US who uses various photos of MMA fighter Gegard Mousasi as his profile pictures.
Spicci will open an account, usually get suspended in a few days and then re-spawn on a new account within 24–48 hours after he’s been suspended. Below is a sample of some of his accounts and tweets from summer 2019 when I captured data for many of these accounts.
The first Spicci account I came across was using the handle @IHateJournalist and participating in a campaign attacking journalists who report on the far right. Below is raw data from the API showing the text of some of Spicci’s tweets using that handle and threatening to dox Huffington Post journalists. Luke O’Brien, who reports on the far right for Huffington Post, is a common target of this trolling community.
I had issues capturing Spicci’s tweets because his accounts got suspended so frequently. Each time I’d start downloading data I could only capture a few hundred tweets and then he’d get suspended again. I was able to download small samples for two of his accounts:
- 257 tweets containing @IHateJournalist from May 29 to June 1, 2019
- 313 tweets containing @WomanRespecter from June 1 to June 3, 2019
Some of the accounts in each of these graphs are there because they were mentioned by other users (such as barstoolsports which Spicci mentioned in a tweet) some are accounts that I’m calling “counter-trolls” who frequently engage and argue with these trolls on Twitter, but several accounts kept recurring throughout various datasets I collected over several months which gave me an indication of some of the central personas in this network.
Since it was difficult to get sizable samples for tweets mentioning Spicci’s accounts due to the limited time each account was online, I also looked at his follower networks.
My theory was since each new Spicci account only lasted a few days, any followers he would gain during the short timeframe each account was online, knew who he was and would re-follow him as soon as he re-spawned on a new account.
I started capturing follower data and was able to download the followers for four accounts that Spicci cycled through while I was researching this network.
WomanRespecting — 607 followers
RapeIsAHoax — 681 followers
SerialRapist — 553 followers
RapeIsASport — 277 followers
I merged the followers of all four accounts onto one network graph using Gephi to see which accounts had followers in common and found 1328 accounts followed at least one of the four Spicci accounts.
I started filtering out nodes to see how many common followers were in this network of four Spiccis. Removing all nodes with degree 1 (nodes with only 1 edge), left 505 accounts that followed two or more Spiccis.
I continued filtering nodes until I was left with only accounts that followed all four Spicci accounts. The remaining network graph included 74 accounts that followed all four Spiccis.
This gave me an idea of how many accounts re-follow Spicci whenever he re-spawns on a new account. I can’t tell if they are all operated by unique users but given the amount of sock puppetry I found in this network, odds are likely some of these accounts are sock puppets.
I found a total of 89 accounts that Spicci has cycled through over time, although there are likely many more than 89.
Kaspa
Kaspa is a woman allegedly from Australia who uses photos of a blonde woman’s face photoshopped on other women for her avatars. Both Spicci and Kaspa have targeted Huffington Post journalist Luke O’Brien.
I scraped the followers of ten Kaspas during the course of this research. I merged all of the follower networks onto one Gephi graph to see if they have common followers like I did with the Spiccis.
Here’s the full network graph of followers for all ten Kaspas. It contains 1516 nodes (1506 accounts plus the 10 Kaspas) and 3908 edges.
The size of each label is scaled by the number of followers each account had at the time I collected data. Accounts that accumulated more followers have larger labels.
I filtered out all nodes with degree 1 — so accounts that only followed one of the ten Kaspa accounts were removed. 731 remaining accounts followed 2 or more Kaspas.
The edges on the outer perimeter are accounts that only followed 2–3 Kaspas and the jumbled mess in the center of the graph are accounts that followed many of the Kaspa accounts. There are sometimes several Kaspa accounts online simultaneously and some of the Kaspas followed other Kaspas. In the follower networks that I collected, jihadspa was following hertzspa.
I filtered out all nodes with degree 8 or less (nodes with 8 edges or less) and found 54 accounts followed all 10 Kaspas. Same as with the accounts that re-followed all of the Spicci accounts, I can’t tell if these accounts are controlled by 54 unique people or if some of these accounts are also sock puppets, but I suspect some are socks.
I also made a combined graph of a Spicci account’s followers (WomanRespecting) and a Kaspa account’s followers (nicecutespa) to see if they had followers in common and they do. I found 70 accounts that had followed both of these Spicci and Kaspa accounts. They also both followed each other.
I found traces of a total 66 Kaspa accounts while researching this blog but there have likely been many more.
Gigi
Gigi is helpful if you’re trying to keep track of who has been suspended and re-spawned on a new account. During the time I collected the data for this blog, Gigi announced the new accounts for 1 Spicci (DiarrheaCumBomb), 4 Kaspas and a fake Chick-fil-A account.
I downloaded data for 4 Gigi accounts. All were suspended not long after I captured their data.
- Thotwaffen2
- 7dayGi
- LockedGigi
- THEGiGI7
I captured tweets mentioning the username Thotwaffen2 and found that the account interacted with several new fake brand accounts (“parodies”) and a few fake antifa accounts. The Thotwaffen2 account also interacted with several Kaspas, two other Gigis and one Spicci (RapeIsAHoax).
Here are some of the fake accounts in Gigi’s orbit and interacting with accounts in this network.
One of first accounts the fake ANTIFA_Portland followed in August 2019 was Gigi along with another fake antifa — AntifaJackson13, the 13th iteration of the AntifaJackson fake antifa account.
Here are 44 Gigi accounts that I found traces of on Twitter. Same as Spicci and Kaspa, there have likely been many more.
iE
I found many parody accounts associated with this persona while I was researching this blog. Here’s a collection of some of the fake accounts that used the branding of the iE persona. They include multiple fake Fox News accounts, fake UPS accounts, a fake Peta account, a fake Planned Parenthood account, fake Chick-fil-A accounts, a fake Identity Evropa account and several notorious fake antifa accounts.
This trolling community intersected with the network of fake antifa accounts which I have previously researched. Two of the fake antifa iE accounts have gained some attention in the media.
ANTIFA_Portland
The ANTIFA_Portland account was created on August 17, 2019 specifically to troll a Proud Boys rally in Portland on that day. The account made several inflammatory tweets that went viral. The fake Portland antifa was amplified by many people with large followings including Curt Schilling, Carpe Donktum, David Wohl and was posted on now banned The Donald subreddit. Breitbart reporter Alana Mastrangelo and Turning Point USA advisory council member Joel Fischer also tweeted the fake antifa account but later deleted their tweets.
Far-right researcher Gwen Snyder found a user sharing a screenshot of the account’s tweet activity in a white supremacist Telegram channel.
ANTIFA_US
The ANTIFA_US account was created May 31, 2020 and went viral after posting inflammatory tweets during George Floyd protests. The account was suspended but screenshots of the below tweet continued circulating on multiple platforms. Paranoid rumors that busloads of antifa were going to invade suburbs to loot and burn white neighborhoods spread like wildfire.
Many incidents of real world fallout were reported across the country that originated from the fake antifa disinformation including some panicked rumors that came from local law enforcement.
In June 2020, a Twitter spokesperson told NBC News that the fake ANTIFA_US account was linked to white supremacist group Identity Evropa and that they suspended the account for creating fake accounts and inciting violence. The group Identity Evropa supposedly rebranded as the “American Identity Movement” (AIM) in 2019 after of its private chat logs were leaked.
I found evidence of 27 iE accounts including 21 parody/fake brand accounts and 6 fake antifa accounts. I found 7 additional fake brand accounts that do not have the “iE” initials in the logo or contain any other markers common to the obvious iE accounts. Twitter has only publicly made an attribution for the 2020 ANTIFA_US account but this persona has been cycling through accounts for several years and judging by its public interactions with other personas in this network, iE is well known within this trolling network.
Micro
Micro aka MicroChip is a fairly well-known pro-Trump troll that has cycled through many Twitter accounts. BuzzFeed News published a profile of MicroChip in 2017 that acknowledged his prolific account creation activity:
“MicroMagicJingleTM is the latest incarnation of MicroChip, a notorious pro-Trump Twitter ringleader once described by a Republican strategist as the “Trumpbot overlord.” He has been suspended from the service so frequently, he can’t recall the exact number of times. A voluminous tweeter, his specialty is making hashtags trend.”
MicroChip claimed responsibility for a White House petition published in August 2017, five days after Unite The Right, to have antifa recognized as a terrorist organization. That petition gained 368,423 signatures and was nearly identical in text to another White House petition to declare Black Lives Matter a terrorist organization that only gained ~900 signatures.
He is also openly racist and anti-semitic.
Here’s what 90 Micro accounts look like in a graph:
There are more personas and many more fake accounts but after collecting an extensive amount of data on this community, I still have no definitive answer as to how many real people are behind the network. Micro has been back on Twitter, here’s an archive of his account with tweets from August 18, 2020. Spicci created a new account in November 2020 and was still tweeting in December 2020. Both accounts have since been suspended but they will probably return
This is the closest I’ve come to visualizing the digital footprint of just a portion of this trolling community. 316 total accounts operated by possibly 5 people.
I was only able to identify sock accounts of these personas because they cycle through similar usernames and images every time they re-spawn on new accounts, but these tactics are endemic to trolling and harassment on social media.
Gephi graphs in this blog were created using OpenOrd combined with Force Atlas 2 layout algorithms. Tweets were collected with Tweet Archivist and data for follower networks was collected using Twarc and Twint.
