Turf Wars: The Birth of the COVID-19 Protests
An online battle for websites preceded real world protests
Over the weekends of the 17th and 24th of April, thousands of Americans showed up at intersections and state houses across the country to protest against social distancing rules, the closure of businesses, and other measures taken by mayors and governors to combat the Covid-19 pandemic. Depending on the location, protestors ranged from the pedestrian to the extreme and bizarre. Some groups were calm, carrying signs calling on governors to reopen businesses. Other groups were toting semi-automatic rifles, combat gear, and QAnon paraphernalia.
Users on reddit, in particular /u/Dr_Midnight, noticed a strange pattern in certain sites purporting to support the anti-quarantine protests. Dozens of sites with the URL format reopen[state code/name].com had all been registered on 17 April within minutes of each other, many from a single round of GoDaddy domain purchases from the same IP address in Florida. The original Reddit posts were removed by moderators because they revealed private information about the individual who had registered the reopen.com domains. Here are screenshots without sensitive information, as examples:
Sites urging civil unrest in Pennsylvania, Wisconsin, Ohio, Minnesota, and Iowa all had the same “contact your legislator” widget installed, and these and other states’ websites “blog” sections cross linked to each other.
Many of the reopen.com sites purchased on 17 April are dormant and have no content at the time of publication. However several of these domains forward users to a string of state gun rights advocacy websites, all named [state]gunrights.org. The Pennsylvania, Minnesota, Michigan and other “gun rights” sites and associated Facebook groups belong to the Dorr brothers, gun rights extremists and conservative advocates who Republican lawmakers in the Midwest have repeated labeled as “grifters”. Multiple reopen.com sites have “shop” sections selling the Dorrs’ anti-quarantine and pro-gun rights merchandise.
Several reopen.com URLs lead to Facebook groups calling themselves “Operation Gridlock [city name]”. Here are the identical descriptions for the LA and Tennessee Gridlock Facebook groups:
Security researcher Brian Krebs also identified reopen.com domains, including reopenmississippi.com, that had eventually been sold on to In Pursuit Of LLC, a for-profit political communications agency reported to belong to the conservative billionaire industrialist Charles Koch. Non-profit journalistic site ProPublica has identified several former In Pursuit Of employees who are now on the Trump White House communications staff. It is unclear who registered reopenmississippi.com and other sites purchased by for-profit political consultancies, as many were not purchased during the 17 April’s afternoon buying spree in Florida.
A further twist in the story came on 23 April, when a man named Michael Murphy, whose IP address was identified in /u/Dr_Midnight’s original removed reddit investigation, was interviewed by reporter Brianna Sacks. It turns out that Murphy, a struggling day trader from Sebastian, Florida, spent $4,000 on dozens of reopen.com domains in the hopes of selling them on to liberal activists looking to prevent conservatives from organizing protests. An attempt to out-grift the grifters.
It is unclear whether Murphy’s intentions were political, financial, or both. He describes his politics as “generally liberal”, however his business has been suffering in recent years — he even tried to reorient to selling N-95 mask cleaning solution when the coronavirus outbreak worsened in March, but was unsuccessful. Murphy even claims to have attempted to contact late night TV host John Oliver, hoping the comedian would pay him for domains to use in one of his show’s signature trolling stunts. Murphy came forward to reporters after anti-right-wing reddit users began doxxing him, revealing his name, address, and businesses. Any reopen.com sites not registered to Murphy’s Florida IP address were likely bought by the Dorrs brothers or Koch-backed organizations before Murphy could snatch them up.
What do we make of all this?
Relatively unsophisticated technical actors have shown themselves capable of mobilizing large numbers of citizens into the streets. A few well-named URLs and a decent Facebook following are all it takes for a series of protests to be organized across the country with little notice. Protesting citizens are entirely unaware that any central coordination of their activities exists beyond their local social media groups. However these groups were not genuine expressions of opinion by concerned private citizens. Most were created concurrently by individuals or organizations with the explicit intent of political or financial gain through advocating activities that contradict public health rules and guidelines in a time of national crisis.
It’s important to note at this point these protests represent the views of a very small minority of voters, regardless of party. A poll conducted by the Democracy Fund and UCLA in late March and again in early April shows broad approval of, and compliance with, local and state social distancing guidelines and business closures. Around 87% of respondents approved of varying measures imposed by mayors and governors, and 81% said they hadn’t left their homes over the last two weeks except for buying necessities, up from 72% in late March. Majorities of Democrats, Republicans, and Independents all believed quarantine measures to be necessary. Despite this general consensus in support of emergency measures, astroturfing operations were able to mobilize a diverse set of online activists, spectators, social media buffs, conspiracy theorists, and guns rights absolutists, even reaching all the way to disgruntled mainstream conservatives and their families.
The Internet and social media catalyze kinetic action
Centrally coordinated puppeteering of otherwise spontaneous demonstrations is not new. What is novel is the ability to do so at a national scale with almost no investment of resources of any kind — financial or otherwise. All it took was an internet connection, a few web domains, and a cursory knowledge of the online right wing universe. Once the spaces for action were created, and the right actors assembled, the demonstrations themselves were almost an inevitability. With enough prodding from conservative media and political figures, right up to the top of the movement, people took to the streets.
Twitter, and to a lesser extent Facebook, have actively shied away from preventing this method of organizing on their platforms. Despite both companies ostensibly having changed terms-of-use enforcement to take down content encouraging violating state quarantine orders, Facebook has not taken down Freedom Fund or Conservative Coalition groups or individual posts, and Twitter has officially decided that the President’s “LIBERATE” tweets do not violate their rules against inciting violence. On 22 April, Facebook did take down events pages for anti-quarantine protests in California, Nebraska, and New Jersey, but only after these states’ governors explicitly ordered the company to do so. Events pages in other states, most notably Michigan, Pennsylvania, and Ohio, remained active over the weekend of 24 April. Several groups of protesters in Lansing, Michigan entered the State Capitol Building carrying semi-automatic rifles and wearing kevlar vests and other combat gear. Michigan’s governor, Gretchen Whitmer, has been a target of particularly vitriolic rhetoric from protestors over the state’s emergency orders — some of the most stringent in the country — enacted after a major outbreak in the Detroit area in late March.
Inauthentic action catalyzed by social media is legitimized by traditional media
Traditional media, most notably TV, are often playing catch-up with more savvy information actors online. An Insider Exclusive special on coronavirus on 29 April — broadcast in primetime on multiple US cable networks — contained a segment on the protests. It first showed “hundreds” of people continuing to protest in front of various state houses, and immediately contrasted these images with footage of long lines at food banks in Houston, Texas. The narration insinuates that the “exasperation” felt by the protestors somehow derives from an inability to find basic necessities. This insinuation, however, is false. Footage of the protests has revealed the discontents to be predominantly white and older, while those requiring assistance from food banks in major cities are often younger, economically-precarious people of color, a demographic notably absent from images of anti-stay-at-home protesters.
The astroturfing operation has therefore worked its way through an entire information cycle. Political donor money is used to fund fringe actors’ online efforts, purchasing websites and organizing on social media. These sites are used to generate kinetic action in the form of protests. These protests are then covered by the traditional media, broadcasting and legitimizing the initial message of the organizers, inserting their narrative into the mainstream.
