HOW RIGHT-WING EXTREMISTS STALK, DOX, AND HARASS THEIR ENEMIES

S E E D E D   C O N T E N T

CHAT LOGS OBTAINED   from message boards used by neo-Nazis and other far-right groups show a concerted effort to compile private information on leftist enemies and circulate the data to encourage harassment or violence.

The messages were obtained by an anonymous source, who infiltrated and gained the trust of white nationalists and other right-wingers, and has been leaking the material to   Unicorn Riot , a “decentralized media collective” that emerged from leftist protest movements.

The chat logs originate from various web discussion communities hosted by the provider Discord and closed to the public. The communities, which have names like “Vibrant Diversity,” “Ethnoserver,” “Safe Space 3,” “4th Reich,” and “Charlottesville 2.0,” range from having 36 users to 1,269 users. The most active, with nearly a quarter million messages over seven months, is “Vibrant Diversity,” a neo-Nazi community forum that includes a channel called “#oven,” where users share racist memes. The 4th Reich server, the second most active, has 130,000 messages over the course of four months and includes a channel called “#rare_hitlers,” where users share propaganda posters and other glorified media from Nazi Germany. The “Charlottesville 2.0” server, which contains 35,000 messages, is where the “Unite the Right” hate rally in Charlottesville was organized.

This article is based solely on chat logs from a community called “Pony Power” (Unicorn Riot   published the logs   yesterday). The Pony Power server has 50 users, and the chat logs contain just over 1,000 messages, posted over the course of 10 days and ranging in topic from far-right politics to advice about digital and operational security to debates about the legal limits of online behavior. The primary activity on the Pony Power server is posting private information, like names, photos, home addresses, and phone numbers of dozens of anti-fascist activists.

Victims of the outings, also known as “doxing,” described reactions ranging from terror to anger to annoyance, and have variously turned to friends and family for support and locked down their accounts. They said the Pony Power doxing campaign is just the latest in a series of online efforts by neo-Nazis and their allies to marginalize their opponents. The information compiled on Pony Power hasn’t yet been distributed to the larger right-wing extremist community. However, doxing efforts associated with prior online hate campaigns have   forced   targets to   leave   their   homes in the face of death threats, rape threats, and other forms of harassment. And those attacks were mounted even before President Donald Trump came to power on the back of racist attacks against his predecessor, Mexicans, and Muslims, and before he embraced white nationalists and encouraged violence against protesters at campaign rallies.

People chatting on the Pony Power server spoke openly, as though behind closed doors, often using offensive slurs. So be warned, some of the following conversations are hard to stomach.

Scope of the harassment campaign

DURING THE 10-DAY   span that the Pony Power chat logs cover, from August 17 to 27, so-called alt-right members collected private information from over 50 anti-fascist activists from the states of California, Florida, Illinois, Iowa, Maryland, Massachusetts, Minnesota, Missouri, Nebraska, North Carolina, South Dakota, Texas, Virginia, and Washington.

The information collected often included photographs, social media profiles, home address, phone numbers, email addresses, date of birth, driver license numbers, vehicle information, place of employment, and in one instance, a social security number. The justification for doxing normally put forward in Pony Power was that the targets were part of loosely structured far-left groups known as antifa, or anti-fascists, which has put up some of the most militant opposition to the far right; or they’re judged sympathetic to antifa; or they’ve been seen at protests deemed “communist” by the the far right.

The members of Pony Power often brainstorm methods to increase the effectiveness of their harassment campaigns. One user called “oxycolton” wrote, “We’ve had a lot of people dox antifags but it doesn’t hold,” apparently meaning that the information is lost, in part because they don’t yet have a database to keep track of everything.

“Klaus Albricht,” the most prolific user on the server, suggested a way to accelerate doxing efforts. “We need to separate states by regions and have a set amount of people work on it by region of doxxing antifa, and then work on other regions, or have multiple different teams per region.”

Although this group has collected private information on over 50 anti-fascist activists, it’s unclear how much of it has been made available to the wider right-wing extremist population. “Lupus_Dei – NC” asked if they should post the dox of an enemy to Gab, a social network for   hate speech , or if they should wait until they have a full database. User “B1488” responded, “Full database. Dont want to go out all half-cocked.”

Selecting targets

AS THE NEO-NAZIS   and their allies were preparing for the “Say No to Marxism” rally in Berkeley on August 27, local anti-fascists were busy organizing a counterprotest. Albricht posted a flier for this counterprotest and asked, “So who is going to be there to stand up against Antifa? This is a good chance to dox them so we can have an idea who they are.” He suggested looking at the counterprotest Facebook page and doxing everyone who was attending, as well as everyone who liked the post.

The crew on Pony Power did not just target antifa; anyone who engaged in activism against racism seemed to be fair game. “Lupus_Dei – NC” posted a link to the   Safety Pin Box , which describes itself as “a monthly subscription box for white people striving to be allies in the fight for Black Liberation.” With the link, Lupus_Dei posted the message, “These white allies need doxing.”

Organizations that research hate groups, like the Southern Poverty Law Center, and any leftist groups that work against fascism, were also mentioned as potential targets.

Some of the users feel that doxing anyone that disagrees with their politics isn’t effective enough, and that they need to focus on bigger fish. The user “NSJW” suggested that they should dox journalists and the leadership of activist groups. The next day, NSJW pointed out a specific journalist that they want to dox because the journalist wrote an op-ed NSJW disagrees with.

User “zayl777” suggests doxing “Marxist professors.”

A few days after zayl777’s comment, Albricht wrote, “It’s time we start mapping out the liberal teachers of universities,” because many people who join antifa come from liberal universities.

Harassing a 22-year-old college student because of her shirt

A USER ASKED,   “Can we get a doxx on this?” and linked to the Facebook page of a 22-year-old college student. In her cover photo, the student is wearing a shirt that says “punch more Nazis,” and the photo itself is framed with the words “good night alt-right.”

“That woman looks Jewish,” someone commented.

“Fuck, she looks as Jewish as Barbara Shekel,” someone else added.

During this conversation, Albricht described how he tricks suspected antifa members into revealing their IP address by sending them a malicious link. “What happens is the person goes through our link to an actual website, and from there this website logs the IP as it redirects the person without them knowing through their IP tracking website,” he wrote. “It’s perfect to capture these people’s IP addresses from now on.” IP addresses can sometimes be used to ascertain someone’s approximate or specific physical location.

Two hours later, Albricht says he has almost completed doxing the woman. “That one is very active. I have found loads of information. Expect a IP if I can get her dumbass to click the link,” he wrote. “Also there is 2 other people who admitted that they liked her shirt, and that they are either getting one or already have one, so I will be getting their dox too just for future reference if you’d like?”

Then he listed the target’s full name, age, current address, college major and the university she attends, and her username on several social media sites.

“I never clicked the link because it seemed hella sketch,” the woman told me when I reached out to her. The Intercept has granted her anonymity because she’s a victim of a harassment campaign.

“Basically some random guy messaged me on Facebook saying that members of 4chan (a popular hub for troll campaigns) or the ‘alt-right,’ don’t remember which he said, were doxing people who had admitted to being antifa and I should check out this link for details,” she continued. “I checked out his profile, and it was just full of ‘alt-right’ propaganda, so I was like yeah, OK not falling for that and didn’t click the link and instead just blocked him.”

I asked why she thinks Pony Power users might be doxing her. “I’m not going to rallies or like super connected to any main antifa work,” she said, “so my best guess would be because I told some Nazi sympathizers on Twitter to go fuck themselves, because I’m a member of more left-leaning and antifa-supporting Facebook groups, and because I’m more vocal on Twitter about my distaste for Nazis.”

Since I contacted her, the woman has locked down all of her online accounts. She has also warned friends who commented on the photo in which she wears the anti-fascist shirt. “I’m annoyed because I’m going to have be paranoid about everything that I do for a while now, and annoyed because I haven’t even done that much to warrant a doxing, aside from probably just hurting the feelings of someone in the ‘alt-right,’ ” she said.

“I’m also terrified because they have my address, and it’s not just myself who’s at risk, but now also my parents who live here as well,” she told me.

Harassing a survivor of the Charlottesville terrorist attack

ON AUGUST 12,   Emily Gorcenski, a data scientist from Charlottesville, was walking with a group of counterprotesters   away   from Emancipation Park, where the hate groups were rallying. That’s when a high-speed car, driven by right-wing extremist James Alex Field Jr., plowed into the counterprotesters, killing Heather Heyer and injuring 19 others.

“I was there when the attack happened,” she   wrote   in an op-ed for The Guardian. “Despite the president deeming me — a transgender woman — unfit for military service, I ran toward the attacker with a weapon. I was ready to engage him if he tried to hurt more people.”

On August 17, NSJW posted a link to Gorcenski’s page on a website dedicated to discussing how best to troll victims (the website was not Pony Power), and said “Gorcenski was at the Cville rally, the torch march the night before as well.”

Twenty minutes later, the user “SleepingInRlyeh,” wrote, “Found Gorcenski’s power word (pre-tranny name).” And 15 minutes after that, he posted her home address, links to her website and social media profiles, and a photograph.

Gorcenski told me that she’s been dealing with harassment since well before the “Unite the Right” rally. In March or April, she says that users on the aforementioned website dedicated to trolling discovered the name she went by before Emily, and she sent me a screenshot of transphobic harassment on Twitter from July.

“As far as being a target goes, it sucks,” she told me. “These folks are evidently dangerous, as seen from the events of August 11 and 12. … At the same time, I am accustomed to online harassment and the more energy they pour into me, the less they spend on other folks.”

An armed neo-Confederate from Gainesville, Florida

A PONY POWER   user called “adolphus (not hitler)” was mostly a lurker, only posting a total of three messages on Pony Power. When another user “ox” posted dox on several alleged anti-fascists from Gainesville, Florida, adolphus responded, “Everything @ox is posting are all key figures in Gainesville antifa. I lost my job because of these faggots so any help is appreciated.” Later on, adolphus stated, “lost my job because I was at [the “Unite the Right” rally in Charlottesville] so I’ve got some scores to settle with my local antifa.”

All told, Pony Power users posted private information, including home addresses, on 10 alleged Gainesville antifa activists.

It’s not clear who is behind the adolphus account, but the case of Jim O’Brien, a 44-year-old man also from Gainesville, Florida (like adolphus), gives one example of the sort of alleged activity for which far-right activists were arrested during the rally. O’Brien was charged with carrying a concealed handgun. A few days later, he, like adolphus, was   fired   from his job, which in his case was at North American Roofing Services. “We do not support the extremist activities that were on display in Charlottesville, Va. over the weekend or any other similar activity,” a memo from his former company states. “We promote a culture of inclusion and diversity.”

According to Southern Poverty Law Center’s Hatewatch   blog , “Footage from the rally appears to show O’Brien, marching with the League of the South, punching a woman repeatedly in the face.” League of the South is a   pro-slavery , neo-Confederate   hate group .

The Intercept tried calling and messaging Jim O’Brien, but he did not respond. According to his   court documents , he’s not allowed to leave the state of Virginia until his case is resolved. His trial is scheduled for September 22.

Right-wing figures like O’Brien have been targeted by leftists for outing that in many ways resembles the doxing Pony Power conducted against anti-fascists. For example, opponents of neo-Nazis identified another far-right figure at the Charlottesville rally where O’Brien was arrested:   Peter Cvjetanovic,   who appeared bearing a torch at the University of Virginia march. Now that his fellow University of Nevada, Reno students know that Cvjetanovic is a self-described   white nationalist , they’ve pressured their school to expel him (university officials said they will not expel him, even though they “unequivocally reject” the views espoused during the rally), and he’s chosen to resign from his on-campus job to avoid trouble.

Anti-fascist activists also publicly identified   Cole White , another participant in the Charlottesville rally. Since he was outed, he has lost his job at Top Dog, a hot dog restaurant in Berkeley, California.

But there’s an important distinction between doxing by neo-Nazis and antifa. Neo-Nazis target nearly anyone who vocally disagrees with their political worldview — which essentially means anyone who isn’t a racist white person and is public about their views.

Antifa activists only target members of hate groups, a small but growing subset of American society that Trump refuses to condemn, responsible for mounting terrorist attacks against mosques, black churches, transgender women, and people of color.

“Confirmation that antifa is a Jewish organization”

MICHAEL NOVICK,   a 70-year-old retired school teacher who lives in the Los Angeles area, has been doing anti-fascist activism for over 50 years. In the 1960s, while studying political science at Brooklyn College, he was elected student body president. He was arrested and expelled from school when he, and dozens of others, staged a sit-in at the registrar’s office, demanding that they open admissions for black and Puerto Rican high school graduates. (He was eventually re-admitted and graduated the following year.)

In 1987, at the age of 40, he started the Los Angeles chapter of what would later become the activist group Anti-Racist Action, but only after spending “many decades fanning the sparks of resistance and particularly trying to encourage people of European descent like myself to break with and help uproot and overturn white supremacy and imperialism.”

Because Novick is one of the few people publicly associated with Anti-Racist Action, he has been “threatened many times over many years by various neo-Nazis and fascists.” Last February, when anti-feminist activist Milo Yiannopoulos’s scheduled talk at University of California, Berkeley sparked anti-fascist protests, Novick told me that he received “another spate of death threats,” including a threat to attack “the women in [his] life” — even though he wasn’t in Berkeley that day.

After users of the Pony Power chat server discovered that Novick ran several anti-fascist websites, they decided that he must be the leader of antifa. Albricht announced, “We have our lead guys.” They imagined an organizational chart of antifa, with Novick at the top. “Michael is behind what we know as the power structure,” Albricht said. “Let’s get some more info.”

A few minutes later, Albricht posted the dox, proclaiming “I am very certain he started the movement.”

And then Pony Power members stumbled upon what they considered a breakthrough, a YouTube video of Novick speaking at the 2011 Los Angeles Housing & Hunger Crisis Conference in which he says, “I’m of Jewish descent.” This was just the proof that the right-wing extremists needed. “We have confirmation that Antifa is a Jewish organization,” Albricht announced.

“Everybody has certainly always known I am Jewish,” Novick told me. “My father came to the U.S. in the early 30s as a teenager from Poland, and most of his family (many aunts, uncles and cousins) were wiped out by the Nazis either in Bialystok during a ghetto rebellion or in the camps.”

Back in Pony Power, excited about the group’s discovery, Albricht wrote: “Thank you! Now let’s tear these kikes apart!” Members immediately began spreading the idea that Novick, a Jew, was the leader of antifa, and they began making up an organizational chart of antifa that placed Novick at the top, with other antifa leaders reporting back to him.

“There is no antifa command structure. There is no organization antifa, so there is no organizational chart,” Novick told me. “Some antifa are Jewish. Hardly surprising, given the level of anti-Semitism displayed by the fascists and neo-Nazis.”

When I asked Novick how he felt being a target of a far-right harassment campaign, he assured me that he had support. “I am obviously not happy to be in their crosshairs,” he said, “but I have many comrades and colleagues locally and nationally who have and will continue to support and defend me and have been aware of the most recent and previous threats.”

Is doxing legal?

DURING THE COURSE   of doxing, Pony Power members became concerned that they were engaging in illegal activities, for example, by sending malicious links, such as the 22-year-old college student, to learn their victims’ IP addresses.

While IP tracking like this is simple to pull off, the technique itself is similar to a criminal hacker tactic called spearphishing, in which an attacker sends a message in hopes that the target will click a link and visit a site that tricks them into handing over login credentials.

Other techniques used by Pony Power members included querying domain name registration records, as well as DNS servers, which convert domain names into IP addresses.

Members of Pony Power were worried about violating the Computer Fraud and Abuse Act, a broad law frequently used to prosecute hackers, and about inviting criminal conspiracy charges. In one particularly lively discussion between Albricht and NSJW, they argue about exactly what laws they might be violating, and how wise it is to discuss it on a server where there might be infiltrators.

“You guys should NOT be talking about anything that violates the CFAA,” NSJW states. “You will get fucked on conspiracy charges quick if you’re not careful.

Albricht responded, “meh, if they were to raid this group, that would be the least of our worries seeing as doxxing is illegal.”

(It’s unclear why the Klaus Albricht’s name changed to “Klaus Schmidt” and his profile picture changed, but an examination of the chat logs show that this is the same user.)

“I don’t see anything here that would be a CFAA violation,” Nate Cardozo, senior staff attorney at the Electronic Frontier Foundation told me. “Using WHOIS, using historical DNS services, using reverse DNS … The closest thing that I can see to a CFAA violation would be the phishing, where they’re trying to collect IP addresses.”

While the Pony Power doxing doesn’t appear to be in violation of the CFAA, Cardozo left open the possibility that they were violating state harassment or cyberbullying laws.

“The CFAA is designed to criminalize hacking,” Cardozo said. “These guys aren’t hackers. They’re just trolls.