Last Friday, January 9, at 11:50 PM, someone tried to "swat" Seattle web developer Israel "Izzy" Galvez—a false anonymous tip phoned into the police, in the hopes that they would raid his home. Galvez's crime was to have criticized GamerGate, the loose reactionary movement of hardcore gamers. The anonymous tipster's effort was thwarted, however, as Galvez had already warned the local police. He had seen the users coordinating their efforts on /baphomet/.
/baphomet/, operated by Benjamin "Benjikins" Biddix, is a board on Fredrick "Hotwheels" Brennan's anonymous imageboard site 8chan, also occasionally known as Infinitechan. 8chan, one of many imitators of flagship English-language imageboard 4chan, emerged from obscurity when it became one of GamerGate's main discussion hubs. Its /baphomet/ board has organized at least three swattings in two weeks, targeting not only Galvez but also the former home of Grace Lynn, a game developer and outspoken critic of GamerGate, and Ashley Lynch, a film and television editor who merely happened to be following critics of GamerGate on Twitter.
Raiders often gloat about trying to drive their targets to suicide with harassment.
/baphomet/ is an invasion board, in a tradition originating on—but now banned from—4chan's infamous /b/ "Random" board. It shares the origins and some of the tactics of Anonymous "operations" like Project Chanology, but not their taste for activism.
Instead, their users scorn such "moralfags" and prefer to harass "lolcows", people who react vocally to harassment. The goal is to antagonize their targets into responding. That response, be it retreat, fear, or defiance, "generates lulz", feeding into the raiders' mean-spirited sense of humor. These tactics have been refined and collected over the past decade in various anonymously-authored and self-published guides imitative of the original Anarchist Cookbook. Many of the tactics are out of date, fanciful, or obvious jokes. Skim off the dross, however, and these guides describe how to collect and exploit "doxx", or personal information, on targets.
"Ruin life tactics are essential to know in order to push any unstable target to things which makes the attacker(s) piss themselves with glee."
Doxxing (also described as digging, to distinguish the process of collecting information from the act of posting it publicly) involves tracking all of the footprints people leave behind on the internet. Master hackers these are not: the key tools are Google and enough free time to scour public records. Doxxers will search name/address/phone number databases, social media accounts, forum posts, web registrar information and whois searches, archives of old websites, and anything else that may contain public traces they can put together.
If your real name is available online, if you reused any account names on different services, if you reused an email address on multiple sites, if your IP address was ever publicly exposed, or even if you used the same avatar image or photograph on multiple sites, it may be possible to piece together enough to reveal further details such as home addresses, phone numbers, re-used passwords and other critical personal information.
If you know in advance that you might be targeted, there are measures you can take to improve your anonymity, but oftentimes there's nothing at all that can be done, especially if you conduct your business on the internet.
Raiders often use this as justification for their activities: if you didn't want your entire life collated and archived, why did you post any of that online in the first place? It's a disingenuous argument, however, because they aren't concerned about accuracy. If your doxx happens to have inaccurate information, who cares? False claims can prompt a correction that reveals more clues to add to the doxx, or just a entertainingly outraged response from a target.
/baphomet/ users post the doxx of a journalist covering the recent swatting of GamerGate critics. The redacted information in the second post is the journalist's address; the third post is a picture of the home at that address.
Once the documents are found, it's archived on sites that won't respond to takedown requests from victims. It isn't illegal, in most places, to post individuals' personal and public information online—after all, that's where it came from. Usually, this is on pastebin-style sites (although pastebin.com itself removes personally-identifying information on request) or automated archives of anonymous imageboards.
One notable venue is Encyclopedia Dramatica, and it is the epitome of the "lulz before accuracy" approach. Originally created in 2004 by Sherrod "girlvinyl" DeGrippo as a way of satirically documenting the emergent culture of the Livejournal online journal service, it gradually became toxic, devoting more and more content to shocking, defaming, and intimidating its subjects.
Having an ED article on you means that the page will be filled top to bottom with smears against you or anyone who shares the same name as you, mixed in with hateful slurs against your ethnicity, religion, or (real or perceived) deviation from the sexual norm. It's now a microcosm of the lifespan of raid communities. girlvinyl eventually became fed up with the toxicity of ED, and tried to force out the toxic elements and rebrand the site as Oh Internet!, with a focus on archiving internet memes, similar to Urban Dictionary or KnowYourMeme. New administrators reconstructed the site from an archive of the earlier content, however, and it survives to this day in this form.
Raid communities, and the boards they inhabit, go through a similar life cycle. Raiders tend to gather on sites—particularly anonymous imageboards—that are either poorly-moderated or operated by sympathetic administrators.
For example, /baphomet/ operates with the complicity of 8chan's owner, who acknowledges the potential for harm to its targets, but nevertheless implemented features to protect /baphomet/ from attempts to disrupt discussion.
Brennan has even participated in the doxxing of critics: when Cloudflare passed along the names and email addresses of people who reported 8chan for hosting child pornography, Brennan posted them, and baselessly accused them of participating in a denial of service attack to take the site down.
Through 8chan, /baphomet/ has a symbiotic relationship with GamerGate, just as raiders in general have a symbiotic relationship with anonymous imageboards and their users. 8chan hosts both one of the main discussion forums for GamerGate and /baphomet/, but the fact that posters are anonymous means that there's no way to tell how many users use both. Anyone who says they're "from" one board or the other could easily be lying.
Raiders fancy themselves bomb-throwing anarchists, and enjoy not only the damage they themselves do, but the damage they bring to others by association. Causing confusion and angering GamerGaters with perceived false accusations is itself "lulz". Some GamerGaters make a point of publicly denouncing /baphomet/ and the harassment tactics associated with it.
That said, GamerGate and /baphomet/ work in tandem. GamerGate identifies targets for defamation, such as people—usually women—in the video game industry who criticize GamerGate or violate its nebulous and idiosyncratic principles of journalistic ethics. GamerGate already digs up personal information to smear its targets and critics, so its tactics frequently overlap with /baphomet/'s.
Where /baphomet/ in particular (and raiders in general) diverge is how they use the doxx once they're collected. GamerGate — at least the visible parts of it — is engaged in a public culture war, smearing their targets with embarrassing half-truths or defamation. Raiders, however, just want to make people miserable, and to laugh at their misery.
Here, PressFartToContinue, at one point the most retweeted supporter of GamerGate on Twitter, posts a picture of game developer Brianna Wu's house on Twitter. This account remained on Twitter until December 23. He returned on a new account a day later, has since reposted the home addresses of game developers on Twitter.
Once you've been doxxed, raiders can antagonize you three basic ways. First, they can simply announce that they have your personal information. Called "dropping doxx", this carries an implicit threat: "I know where you live." Despite this, anonymity or a thin pretext is sufficient shield for the raider against consequences. While it's intimidating and hostile to post pictures of someone's home, it is not necessarily a threat. Sometimes, it won't even get you banned from Twitter, which has not done a good job of responding to explicit threats, either.
Once your doxx have been dropped, the harassment can begin.
Harassers flood email with threats and hateful garbage. They can call on the phone at all hours with threatening, insulting or merely obnoxious messages. Standup comedian Brock Wilbur described his experience with this harassment as a result of GamerGate posting his personal information, despite his lack of involvement in the game industry. People have camped out near someone's home or workplace and sent packages.
Physical threats are usually empty, but must still be taken seriously. The alleged strangler of Amber Coplin posted pictures of her corpse on 4chan.
Here, /baphomet/ users discuss the possibility of hiring a hitman to get revenge on someone. They likely aren't serious. (An unrelated post was omitted from this screenshot.)
The escalation can also extend to fraud, using your personal information to impersonate or implicate you. This is unlikely to rise to the level of identity theft, as bank accounts, government programs and the like are relatively secure, and such crimes more likely to generate a law enforcement response. Instead, it's fake pizza delivery orders, COD mail orders (often for embarrassing, expensive items like custom sex toys), magazine subscriptions, etc. It's possible to defend against this simply by not accepting the items; companies that bill on delivery are generally liable for their own failure to screen out bad faith orders. If you don't want an anchovy pizza, a sex toy shaped like a tentacle, or a subscription to Playgirl, you don't have to accept it or pay for it.
The most conspicuous and most dangerous escalation is swatting—when raiders call in a false, anonymous tip to the police. Raiders rationalize this as an object lesson in the danger of police militarization: the fault is that of the SWAT team kicking down your door on a flimsy pretext, not theirs for calling in a false tip. Luckily, if you're forewarned, this is easy to protect against. By calling your local police department's non-emergency number, you can warn them that someone may call in a false tip on you. If an attempted swatting does happen, the police will still need to pay you a visit, but this way it's more likely to be a polite one.
The internet has entered our lives: it's no longer a a virtual world where nothing is real. It's a tool that people use every day to stay in contact with their friends and family and conduct business. And this integration of the internet with our lives—and the trails we leave as we use it—has become a new weapon for the hateful and bored to lash out.
Until the law and internet services catch up to what's needed to protect people, the best protection is being aware of what constitutes a threat—and what you can expect to happen after you receive one.
Further reading
- justdelete.me, a collection of short how-to guides for deleting your information from many common websites.
- "Will the Internet Ever Be Safe For Women?", by Samantha Allen in Daily Beast. On the failure of social media companies to protect their users from harassment.
- "Game Changer", by Katherine Cross in Bitch Magazine. How the false internet/IRL dichotomy normalizes harassment.
- "Meet the divisive blogger who says he outed Rolling Stone's 'Jackie'", by Terrence McCoy in Washington Post. On how Chuck C. Johnson turned doxxing and threatening his political opponents into a business.
- "Doxxing Day", by Dan Olson. How to prepare for and soften the blow of many of the most common doxxing tactics.
- "/baphomet/, 8chan's Black Board", by Zoe Quinn and myself. A collection of /baphomet/'s excesses, including planning doxxing, threats, harassment, and outright violence.
Correction
• An earlier version of this article incorrectly referred to Sherrod DeGrippo as co-founding LiveJournal, and to spree killer Elliot Roger as having posted on Wizardchan.
