Early in 2015, Australian TV news journalist Elise Potaka noticed a Twitter user with the online alias Australi Witness, who was attracting attention from journalists and terrorism experts. Some of the media seemed to be quoting Australi Witness as if he were a genuine jihadi.
As someone who’d been following and talking to jihadis for some time, Potaka had a sense of the ideology. To her, there was something odd about the way Australi Witness presented: “I’d followed a lot of them on Twitter and … understood the language they would normally use.”
The now-suspended Twitter profile of Australi Witness claimed he used to work for Amnesty International. He also seemed to claim lawyer and anti-Islamophobia campaigner Mariam Veiszadeh was a friend. (This turned out to be untrue.)
To Potaka, this made no sense. Islamic State supporters hate Shias, and Veiszadeh is Shia Muslim, and “all of the ISIS guys are Sunni Muslim. So why would this Australi Witness, by all accounts an ISIS-supporting Australian, like Mariam?”
One of the people Potaka had interviewed for a documentary in 2014 was the young Perth-born Islamic preacher Junaid Thorne. In April 2015, Thorne let Potaka know via Facebook Messenger that someone had set up a fake Twitter account in his name. He warned her not to follow it.
With the instincts of a journalist, Potaka couldn’t help herself; she wanted to track down Thorne’s doppelgänger. She thought: “I’ll just have a little bit of fun, just to see if I can suss out what this weird impersonator is doing with this fake Junaid Thorne account. So,” Potaka tells me, “I sent a message [to the fake account] saying, “Do you remember what I said to you last time we met?” and I didn’t hear anything back.”
Over a few days, Thorne and Potaka kept chatting on Facebook Messenger about the oddness of Thorne finding himself with an impersonator. “And then suddenly … Junaid sends me a message mid chat. He says, ‘Why are you chatting to me from two Facebook accounts?’”
As if things couldn’t get any stranger, Thorne sent Potaka a screenshot of a fake Facebook account in her name.
When Potaka took a look at her own fake account, it was nothing but a shell containing her stolen profile photo. The account had no friends. It linked back to a single Facebook account, under the name of MoonMetropolis.
Bizarrely, the fake Elise Potaka Facebook account had sent the real Junaid Thorne Facebook account a message asking, “Do you remember what I said to you the last time we met?”
“This is how I linked the fake Junaid Thorne Twitter account to this person who was then impersonating me on Facebook,” Potaka explains.
# # #
Consumed with curiosity about the strange fake accounts, Potaka found MoonMetropolis on Twitter and started to chat with him. Following her journalistic instincts, she asked him all kinds of polite questions: Who are you? Why are you impersonating jihadists? What’s your interest in Junaid Thorne? Why did you set up a fake account?
“But in the back of my mind, I was like, ‘I am going to find out who you are’,” she says. She was far closer to the truth than she realized. In fact, she had already stumbled across the troll’s real name. But her assumption was: A troll partaking in such complex mimicry would surely cover his tracks. Whatever game he’s playing, he wouldn’t use his real name.
As Potaka probed further, she noticed MoonMetropolis kept mentioning the Twitter user Australi Witness as the supposed “TOP Australia-based ISIS Twitter account”. She quickly figured out MoonMetropolis was somehow connected to the Australi Witness Twitter account.
Another Twitter user sent Potaka a collation of screenshots linking MoonMetropolis to the Bornstein hoax [in which prominent Australian employment lawyer Josh Bornstein discovered someone posing as him had posted a racist opinion article on the website of the Jerusalem-based newspaper the Times of Israel, which led to him being trolled online, and receiving death threats inspired by Australi Witness].
One of those screenshots showed MoonMetropolis was the very first Twitter user to draw attention to the Times of Israel article. This tidbit seemed to be a dead giveaway.
“He [the hoaxer] was really not being that careful about what he was doing. The clues were all there in his tweets,” Potaka says. Given how dangerous the troll turned out to be, she’s at a loss to explain why authorities didn’t pick up on the evidence: “There were all these red flags, but they were just being overlooked.”
As an investigative journalist, Potaka wondered if there might be a story in all this but realized she couldn’t find the person behind the MoonMetropolis account by herself. She needed the assistance of someone with technical skills, someone who understood the murky water beneath the ice. She reached out to someone Bornstein describes as “Australia’s number-one troll hunter.” His name is Luke McMahon. The trolls aren’t even sure whether he’s a real person. But he is.
# # #
McMahon meets me at Melbourne University’s Law School wearing a black t-shirt and worn-out jeans. He’s got a five o’clock shadow and a resonant voice. Within seconds we’re chatting as if we’ve met dozens of times before. He leads me up a few floors and past a library jammed with legal books and a creepy modern painting of a judge with deep-set eyes. The mock court on this floor, where law students practice their future profession, is empty. We sit down.
“Do you see yourself as a troll hunter?” I ask.
“No, not really,” he says, fidgeting in his chair, “although other people might.”
In an email McMahon had already obliterated any presumptions. “I have really very little interest in trolling,” he wrote.
My main area of interest is the law. I just like solving complex puzzles and I really don’t like bullies. At the end of the day it boils down to a different way of looking at complex information and finding small details, or patterns, being obsessive, technically proficient and having a good understanding of human psychology. I don’t consider myself especially skilled.
To be precise, because troll hunting isn’t really a profession, McMahon is a journalist with a legal background.
“How do you find somebody?” I ask.
“What I’m looking for are things like giveaways. I’m looking for associations. I’m looking at what’s their motivation?" McMahon says. “Human beings are habitual. It’s a big problem for them because it makes finding them a lot easier." For example, he explains, if someone uses a handle on one platform they may well use the same handle in another location. Just like MoonMetropolis on Facebook and Twitter.
When McMahon read Potaka’s first detailed email explaining why she thought MoonMetropolis and Australi Witness were the same person, he knew straight away her analysis was sound. “For me it’s an intuition thing," he says, although he’s careful to explain that proving your intuition is an altogether different matter.
He was hooked. McMahon started sitting up until four or five in the morning for days and days, trying to solve the MoonMetropolis puzzle. “I mapped it out,” he says. “Trawling through tweets, through Facebook stuff, through everything, going through individual photos, eliminating profiles. People think hacking is some mystical skill … Actually it’s not. A lot of it’s social engineering stuff, like going through people’s garbage bins, a company’s garbage bins, looking for passwords and that kind of stuff.”
The troll McMahon and Potaka were hunting had numerous aliases on numerous platforms. “He would publish an article, like, under the name Tanya Cohen, which was one of his aliases, and it would get mad outrage. And then he’d tweet [about the article] from all his different accounts,” McMahon says. Then he’d also tweet numerous journalists about his articles, nagging them, “Have you seen this?”
Like Potaka, McMahon was determined to track the hoaxer down: “I was like, ‘If we’re going to get this guy, I’m going to confront him’.”
McMahon jumped right in. He started direct-messaging MoonMetropolis on Twitter, using the Twitter handle Media Direct. “I said to him, “How long are you going to keep this up?” I opened with a bang.”
Over many months, he developed a relationship of sorts with MoonMetropolis and gradually drew out information. “So originally I thought I was dealing with a Neo-Nazi because I knew that Michael Slay was his pseudonym on the Daily Stormer,” McMahon says. The Daily Stormer is the prominent Neo-Nazi website run by notorious internet troll weev, or Andrew Auernheimer, and Andrew Anglin.
But the troll then admitted to also being behind the fake ISIS Twitter account Australi Witness. He was a chameleon, constantly changing color to suit the issue of the day. “He was trolling all through the night and he never left his house. He told me he lived with his parents … [and] he never had any sort of social contacts with anyone,” McMahon says.
This lonely fact was confirmed by law enforcement later in the year as they surveilled the house where MoonMetropolis lived. Officers repeatedly “observed the shadow of a person moving around the inside of the residence … [and] were unable to observe anything beyond the shadow.”
“His thing was free speech,” McMahon says. “That’s why he targeted Josh Bornstein because Josh had written something about it and … was seen as anti–free speech.”
Free speech absolutism is something trolls of all stripes express repeatedly — with the irony being that their actions often result in the liberties of others being impeded. In her book "Hate Crimes in Cyberspace," Danielle Keats Citron notes that the “absolutist, almost religious devotion to free speech” should be weighed against “important interests that cyber harassment jeopardizes”.
“Because the Internet serves as people’s workplaces, professional networks, résumés, social clubs and zones of public conversation, it deserves the same protection as off-line speech. No more, no less,” she writes. She goes on to say it is possible to regulate speech that harms people and doesn’t make a valuable contribution to public debate.
# # #
The troll hunter explains to me that MoonMetropolis had learned to use paid social media ads from the troll weev. “I have logged conversations where weev discusses his imminent ban from Twitter and where MoonMetropolis requests advice about running Twitter ads to troll people,” McMahon says.
The impact of these ads only becomes obvious to me later, when I start to understand the harm MoonMetropolis caused not just online, but in real life. weev played a crucial part in this harm by teaching MoonMetropolis skills that he used to great and damaging effect.
McMahon sends me some of the screenshots: weev is indeed coaching MoonMetropolis on how to get around Twitter’s rules for paid ads, advising him, “You’re going to have to be very subtle.” There are also publicly accessible tweets sent from the MoonMetropolis Twitter account to weev’s now-defunct Twitter handle rabite, asking questions such as “What platforms don’t check ads?” and “How much does Facebook charge for ads?”
MoonMetropolis invited McMahon onto weev’s private chat server, which had the name NAQDI. McMahon sat there for months watching and listening. “What I was trying to ascertain or interpret was, who is this guy?,” he says, about MoonMetropolis. “Is he one of the crew? For a while I thought he might be weev or Andrew Anglin.”
When I spoke to weev on Skype in January 2018, he initially denied knowing MoonMetropolis but after a while conceded he was aware of him under a different name associated with the Daily Stormer. Still, weev wouldn’t admit to being in an IRC chat room with MoonMetropolis or having any specific conversations with him. In answer to my repeated questions, he retorted: “How many bullshit claims do I have to talk about?”
Meanwhile, McMahon tracked MoonMetropolis through various IRC chatrooms and acted as a fellow troll and troublemaker, while Potaka played good cop. She pretended to be the “naive journalist” who was simply “keeping in contact with him about things he posts”. The journalists were in constant contact with each other, spending hours on the phone and sharing information online so they could, in turn, elicit more information from MoonMetropolis. They were inching closer and closer.
# # #
Potaka had been investigating MoonMetropolis for about a month when, on 3 May 2015, two men wearing body armor attacked a security officer and a police officer outside the Curtis Culwell Center in Garland, Texas. The centre was showing an art exhibition that featured images of the prophet Muhammad. Shortly afterwards, the attackers, Elton Simpson and Nadir Soofi, were shot dead.
The attackers’ motivations could only be guessed at until, months later, in September 2015, the FBI filed a criminal complaint with the United States District Court, revealing Australi Witness had posted a map of the centre before the incident, urging anyone in the area to attack “with your weapons, bombs, or knives”. Simpson had used his own Twitter handle to retweet Australi Witness’ message. According to Special Agent William J. Berry, who lodged the criminal complaint, Australi Witness used a second Twitter handle to tweet, “I’M BACK KUFFAR! DIE IN YOUR RAGE!” Kuffar is a derogatory Arabic term used by Islamic extremists to refer to non-Muslims or non-believers.
Point 13 of the thirty-four-page document publishes, in full, a rant written by Australi Witness on the link-sharing website JustPaste.it a month after the Garland attack. In the post, he takes responsibility for “inspiring the attacks in Garland, Texas”.
Back in May 2015, when the Garland attack occurred, the Australian Federal Police (AFP) had only just started investigating Australi Witness. The two people who knew the most about Australi Witness were journalists Elise Potaka and Luke McMahon. As in so many stories about predator trolling and law enforcement, the police seemed baffled and missing in action. But with this case, their confusion and inaction seemed to increase acutely.
Meanwhile, the journalists were gathering intelligence at a rapid pace. Even so, it wasn’t enough: “We still didn’t know who he was,” Potaka says. “All we knew was that Australi Witness was possibly MoonMetropolis, but we didn’t … have enough information to know in the real world who was behind this and who orchestrated it.”
Finally, in June 2015, MoonMetropolis admitted to McMahon that he was Australi Witness. From that moment, the journalists’ investigation moved fast. Their project started to take on a sense of urgency: with the events in Garland still fresh, they started to wonder if he’d incite more terrorist attacks.
One night McMahon found a thread on Reddit: Australi Witness was discussing the flag of Orange Park, a town in Clay County, Florida. It clicked into place: This is where MoonMetropolis/Australi Witness lives. Then he uncovered an old dating profile on the website OkCupid belonging to the troll. It included a tiny photo and confirmed that he was located in Orange Park, Florida. Thereafter, he stumbled upon the piece of information he describes as “the tweet that got him”.
To anyone else, the Twitter exchange might have seemed innocuous. McMahon is not anyone else; he’s a troll hunter. He tells me what he found that day — and why it mattered: “He messaged somebody using his MoonMetropolis Twitter account. She’d made a comment that she was fat. He responded, ‘You’re not that fat.’ And she said, ‘Oh, no. Trust me. You haven’t seen me in a while.’” For McMahon, this was the vital piece of the puzzle. He actually knows this person in real life, he realised.
His next step was to comb through the woman’s social media: “After probably a month of … looking at all her social media and going through all her photos … I eventually got onto the sister [of MoonMetropolis].”
Meanwhile, Potaka had narrowed her search down to the same person, and the same location. “So, while Luke was tracing him down through the friend and located the sister’s profile — with a family photo that we could compare with his OkCupid photo — I looked up the electoral roll,” she says. She found the whole family’s US voter registrations. MoonMetropolis was a registered Democrat. Once they’d age-matched all the information about each family member, they had MoonMetropolis’ name and home address. Using Google Earth, Potaka and McMahon could even see the family’s backyard pool.
The terrorist troll was a Jewish-American man called Joshua Ryne Goldberg. At the time, he was twenty years old.
# # #
Excerpted with permission from "Troll Hunting: Inside the World of Online Hate and its Human Fallout" by Ginger Gorman, published by Hardie Grant.
Shares