Case Study: How a notorious spammer was brought down via Twitter
August 17, 2011 117 Comments
Today the Montreal Police announced that an arrest has been made (in French here) in the “Mabus” case. It wouldn’t have happened but for Twitter. This post explains how.
Twitter has been around for five years now, but there is still much confusion about what it is good for. How can you post anything useful in 140 characters? Isn’t it just people posting what they had for lunch? It’s a massive time waster. Those are typical complaints.
And yet there are several thousand self-proclaimed skeptics actively using Twitter quite effectively as a means of communication and organization. I quite like it myself. Unlike some complicated multi-purpose websites like Facebook, Twitter is dead simple. And you can do amazingly useful things with it.
“Like what?” you might ask. Well in the last week the science, journalism, skeptic and atheist communities on Twitter organized to pressure a law enforcement agency to take action on someone who has been a copious source of spam and death threats on the Internet for at least 15 years. Today’s arrest came about in under 10 days from the first moves.
I think the sequence of events of how this came together are quite interesting, and perhaps an object lesson in online activism. As it was happening I was capturing links to the relevant posts so I could document how it came about. Read on…
Setting the Stage
I really want to focus on the events of the last week, but to understand why so many people were so upset by this case, you have to know a bit of history, which goes back more than 15 years. This is not the story of an over-reaction to a garden variety troll. This person was the source of epic levels of spam, disruption and threats since the mid 1990s.
I’ll try to keep it as short as I can. If you are already familiar with the Mabus story, click here to jump to the end where I tell you about the events of last week.
If you are not familiar with David Mabus, do read through as it is a very interesting story and a pretty quick read. Up until now many of the details have been scattered across numerous blog posts.
Table of Contents
- Background: David Mabus
- And Mabus Twittered
- The Threats
- Finding The Person Behind Mabus
- The Beginning of an Obsession
- The Complaints
- The End Came in August
Background: David Mabus
Skeptic and atheist webmasters, forum moderators and bloggers have known for some time of a character by the name David Mabus. He would appear periodically to post long-winded rants as forum or blog comments, or to make various rude threats. His posts would be deleted, his accounts banned, and he’d disappear for a while. Lather, rinse, repeat.
The name Mabus comes from the prophecies of Nostradamus. Believers in Nostradamus claim it is the name of the anti-Christ. Many of the earlier posts from this person would mention Nostradamus, sometimes claiming that he should have won the prize from James Randi‘s Million Dollar Challenge (MDC) and berating Randi for not awarding it.
I only became aware of him in 2008, but better known skeptics have known of him far longer. In a 2008 post James Randi recounts how Mabus made an incorrect prediction of nuclear war back in 1997. And PZ Myers says he has been getting messages from him on a daily basis since 1993. Many of these messages contain quite dire threats. In September 2009 PZ gathered up the threats sent in one evening and printed them out to show them to the police. Even in small print they came to 61 pages. The police were stunned.
In the last few years as skeptic activity on the internet increased, “Mabus” widened his target list. If you put up a blog or site, and your email address was publicly known, eventually you’d start to get the emails from him. These emails would contain rants similar or identical to whatever he was posting to blogs and forums at the time, and would usually be carbon copied to a litany of famous skeptics including James Randi, PZ Myers, Michael Shermer and so on. (Some skeptics, flattered to see themselves listed in such company, would sometimes sheepishly admit to thinking they had “made it” as a skeptic upon receiving their first Mabus email, despite the threatening nature of these messages).
Much of what he posts gets deleted for being off topic, threatening or just plain incomprehensible. And yet all over the net, on various sorts of sites, random flotsam and jetsam of his posts still survives. It’s like the digital version of someone constantly driving around town hurling leaflets out his car window, not caring if anyone ever picks them up.
The emails never made all that much sense, but gradually they seemed to decay even further. I thought about quoting two of them here, but there is no real point. Suffice it to say they started out as semi-coherent rants about Randi or about atheism, and gradually declined to mere shouting. This decay was the first red flag for many of us.
Red flag number two came last October 1st when he showed up at an atheist convention where PZ Myers was speaking and Tessa Brown took his picture. Most Internet trolls would never dream of personally confronting their targets. The fact that he did this set him apart.
And Mabus Twittered
Mabus had apparently toyed with Twitter before. During The Amazing Meeting 7 in July 2009, he set up an account named @davidmabus (naturally enough) and sent some taunts, typically mentioning the JREF MDC. Later that year and the next there is evidence he set up some other accounts but did nothing with them.
But in January he started a Twitter campaign of epic proportions. Because posts on Twitter are by default public, and anyone can send a reply to anyone simply by typing the “@” character appropriately, it is ideally suited for Mabus’ brand of harassment. The 140-character limit of Twitter is not well suited to long-winded rants, but he quickly discovered that you can compensate for that by including a hyperlink.
He began sending links, over and over, to any and all skeptics or atheists he could find on Twitter. Early on the links led to a YouTube of Depeche Mode‘s music video for “Enjoy the Silence” (the one shot on top of the World Trade Center). I’ll explain the significance of this later, but the video had titles added to it which threatened atheists. Later Twitter posts dropped the YouTube link and switched to links to forum posts of the same sort of rants he had been posting all along.
THE AMERICAN REVOLUTION – JAN 1, 2011
David Mabus (@orobotsx) January 20, 2011
(A post from early in his Twitter campaign – the YouTube link no longer leads to the video it did at the time).
His posts changed from time to time. He would switch URLs when his manifestos were inevitably deleted and he would switch taglines. Early on he used the phrases “clobbering time” and “the end of atheism”.
Some of the taglines didn’t make much sense and became the subject of nervous joking by threatened skeptics. In February he started exhorting people to look into the cornfield, and his manifesto included a photo of a scarecrow (see below). And one of the most famous lines in his emails literally said “GOATS ON FIRE….”
Some tweets were directed at a single person, but a majority included several @ mentions to spam multiple people at once. (He’s nothing if not efficient). Sometimes he would scan down the Twitter page of a particular user and reply to every single post he saw. Sometimes he would search for PZ Myers’ name or his own name and reply to what he saw. Other times he would pick people out of the blue to harass.
Naturally people would use the block function on Twitter on him when he appeared. When enough people block an account quickly enough on Twitter, the account itself is suspended. But this rarely slowed down Mabus very much. He would create another account and continue.
The volume was stunning and the rate was obsessive, to say the very least. Until the end of February, I tracked what what he was posting on Twitter pretty closely, using the BackTweets service to locate his (often long-deleted) posts via the URL he was using on a given day. In five weeks he went through over 330 Twitter accounts.
Near as I can tell, all this posting was done by hand. The posts would be marked as having come from the Twitter web site, and there is no evidence that he was using a script or a robot to do the work for him. He would just sit there and cut and paste.
He would spend hours at it. For example, on February 25th I found 25 separate accounts he used. Based on the timestamps of the posts, he started around 7:30am, and posted more or less continuously until about 10am. He continued somewhat more slowly until noon, when I presume he took a break for lunch. He resumed at 3pm, and posted until 9pm that night. I counted almost 700 tweets. And because of the way Twitter was deleting each account (and all its output) when they noticed the spamming, all of that output from that day was gone within minutes. Disappeared.
And that was part of the problem. He would post hundreds and hundreds of spams, such as this one above. But mixed in with endless repetitions of that sort of thing, would come the direct confrontations and threats. Here is a relatively tame one directed at me that also still survives on Twitter:
Even just the endless hitting of to the Twitter block button itself got tiring when you have to do it 25 times a day because of changing account names. This led me to write an epic how-to blog (including a demonstration video) on using the filtering functionality of Twitter clients to block Mabus using his URLs.
As this story has played out, I’ve seen a few bloggers minimize the nature of the threats. That one above isn’t that bad, after all. Some view a certain degree of this to be part of the wild, anything goes nature of the Internet. I don’t entirely disagree – you have to have a thick skin if you are involved in discussions on the net.
But let me assure you, Mabus’ threats go way beyond the norm, both in content and sheer volume. I talked about the volume above, so let’s see some of the content.
He tells people they are going to die that day or “cease to exist”. He threatens executions. He uses offensive terms starting with “bitch” and getting far worse. He threatens people’s loved ones, such as this one from February 10:
He threatens to cut off people’s heads and tells them they are “finished.” He asks people if they think they “deserve to live”. He says he is going to “pound you into the dust” and that you will suffer the “worst form of torture.” Here’s one threat directed at Michael Shermer from April 18:
He doesn’t limit his threats to well known public figures like Myers or Shermer. He’s even threatened young adults directly. Here’s one of several threats directed at a teenage boy in Wales, Rhys Morgan:
And finally, here’s a particularly nice one directed at me just a few weeks ago:
These are but samples. There are hundreds and hundreds more.
Because of the rules violations of the accounts, the threats would disappear along with the spam. So if you weren’t alert and ready to take a screen shot, these threats would disappear. I collected the ones I saw in time.
I managed to capture about 60 threats to me and about 30 to other people, but I know hundreds of Twitter users were affected by this. Some of the others who collected screen shots and posted them publicly are Heather Henderson and Martin S. Pribble.
In encourage you to click those links and see more. It was a truly sick campaign that went on for more than six months. And the threats were clearly violations of the law.
Finding The Person Behind Mabus
So, how did we put a name to the threats, to even know which police department to call? It was easier than you might expect.
If Mabus had truly wanted to remain anonymous, there are tools and methods to accomplish that quite effectively. Fortunately for us (and unfortunately for him) Mabus didn’t seem to be aware of many of these methods. In fact, he seemed technically inept sometimes. The hilariously awkward titles on his Depeche Mode video hint at this – they were created by screen-capturing a scrolling Microsoft Word window, toolbars and all!
He did do two simple things that helped him a bit. He used throwaway email accounts on free webmail services to send many (but not all) of the email spams over the years. And when posting his rants (and, I presume, while on Twitter) he would connect to the Internet using the free WiFi provided at internet cafes, hotel lobbies and college libraries at various locations around Montreal. That made it harder to tie the posts to a particular person such as through an ISP.
In many of the articles to which I link, Mabus’ real name is freely mentioned. This is because Mabus was never too careful about concealing it in his online postings. If I hadn’t already seen his real name in that 2008 post by James Randi, all I had to do was wait. The fifth email he sent me, on May 27, 2009, had his real name in his return address, next to the throwaway email account firstname.lastname@example.org. (More evidence of his technical ineptitude).
Once we know his name, and the fact that he posts from Montreal (which the IP addresses on his emails tell us), we can proceed quite quickly. For instance, there are only three publicly listed phone numbers for that last name in Montreal. One of them turns out to be his mom. (Please don’t try to call her, if what she says in this article are accurate quotes, clearly there is no point).
PZ mentioned that Mabus was active on Usenet news years ago, so Google Groups can be used to find his earliest posts. (Be sure to restrict your search to years prior to 2005 or so or else you’ll find much recent discussion of his activities and not much of his own posts).
You can easily find evidence that he has been spamming since 1995 – but in those days it was advertising for various stereo and computer stores he worked for. If you trace through those computer store ads, you eventually come to the one he apparently worked for until very recently. Looking up that store’s domain names in WHOIS will lead you back to the telephone listing for his mom.
One quite frightening thing you can find in Google Groups is him expressing an interest in making a bomb in 1995 and using it to blow up government buildings.
The Beginning of an Obsession
But the most interesting stuff pops up if you add Nostradamus to the search.
It is here that you finally learn the reason for both the name “David Mabus” and his fascination with Depeche Mode. The answer is in Nostradamus’ Quatrain 8,66:
When the inscription 500 A.D. is revealed
Quand l’enscriture D.M. trouvee
In an ancient cave, illuminated by a lamp,
En cave antique a lampe discouverte,
The law, King, & Prince by Roman law are examined,
Loi, Roy, & Prince Ulpian esprouvee,
The House of the Queen & the Duke are overshadowed.
Pavillon Royne & Duc sous la couvert.
The original French is in italics, as you can see a date is represented as “D.M.” in the French. But if you read that Usenet conversation, it appears Mabus somehow became convinced that “D.M.” were actually a set of initials. “D.M.” are his real-life initials, as well that of his nom-de-plume. And in his efforts to find other things they might match, he found Depeche Mode as well.
Seven years later when 9-11 happened, and some people claimed Nostradamus had predicted it, Mabus no doubt flashed back to that Depeche Mode video that was filmed at the top of the World Trade Center. He would at various points make claims that Nostradamus or himself had predicted the 9-11 attacks. It was no doubt all downhill from there.
You can see how all this old research is completely consistent with what we know about the current Mabus. It all fits together.
(In retrospect, when I said I’d try to keep it short I was beyond optimistic. Ah well).
As documented above, Mabus Twitter campaign had him threatening and annoying many hundreds more people than he had ever affected before. When the threats started coming quite rapidly, this led to calls for him to be arrested and so on.
I got some particularly nasty threats early on, and started searching for the appropriate way to complain. Knowing he was in Montreal and even having an address and phone number for his family, I figured the local police in Montreal would be the natural choice. They seemed unwilling to take my call. When I finally did get an answer from them, they said I had to complain to my local police department. Fair enough, my local police can verify my identity more easily, after all.
And so on a Saturday in January, I killed one whole afternoon at my local Atlanta Police zone office filling out paperwork with a detective. She told me I could get a copy of the incident report within a few days at another office.
Others did the same thing. Phil Plait gave a report to a sheriff by telephone. Michael Shermer told me he obtained a restraining order to ensure Mabus would stay clear of him. Canadian skeptic Steve Thoms and blogger Greg Laden also filed reports. There are no doubt others.
On February 10, 2011 I was finally able to get a copy of my report from yet another Atlanta Police office across town. I quickly took it to a local print shop and faxed it to the Montreal Police.
And nothing happened. For me or for anyone else.
But the threats continued. If anything, they accelerated day by day. Even when people mentioned contacting the police, Mabus mostly scoffed as you can see above.
The End Came in August
And now we come to the part of the story I really wanted to tell. Many of us knew that getting the local Montreal press involved in the story might be a key to spurring the police into action. Back in February I had attempted to make this happen with this tweet:
By @ mentioning several Montreal journalists, not only was I soliciting a reply from those journalists, but knowing Mabus’ M.O. I expected him to include those journalists in his spams (and perhaps his threats), letting them experience it up close.
As you can see at right, that did happen. In subsequent days I was able to contact one journalist at CTV Montreal, but he was unsuccessful in getting his editors interested in the Mabus story. It was a dead end.
As it turned out, I had the exactly right idea, but simply picked the wrong journalists.
Monday, August 8, 2011
On the morning of August 8 he was monitoring Twitter as part of his job. He noticed this retweet by science writer Carl Zimmer:
Since he talks with scientists online all the time, he had seen some of the Mabus posts before. He dug a little bit and found this hashtagged tweet by Heather Henderson, (a singer and atheist podcaster who had performed at TAM last month). It was posted the day before:
His curiosity was piqued. Was this Mabus more than just a spammer or troll? So he asked a question publicly about the situation, and this was what transpired:
William Raillant (@wraillantclark) August 08, 2011
As a press atttaché, he is connected in the Montreal press community. He knew that if he got the right journalists interested in the story and they wrote about it, something would happen. So he did some more research online using Twitter.
William Raillant (@wraillantclark) August 08, 2011
Canadian Twitter user @Inrideo was part of that conversation as you can see. When he had attempted to report Mabus to the RCMP previously, he had contacted me for additional evidence and information. So around noon on August 8, he contacted me via Twitter to point out that Clark was planning an article. This was key, because since I was not following Clark, I hadn’t seen any of the conversation above.
The Montreal Police have a Twitter account (@SPVM) and they did take notice of the conversation. They sent this message:
The fact that they included their email address will become important in a moment.
I emailed Clark with reams of details about the history of David Mabus, similar to the introductory sections of this blog. Heather Henderson volunteered her screen shots. Clark set to work on a post and making phone calls.
The result was this Tumblr post, which appeared in the late afternoon of August 8: Police Pontificate as Montrealer Threatens to Murder Science Journalists.
Clark tweeted it and I quickly followed:
#Montreal man threatens to murder #science journalists, @SPVM & @RCMPGRCPolice do nothing rwrc.tumblr.com/post/866018634… mabus #media #quebec #canada—
William Raillant (@wraillantclark) August 08, 2011
PZ Myers’ doubting notwithstanding, BackTweets says the post was retweeted over 174 times in the next week. According to a competing service WhoTweetedMe, the post was retweeted over 291 times and potentially reached up to 10,000 different people. (Clark reported on Thursday that the post had been viewed almost 14,000 times).
Tuesday, August 9, 2011
Remember those two tweets above which contained email addresses? Mabus, noticing that Clark had been conversing with @pzmyers, did what he often does – he spammed. Clark got a copy of Mabus’ usual threatening manifesto via email in the middle of the night.
I got a copy of this email too, as did the Montreal Police themselves since they were part of the conversation. Yes, you read that right – Mabus sent one of his threatening emails directly to the Montreal Police.
I don’t know what Montreal Police’s reaction to that first email was, but those of us who have been getting them all along are a bit jaded by now. We rarely read more than the first few lines, if at all.
But Clark had never received one before! He read it with fresh eyes, and he was shocked by what he saw. He knew what he had to do. He needed to contact the Montreal Police himself. Because he is a local resident, they had to pay attention to him.
By that afternoon, there was a public indication that SPVM was on the case:
Kyle saw those tweets with the emails in them, and knew he had a potential tool right at his fingertips. He created a petition titled “Montreal Police: Take “Mabus” death threats seriously” and configured it to send responses directly to the SPVM public email address (which we saw above).
He, of course tweeted about it to get the ball rolling:
And he made sure to thank people as they signed it, to keep excitement high:
According to BackTweets it was retweeted over 500 times. The competing service WhoTweetedMe comes up with approximately the same numbers, and estimates that an astonishing 450,000 people could have seen those tweets! That’s huge.
That evening, hundreds of people signed the petition. Every one of those sent an email to SPVM.
Wednesday, August 10, 2011
On the morning of the 10th, the Montreal Police cried “Oncle!” with this Tweet:
Please stop sendind e-mails to our media adresse by signinig the petition.We are investigating the case. Thank you fou your help.—
Police Montréal (@SPVM) August 10, 2011
Seeing all this activity and discussion of him online, Mabus was as active as he has ever been during this period. He posted a new version of his manifesto to Google Groups, and was spamming it to anyone and everyone, with copies to @SPVM! (Because of BackTweet’s freemium business model, that link might not show much if you are reading this at or after the end of August 2011).
Kyle VanderBeek became one of Mabus’ targets and he started receiving Mabus threats and spam too.
We felt like we were almost there! But remember I said William Raillant-Clark had press contacts? Those started to pay off on August 10. In the afternoon, I got phone calls from two different reporters and from the SPVM detective assigned to the Mabus case! (One of the reporters suggested to me that the detective called me because he had just called her, but I have no way of verifying that).
The reporter calls would pay off the next day.
Thursday, August 11, 2011
On Thursday the mainstream media went with the Mabus story. First La Presse (the largest French-language newspaper in Canada) posted their story, titled “Die, Atheists, Die!” (Here is a Google translated version of that story in English). This was shortly followed by the Montreal Gazette, whose story is titled “Montreal police start probe of Twitter threats“. I am quoted in both of those stories.
Press coverage continued through the day as the wire services noticed the story and distributed it to papers all over Canada. Here is one from the Toronto Sun titled “Montreal cops probe Internet death threats” for which I was interviewed during the day on Thursday.
And finally, TV. William Raillant-Clark figures prominently in this report (and other versions of it) hitting the CBC evening news that night:
There are other stories as well. One of my favorites was this late-night follow up from the Montreal Gazette entitled “Montreal police goaded into investigating cyber-crank.” I like it because it coins the phrase “truculent cyber-crank” and because its original headline (still visible in the URL) was “Montreal police spammed into submission.” Spamming undid the spammer.
Naturally I can’t give too many details about what was going on off Twitter, but during this period I spoke with the SPVM detective several times, and provided all sorts of evidence in the form of archived emails, screen shots, IP address traces and so on. I also helped find other people who had reported Mabus to the police and get them the detective’s contact info.
But on Thursday evening, something odd happened.
Mabus went silent. One last email was sent around 9:57pm Eastern time. And then, a series of apologies appeared.
@Inrideo and finally u - lest we forget - we apologize for any threats.we would never hurt you. we want you to wise up on the atheist issue—
johnhogu44994 (@davemabus434222) August 12, 2011
Nothing has been heard from Mabus since.
Monday, August 15, 2011
SPVM officially announced that a case had been opened regarding Mabus and investigators were on the case:
Tuesday, August 16, 2011
Mabus is arrested, I was told privately by the detective.
Today, Wednesday, August 17, 2011
SPVM announces the arrest on Twitter:
Update August 18, 8:18am EDT: This news story confirms that the petition was key to getting the police moving, they doubted the seriousness of William Raillant-Clark’s complaint at first.
Update August 19, 5:18pm EDT: Mabus appeared in court on Friday and now faces 16 charges. He was ordered to undergo a 30-day psychological evaluation, and will appear in court again on September 19.
Update June 1, 2012: On Tuesday, May 22 Dennis Markuze pled guilty to 8 counts of making threats and received an 18 month suspended sentence.
Update November 20, 2012: Markuze has once again been arrested.
Twitter can be a excellent medium to organize people across time zones and countries to achieve a specific activism goal. Other actions (petitions, emails, official complaints, mainstream press attention) may be required as part of the campaign, but Twitter can be the kickoff point.
People had used blogging and direct contact of the police for years to attempt to get some closure in the Mabus case, to no avail. Harnessing the power of a large number of Twitter users, through the interlocking networks of different people, was key.
A few Twitter tips or “best practices” emerge from how this story went down:
- The default public nature of Twitter posts is key – it allows people who don’t know you to notice your posts
- Hashtags (like #montreal) can serve to get attention of those who may not follow you
- Retweets work to get the word out
- @ Mentions help call content to the attention of people who wouldn’t have seen it
- Persistence is key – if I had stuck with my idea of contacting journalists, this would have happened months earlier
- If you’re trying to get someone’s attention, give them something they want. (Mabus likes to email, two of the posts contained email addresses).
- Being a pack rat can be useful – all the screen shots and other stuff I collected about Mabus in February were a gold mine.
- Petitions can work, when properly targeted!
This post has been wildly popular, I hope you enjoyed it. If you would like to show your appreciation, then use the link below to purchase something for yourself or a loved one at Amazon.com. I receive a small commission and you pay nothing extra. Thank you.
Thank you to @wraillantclark, @kvbeek, @HeatherHenderso, @Inrideo and the many other folks on Twitter who contributed to this story through their actions. Without them, we’d all still be deleting Mabus posts and wondering what he was going to do next.
Oh, and you can follow me on Twitter here.