Scripted, automated troll posts via botnets – welfare opponents running scared

My blog has been attracting trolls recently. Or more likely, I suspect, one troll. They comment most days on my latest blog post under various different names, using a different email address and from a different IP address each time.

Despite the different names, email addresses and IP addresses each time there are consistencies that betray a connection. The domain name of the email addresses are always either that of a throwaway email address provider or a large website. Mostly not an major email provider.) The first part of the email address is often five characters starting with “n”. The name is usually a short form of a male name such as bob, dan, matt, fred, and often has a number like dan 50. They always post the same kind of message – that people won’t work because they’re better off on benefits, that Britain is broke, that British people are lazy and that’s why foreigners have taken all the jobs, that I’m a scrounger. Sometimes they post a link to the daily mail.

You can probably agree that I have reason to suspect this is all the same person. But more than that, I wonder if this person is using an online persona management service like that known to have been requested by various US government agencies, and produced by HBGary among others and sold to governments and corporates. This kind of service and software allows one operator to handle dozens of identities which are used to leave comments anywhere their employer wants a message promoted. It is used to give the impression that there is a lot of disagreement with an idea, or to try to discredit someone by pretending to prove them wrong or just calling their ideas into question. This software is known to exist because one of the companies that make it was hacked in 2011 and had their communications published. A request for this kind of service by a US government agency was also published openly, possibly accidentally on a website for suppliers of services to governments.

Daily Kos writes:

“According to an embedded MS Word document found in one of the HBGary emails, it involvescreating an army of sockpuppets, with sophisticated “persona management” software that allows a small team of only a few people to appear to be many, while keeping the personas from accidentally cross-contaminating each other. Then, to top it off, the team can actually automate some functions so one persona can appear to be an entire Brooks Brothers riot online.”

Who would use this kind of service? And why would they bother with me? I think there are a fair few interested parties who would want to discredit my message about welfare and benefits. Big insurance companies, for one, and companies involved in administering benefits now and in the future. Various think tanks too. We know that insurance company UNUM has been “advising” government for years, and has actually boasted in writing that they influenced welfare policy. Atos has an interest in taking a cut for assessing people. I’m not claiming that any organisation has done this, but these are exactly the kind of customer that persona management services are marketed to.

I don’t think this is paranoia on my part, it’s just an idea I’m pondering. I’m still not sure if my troll is a lone person or several. I’m not claiming to be stalked by the military, I’m talking about software that is sold to military, government agencies, and corporates alike. I’m not talking about being targeted by spy agencies, I’m talking about being on a list of blogs and social network users that have ideas that are vaguely troublesome to the customer for this software. I’m not talking about anyone spending time on me, I’m talking about a person who has dozens of targets and a short brief about what kind of message to post there every so often under a new identity each time. Commenting on my blog is a tiny fraction of their time.

The troll on my blog doesn’t usually read the blog posts, they just scan for keywords like “benefits” and then post their message. They don’t see messages like “your comment is awaiting moderation”, they just try to post four times over a couple of hours. When I block their IP address they don’t come back immediately, they appear the next day on a new address – as though they waited for software to move on. They reply to people who reply to them but they just say more of the same without addressing questions. They are repetitive, saying much the same thing each time but written slightly differently, like someone has a brief to convey a certain idea but has no awareness of context.

I’m probably way off the mark here, but it’s an interesting idea that we could be seeing the work of persona management software in the wild. The messages left on my blog could have been left by people using this kind of system. But they’re probably the work of a particularly witless nasty troll. Thanks for the inspiration for a blog post, dan / fred / wes / dave / ozzy / mark / jane!

UPDATE 2013-03-10

I’ve been checking the troll’s IP addresses at and all but two that I have checked have been known sources of automated comment scripts. It appears that the system being used might not be as sophisticated as the persona management that I talked about, but is instead pre-written comments posted automatically by bots on blogs with welfare-related keywords.

Further reading

The Register: HBGary ‘puppets’ FAIL to convince

The Guardian: Revealed: US spy operation that manipulates social media

Daily Kos: The HB Gary Email That Should Concern Us All

Daily Kos: HB Gary Federal CEO a Daily Kos Member?

Pastebin: An archive of the troll comments left on this blog – with email and IP addresses

Pastebin: IP addresses used to post troll comments


Author: Latentexistence

The world is broken and I can't fix it because I am broken. I can, however, rant about it all and this is where I do that when I can get my thoughts together. Most of the time you'll find my words on Twitter rather than here though. I sometimes write for Where's The Benefit too.

26 thoughts on “Scripted, automated troll posts via botnets – welfare opponents running scared”

  1. £26k as a benefit cap equiv. to £36k before tax and that aint enough?? No incentive to work these days. Yet the people getting thousands in housing benefit wont move for work?? Yet working people move all the time for employment. Rowntree foundation say the thing that shocked them the most is how the people on the most lucrative level of benefits are the ones that think noone else should be on benefits! How selfish are people who get something when they have contributed nothing? If housing benefit not enough for your rent stop moaning and move or live on the street!

  2. £26k as a benefit cap equiv. to £36k before tax and that aint enough??
    No incentive to work these days. Yet the people getting thousands in
    housing benefit wont move for work?? Yet working people move all the
    time for employment. Rowntree foundation say the thing that shocked them
    the most is how the people on the most lucrative level of benefits are
    the ones that think noone else should be on benefits! How selfish are
    people who get something when they have contributed nothing? If housing
    benefit not enough for your rent stop moaning and move or live on the

    1. So if the benefit system is so generous, how come as a disabled person even ATOS accept is not fit for work I am eligible for precisely nothing?

  3. Wheres the magical 26K ? I get no where near that and a while back I did a JRF comparison and I fell about 80 quid below a decent living standard.

  4. I suspect that there’s someone paying for this to be done on a range of blogs (and papers) known to cover the area. It would seem unlikely that anyone is targeting you specifically, but someone wanting to target the subject and the community in question is very believable.

    1. Why not offer to interview them to give them a proper chance to explain their position (and backers ).

  5. Astroturfing (the generic term) is definitely out there, there’s a pretty nasty post (it manages both misogyny and racism purely in passing) that goes out on the #disability and a bunch of other benefit related Twitter hashtags at least twice a day, every day for at least the last six months, always the same wording and (odd) capitalisation, never a retweet, always from a different twitter account, which always seems to have about a dozen random tweets over the previous fortnight to give the surface impression it’s a live account (many of the tweets are apparently in Tagalog or Bahasa Indonesia or a related language – so I suspect the company responsible is based in either the Phillipines or Indonesia).

  6. Oh I have one. Definitely paid, uses a goggdlegeek of numbers and letters to circumnavigate my no free comments policy.

    They’re definitely paid and I’d be ASTONISHED if it were by any of the corporates, – believe my I have experience and they’re WAAAAY cleverer than that.

    I’d lay money that the messages you get mimick Tory policy soundbites to the letter? My bet is anyone on the range of right wing supporter with more money than sense or Tory HQ has a little slush fund for pointless opposition. My gut says the latter.

  7. It shows real cowardice from those who refuse to come out into the open to manipulate social media in this way where they think they can get away with statements which are not legal either.I think you have hit the nail on the head-it proves you are being effective.Carry on the great work.

  8. It’s not a big leap to think of this as being from the same root as comment spamming software. Since I moved my site from MODx (garbage) to WordPress (still garbage but better supported) I’ve had a silly amount of attempted comment spam. All that’s needed is a few pre-written messages loaded into a command and control server linked to certain keywords and a network of spambots to do the scanning.

    In the case of spambots they’re looking for words in the html output that relate to certain systems such as WordPress and a comments form for which they can send a POST request. In your case it’s maybe a case of using google rankings for certain keywords and the sitemap to find ‘relevant’ posts. It’s basically fire and forget because there may be a few false positives but so long as it gets on sites like yours then they consider the job done.

    What this does mean is that it’s even less effort than you might think because the messages only have to be written once and with a little money spent the rest is largely automated.

  9. Several london council boroughs admit that the levels of housing benefit payments are so high that working people with mortgages could never ever afford to live in these properties. Where is the justice here? Now that sense is being discovered they refuse to move. Ok then pay the rent yourself, mugs who work shouldnt subsidize it.

  10. I’m not suggesting this is in any way connected, but are you aware of Tory MP Grant Shapps, Minister without Portfolio?

    In his previous life he was a multi millionaire “internet marketing guru” who ran an internet business doing all kinds of morally and legally dubious things, flogging software that copied other people’s content and republishing it to get money from adverts (a violation of google’s code). He’s also used software to follow/unfollow thousands of people on twitter to get his follower count up. He’s used several other personas online and offline in business dealings, and he’s even been caught out doing some lame manual astroturfing for his party.

    If I asked myself the question, “Who in the Tory party would know how to utilise/access astroturfing software?” well…

  11. This has made very interesting reading and I think warrants further investigation.
    Do other blogers get this? If not,just an idea, but it occurred to me as a fellow M.E sufferer that maybe YOUR blog is targeted because it is about M.E.,written by someone with M.E, not just about benefits in general?
    We all know that there is some very weird stuff going on to try and discredit M.E in the eyes of the public and the medical community and has been for years. We all know who first started it too – via the well known insurance companies who don’t want to pay out on policies for people with M.E because it would cost them a fortune – often young, youngish people, many well educated who get sick with an illness that in most cases lasts a lifetime and often requires 24 hour care. That’s a heavy payout for any insurance company. The company that invented the biopsychosocial model specifically to discredit M.E initially is now the model that has been extended to cover all illnesses via the WCA.
    Maybe the trolls involved are paid by those with a vested interest in discrediting M.E generally or people with M.E specifically and their claim to benefits of any kind, including by default, insurance payouts?
    It has been very noticeable recently that whenever any new piece of breakthrough scientific research is published on M.E, a “spoiler” story will appear in the usual media, within a day or two. In fact the last piece of big research to come out, I was actually expecting an M.E story to appear in the media and it did. A woman who claimed she’d been cured by CBT and GET. How convenient and not a coincidenceat all!
    As I say, just an idea. Could be completely wrong, but we know there are very big powers at work to try and discredit M.E and they are losing the battle with all the undisputable scientific research and more coming all the time. There are certain people, who are getting very rattled. Keep up the excellent work and I wish you the health to do it.

Comments are closed.