Hacker News new | past | comments | ask | show | jobs | submit login
Why Leo Traynor’s troll story may be a lie (resistradio.com)
56 points by philk on Oct 2, 2012 | hide | past | favorite | 61 comments

"Almost certainly" seems like a stretch.

- The arguments regarding Traynor's behavior on Twitter carry absolutely no water with me and sound like totally average behavior. It's not very intuitive that only people you follow can message you.

- Police in America frequently decline to investigate things like harassment and petty theft in favor of spending their time elsewhere. I don't know about Ireland, but it seems very unsurprising (if disappointing) that they would ignore his complaint.

The only compelling reason to disbelieve anything is the whole home address discovery thing, which does seem very strange. Although it's possible that there was some convenient coincidence that permitted the identification, probably that part of the story was embellished or false somehow. (edit: After looking at replies, I changed my mind, I think it's more likely mostly true. There's a lot of plausible avenues of discovery given the length of the alleged abuse.)

The rest, however, seems very conventional and I don't see a good reason to disbelieve it.

It's not very intuitive that only people you follow can message you.

But after you've received some hate messages, it also sounds like the kind of thing that you'd learn pretty quickly.

In other words if you're making up a story, it is the kind of detail that you'd not noticed you'd gotten wrong. But if you're actually harassed, it is the kind of thing that wouldn't keep happening to you for years.

Seems like a good reason to conclude that the story is made up.

As for home address discovery, that bothered me far less. If I had tracked someone down to 3 IPs, one of which was close, I'd go looking for evidence that there was a personal connection. One of the standard things that I would think of is to look through all received emails, and look for the IP address there.

That would indeed track it down reasonably reliably to a specific household without any need for a court order. And if the person that I did this for didn't understand what I did, confused explanations about how it was done are only to be expected.

It looks to me like Traynor understood that the follow-backs enabled the DMs, but resisted changing his behavior (at first) to not let the troll win. If the follow-backs sometimes led to nice exchanges with new friends, it's reasonable to hope the troll would tire, or that handling via unfollow/Twitter-reporting would be enough, before going full "shields up".

The way Traynor describes it, after he eventually went fully private on Twitter, the harassment moved to other forums.

> But after you've received some hate messages, it also sounds like the kind of thing that you'd learn pretty quickly.

He can't know in advance if he has a troll following him, and he likes to reciprocate followers. Should he, in a sense, penalize followers because of a troll?

I don't see anything in the original story about the delay between July 2009 and making his twitter account private. Is there anything to think it was years rather than weeks?

This makes no sense at all to me. If you're getting 2-3 people a day following you, and then sending you hateful DMs when you follow back, you seriously keep refollowing random people who will presumably be harassing you? It's not punishing anyone to put a bit of an effort in to seeing if the person seems legit before following them back.

If you have 20 new people a day following you and 2-3 are trolls, I'd still do it. No troll is going to make me change my polite behavior with other people.

I'd even go so far as to say that if you don't care enough about the person to research them before following them, then you shouldn't be following them anyhow.

One plausible scenario for the IP address is that he had comments from his friend on his blog, and then baited the troll to also comment there. The IP addresses would then be identical, providing the identification. Dynamic IP addresses would pose a problem, but most broadband has (semi-)fixed addresses, and even dynamic addresses would come from the same range so could be enough to trigger a hunch.

Rather than embellished, I'd more easily suspect the story of being selective. I just can't imagine someone not expressing anger when confronted with someone who harassed you.

With the active help of his "IT genius" friend, the deduction of a neighbor's address isn't very far-fetched.

Often the IP will clearly identify a regionally-specific ISP and even a particular community. And once recognized as someone local, there were probably just a few suspects from vague hunches about who seems a little angry/fidgety/pranky.

Maybe the neighbor leaves their wifi open: borrow access one day, see what the public IP is.

Maybe the neighbor corresponds via email with Traynor or the 'genius': check email 'received-from' headers; include an HTML email image bug; tempt the target to click a unique link.

In reference to your second point, racially motivated crime is taken very seriously in Ireland.

Traynor was apparently subjected to sustained and horrific racial abuse based on his being Jewish. There has been an escalation of attacks on Jews in Europe by Islamists and neo-Nazi groups. This, combined with death threats and the fact that the abuser knew where Traynor lived would very definitely attract the full attention of the law.

There is either a problem with the police here, or with the story.

>"Almost certainly" seems like a stretch.

That's an big issue with our society.

Unless you have huge following (eg PG), making moderate considered and balanced headlines and opinions, more often than not fails to get a reaction and hence traction, even if it's more truthful.

" It's not very intuitive that only people you follow can message you."

I am a very, very sporadic user of twitter - I've tweeted maybe 40 or 50 times, and one of the very few things I know about it, is "You can't DM somebody who isn't following you"

Nothing to do with intuition - the client gives you a big fat message saying so the first time you try and do it.

My understanding from the article is that this Traynor was a twitter veteran - and I'm guessing somewhere on the order of 99% of frequent twitter users, and DMers know this.

The author of this article is almost certainly trolling.

It's perfectly logical that the victim would change his Twitter behavior even after discovering the identity of the harasser. If your car were stolen but then recovered and the thief arrested, would you stop locking it? After all, the threat has been eliminated...

Just because you cannot traceroute an IP to a physical address doesn't mean you can't determine where an IP is being used with a high degree of confidence. If the parents were indeed friends of the victim, any email correspondence sent from their home connection would include their IP in the headers.

The biggest flaw however is that there is no plausible motive given for the victim to lie. Sure, it's possible that he lied, but why would he?

To be fair, there certainly is a motive for him to lie, and that's exposure/fame/internet celebrity/etc. Not that I think that he lied, but let's be honest, he certainly got a lot of attention from the story...

By this logic we should also be highly suspicious of the claims that he lied.

Well perhaps it's just as much a flaw that there wasn't really a motive for the troll. I think it's very likely that something is missing from the story to explain why he was targeted in particular.

0. He didn't change his behavior during the abuse, when he could have trivially stopped it by unfollowing. If your car was stolen, would you keep the loaner unlocked before your car was even recovered?

1. Only if they use non webmail

2. To sell a story. The default assumption should always be that tales like this are false or at least extremely embellished.

Wait... am I supposed to assume all blog posts are false? Certainly an interesting way to live. I'll start with your comment.

If there is one coincidence to make you question the authenticity of the author - nah.

If there are several coincidences, then this leads to a pattern of behavior to which a motive can be questioned.

Traynor did change his behavior: but when he unfollowed one account, another took its place. It took him a while to change his habit of an optimistic follow-back -- if some of his follow-backs resulted in pleasant exchanges with new friends, why wouldn't he try to outlast the troll for a while? -- but it's clear he eventually did.

And Traynor reports that when he made his Twitter account private, the harassment moved to other forums: Facebook, blog comments, email.

This line of logic works to a point, but if 2-3 strangers are following you per day on twitter and then when you follow them back, they send you hateful messages, wouldn't you consider at least getting to know the person/changing your behavior? I get that you wouldn't think its a big deal if it just happened a few times, but the guy is screaming that it was happening 2-3 times a day and we are wondering how he possibly could have seen this coming. Seems pretty simple to me.

He did change his behavior! He unfollowed/reported harassers and eventually rejected all new followers by taking his accounts private. And then the harassment came via other avenues!

What more are you expecting him to have done? And why wasn't it OK for him to try remaining open to possibly-friendly strangers for as long as possible? And he's not "screaming" or indeed complaining about anything, he's just describing a chain of events.

He's condensed around 3 years of on-and-off-again harassment and on-and-off-again countermeasures into a few paragraphs. You can either read it charitably, and assume other consistent and reasonable details for things unsaid, or read it in a hostile and suspicious manner (as '@ResistRadio' has).

I'm not taking any side, by my own personal habit for a follow on twitter is to look at who followed me's stream before following back. I'd hope others would do the same rather than automatically following back.

You talk like these were the only 2 to 3 strangers that ever followed him, that only trolls followed him. Was that the case? How are you to distinguish between legitimate followers and not?

The whole OP reads like a string of conjectures just like this one. I kept waiting for some firsthand knowledge of the matter, some smoking gun, but mostly it was a lot of innuendo and assumption.

There's just not a lot of "there" there. It sounds more like an assemblage of facts to fit a theory rather than the other way around.

My point is simply that if you're going through a period where 2-3 people are harassing you in the exact same manner, every day, you might consider changing your behavior to stop it from happening. I know I would.

Ad 1: webmail can show IP as well; e.g., hotmail has X-Originating-IP header. It makes a lot of sense to include such information for obvious abuse tracking purposes.

This article is copied in its entirety from:


as admitted in the intro. Why link to a copy instead of the original?

Because I'm functioning on little sleep and managed to miss that.

If one of the mods could change the URL to point to the original I'd be grateful.

Why did you post this analysis?

No, really, I'm curious. What drove you to do this?

Who cares whether he's lying? (And why do you care?)

I care if he's lying because his story was re-printed in The Guardian, where I read it, as truth. If it's not a true story, it's wrong to present it as such.

If it's not a true story, it's wrong to present it as such.

But why? Can you (or someone) please articulate what exactly is so bad about it?

Some of the best and most influential stories in human history were precisely that: lies presented as truth. Were the authors "bad" for doing this? At what point does it become bad? (And why?)

Hey look buddy, I'm an engineer; that means I solve problems. Not problems like 'Why is lying wrong?', because that would fall within the purview of your conundrums of philosophy. I solve practical problems.

Oh we can come up with a zillion questions ...

Drive up the rageviews?

Seems like 'graunwatch' is all about bashing the Guardian and this is an anti-Guardian story kinda?

A more interesting question is does the author know and consent to the wholesale copying? Does that change the story?

Because the original has unreadable formatting and color.

The only strong case here is in the IP address geo-identification.

Traynor could identify them if he were to cross validate the IP address location with a list of known friends and family - people of whom would have Traynor's personal address.

But Traynor should have suspected his friend - not his friend's teenage son. That's the part of the story that doesn't add up.

"But Traynor should have suspected his friend - not his friend's teenage son. That's the part of the story that doesn't add up."

Really? He should suspect his friend that he knows intimately rather than his friend's teenage son which he doesn't know very well and is of an age to be up to mischief? In what universe does that line of reasoning make sense?

Depends on what the "IT Genius" tried.

For example, IP addresses (even internal unroutable ones) are frequently passed along in email headers. If he was able to find an IP and an email sent by his friend in the same timeframe, that would be a good correlation. I've done this on occasion when someone's external IP has dynamically changed but they sent email, in order to fix VPN connections.

Pinning it on the son is the stretch here.

Even with the IP address from the header, which geolocation service did he use to pinpoint the street address?

If it's like most ISPs, this IP address is subject to change every couple of days, so this IP location service would need to be updated with personal addresses, across the globe, that often.

Most ISPs don't change their IPs nearly that often. This isn't the 90s where everyone was dialing in, and changing an ip address would cause existing connections to fail, making the service look crappy. Most of the time the IP only changes when there's maintenance or something that requires it, or the modem gets disconnected.

Using a geolocation service isn't needed for the scenario you're replying to. If it was me, and I had this trolls ip, the first thing I would do it compare it to the other emails and connections that occurred simply to group the troll's crap together. In this situation the friend's email would have shown up to (being sent from the same house), and I doubt Mr. Traynor needed a geolocation service to look up the address of his friend.

I have a "dynamic" IP address from Cox, it has changed three times in six years.

Anecdotal, but did you request the static IP? I can't imagine Cox handing those out like Pez.

I think that's the point.

Cox (and my understanding many other ISPs as well) CHARGE for static IPs, but give out dynamic IPs that basically never change because it is actually just easier for them to set the service up that way.

The few times the IP address changed was when they did an upgrade at their site, a very long outage, and I think a time when an installer screwed up a neighbors installation.

I cannot guarantee my address tonight will be what it is now, but the reality is, it will be.

I believe (stress no real evidence of this) that my home router tries to give out the same IP addresses to the same MAC addresses. I say this because after I reboot the router, my various machines will pop up at the same IP addresses they had before (and none of them are Apple products known to do this on purpose.)

I have cox as well and my IP only changes when:

1) My cable modem has been offline for a while (e.g. power failure) 2) My subnet changes, which has happened twice in 6 years.

Why would his friend be a more likely suspect? Psychopathic children are more common than psychopathic friends.

That statistic could be because children are much more frequently studied as victims of cyber bullying, and that their peers are also children.

I say the friend because more often than not, the relationship includes some triggering factor for the cyber bullying. Where is the sense of power for the teenager when the victim is a hemisphere away, and not in class?

Just to add a bit more fuel to the fire, while a reasonable skepticism should always be well, reasonable, I think it takes a lot of chutzpah to so directly out and out call this fake given the sparsity of the argument as it is.

Compare this to skepticism over ElevatorGate.

FWIW, here's a woman at skepchick expressing doubt that Leo even exists: http://skepchick.org/2012/10/leo-traynor-anti-semitism-and-t...

Someone should send her a link to Derailing for Dummies. Questioning his account of the events is dangerously close to blaming the victim, derailing the argument from the cause discussing anti-Semitism, and forms a pattern of discouragement against people who come forward as the victims of trolling. This is NOT ok.

And that is why the concept of "derailing" is BS. The position of the speaker as member of an oppressed class means that you must accept their claims on faith. To question them in any way is "NOT ok". Adopting this policy means that no rational person should believe anything that comes from a group with such ground rules.

You've missed the point entirely.

If I told you I had a sandwich the other day, your skepticism meter wouldn't suddenly kick in. You wouldn't ask me how much I paid or intimate that I don't know what a sandwich is. If I told you a crazy guy yelled at me on the bus in the city, you wouldn't ask me whether maybe I misunderstood, or start going through my social network postings to confirm/deny that I took the bus to work the other day.

Yet suddenly you're skeptical when someone claims to have experienced discrimination or bigotry, you're full speed ahead on skepticism? Take nothing as given? Come on.

This might not apply to you personally, but that dynamic is why the term was invented. Esp. with white male nerds, they find their skepticism often, it seems, when minorities, et al, talk about experiences outside the typical white male's.

Thank you for posting this. I thought the story was fishy too. Hopefully everyone reading this knows you can't generally trace an IP to an exact home address without help from the ISP.

People are WAY too eager to explain that away with "oh he must have cross checked it with his registry of friends IP addresses." Nope. As the article notes, Traynor said the method his "IT friend" used was "almost identical" to ipttackeronline.com, which does not provide exact addresses.

Great point about the police procedure for handling credible death threats, too. We don't even have to get into the twitter stuff.

Why would he lie? For attention and sympathy, of course. People do it all the time.

Easy to trace an IP to the ISP that owns it and often an area of a country via naming schemes.

Not a huge step from there to think "Wait, x uses ISP Y and lives in Z" before burrowing through emails or checking blog comments, etc. Could be that two people were commenting from the same IP, but with different devices which suggested the son rather than the friend could be responsible.

Problem is he didn't do that critical second step, the "burrowing through emails or checking blog comments" for something that links the IP to a friend.

He made the mistake of responding to the criticism of his story's technical implausability by claiming his friend used a procedure of looking up the IP location on a general web database. But those only resolve to ISP-level geolocation, not user-level, as the very post he linked to was later updated to admit.

Would have been better for him to keep quiet and let us all keep imagining exotic solutions.

I must've missed where he claimed that he didn't do those things? Their specific methods were always suggested to be something "like x" rather than exactly like it.

Further, he didn't need a method that worked at identifying all people (as tripped up 90% of people in the linked explanation), just this particular one.

I run a forum and often try to identify/discourage PITAs. Sometimes just tracing an IP reveals nothing but the ISP and location/exchange, sure, but other times it'll give me an employer and so on. Trace an IP, get something like accessplus.weblink.telstra.net, recognise your pal's Access Plus business name and you're on your way.

Revealing the method goes some way towards informing future trolls of tricks available to them.

To me, it seemed that the mysterious method referenced was half about luring the troll away from Twitter/etc to a place where they could directly record the IP address. The rest came from there.

Picking out something like this to discredit the entire account is very rough, IMO, and I flagged this story FWIW.

He said it was his friend's house, not a workplace, so your theory is pretty weak.

He didn't say his IT wizard did something "like" geolocating the ISP, he said it was "almost identical" to geolocating the ISP.

Furthermore if there were some magical additional steps or wonderous circumstance that did bridge the gap between ISP-level geolocation and personal home address, he has absolutely no reason not to spell them out.

Unless he's lying.

You know, what's really fascinating about this whole thing is not why this guy would fabricate a dramatic story about him confronting a troll. That's easy to understand. It's why some people have such a powerful need to believe it. So much that they bend over backwards to find some exotic explanation around all the holes, rather than seeing them for what they are.

People run businesses from home. I outlined a reason someone wouldn't spell out specific details and others have written more too.

Will leave you to it, I think.

This is more of an aside than a comment specific to the article.

Over the past year I've felt that the term "troll" is increasingly being confused with what would have been called "griefing" back in my gaming days. My early encounters with trolling were that it was your fairly basic ribbing of friends, nothing particularly malicious. Nowadays, anything and everything seems to be labelled as trolling when I feel that the circumstances with malicious intent would be better labelled as griefing. Not only do I think griefing is a more apt description for the behaviour being associated with trolling, I think it allows for a distinction between harmless fun and out-to-cause-harm when describing activity on the internet.

Proper distinction between the two modes would, imo, help keep frames of reference and hopefully prevent knee-jerk reactions to what is currently labelled as trolling affecting a more wide variety of interactions.

Also, it would probably help a lot when the next newbie asks you what "trolling" means as well.

If someone was sending me DMs that would mean I had followed them.

If I somehow had three IP addresses to general locations, I would wonder who I had followed in those general locations.

If in one of those locations a friend of mine lived, I might wonder and then check my email to see what IP addresses had been captured there.

Strange logic or comprehension problem. How did the author go from "does not work in all cases" to does not work at all? Is he really ready to stake his reputation on the claim that an IP address can NEVER lead to an individual's home address?

"(NOTE: this does not work in all cases but even a general location is a piece in the puzzle when tracking a troll.) The late addition of this note to ‘Tracking a troll’ only confirms what has just been explained in this article – that an IP address does not enable you to identify an individual’s home address. An author whose article was specifically referenced by Traynor as ’proof’ of his home address claim, has had to admit that the method given in his article does not actually allow you to identify someone’s home address"

Jesus, how much time went into "investigating" this? This is really, really long.

We all enjoyed the story, and it sounded plausible enough. It had character depth. It had (kind of) redemption, and forgiveness. It had a boy in an awkward position that we could tut tut at.

Who gives a shit if it's embellished?

When Twitter first started many people auto-followed back anyone who followed them. There were apps to make this easy; I never did, but it was pretty common and was how conversations would take place. Twitter dynamics have changed significantly since the time period he was talking about.

I always get suspicious when I hear the term "almost certainly."

Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | Legal | Apply to YC | Contact