Written by Ben Collins

Ben Collins is an NBC News reporter covering disinformation, extremism and the internet. For the past five years, he’s reported on the rise of conspiracy theories, hate communities, foreign manipulation campaigns and platform failures. He previously worked at The Daily Beast, where his team discovered the accounts, groups and real-life events created by Russia’s Internet Research Agency troll farm during the 2016 U.S. election.

On August 3, 2019, Patrick Crusius walked into an El Paso Walmart and killed 22 people in a white nationalist-motivated shooting. But before he entered the store, he posted a manifesto to the /pol/ political discussion board on 8chan.net, an anonymous message board that has in recent years become a gathering place for white nationalists. The /pol/ boards on 4chan and 8chan are almost entirely unmoderated, and by the summer of 2019, 8chan had become a gathering place of violent white nationalist content and discussion.

Partly because of this, 8chan users would sometimes alert authorities and journalists when a new, violent manifesto was posted. This was done by adding comments beneath the manifesto itself and through online tip submissions to media or law enforcement. When the El Paso shooter first submitted his manifesto — which initially went up with the wrong attachment — one user replied “Hello FBI.” The correct manifesto was then posted directly underneath the comment flagging the FBI.

This sort of self-reporting can be critical information for journalists in the wake of these tragedies. In some cases, slightly benevolent users will take to more open and mainstream, civilian parts of the web like Reddit and Twitter to call out manifestos or suspicious posts made before shootings. This is essential because it’s easy to miss a relevant post or comment on 4chan and 8chan.

Anonymous platforms like 4chan and 8chan play an important role in the online mis- and disinformation and trolling ecosystem because they’re where people often work together to hatch and coordinate campaigns. Reddit, another popular place where users are largely anonymous, hosts a diverse array of online communities. Some are heavily moderated subreddits that can help users trade stories about hobbies or discus news and events; others are basically free-for-alls where hate can breed unabated. It’s essential for journalists to know how to monitor and report on all of these communities, and know the intricacies of how they operate.

With that in mind, here are five rules to abide when events require you to use 4chan or 8chan (or its newer iteration 8kun) to inform your reporting:

1. Don’t trust anything on 4chan/8chan.
2. Don’t trust anything on 4chan/8chan.
3. Don’t trust anything on 4chan/8chan.
4. Some useful information pertaining to (or even evidence of) a crime, trolling campaign or disinformation might be found on 4chan/8chan.
5. Don’t trust anything on 4chan/8chan.

I can’t stress how important it is for reporters to follow rules 1, 2, 3 and 5, even if it prevents them from getting some of the important juice that could be garnered from number 4. These websites are literally built to troll, spread innuendo and falsehoods about perceived enemies, push lies about marginalized people, and, occasionally, post quasi-funny lies framed as true stories about what it’s like to be a teenager.

This is evidenced by the fact they have been used as dumping grounds for manifestos by white nationalist, incel and other aggrieved young male shooters.

Let’s say it one more time: If it’s on 4chan or 8chan (which we’ll continue to refer to as 8chan from here on out, despite its merely nominal name change to 8kun), there’s a very good chance it’s a lie meant to sow chaos and mess with reporters. Don’t go into a thread asking for more details. Don’t post anything, actually. You will be targeted by people with too much time on their hands.

Confirming the manifesto

This is why it’s so helpful when members of these communities make an effort to call out manifestos or other newsworthy content. The “Hello FBI” comment on 8chan is how I found out about the El Paso manifesto’s existence. Shortly after reports of the shooting, I searched Twitter with the keywords “El Paso 4chan” and “El Paso 8chan.” Searching for “[city name] + [8chan or 4chan or incels.co] or other extremist sites provides a useful template for any similar event.

My Twitter search revealed that a few users had shared screenshots of the shooter’s 8chan posts, though most had falsely attributed the post to someone on 4chan. So I needed to look for the post.

What’s the fastest way to search for an 8chan post? Google. In the aftermath of the shooting, I searched for “site:8ch.net” then added a part of a sentence from the alleged 8chan post from the shooter. (Note: 4chan automatically deletes posts from its servers after a certain period of time, but there are automatic 4chan archive sites. The most comprehensive one is called 4plebs.org. Archived 4chan posts can be found by simply replacing 4chan in the URL with 4plebs, and removing the “boards” prefix. For example: boards.4chan.org/pol/13561062.html could be found at 4plebs.org/pol/13561062.html.)

During some shootings, it might be beneficial to try searching for “site:4chan.net + ‘manifesto’ or ‘fbi’” and use Google’s search options to restrict your time frame to the past 24 hours. Chan users might have already attempted to rat out the shooter in replies to their post.

My initial search strategy didn’t turn up the relevant 8chan post, which led me to believe this was a quickly created hoax. But something didn’t sit right. The post shown in the screenshot on Twitter did, in fact, have a user ID and post number. These details led me to think it was real, and not a simple fake. On 8chan, each post comes from a unique user ID, which is algorithmically generated and displayed next to the post date. This system allows users to have a static ID so they can identify themselves within a thread.

This user ID system, by the way, is how people know “Q” from the QAnon conspiracy theory is actually him. Users can create de facto permanent usernames and passwords by entering a username in the ID field while making a post, followed by a #, followed by a password.

This user ID is how I knew the same person who mistakenly posted the PDF with the name of the shooter on it was the same user as the one who posted the actual manifesto two minutes later. Both posts shared the randomly created same user ID: 58820b.

Next to a user ID is a post number, which is a somewhat permanent artifact that creates a unique URL for each post. The screenshot of the El Paso manifesto shared on Twitter included a post ID of “No.13561062.” This creates the url 8ch.net/pol/res/13561062.html. You can use this URL convention across both 4chan and 8chan.

But in this case, the post didn’t exist. I thought maybe it had been deleted. (I later learned that 8chan owner Jim Watkins removed it once he was alerted to its content.)

With the post gone, my last best hope was that it had been archived by someone who recognized its importance. Thankfully, a quick-thinking 8chan user saved the post on the archive site archive.is. Pasting the URL into the “I want to search the archive for saved snapshots” box of archive.is revealed that the manifesto post was real, and now I could view it.

But there was a new problem: When was it first posted on 8chan? I needed an accurate timestamp to confirm that the manifesto was posted before the El Paso shooter began his rampage.

Both 4chan and 8chan localize their timestamps, making it a complicated task to derive the real time from archiving sites. Fortunately, there’s a foolproof way around this. Right-clicking the timestamp and clicking “inspect element” will bring up the site’s source code, and it will highlight a section that starts with ‘<time unixtime=‘[number].’”

Copy and paste that number into an Epoch/Unix timestamp converter, like unixtimestamp.com, and you’ll get a to-the-second post timestamp in UTC time. Converting from UTC time to El Paso time revealed that the manifesto was posted at 10:15 a.m. Central Time — minutes before the shooting began.

This work helped me confirm that the manifesto posted on 8chan manifesto was, in fact, a legitimate piece of evidence in a case of racist domestic terrorism.

Tracking actors across platforms

In 2017, Lane Davis, a former “Gamergate researcher” (read: professional internet stalker) for disgraced alt-right figure Milo Yiannopoulos, killed his father in his own home.

Davis had gotten into an argument with his parents, and a 911 call revealed he was spouting far-right internet extremist jargon shortly before the attack. He referred to his parents as “leftist pedophiles” before his father called the police to help him kick Davis out of their home, where his son still lived.

Davis was known as “Seattle4Truth” online, and in YouTube videos he frequently referred to fictitious secret pedophile rings he believed were the driving force behind liberalism. One video on YouTube under his name was titled, “Progressive ideology’s deep ties to pedophilia.”

A reporter’s dream scenario in online extremism investigations is a perpetrator using a static username across platforms, and that was the case with Davis. He identified himself as Seattle4Truth on YouTube and on Reddit, where his posts revealed an even more conspiracy-addled brain.

How was that discovered? By simply putting seattle4truth into the Reddit username URL convention: reddit.com/u/[username]. Once there, you can sort by newest posts, most popular posts, and most “controversial,” which ranks posts by how a combination of how many times they were upvoted and downvoted.

One way to quickly research a username is to use Namechk, which searches for a username across close to 100 internet services. As I detail below, that doesn’t mean the same person is running these accounts, but it’s an efficient way to see where the username is being used so you can dig in and research. You can also Google any username you’re interested in.

It’s also important to be aware of the kind of super-niche internet communities where your target could be active. A 2017 school shooter in New Mexico, William Edward Atchison, was identified by users on KiwiFarms, a site primarily devoted to anti-trans bullying, as @satanicdruggie. Users said he was active on Encyclopedia Dramatica, an anything-goes meme site that can sometimes host extremist rhetoric.

Not only was Atchison active on Encyclopedia Dramatica, he was a SysOp there, which means he was an administrator and power user. (We confirmed with users on the site who developed real-life, Skype-centric relationships with Atchison that the accounts were his. Atchison would voluntarily point users to other accounts of his own, in case of a ban.) A Google search of his username using the string “site:encyclopediadramatica.rs + [username]” revealed he went by Satanic Druggie, but also names like “Future School Shooter” and “Adam Lanza,” the name of the Sandy Hook shooter.

His posting history across the web revealed an obsession with school shootings that even the police didn’t discover in the wake of the shooting.

It’s again important to emphasize that the presence of a username across platforms does not guarantee the accounts were created by one person. In one famous example, notorious far-right disinformation agents Ian Miles Cheong, Mike Cernovich, InfoWars and GatewayPundit all claimed a man who killed two people and injured 10 others at a Jacksonville video game tournament was anti-Trump.

Their reason? The shooter, David Katz, used the username “Ravens2012Champs” in online video game tournaments, and an anti-Trump user on Reddit had a similar username: “RavenChamps.”

The coverage was as breathless as it was incorrect. The InfoWars headline read “Jacksonville Madden Shooter Criticized ‘Trumptards’ on Reddit,” and the story claimed he “hated Trump supporters.”

RavenChamps, it turns out, was an entirely different person, a Minnesota factory worker named Pavel.

“I’m alive you know?” he wrote on Reddit hours after the shooting. (The real shooter killed himself after committing the massacre.)

You need a lot more than just a username, but it can be a key starting point to further your reporting as you contact law enforcement, dig in public records and make phone calls.

Tracking campaigns in close to real time

Disinformation and media manipulation campaigns often spread across on Reddit and 4chan, and some are traceable in real time.

For example, 4chan has been in the business of rigging online polls to boost preferred candidates for years. In 2016, 4chan posters repeatedly posted links to both national and hyperlocal news sites running polls in the wake of debates featuring the userbase’s preferred candidate, Donald Trump.

Changing Google’s search parameters to filter by posts in the “last hour,” then searching “site:4chan.org ‘polls’” will give you a pretty good window into the polls 4chan users are trying to manipulate in real time.

This has continued well into the next election cycle. 4chan polls boosted Tulsi Gabbard, whom they referred to as “Mommy,” in polls on The Drudge Report and NJ.com. Using that simple Google search, anyone could see poll results shifted in real time after one channer told users to “GIVE HER YOUR POWER.”

It’s even easier to see active trolling operations on sites like Reddit’s r/The_Donald community because of Reddit’s useful “rising” feature.

Using the convention “reddit.com/r/[subreddit-name]/rising” shows results that are gaining steam at an unusual clip on a subreddit at any given hour.

You can also look at the posts that are overperforming posts across all of reddit.com/r/all/rising. This indexes every post across most Reddit communities. It does not search in quarantined subreddits, which are toxic communities with a habit for deeply offensive content and targeting other communities with trolling campaigns. Quarantined subreddits also don’t index on Google, but the “reddit.com/r/[subreddit-name]/rising” will work for them. Quarantining works great for limiting the reach of trolling campaigns outside of centralized audiences, but it makes it harder to track how bad actors are organizing in the moment.

Overall, it’s a good idea to keep tabs on the rising section of communities known for trolling campaigns, like r/the_donald, during big political news events, tragedies and elections.

The reality is that sometimes the things these platforms do to thwart bad actors can also make it more difficult for reporters to do important work. Tools can help, but so much of this is manual and requires approaches to verification that algorithms and computers can’t reproduce.

At the end of the day, a computer can’t replace this kind of work. It’s up to us.