Large pixelated hand pointing at a small figure in a corner.

Targeted Harassment: The Ukraine Whistleblower

By
Joan Donovan and Brian Friedberg
Published on
September 22, 2020
Media Manipulation Tactics Used
Keyword Squatting
Recontextualized media
Swarming
Date Range
September - December 2019
Region
USA
Network Terrain
4chan
Blogs
Facebook
Gab
Google
Reddit
Twitter
YouTube
Attribution
Conspiracists
Influencers
Networked faction
Partisans
Target
Individual
Strategy
Targeted harassment
Trading up the chain
Vulnerabilities
Breaking news event
Data void
Observable Outcomes
Harassment
Media exposure
Misidentification
Political adoption
Mitigation
Blocking
Content removal
De-indexing
Debunking
Media blackout
Campaign Adaptation
Tactical adjustment

Overview

In the fall of 2019, a whistleblower logged a complaint about President Trump’s dealings with Ukraine. A coalition of conservative and right-wing influencers and conspiracists encouraged campaign participants to keyword squat the name of an individual who they alleged was the whistleblower. Mainstream press outlets implemented a media blackout to protect the identity of the whistleblower, which involved never printing the name of anyone alleged to be the person, including the target of the keyword-squatting campaign. After attribution to this spread, some social media platforms blocked the use of his name. This asymmetrical media environment shaped the breaking news event and led to misidentification and targeted harassment.

(NOTE: In order to compile this case study accurately without furthering the aims of the manipulation campaign it details, we will refer to the targeted individual as “C” in this text wherever possible. The name will only be used in direct quotes, screenshots, or footnotes, per the URLs and headlines of articles being cited.)

STAGE 1: Manipulation Campaign Planning and Origins

On August 12, 2019, an anonymous government whistleblower filed a complaint to the US Senate Select Committee on Intelligence, asserting that President Trump had engaged in illegal discussions with Ukraine over Democratic presidential candidate Joe Biden. This disclosure entered public conversation on September 19 when The Washington Post released an article about the whistleblower complaint.1 On September 23, the committee released a redacted version of the complaint,2 which eventually led to an investigation and ultimately the impeachment of President Trump on December 18.3 As the Ukraine scandal captured national attention, a loosely affiliated online networked faction swarmed to unmask the whistleblower. Federal whistleblowers are protected by law from retaliation by the government, which can include protecting their anonymity.4

On social media, users, particularly political opponents of Joe Biden on the right, engaged in wide-scale speculation about the whistleblower’s identity. Some users of 4chan’s Politically Incorrect board began investigating the from The Washington Post, with explicit plans to seed their expected findings on social media.5 These investigations resulted in several false leads and misidentifications, including a September 30 4chan thread claiming Democratic National Committee contractor Alexandra Chalupa was the whistleblower.6  

On October 3, conspiracist and activist Jack Posobiec first speculated in a retweet that CIA analyst "C" may match a leaked description of the whistleblower.7 He posted another speculative tweet about "C."8 Some participants in this breaking news conversation on Twitter referenced a (now republished) Medium post written by Mike Cernovich from 2017, in which Cernovich accused "C" of being “the main force pushing Trump-Russia conspiracy theories.”9

Tweet by Jack Posobiec: "Sounds like Eric Ciaramella by this description."

Jack Posobiec sent the first tweet speculating that "C" was the whistleblower. Credit: Screenshot by TaSC.

STAGE 2: Seeding Campaign Across Social Platforms and Web

The seeding process of the campaign to spread the allegation that “C” was the whistleblower involved the strategic release of documents alleged to support the claim by operators on Twitter. On October 11, writer Seamus Bruner tweeted the image of a document supposedly detailing "C’s” role in US-Ukrainian diplomatic relations.1 The claim was reiterated first in a tweet by writer Greg Rubini on October 11,2 and then in a follow-up thread on October 15.3

On October 30, these initial claims were traded up the chain into more legitimate circles when Real Clear Investigations released a report identifying "C" as the whistleblower, without direct reference to Jack Posobiec who initially popularized the claim on Twitter.4 Political provocateur Dinesh D’Souza further amplified the claim in a retweet of an article from The Hill on October 31.5 Also on October 31, following the Real Clear Investigations report, Rush Limbaugh named "C" on his radio show.6

The claim that "C" was the whistleblower spread over the subsequent week, resulting in 150,000 tweets naming him.7 During this time, North Carolina businessman Tim D’Annunzio reportedly used Facebook ads to spread the name, specifically microtargeting Christians.8

On November 6, political columnist Benny Johnson shared an image of a transcript of the closed-door congressional impeachment testimony of William Taylor, the former acting ambassador to Ukraine. The document had reportedly been released on the House of Representatives Committee Repository website that day, though the testimony occurred a month prior, and it showed the GOP’s lawyer asking Taylor directly about "C’s" name.  The document is no longer on the committee website, but remains live and unredacted on NBC.9  That same day, Donald Trump Jr. tweeted a link to a Breitbart article about "C," writing “Because of course he did!!! Alleged ‘Whistleblower’ Eric Ciaramella Worked Closely with Anti-Trump Dossier Hoaxer.”10

On November 7, a prominent Qanon-associated Twitter user “Eyes on Q” shared a collage of recontextualized images of Alexander Soros, the son of billionaire investor and philanthropist George Soros, with a variety of Democratic leaders. While this account did not identify Alexander Soros as the whistleblower, the image was subsequently shared on and reposted on fringe news site The Buffalo Chronicle on November 10.11 Both young white men with short beards, Soros and "C" share some visual similarities, which led some campaign participants to misidentify Soros as "C," and share that misidentification across the web.12 Soros wasn’t the only one. Other men whose photos were misidentified as that of "C" include former Obama administration official David Edelman, French presidential advisor Hugo Verges, and Ukranian Rostyslav Pavlenko.13

While some press and reporting contributed to the spread of the whistleblower’s alleged identity and image, the conversation was driven by . “Please do not retweet this photo of the scam-whistleblower,” Candace Owens tweeted on November 8, followed by a hashtag of his full name, and the claim, “He does not want his name or picture to go viral so please, whatever you do, do not hit the retweet button. Thank you in advance.”14 From November and onward, other campaign participants continually seeded "C’s" name on small blogs, Twitter, Facebook, , Gab, YouTube.15 The asymmetrical media environment, in which the right freely used "C's" name while the left did not, allowed campaign participants to add noise around who the whistleblower was, and if he had been positively and officially identified.

Tweet by Candace Owens of a photo of "C", telling people he was the whistleblower and not to retweet the photo while naming him explicitly in the tweet.

Candace Owens tweeted a photo of "C", telling people that he was the whistleblower and not to retweet the photo while naming him explicitly in the tweet. Credit: Screenshot by TaSC.

STAGE 3: Responses by Industry, Activists, Politicians, and Journalists

Politicians adopted the campaign, joining the quest to unmask the whistleblower, making the issue the subject of much partisan conflict in Senate committees.1 In a retweet of his official campaign account, @TrumpWarRoom, President Trump shared a The Washington Examiner article naming "C."2   On December 27, President Trump retweeted Twitter user @surfermom77, who explicitly called "C" the whistleblower.3

On November 14, Sen. Rand Paul called for the whistleblower to testify in the Senate impeachment hearings.4 On November 19, Rep. Steve King shared the aforementioned Alexander Soros misidentification collage, commenting, “Adam Schiff said, I do not know the identity of the whistleblower. @RepAdamSchiff here are four strong clues.”5 On December 11, Rep. Louie Gohmert named "C" in a House Judiciary Committee meeting,6 as did Paul in speech to the Senate on February 4, 2020.7 This resulted in a slew of media exposure.

There was a stark divide between how the right-wing press and liberal and mainstream press covered this breaking event in late October and early November, 2019. Some right-wing outlets like Breitbart News,8 The Gateway Pundit,9 Red State,10 and The Washington Examiner, among others, decided to include the name of the suspected whistleblower in their reporting. While the Daily Caller initially did not print "C’s" name in articles, he was named on the site’s on October 31.11 Other conservative publications like The Federalist12 and Fox News13 did not include his name in publication. Two Fox News guests did, however, name "C" live on air on November 7 and 11.14 Even in debunks of the Alexander Soros misidentification collage, right wing pundits like Mark Dice included "C’s" name.15

While liberal and mainstream press continued to cover the investigation, they universally refrained from naming "C." The choice to identify the suspected whistleblower was widely condemned by Democratic politicians and most press. 

This absence of "C’s" name in mainstream press contributed to a data void, in which only unverified sources and some right wing press outlets dominated queries for the name on search engines.  As a result of this asymmetry, it remains easy to find articles in right-wing press that allege "C" is the whistleblower, and nearly impossible to find any naming him as even a person of potential interest in mainstream or liberal media.

On November 19, Republican congressman Steve King shared an Alexander Soros misidentification collage, commenting, “Adam Schiff [Democratic congressman] said, I do not know the identity of the whistleblower. @RepAdamSchiff here are four strong clues.” Credit: Screenshot by @IAStartingLine on Twitter.

On November 19, Republican congressman Steve King shared an Alexander Soros misidentification collage, commenting, “Adam Schiff [Democratic congressman] said, I do not know the identity of the whistleblower. @RepAdamSchiff here are four strong clues.” Credit: Screenshot by @IAStartingLine on Twitter.

STAGE 4: efforts 

While most major proactively implemented editorial bans on “C’s” name being mentioned as soon as the campaign to unmask the whistleblower settled on “C” as the suspect of interest and took off, social media platforms intervened reactively and asynchronously.  On November 8, Facebook announced that it would be removing mentions of “C’s” name from its platform and , while Twitter took a different approach, allowing the use of the name so long as there was no further identifying information that could lead to . Twitter did, however, prevent his name from trending, de-indexing it, despite allowing use of the hashtag.1 On February 13, YouTube removed a video of Rand Paul stating that “C” was the whistleblower in a speech on the Senate floor,2 and subsequent content with “C’s” name in the title.3 Reddit took no mitigation efforts to suppress the name.4 Wikipedia editors reportedly prevented “C” being named as the whistleblower.5 “C” does not have a dedicated Wikipedia page, and his name is not mentioned in the Trump-Ukraine scandal entry.6 All major search engines, like and Bing, did not intervene in hiding or redirecting search results for “C’s” name.

In addition to the by mainstream press, the work of the Alexander Soros misidentification was done by groups like Media Matters,7 AP,8 and FactCheck.org,9 all of whom refrained from identifying "C" in their reporting.

STAGE 5: Adjustments by campaign operators

As “C” has a relatively unique name, and as no mitigation efforts to disrupt web search results were put in place, that chose to allow the name to be published populate search engines. Despite mitigation efforts from some social media platforms like Facebook, campaign participants adapted tactics. They took to sharing links, , and images, and modifying the name to avoid the search blackout.10 Some participants changed their display name to variations of the name and “whistleblower.”

An organized effort to increase campaign participation and further seed the name on social media began in earnest on December 12. In a 4chan thread on December 12 that used the name in its title, a campaign operator laid out the strategy to attract attention: “We need to take up the responsibility of making sure everyone knows his name, no matter how hard the media tries to suppress it. i.e if you're talking about the impeachment with friends or family, casually bring up his name.”11  The post encouraged participants to use “C’s” name in hashtags along with other trending hashtags on Twitter to “let everyone you know be aware” of the name and “why they should care.” As a result of tactical adjustments like this, it remains easy to find tweets that explicitly accuse "C" of being the whistleblower. 

Cite this case study

Joan Donovan and Brian Friedberg, "Targeted Harassment: The Ukraine Whistleblower," The Media Manipulation Case Book, July 7, 2021, https://casebook-static.pages.dev/case-studies/targeted-harassment-ukraine-whistleblower.