|
THE STORY BEHIND THE TROLL
In February, 1997 a series of messages
appeared on alt.sex.prostitution.tijuana telling people that Tijuana was
ridden with "high crime" and that because of that any American visitor
should carry with him all sorts of weapons ranging from knives to mace,
pepperspray, and even hand guns. The author of those messages argued that
American citizends would be the primary targets of all the "hig crime."
This is FALSE. Taking weapons into
Mexico, for one thing, is a federal offense under Mexican
law punishable with several years in prison. Second, as long as any
visitors, in this case to TJ's red light district, were to follow the safety
guidelines in the Brockoton O'Toole TJ FAQ no
American visitor should fear any type of wrongdoing on his person.
This was pointed out to the author
of the misleading messages, who, as a childish response, "trolled" ASPT
with a series of racist (anti-mexican) messages, and forged the e-mail
addresses of several ASPT regulars in more racist messages to all kind
of newsgroups (he had, and still has, a particular penchant for posting
anti-semite messages to many crossposted newsgroups.)
His messages, from day one, got
him on trouble. I organized a complaint task force with the purpose of
curbing his abusive behavior. This effrot got him off from American On
Line THREE times (yes: he lost THREE accounts on AOL for repeating this
behavior.) Then we got him off Earthlink.net TWICE (and they no longer
allow him to get back on their service.)
His "tactic" to post to UseNet is
well known to the regulars at ASPT: most of the time he gets one of those
web-based free e-mail accounts (He's particularly fond of I-NAME,
although he has also used Hotmail.)
He then uses the anonymous e-mail address to post his garbage through the
DejaNews web-to-UseNet gateway, hence
partially shielding himself from being recognized. (I should add that we've
gotten him off DejaNews a few times by sending complaints to DejaNews'
webmaster.)
Too bad DejaNews will post the originating
ISP address of the user, thereby marking the culprit's ISP for us, and
clearing the way for us to send our complaints.
When DejaNews cuts him off he simply
changes the settings in his 16-bit version of Netscape with his "identity"
info, or with forged information about me or any other of the regulars
of ASPT. This was probably the case if you found an offensive message under
my name.
This kid has a very unhealthy obsession
with getting *me* in trouble, since I was the one who, since day one, criticized
his misleading posts and, eventually, led the efforts to get his ISPs to
terminate his accounts. In other words, he's holding a very infantile grudge.
That's why you'll see, as long as he is online, forged messages with my
name, but authored by him.
However, it is all too easy to spot
the forgery from the real thing simply by looking at the post's HEADERS.
Notice, for example, this copy from one of his messages sent to UseNet
through an account he got with JPS.NET:
Date: Sat, 18 Oct 1997 20:57:19 -0700
From: EL CHAMUCO
Organization: http://www.geocities.com/Baja/9664/tjgal1.htm
Message-ID: <3449851F.62F7@legalizit.com>
X-Mailer: Mozilla 2.02 (Win16; I)
Newsgroups: alt.sex.prostitution.tijuana
Subject: You should carry MACE in
TJ! asp aspt
NNTP-Posting-Host: istk-port747.jps.net
Path:...news.bbnplanet.com!news.pbi.net
!blush.jps.net!istk-port747.jps.net |
First sign of forgery: he
put "chamuco@legalizit.com" in the FROM line, which is what he thinks is
my real address. I NEVER use my real address when posting to UseNet to
fend off SPAM.
Second sign: Notice how he
put the old address of the picture gallery in the CHAMUCO webpage in the
ORGANIZATION line. I NEVER do that. I ALWAYS put "Fake Organizations Inc."
(and something tells me after he learns I put this warning he'll change
the organization line too. Very predictable.)
Third sign: The X-MAILER
line says the newsreader he used to post the message was Netscape Navigator
version 2.02 for windows 16 bit (3.x). Too bad I use Netscape COMMUNICATOR
4.03 for win 95. Prior to this I used the Navigator 3.0.
(UPDATE:
The little kid finally
upgraded his version of Netscape Navigator from version 2.02 to version
3.04 GOLD (wow!). Too bad his new version of Netscape is STILL for
WIN 16 bit, as the headers in his messages clearly say.)
Fourth sign: The SUBJECT
line is something I would NEVER put in a message to UseNet. If you read
my law and custom section you'll know why. The
same goes for racists posts. Being Mexican I find racism to be disgusting.
Fifth sign: The NNTP-POSTING-HOST
line. This is THE one thing which always gets this kid in trouble. In his
forgery it says it came from jps.net. That's NOT my ISP, nor the NNTP host
I use to post to UseNet. By the way; in a later post, which he sent through
DejaNews, the NNTP line read as coming from IP address 208.25.50.185, which
comes from machine used by SPRINT--who
gives the Navigator 2.02 with its introductory CD. Turned out Sprint allowed
JPS net to use their NNTP server. Later on MCI allowed the use of their
NNTP server. Being JPS.NET a relatively small ISP, this is only logical.
Sixth sign: Lastly, the PATH
line ends with jps.net, meaning the message orignated from that machine.
As I said before, jps.net is not my ISP nor I use their machines.
His messages posted from DejaNews
can be identified because of the address he uses, which are usually with
some sort of racist tag. One of his most obvious uses of racism came with
his "disraeli48@hotmail.com" address. Notice his racism in trying to mislead
people into thinking jews are troublemakers. The second mark in his DejaNews
posts is the "X-Originating-IP-Addr" line, which says the message came
from IP address 208.25.50.185. Doing a search on INTERNIC
you can see that address belongs to SPRINT. Again: Sprint at that point
was providing NNTP and IP machines for JPS traffic.
WHO IS THIS CRETIN?
In ASPT he is known as "The Hemorroid"
(for obvious reasons.) He is a kid from San Francisco (we calculate his
age around the early teens in light of the content of his messages and
his behavior online.) He has TOO much free time on his hands, TOO little
places to go, NOT too many friends, and, judging from his behavior, VERY
incompetent parenting.
He used to identify himself as "Tom
Wong" and described himself as being "Chinese." We don not know if he was
telling the truth, but since he has posted several messages praising Asian
cities as being superior to Mexico we feel there could be weight to the
claim (though it could also mean he's trying to bismirch people of Asian
origin or descent by acting like a jerk.) What we DO know is that once
one of our correspondents caught him in AOL and he identified himself as
"Tom." He has used MANY e-mail aliases, the most famous of which was litigator@cyberdude.com.
Whichever the case he's just a kid
who needs a good spanking--and apparently losig 5 internet accounts is
not enough. It should be noted that he has posted MANY racist messages
to ethnically-oriented newsgroups, and he has even posted anti-black messages
in white supremacist newsgroups (under different e-mail aliases, but many
times as "Tom Wong.")
WHAT TO DO ABOUT HIM
A few things can be done about him.
If you want to cut his access to DejaNews write to their WEBMASTER
and explain the case. They WILL cut his access. All you need to do is to
send them a complete copy of an offensive/misleading message posted by
him through DejaNews and explain the post is abusive and off-topic.
The second thing you can do is to
send copies of his offensive message to his current internet provider with
the explanation. Point to the irregularities in his headers if the message
is a forgery and report him for USENET ABUSE. Make sure you mention the
message is offensive, and off-topic. If the message originated from DejaNews
then make sure you point to them the IP address header.
Another thing you can to is to report
his use of the I-NAME or HOTMAIL
address for abusive purposes (that IS what he's using the address for,
since he CAN'T use the DejaNews engine without an e-mail address.) Using
the address for abusive purposes will get his e-mail account terminated.
As of the second week of November
of 1997 the little creep was still posting garbage from JPS.NET. If they
haven't terminated his account already, and you find that the message you
found from him was posted from there, you can send your complaints to abuse@jps.net
and they'll look into it.
(UPDATE:
His JPS.net account was terminated by March of 1998 due to the amount of complaints filed against him.)
If he were to change ISPs then simply
look at the headers and send the complaints to the respective webmasters. |