On November 10, 2020 a Twitter user with the handle "@oto666yamaguchi" [1] and the screen name "Duncan Lemp"[2] claimed to have been "wardriving antifa rioters, letting them associate with mobile honeypots to access internet" so they could "look at their traffic." Included in the tweet was a network diagram that outlined what the poster purported was a Portland "antifa" network derived from the data culled from this alleged collection of wifi signals.
Keen-eyed Twitter users familiar with the technological limitations of identifying individuals as described in the tweet, however, were quick to debunk this premise. The network diagram, at best, was merely representational of publicly available data from social media networks. Nevertheless, the diagram put the spotlight on names of real people in what was obviously an attempt to bring harm and negative attention to activists, protesters and politically active people who are not in agreement with the poster.
Perhaps more alarming was the additional dox information posted by "@Oto666Yamaguchi" in the tweet. At some point this user posted links to a file download that contained extensive notes on alleged activists in the Portland, Oregon and Asheville, North Carolina areas.
While this file of alleged dox material was quickly removed from Mega.nz hosting, it soon appeared at various other hosting services and torrents.
Word spread as well among various right-leaning and right-wing internet forums, with commenters often calling for violence against the exposed individuals.
We obtained this material in order to examine its contents, assess its potential for harm and hopefully pick up a clue on the person or persons compiling this information. What we found proved to be very interesting indeed.
What are in the files?
The 402.7 MB compressed file entitled "A ROSE BY ANY OTHER NAME" unzips into several folders containing PDF files and image files that contain information on alleged "antifa" and "anarchist" activists in the Asheville, North Carolina and Portland, Oregon areas. The introductory document states:
Research Conducted ~ Late 2018-19
Research Disclaimer:
Everything I am sharing here is purely as an investigative journalist interested in mapping the network of an idea, if you will. A completely unorganized, conglomeration of people who Joe Biden has assured the American people are not a threat and not an organization. So, I'm purely mapping the branches of the Idea tree. This information is shared with other citizen journalists and absolutely no harm should come to the subjects of this research from participating in lawful peaceful protests and free speech events.
I was not able to complete all the mapping. There is a core group of Rose City Antifa that all came up together. Little baby anarchists and crust punks. They brought in kids – like [REDACTED], who was probably 12-13 at the time that many of the old pics I found in their Facebooks were posted. They made the mistake of posting a Publicly visible group photo. They all show up in the YT vids from Portland riots starting 2016 and beyond.
They are surrounded by a much larger network of community activists, organizers, outreach folks, facilitators, etc. I was able to tag some of them as well. There is a huge image set that will have to go along with this. I’m not going to clean this up too much. There are lots of my personal notes here referencing their relationships and specific images. I’ll post the images to Mega as they are very important as well if you want to continue this research.
Remember, all of this was gained from my mad OSINT skills and their inept use of social media. And Facebook had different settings back then. FB has closed most of the holes I used to use.
I have tagged a lot of them as Antifa, Black Bloc, etc. Not all Antifa go out blocced up. Many are have support or admin roles. The ones I knew were into a specific thing, I’d tag them.
Take this and run with it. Write good news articles. Give the credit that is due to these heroes of the revolution!
Enjoy – R.
Although the writer states that "no harm should come to the subjects of this research," it is hard to imagine that this information was presented for any other reason. Each PDF contains extensively researched images and links pulled from social media accounts like Facebook and Instagram, as well as information likely retrieved from internet "people search" sites with residential addresses and phone numbers. This basically amounts to a list of individuals to harm and harass.
The contents of the dump are:
- "Rose City Antifa Starter Pack.pdf" (72 pages)
- "Asheville NC Auntie Fa – Master file part 1.pdf" (41 pages)
- "Asheville NC Auntie Fa – Master file part 2.pdf" (44 pages)
- "Codename Old School.pdf" (3 pages)
- [REDACTED].pdf (2 pages)
- [REDACTED].pdf (4 pages)
Additionally, there are over a thousand images collected from various sources, mostly from social media networks. There is some duplication in the collection. A typical page contains a list of individuals with images and notes on that individual.
Although the research appears to be relatively unsophisticated social media creeping, the fact that someone is targeting these individuals is worrying. It is obvious that whoever collected this information spent considerable time and energy on this project. Also of note is the author's particular concentration on members of the LGBTQ community, who are often described with slurs and disparaging terms.
This particular fixation on the LGBTQ community will play a role later in our investigation.
Accompanying the PDF files are folders of images compiled by the creeper. We used an image metadata utility to pull the metadata from these files and examine them. For context, metadata is basically "information about information." For an analogy, if a letter you write is the data, the addressee written on the envelope in which you mail the letter is the metadata. Files on your computer commonly have metadata to assist or enhance functionality. When we extracted the metadata from the 2,141 files in the dump we found that 1,446 of them were XMP tagged with a creator name "Chadwick Jason Seagraves."
To put it in perspective, 67.5% percent of the total files in the dump, a significant portion, can be attributed to a device or software associated with this name. Therefore it is fair to say that this name was worth checking out. We at the Anonymous Comrades Collective, however, do not jump to conclusions. We proceeded to investigate this lead.
Who is Chadwick Jason Seagraves?
We located a "Chadwick Jason Seagraves" residing in Garner, North Carolina. He is an employee of North Carolina State University in Raleigh, North Carolina where he works in IT for the university's libraries.
But we can't assume that the name "Chadwick Jason Seagraves" is unique, or that this individual had anything to do with the doxes. And it is, of course, possible that someone may have used his computer or software. It was necessary for us to determine how his name fit into the scenario. While examining the contents of the collection, however, we came across something that opened up our investigation considerably.
What we found was a screen shot image of a Twitter post that referenced other images included in this same collection. This tweet was a dox of minor by a Twitter user using the handle "@roostersghost" and the image metadata indicated that it was created at or just after the tweet was posted. According to the metadata, the creator of this file, like many of the others, is tagged "Chadwick Jason Seagraves."
As mentioned, the images posted in this tweet are also included in collection of images in the dump.
Looking through the Twitter timeline of @roostersghost, who claims to be located in North Carolina according the bio, we see that he has some interesting things to say about people of color, social justice activists, and perceived leftists. For example, in this tweet @roostersghost refers to young African-American men as "joggers," a racist reference to the killing of Ahmaud Arbery:
We have confirmed that Chadwick Jason Seagraves does indeed have a daughter that would have been two years of age at the time of this post. @roostersghost also posted the name of his daughter (which we have redacted) in this tweet:
We have redacted the image in the post in an effort to avoid an obvious connection to a minor's given name. To put the post in context, @roostersghost is making commentary on the ethnicity of a fictional video game character that shares the name.
We have confirmed this name by examining social media posts of persons in Chadwick Seagraves' personal circle.
In consideration of the information we have examined we are reasonably confident with naming Chadwick Jason Seagraves of Garner, North Carolina as both Twitter user "@roostersghost" and the compiler of the dox materials disseminated by Twitter user "@Oto666Yamaguchi."
This is Chadwick Jason Seagraves
As we mentioned earlier in this report, Chadwick Seagraves is an employee of North Carolina State University, working at NCSU campus IT as a Technology Support Services Desktop Support Team Manager. Examining the time-date stamps in the metadata of images tagged with his name it appears that he spent much of his time at work creeping on people instead of attending to the IT needs of the NCSU library system.
Now that we are aware that Seagraves is also the owner of the "@roostersghost" Twitter handle another troubling fact comes to light. On at least one occasion it appears that Seagraves doxed a student at his own university.
Seagraves began work at NCSU libraries in 2009. Being an experienced library systems analyst one would expect that Seagraves would have a better understanding of digital metadata, so it is with much irony that he slipped up with his own metadata.
Seagraves seems relatively quiet on social media regarding his affiliation with the Proud Boys hate group, possibly in consideration that it may affect his employment with a state university.
On Twitter, however, where he is (was) relatively anonymous, he is more vocal about his affiliation.
In fact, we found an archived tweet from Dec 12, 2017 in which Seagraves' Twitter bio read "State President: NC Proud Boys Official."
And we managed to find Seagraves at a 2017 Proud Boys rally in Chapel Hill, North Carolina chatting up neo-Nazi attorney and attorney-for-neo-Nazis Augustus Sol Invictus.
Considering all these facts, we feel that Chadwick Jason Seagraves of Garner, NC is a danger to our communities and a danger to the community of North Carolina State University, where he is employed. He has expressed violent racist, homophobic and transphobic views and is a member of the known hate group the Proud Boys. Furthermore, Chadwick Jason Seagraves compiled and disseminated extensively researched personally identifying information on persons for the purpose of harm or harassment.
Please write, call or email North Carolina State University and NCSU Libraries to inform them that their library services team leader has been using work time to creep on people and dox university students. [CORRECTION/UPDATE: we have been informed that Chadwick Seagraves is no longer affiliated with NCSU Libraries but is instead employed by NCSU campus IT as a Technology Support Services Desktop Support Team Manager]
Conclusions and further questions
In this report we have provided reasonable evidence that Chadwick Jason Seagraves is the individual behind the collection of dox material disseminated by the Twitter user "@Oto666Yamaguchi." There were no sophisticated techniques in his research; only time on his hands and a monomania regarding alleged "leftists," persons of color and LGBTQ individuals.
However, this still leaves the question about the identity of "@Oto666Yamaguchi" unanswered. We do not believe that Seagraves was the person behind this Twitter account, though he may have been working with this person. We expect that further information will come to light in the near future.
Thanks go out to our friends @utah161 and a special anonymous comrade for their contributions.