Internet trolls flooded UC Irvine chat groups with gore. Then students mounted a counterattack
At the start of a new quarter, many UC Irvine students join communities on the instant messaging platform Discord to swap notes, chat about local restaurants and form interest groups. But on the second day of class this winter, internet trolls spouting alt-right and transphobic language raided those channels, flooding them with images of gore.
Some of the images included photos of a dead man’s head, Islamic State bombing videos, a decapitation and violence against children and pets, said Alina Kim, an independent manager for UC Irvine’s student-run communities on Discord.
Several students vomited after seeing the graphic visuals, according to Kim, who said “there were many traumatic responses to the blood and gore.”
But the students and alumni who use the channels banded together, turning from victims into combatants to fight off the trolls, said Kim, who stopped short of claiming the counterattack completely thwarted the so-called gore raids.
“We’re hesitant to say their attack has ‘fully stopped' because we don’t want to encourage the groups to come back,” Kim said Tuesday. “What we can say is that we haven’t had any incidents over the last 48 hours.”
Read more: Faculty call for overhaul of how L.A. community colleges respond to sexual harassment
About 3,000 users on 30 to 40 servers were affected, and the raiders unsuccessfully attempted to hit 70 more servers, according to Kim. The incident was first reported by the Orange County Register.
As the chaos began around 9 p.m. Jan. 9 across the UC Irvine Discord servers, some community creators were unaware of what to do and three to five servers that included years of history and notes were deleted, Kim said, adding that the mathematics server "got hit hard."
The computer science Discord was targeted with a couple of videos but quickly responded to block the content. Other servers were loaded with images as moderators were offline for hours, according to Kim.
Along with the images, the Discord raiders demanded a $1,000 ransom, which bewildered Kim.
“It sounded like a joke because it was such a little amount,” she said.
Instead of money, Kim believes the trolls attacked for notoriety.
Read more: Blue Shield of California customer data stolen in cyberattack
“As far as we can tell, we think this attack was motivated by attention,” Kim said. “We’re not identifying the groups responsible for this action.”
UC Irvine’s Discord community may have been a target because of its size: Over 30,000 users exist across 500 school-affiliated servers, according to Kim. Her own community, the computer science Discord, boasts 7,600 users, almost 5,000 more than UCLA's, she said.
Kim believes three groups are involved and has classified them as “anti-trans and alt-right,” saying that those carrying out the raid specifically searched for transgender students and used slurs. Many of the raiders whom she and others identified also belonged to anti-trans social media groups, she said.
Because Discord is a public-facing, non-university platform, there was very little user verification prior to the attacks, Kim said. Anyone can easily join servers through invitations sent in emails or posted online, and a school-affiliated email address was not necessary.
Since the attack, some Discord server moderators have enabled two-factor authentication through cellphones.
After Kim warned other server leaders of the attacks, she said, many of them shared user IDs of the attackers so that moderators could block the raiders preemptively.
Biomedical engineering student Vietbao Tran then went on the offensive, creating a Discord bot that automatically banned those IDs before channel moderators could. The bot eventually was used to protect the 98 largest servers, according to Kim.
“It was an incredible response because he worked through the course of 24 hours and it was so incredibly helpful,” Kim said.
Kim and other UC Irvine Discord leaders also reached out to student groups at Washington State and USC, which received similar attacks.
Read more: UC Berkeley makes dead-of-night push to wall off storied People's Park
In a statement about the attack, UC Irvine officials said that because the servers are independent, the university was not involved in their security.
Officials are offering assistance to affected students, however.
“The university offers information security training and resources, and encourages members of the community to engage in cyber hygiene best practices including use of strong passwords and awareness of phishing attacks meant to harvest confidential credentials,” the statement read.
Michael Dennin, UC Irvine’s vice provost of teaching and learning, said in a statement that counseling was also available for students.
UC Irvine Discord moderators were collecting evidence and user IDs to submit to the FBI's cybercrime division, Kim said.
"We're not back to normal, but we're getting there," Kim said. "I'm proud of how our students responded, and we came together and handled it."
This story originally appeared in Los Angeles Times.
