URL http://www.hyphenologist.co.uk/killfile Last modified 3 Nov 2002
This FAQ describes what a Troll is, what they do, what can be done about them, together with some suggestions as to why they do may it. Other FAQs on similar subjects, have not covered the ?philosophy? and ?organisation? behind this phenomena, and have not covered the intent of destruction which is now evident.
While every usenet user has been the victim of Trolls, very few have had the opportunity to study many thousand troll posts and look for patterns. They are therefore unaware of the methods used. It is important that all usenet users have access to as much information as possible. A person who has only experienced the Crosspost Trolls in a Sub Target newsgroup will naturally suggest inappropriate measures.
I have only included things which the Trolls have demonstrated that they are well aware.
This FAQ is coordinated by Dave Fawthrop <firstname.lastname@example.org>.
This FAQ is held at http://www.hyphenologist.co.uk/killfile. Feel free to incorporated the URL into sig files, web pages etc, and post in full to any newsgroup which has problems.
3.1 The old definition
3.2 The Irritating Troll
3.3 The destructive Troll
3.4 The nasty Troll
3.5 The evil and illegal Troll
3.6 How they are organised
4.2 The crosspost Troll
4.3 The request for assistance.
4.4 General nastiness
4.5 Personal attacks on individuals and groups.
4.7 Setting X-No-Archive: Yes
4.8 On Topic Trolls
4.9 Disrupting usenet
4.11 They read newsgroups
4.12 Generate splits among subscribers
4.14 Threaten to infect computers with viruses.
5.1 Ignore them and they will go away?
5.2 Use a Killfile
5.3 A moderated newsgroup
5.4 A purely robomoderated newsgroup
5.5 A Yahoo Group Listserver
5.6 Cancel posts
5.7 LART (report to ISP)
5.8 Trim the newsgroup line
5.9 Give them a good st*ff*ng
5.10 Follow up the offending posts.
5.11 Digitally Sign Posts with PGP.
5.12 Continue posting On Topic posts to the newsgroup.
5.14 Tempt them back into the mainstream of usenet
5.15 Reclaim Troll threads
6.1 The Infant or Attention Seeker theory
6.2 The retired bitter old person theory.
6.3 The insane person theory.
6.4 The just evil theory.
6.5 The sad git theory.
6.6 The loser theory.
7.1 Target Newsgroup(s)
7.2 Sub Target newsgroup(s)
7.3 Old Target newsgroup(s)
7.4 Troll communications newsgroup(s).
7.6 Morphed Identity
7.7 Morphed Subject
7.8 K00k or kook
There are four basic types of Troll.
The old definition of a Troll is one who posts to generate the maximum number of follow ups. These are a very minor irritation, and can be considered to be advantageous to newsgroups.
Some merely post drivel, or tirades against netnannies and netcops, often at a BI of over 20. In general they cause little real damage to newsgroups.
In about the year 1999 a new breed of Troll appeared who have the declared intention of destroying a specific Target newsgroup. This is done by a variety of posts, (see Section 4) intended to drive normal posters away from the specific newsgroup.
When the percentage of Troll posts, including followups exceeds about 75% of the total posts, most readers seem to just give up and unsubscribe. Usenet, and particularly the uk.local.* hierarchy is for most users a hobby and if that hobby ceases to be enjoyable, the obvious answer is just to find another hobby.
Once a specific Target newsgroup has been laid waste as was uk.local.birmingham it becomes a Old Target newsgroup, This happened in about February 2000 it is being maintained a wasteground by crossposts from the current Target ng.
Alt.astrology.metapsych at the time of writing is totally destroyed by destructive trolls. This is
Here is a useful FAQ that explains what has happened to the group I created alt.astrology.metapsych: http://www.hyphenologist.co.uk/killfile/anti_troll_faq.htm
If anyone does anything which will interfere with the troll's ability to cause mayhem, they can become very nasty, posting from obviously incorrect variations of the name etc. insults, call them netcops, netnannies, homosexuals.
Various off usenet methods are also used to force the victim to stop posting: Subscribing the victim to hundreds of unwanted pornographic email newsletters, and sites. Complaining to employers about non existent misdemeanours. Sending garbage emails without indication of sender. Telephone calls at dead of night. Harassing the close relatives of victims.
If anyone does anything which will interfere with the troll's ability to cause mayhem, they also forge posts in that persons name and internet address and libel them on usenet. Both these are illegal.
They use private listservers to communicate between themselves. An archive of one such listserver is at http://www.uklocaltrolls.fs2.com. For less important communications, they use Troll Communications newsgroup(s).
The listserver must have an owner(s) who can approve or deny access. Other than that anarchy reigns where each member does what he/she thinks fit. Thus because no leader or committee exists coordination with the group is impossible. Any agreement reached with one or more can instantly be abrogated by others.
Coordinated action can occur where it forwards their general aims.
There are several quite formalised methods of trolling.
Non of these actions occurring singly or in moderation indicate a troll attack. When they occur in combination or large amounts they may indicate a troll attack.
Posts without interesting content are simple to produce. Cascades have a long history on usenet, usually containing wordplays round a specific theme. The Trolls version is a cascade of drivel. two persons working online to the same newsserver can throw a thread between themselves and create very large numbers of posts. One person can throw a thread between two or more sockpuppets.
This is perhaps the most effective Troll in that it produces large numbers of posts with little effort from the Troll. An inflammatory post is made to a group of Sub Target newsgroups, say cooking, politics or guns. The Target Newsgroup is included in the ng list. The innocent posters to the Sub Target newsgroup continue to discuss this in the normal way without noticing that the posts are also going to the Target Newsgroup.
This is commonly combined with The Request for Assistance troll.
This is similar to The crosspost Troll but it is crossposted to Troll Communications newsgroup(s). Thus any Troll subscribed to a Troll Communications Newsgroup(s), may troll newsgroups to which he/she is not subscribed.
An example <sniped> where uk.local.yorkshire is the
Target newsgroup is:
From: "Sharon Thorman" <Sharon@hotmail.net>
Newsgroups: alt.golf.perfect-impact,alt.fan.karl-malden.nose, alt.alien.vampire.flonk.flonk.flonk,alt.redheads,
Subject: Re: Troll Owned and Operated
Date: Wed, 28 Aug 2002 10:36:57 -0400
Organization: Altopia Corp. - Usenet Access -
xganon <email@example.com> wrote in message
> Please add alt.golf.perfect-impact to all x-poastes.
> We need traffic to be eligible for valuable prizes.
It is commonly combined with The crosspost Troll
The Target newsgroup is flooded with nastiness, name calling and swearing, and flame wars, mostly between themselves. This can be a great off put to new subscribers.
An interesting variation is for one of their number purports to object to swearing, while encouraging others, off newsgroup, in the practice.
Selected individuals are subjected to quite vicious personal attacks throughout usenet. Examples are: "fucks animals!" "is a cannibal" "is a hermaphrodite!" "is a molester of boys" "in panties gets fucked up the arse" "is a Nazi!" "is a cocksucking queer" "is a hermaphrodite just like Maryanne Kehoe" "molests boys on American Airlines" "Sexually harassed by" "is an anthrax pervert" "AT GAY PARTY" "sucks his father's cock" "is a pervert" "hated wherever he goes!" "White Racist" "Usenet spammer!" "Usenet k00k!" "I hope you die SOON".
As will be seen several of these are libelous, and thus illegal
Groups such as the regular posters are attacked similarly,
They regularly forge the identities of posters who they do not like. This can vary from badly spelled versions of their name and/or email address, to forgeries which the average reader would not be able to detect.
At times this can reach a bizarre condition where they troll using a forged identity at a Breidbart Index of well over 20. They then at every opportunity call the victim a troll.
Larting the offender is often effective because ISPs recognise the seriousness of this offence.
Where Forgery is done via an anonymous remailer complaints to abuse@thelastremailerinthechain may well be effective. The remailers administrators do not like their facilities being misused, and have ways of combatting this. It is also worth registering with http://www.paracrypt.com/remailerabuse/
There are several usenet archive sites where posts are kept for ever. If one is doing something underhand, illegal, or very nasty, it is an advantage to do the dirty deed, create mayhem, and then let all evidence disappear when the servers delete the posts when they are 7 days old or whatever limit is set on that server.
This can be compared with a town centre with CCTV cameras, where the vandals begin a systematic to trashing of an area by disabling the CCTV system.
When combined with other practises in this section X- No-Archive: Yes can be particularly damaging.
A bizzare troll post has emerged where On Topic posts are used to troll a newsgroup.
There is a WWW site which contains out of copyright Yorkshire Dialect poetry and readings. This site has been copied and each poen individually posted to uk.local.yorkshire in a single day.
This is very irritating but disobeys no ISP or Usenet rule.
Several other variants of this troll have been seen.
Usenet and its procedures were designed in the days when usenet was a group of likeminded organisations and individuals, working together to create a worthwhile whole. It was not designed to withstand sustained attack by those intent on destroying usenet.
The Trolls disrupting usenet by using the holes in existing rules to harm usenet. This is normally done in the *.config and *.management newsgroups.
This is a program which splits a large file into sections and creates an individual post from each section. It also has other functions, not relevant here.
On one particular night they posted 1700+ posts a total of 30Mbytes+. On another ocasion they posted many identical copies of freeware programs each copy being more than 100kBytes long.
That they read newsgroups is on the face of it obvious. They are thus privy to any discussions about countermeasures. It is clear that they adjust what they do to reduce the effect of countermeasures, and further their general aims.
Any tensions within a newsgroup are deliberately increased.
The Trolls often demand the right to post anything and everything to a newsgroup. If anyone or any group opposes them they threaten to continue, for longer.
They regularly threaten to infect opponents computers with Viruses and/or Trojans. It is difficult to prove where a
Virus or Trojan originated, so I cannot prove that they have
ever carried out this threat.
Running one of the commercial anti virus programs to permanently monitor incoming newsgroups, email, etc is always a Good Thing and to be recommended.
The actions taken by a person, or a group, against Trolls depends on many factors, technical expertise, personality, equipment available to name but a few.
Almost all newsreaders will kill individual threads and/or posters. Some have more complex, and
wide ranging facilities.
Below are listed some possible actions with advantages (Pro) and disadvantages (Con) given for each.
This is the traditional usenet method of dealing with Trolls, and is regularly suggested.
It is similar to the method use to train dogs, and very young children, ignore bad behaviour and reward good
behaviour. Thus it is only likely to work if the, The Infant or Attention Seeker theory, is true
If you are subscribed to a Sub Target newsgroup this is quite a reasonable method. The normal change of Sub Targets will ensure that they do "go away", convincing you that this is an effective way of dealing with the problem. It however leaves the Target newsgroup in exactly the same mess as it was before.
If you are confronted with a minor attack by merely Irritating Trolls, or
inexperienced and disorganized Trolls, this may also work.
If you are subscribed to a Target newsgroup, this is impossible, as up to 90% of posts may be trolls. As the Intention is to destroy the Target Newsgroup, they will *never* go away.
On any newsgroup there are a mixture of subscribers, non of whom has any ability to control the postings of other subscribers. Human nature dictates that someone will *always* reply to a good troll. Arguably this section should be headed "If *everyone* ignores them and they will go away." which is arguably impossible to attain.
In the case of uly after a full week of almost total ignoring of a specific
troll made him so angry that he
invited in other trolls. After that a massive and damaging attack began.
uk.local.yorkshire contained this telling sentence. "Most people like the countryside, but not everyone is willing to tread shin deep through pig shit to get to a meadow."
There is a killfile FAQ at http://www.hyphenologist.co.uk/killfile giving information about how to use killfile facilities many newsreaders.
One only sees posts from each thread, or by each Troll, Sockpuppet or morphed identity a few times to determine the true nature of the poster.
You might miss something important, such as a libel against oneself. However an important post will usually start a thread and you may well see someone else's follow ups.
It takes quite a bit of effort, and knowledge for someone subscribed to a Target newsgroup to maintain a killfile. For someone subscribed to a Sub Target maintaining the killfile is easy, and recommended.
Very few posters know of the existence of killfile facilities, and some cannot handle them when pointed out. The old hands on usenet can not understand why newbies cannot do what the old hands find so simple.
Even very technically savvy, usenet hands are often unwilling to subscribe to the Target newsgroup. The hard grind of keeping the killfile working may be considered more bother than the subscription is worth.
A Moderated newsgroup is almost impossible to troll.
misc.kids a newsgroup for parents and carers for kids, rather than the kids themselves, had trolling problems as recorded in http://www.misckids.org/history.txt
>>> The misc.kids.moderated effort began sometime in the summer of 1996, when a regular poster to misc.kids, Roger Hunt, suggested to the newsgroup, as well as others who were former regular posters, that we establish a moderated alternative to misc.kids. This time, unlike previous occasions when this type of suggestion was made, many people seized upon the idea. Misc.kids had suffered several troll invasions; many regular and trusted posters had left; and the level of discourse had declined. Colleen Porter did a straw poll on some issues related to creating a new newsgroup and got 199 responses. Those responses have been
thoughtfully considered throughout this creation process and form the basis for much of what appears in the RFD. <<<
Towards the end of 1997 misc.kids.moderated was created see: http://www.misckids.org/
After the creation of misc.kids.moderated the level of destructive trolling of misc.kids fell drastically. At
the time of writing, misc.kids.moderated is a small but thriving newsgroup, also misc.kids is a large newsgroup, but riven by On Topic disputes. On a superficial examination it could be concluded that the creation of mkm was a waste of time and effort, because mk now has only minor problems. On a deeper examination, it could be concluded that the existence of mkm protects mk from the worst of the outright
trolling, presumably because in the case of drastic problems, subscribers could move to mkm.
It works and is a traditional usenet method of solving the problems of troublesome newsgroups.
It requires a permanently on line machine. It requires a moderbot to handle much of the work. It requires a team of moderators ideally about six to handle posts which the moderbot does not approve. It requires a very well written charter, with specific moderation guidelines, otherwise the moderators will end up accepting or rejecting posts on personal preference. The Trolls will try to become moderators, and cause mayhem. Changing from a non moderated to a moderated newsgroup is *extremely* difficult. A new newsgroup with the same name but .moderated would normally have to be created. This would need an RFD and vote in the uk.* hierarchy, if that is where the newsgroup is to be situated.
A purely automatic moderation system which will reject all crossposting. Also limit the number of posts which can be made by a single poster in a day, and similar problems.
This is being discussed at the time of writing on uk.net.news.config subject: RFD: uk.net.news.beginners
It might work, or at least improve matters.
It requires a permanently on line machine.
It requires a very well written charter, with specific moderation guidelines,
Changing from a non moderated to a moderated newsgroup is *extremely* difficult.
A new newsgroup with the same name but .moderated would have to be created.
This would need an RFD and vote in the uk.* hierarchy.
Nobody knows how well it would withstand an onslaught by determined and well organised Trolls.
If things get too rough the existing group of posters could move to an invitation only Yahoo Group, or a UK Yahoo group. This has been done successfully with uk.local.yorkshire where most of the posters have moved to
Tykesground, which provides respite from the continuing Trolling problems, but uly has not died, because many post to both forums,
The Trolls can be effectively kept out.
The group of reasonable posters is kept together.
Yahoo posts do not thread as usenet posts, on some newsreaders. The list owner is Ghod. He/she must be trusted, and treat the group with a light hand. People get bored, lose Internet access, die and so on, and thus unsubscribe. In the longer term, new recruits must be found or the group will wither and die.
The Trolls have effectively won, and the newsgroup will probably wither and die.
The Trolls hate it and treat the Yahoo group as an affront to the their ability to control the Target Newsgroup. They will fight harder, and *never* go away.
All usenet groups need new blood to replace people who get bored, move on, die, loose access to the net etc. etc. Getting new subscribers to a closed group is difficult.
Traditionally posts which exceed a Breidbart Index of 20 or any of the other usenet rules may be cancelled.
For unix users, there is a system NoCeM which lists posts with a BI above 20, and prevents you from downloading them.
It gets rid of offending posts.
The Trolls hate it.
For forgeries of oneself there is good justification for cancellation.
Cancelling other peoples posts is not for the uninitiated. Cancellation does not work on all newsservers. It must be done quickly, or it is not worth doing. The posts get to the users machine where cancellation has no effect, harm is done before the canceller sees the post.
Most troll posts are not strictly against the usenet rules and guidelines. In these cases, it is difficult to justify cancellation.
Where a Troll breaks the rules of usenet or their ISP an email or "LART" to abuse@ISP,name will often persuade the ISP, newsserver operator, or their upstream providers to cancel a users account.
It often works. It is traditional usenet practice.
Free ISPs are ten a penny, and the Troll can easily get another account and continue as before.
Some Trolls can have several paid for internet accounts.
Some of the worst trolls take care not to break their ISPs Terms and Conditions, or usenet rules. ISPs are reluctant to act without evidence of an offence.
With the crossposting Trolls one can follow up the posts asking only those in the Sub Target newsgroups to trim the newsgroup line, when following up. Remember not to ask the Troll Communications newsgroups to trim the newsgroup line.
It reduces the inadvertent crossposts by up to 90%
The Trolls notice that it has been done, and replace the crossposts.
Newbies, do not have a clue, and ask what on earth you are talking about.
This is the preferred method on uk.rec.motorcycles, a robust newsgroup.
It is very satisfying.
Some would say that it makes things worse because it gives them the attention which they crave.
At best it becomes a war of attrition. In the Target newsgroups there is nothing to loose, so one might as well try to wear them down.
It is always possible to follow up troll posts.
For forgeries of posts in your name, and libelous posts, A follow up is an effective rejoinder, because of the ineffectiveness of Cancel posts.
For The Crosspost Troll, warning the Sub Target newsgroup(s) of the list of crosspostings, is effective in reducing the damage.
For The Request for Assistance Troll, only the Target Newsgroup and the Troll communications newsgroup(s) will see the followup so they are not effective.
For combined Crosspost Troll combined with a Request for Asistance Troll, only the Sub Target newsgroups should be warned.
In general just following up is not a good idea.
If forgery is a problem, one can sign posts with Pretty Good Privacy. This is free for non commercial use and may be found at http://web.mit.edu/network/pgp.html. There are USA and Non USA versions available. Non USA users should ensure that they get the non USA version.
This does not stop the forgeries, but does allow the reader to check if a post comes from the person it appears to come from.
Continuous surveillance of incoming email etc. for viruses and trojans is essential for those using a PGP sig. If your machine becomes infected with a backdoor trojan the digital sig may be compromised.
Those who find themselves subscribed to a Target Newsgroup, can agree amongst themselves that they will not be driven away by the Trolls. If they just keep on posting On Topic posts, the Trolls can never totally win. Better, new subscribers will find something interesting to read amongst the dross, and filth.
If someone includes the URL for the killfile FAQ http://www.hyphenologist.co.uk/killfile in a sig, and perhaps posts the whole thing weekly, new subscribers will learn very quickly how to use killfiles, and so not see the trolls.
When a ng is troubled by trolls it is always possible to just unsubscribe.
From a purely selfish point of view this is by far the easiest thing to do. You can happily transfer your subscriptions to less troubled ngs. Problem solved!
From the point of view of usenet as a whole, it is absolutely the worst possible course of action. Whether the
trolls are the infantile kind with a strange sense of fun, or the evil kind intent on destruction, the result will be
the same. No On Topic posts, lots of ridiculous troll posts, dead newsgroup.
This is what happened to uk.local.birmingham, when a group of reasonable posters including Iain Bowen just
unsubscribed. It has never recovered.
Trolls sometimes post reasonable things, these can be followed up
It may improve matters.
Those who believe in a strict "ignore them" policy will not use this.
There is sometimes a small point of general interest in troll posts. Careful snipping and follow ups can create interesting threads.
It irritates the Trolls.
Reasonable posters may already have killed the threads
Two forms of retromoderation already exists on usenet, namely:
Spam canceling. This function is not automatic at the
time of writing. Spam is *detected* automatically but the
canceling is done manually by volunteers.
Also binaries, except tiny ones, posted to text newsgroups
are automatically cancelled.
It would be possible to write scripts which would
automatically detect and cancel posts to any specific
newsgroup or newsgroups which contravene some parts of the
Examples would be excessive crossposting, and perhaps
It may be effective against crossposting
Most Troll activities could not be reliably detected
automatically. A human retromoderator would have great
difficulty determining exactly if a specific post was
to be cancelled.
Retromoderation is intensely disliked by usenet generally.
The Troll communications newsgroup(s) used changes rapidly
It would be impossible to list, Troll communications
newsgroup(s), in a charter because the trolls would just use
a different newsgroup.
No one knows why the Trolls act as they do, but there are several theories. Clearly an individual Troll may be in one, or several of these groups, or indeed in none at all. It is difficult to believe, but possible, that a totally normal person would become a Troll.
Some believe that the trolls are just adults who brains and morals have not developed beyond childhood, and they are just behaving as attention seeking children.
There is evidence that some Trolls are retired persons, with a good pension and little to do with their lives. They may have suffered a personal loss such as the death of a much loved spouse which warped their outlook on life.
This type is particularly dangerous, because they may have ample funds to buy computer equipment, own multiple domain names, and multiple access to the internet. Worse they may have, say 8 hour per day to invest in their "hobby".
Some Trolls may be clinically insane, indeed one posts as Mogadon John which may indicate that he/she is taking this *major* tranquiliser, or it may just be a joke.
There are people in this world who enjoy destruction. Some enjoy murdering children. Some enjoy sexually abusing children. Some Trolls may be in a similar category.
There are unfortunately people with such restricted lives that they cannot think of anything useful or constructive to do with the powerful and expensive kit which they are using.
This theory is that the Trolls are just losers who cannot succeed in anything in their real lives. They can however disrupt usenet with relative impunity.
Some of the terms used may not be familiar to all readers, and indeed I have been forced to invent some definitions.
The newsgroup(s) which they are attempting to destroy, at the time of writing, May 2002, two are uk.local.yorkshire
and comp.os.linux.advocacy (thanks to mjcr)
The newsgroups(s) which they are using to flood the target newsgroup with Off Topic posts. These are continuously changed, examples are the cooking newsgroups, the guns newsgroups, and the political newsgroups. All of which may be relied upon to follow up inflammatory posts which are on topic to them, but off topic to the Target newsgroup.
The newsgroup(s) which have been made into a wasteground by the Trolls, and are being maintained so by using crossposts from the target newsgroups. At the time of writing, end 2001, one is uk.local.birmingham.
These are ngs used by the trolls for non important communications, such as the Request for Assistance. Typical ones are alt.troll, alt.alien.vampire.flonk.flonk.flonk, alt.fan.karl- malden.nose, alt.hackers.malicious. If a troll is subscribed to one of these he/she may assist in trolling many Target newsgroups, using the request for assistance troll. The ngs used for this purpose change regularly.
A Sockpuppet is when a poster has several usenet identities, either just different names and email addresses from a single account. Alternatively several email identities with valid email addresses and email accounts.
A morphed identity is when a poster has one usenet identity, which changes in detail, to outwit killfiles. For instance the name may remain the same and the email address change, or the name and/or email address may contain accented characters which are changed for different versions of the same letter.
A morphed Subject: is when a poster changes the subject line, in some visually insignificant way in the middle of a thread to outwit killfiles set to that thread.
A general insult used by Trolls. One who displeases or opposes Trolls
Using a search engine such as http://www.google.com/ is the best way to obtain up to date information on Trolls, but some worthwhile links are included here.
Google Usenet and Bulletin Board Abuse
The Art of Lart
List of Abusive ISPs
This article is provided as is without any express or implied warranties. While every effort has been taken to ensure the accuracy of the information contained in this article, the author/maintainer/contributors <take your pick> assume(s) no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein.
Dave Fawthrop <firstname.lastname@example.org> <http://www.hyphenologist.co.uk> Computer Hyphenation Ltd, Hyphen House, 8 Cooper Grove, Halifax HX3 7RF, UK, Tel/F/A +44(0)1274 691092. M: +44(0)7720455248, 16 years of Word Splitting. Hyphenologist is sold as C source code and splits 50 languages.