A pseudonymous hacktivist used the occasion of a hackers’ convention in Germany to take down white supremacist websites live on stage.
In a presentation at the Chaos Communication Congress in Hamburg, one of the world’s largest gatherings of cybersecurity experts and digital activists, a hacker know only as Martha Root remotely deleted the servers hosting three white supremacist websites: WhiteDate, WhiteChild and WhiteDeal.
All three were still offline days after the demonstration.
Power ranger
Root, dressed as the Pink Ranger from the Power Rangers, said that the action was born of frustration with the sites’ role in cultivating hate-based networks.
WhiteDate, described as a “Tinder for Nazis,” matched users based on racist criteria; WhiteChild targeted white supremacists seeking specific egg and sperm donors; and WhiteDeal operated as a gig-style labour marketplace for like-minded individuals.
During the presentation, entitled “The Heartbreak Machine: Nazis in the Echo Chamber,” Root, ran a live script on screen as s/he deleted the websites’ databases and backups in real-time, to applause from the audience.
Lax security
Root walked attendees through the AI-driven tools used to bypass racial verification checks on the sites and extract publicly available user information.
The data, which Root published online, revealed tens of thousands of user profiles, including photos, ages and precise geolocation data embedded in images, highlighting both lax security and the risks associated with using such platforms.
Before destroying the platforms, Root had deployed a chatbot trained to conduct conversations in the manner of the far right to gain users’ trust and collect as much information as possible before the admin noticed the platform had been breached.
The prompt for the model instructed it to demonstrate interest in “traditional family roles and heritage,” communicate amiably, and avoid sharing contact details before a personal meeting.
Cyber-terrorism
According to Root, WhiteDate’s security turned out to be “as bad as it gets”: the full list of users could be downloaded simply by opening a specific URL. As a result, s/he managed to obtain data from more than 6,500 accounts, about 86% of which belonged to men.
In an online post, the administrator of the three sites condemned the takedown as “cyber-terrorism,” vowing retaliation. Root has also claimed credit for temporarily removing the administrator’s social media account, though it has since been restored.
Supporters of Root’s actions frame the intervention as a form of direct digital activism against organised hate, while critics warn that unilateral takedowns of this kind raise legal and ethical questions about vigilantism in cyberspace.
A nonprofit archival collective, DDoSecrets, says it has received a large dataset from the sites, which it is making available to verified journalists and researchers working on extremism and cybersecurity.
