GNAA▊
A trolling collective that ran itself as a parody corporation — presidents, spokesmen, wire-service press releases — under a name built to be unprintable, so that every victory came with a bonus round: watching newsrooms try to report it. Its product line was the elaborate media hoax. It fed fake screenshots to the Mac press, a fake operating system to BitTorrent, a fake statistic to CNN, fake looters to the Daily Mail, and a worm to eight thousand Tumblr blogs — then issued a press release each time explaining, in perfect corporate deadpan, that the real story was how easily everyone fell for it. Its security wing found 114,000 email addresses sitting on an open AT&T server, and one of its presidents went to prison for it — until an appeals court threw the conviction out.
If there's one thing lacking from modern journalism, it is indeed integrity.
"Leon Kaiser," GNAA spokesman, in the group's statement on its Tumblr worm — iMediaEthics, December 2012. The group had just defaced thousands of blogs to make the point.
- WHO
- GNAA — internet trolling organization, founded 2002 by "timecop," a founder of the anime fansub group Dattebayo. Later presidents included Andrew "weev" Auernheimer, "Jaime Cochran," and "Meepsheep"; house spokesman "Leon Kaiser" FACT
- SCENE
- Slashdot comment sections, IRC, BitTorrent, Twitter, Tumblr — wherever a newsroom or a comment form could be baited (see Crew Rivalries and the scene timeline)
- THE DRAMA
- Two decades of engineered media failure: hoax "leaks," hoax statistics, hoax looters, a shock-page trap, a Tumblr worm — each followed by a mock press release taking corporate credit
- RECORD
- The pranks are documented in the contemporaneous press. One spun-off operation — Goatse Security's 2010 AT&T/iPad disclosure — produced a federal conviction (weev, Nov 2012) that was vacated on appeal (Apr 2014, improper venue; the court never reached the merits) FACT
- STATUS
- DISPERSED — sporadic claims of credit into the late 2010s, then quiet. The alumni network is another story
About the name, once, for the record: the acronym expanded to "Gay Nigger Association of America" — the group's own deliberately offensive self-name, which it claimed to have taken from a 1992 Danish satirical blaxploitation short film whose title carries the same provocation, and which it chose precisely so that polite institutions could not report on it without flinching. The group denied that the name reflected actual racism or homophobia, saying it was intended "to sow disruption on the internet and challenge social norms." That denial is theirs; the design intent — a name as a trap for anyone forced to say it — is the one part nobody disputes. This file uses the acronym, describes the shock payloads without reproducing them, and names no member beyond those who publicly named themselves.
the drama timeline
ACT I — THE PARODY CORPORATION (2002–2004)
A trolling crew incorporates itself as a bit: officers, titles, press releases — and a product.
-
2002
Founded, with org chart
The GNAA is founded by "timecop," also a founder of the anime fansub group Dattebayo. From the start the joke is structural: a shock-troll crew wearing the costume of a professional association — a president, an "interim vice president," a press office issuing announcements in flawless wire-service register. Even the roster was part of the bit; contemporaneous accounts note it was unclear whether there was initially any clearly defined membership at all.
-
2002–04
The product line: crapfloods and the trap page
The working method is industrialized nuisance: Slashdot and other prominent sites get "crapflooded" — comment forms buried under repeated words and phrases — and unsuspecting readers get baited into "Last Measure," the group's shock-page trap, which the record describes as opening "an endless cascade of pop-up windows displaying pornography or horrific medical pictures." This file describes that page; it does not reproduce or link it. Nothing about the toolkit is subtle. That is the point — the lulz are in the reaction, not the craft.
ACT II — THE HOAX MACHINE (2004–2007)
The crew discovers its true calling: not flooding the media, but feeding it.
-
JUL 2004
The Tiger "leak"
Days before Apple's WWDC, GNAA members submit fabricated "leaked screenshots" of the unreleased Mac OS X 10.4 Tiger to MacRumors, which runs them — the site's own coverage cites the GNAA as the source of the "leak," down to invented feature details. When readers cry fake, the group issues a press release insisting the screenshots are genuine. The hoaxed post is still up, a small museum piece of a newsroom sourcing an operating system from a troll crew.
-
JUN 2005
The fake operating system
The sequel raises the stakes from screenshots to software: the GNAA announces a "leaked" build of Mac OS X for Intel processors and seeds an ISO on BitTorrent. Tech media bite. Downloaders who boot it get no operating system — just a shock image. An entire hoax product, shipped, with distribution and a press cycle.
-
FEB 2007
CNN, live
On February 3, 2007, the group gets a hoax all the way onto CNN: a Paula Zahn segment airs a planted claim that "one in three Americans" believed Israeli involvement in the September 11 attacks — a fabricated statistic laundered into cable news. Eight days later the group hits the barackobama.com community pages, getting its name onto the campaign's own web presence. The pattern is now unmistakable: the target is never the audience. It is the gatekeepers who were supposed to check.
ACT III — GAPING HOLES EXPOSED (2009–2014)
The trolls spin off a security-research wing, find a real hole in AT&T — and the government makes a federal case of it.
-
DEC 2009
Goatse Security incorporates the joke
GNAA members spin up Goatse Security, a grey-hat research outfit named for the internet's most infamous shock image and sloganed to match ("Gaping Holes Exposed"). The stated logic, per spokesman "Leon Kaiser": the crew had genuine security researchers whose findings "would not be taken seriously" if published under the parent organization's name. A troll collective founding a subsidiary so its real work could be citable is perhaps the purest parody-corporate move in the group's history — Goatse Security is weev's crew and rates its own parallel file.
-
JUN 2010
114,000 iPad emails
Goatse Security finds that AT&T's website will hand back an iPad owner's email address for any valid SIM identifier fed to it — and harvests roughly 114,000 addresses, including celebrities, government, and military accounts, disclosing the haul via the press. The hole is real. AT&T's exposure is real. The question that will consume the next four years is whether walking through an open door on a public web server is a federal crime.
-
NOV 2012 → APR 2014
The conviction that didn't hold
Andrew "weev" Auernheimer — a onetime GNAA president — is convicted in November 2012 on identity-fraud and conspiracy charges over the AT&T disclosure; co-defendant Daniel "JacksonBrown" Spitler takes a plea. In April 2014 the Third Circuit vacates weev's conviction on improper venue, pointedly declining to rule on whether accessing the unsecured site was a crime at all. He walks out of prison a cause célèbre of the security world — and his fuller, darker arc belongs to his own file at thefire.lol, not this one.
ACT IV — THE MEDIA IS THE PAYLOAD (2012–2017)
The late masterpieces: a fake looting spree the tabloids print, and a worm that makes eight thousand blogs read the press release.
-
OCT 30, 2012
The Sandy Loot Crew
As Hurricane Sandy drowns the East Coast, GNAA accounts flood Twitter with a fake looting spree — staged brag-tweets and photographs recycled from years-old, unrelated images — under the #SandyLootCrew tag. The Daily Mail and InfoWars run the fakes as news; Drudge amplifies. "Leon Kaiser," for the group: "We're a trolling group all the way; we did this strictly to point out how easy it is to manipulate the media." The same reporting records the part the press release skips: the hoax worked by inventing black looters, and the group expressed no concern about the stereotype it was feeding to get its screenshot.
-
DEC 3, 2012
The Tumblr worm
A cross-site-scripting worm rides Tumblr's reblog feature and papers roughly 8,600 blogs — including USA Today's, The Verge's, and Reuters' — with a GNAA screed: a racist message urging readers to kill themselves, which this file describes and declines to quote. First target: the "brony" tag. The group takes credit by press release, and its "interim vice president" pins the blame upstream: "Lazy developers, far too incompetent to sanitize input, are the ones to blame." Tumblr patches the hole the same afternoon. The vulnerability was real; so was every stranger who logged in to find that message wearing their name.
-
2013–17
The long tail
The record thins into sporadic claims of credit — the #cut4bieber self-harm hoax alongside 4chan in January 2013, election-season Wikipedia vandalism in 2016, a claimed hand in a 2017 Austin corporate-relocation spat — and then quiet. The organization disperses the way it existed: no formal dissolution, just a press office that stopped issuing releases. Its methods did not retire with it; the raid culture, hoax-the-newsroom playbook, and named-crew-with-press-releases format all outlived the acronym (see Crew Rivalries).
both sides, on the record
The ammunition was hate: whatever the stated theory, the working materials were a racial slur worn as a flag, shock images sprung on unconsenting strangers, a hoax that invented black looters during a disaster, and a worm that told thousands of people to kill themselves. The group's own spokesman, on the record, expressed no concern that the Sandy hoax propagated a racist stereotype — the collateral was priced in and paid by someone else [2].
The victims weren't the powerful: for every editor embarrassed, there were thousands of bystanders — the downloaders trap-paged, the bloggers defaced, the disaster victims whose neighborhoods became a punchline. The press criticism arrived after the harm, as a caption for it, not a substitute.
The group denied the obvious reading: it maintained the name was satire — taken from a Danish parody film, intended "to sow disruption on the internet and challenge social norms," not as a statement of racial animus. That denial is theirs and it is on the record [1].
Every marquee hoax found a real failure: MacRumors published fabricated screenshots without verification; CNN aired a fake statistic; the Daily Mail and InfoWars printed invented looters sourced from recycled photos; Tumblr sat on an exploitable XSS hole. The group's whole case — "how easy it is to manipulate the media" — was proven, repeatedly, by the institutions themselves [2] [3].
The one federal case collapsed: the AT&T data was sitting on a public, unauthenticated web server; the conviction built on it was vacated, and the appeals court declined to say the access was a crime at all. The security finding was genuine, and disclosure moved AT&T to fix it [6].
YOU DECIDE
The GNAA was a machine for manufacturing institutional embarrassment, and the machine worked: the newsrooms really did print the fakes, the network really did leave 114,000 emails on an open server, and the press releases really were funnier than the corrections. It was also a machine that ran on a slur, shock images, and invented black criminals, and its operators knew exactly what fuel they were burning. The failures it exposed were real. So was the cost, and the group's own records show who paid it.
The archive does not launder the lulz. It keeps the hoaxed front pages — and the worm's target list.
evidence locker
PRIMARY / PRESS RECORD
Wikipedia — the GNAA article (filed under the group's full name) ATTRIBUTED — founding (2002, "timecop"), the presidents, the crapflood and Last Measure methods, the 2004–05 Apple hoaxes, the 2007 CNN and Obama-site pranks, the later claims of credit, and the group's denial of racist/homophobic intent.
en.wikipedia.org — GNAA (full-name article) BuzzFeed News (Craig Silverman) — the #SandyLootCrew hoax FACT — the GNAA attribution, the recycled pre-2005 photos, the Daily Mail and InfoWars publications, and the "we did this strictly to point out how easy it is to manipulate the media" quote — plus the reporting that the group voiced no concern about the racist stereotype the hoax fed.
buzzfeednews.com — Silverman, #SandyLootCrew Slate — the December 2012 Tumblr worm FACT — ~8,600 blogs hit, the brony-tag first target, USA Today / The Verge / Reuters among the defaced, the group's press-release claim of credit, and the "lazy developers" quote from its "interim vice president."
slate.com — GNAA Tumblr worm iMediaEthics — the GNAA's Tumblr statement ATTRIBUTED — the group's parody-corporate press statement in its own words, including the "integrity" line quoted at the top of this file.
imediaethics.org — GNAA on "integrity" Wikipedia — Goatse Security ATTRIBUTED — the December 2009 founding as a GNAA offshoot, the "would not be taken seriously" rationale, the ~114,000-address AT&T/iPad disclosure, weev's November 2012 conviction and its April 2014 vacatur on venue grounds.
en.wikipedia.org/wiki/Goatse_Security
CONTEXT & CROSS-LINKS
thefire.lol — weev CROSS-LINK — the full profile of the GNAA's most consequential alumnus; this file defers his biography there.
thefire.lol/profiles/weev/ troll.fan — scene timeline CROSS-LINK — where the GNAA's beats sit against the rest of the record.
troll.fan/timeline.html
The standard. The GNAA named itself to be unquotable; this file quotes the name exactly once, clinically, as the group's own documented provocation, and reproduces none of its shock content — the payloads are described from the record, never displayed or linked. Every prank stated as fact is carried by contemporaneous press; claims of credit are stated as claims; the group's denial of racist intent is given at full strength in its own words, next to the reporting on what its hoaxes actually spread. Members are named only where they named themselves, and weev's conviction is reported with its vacatur at equal volume. If a line here couldn't survive scrutiny, it wouldn't be on the page.