Trollhunter

It's time to reveal the truth behind my recent posting "My Troll Hits Riin."

The truth is, until recently, I had stopped visiting Riin's blog; I removed Riin's blog from my tracking list and removed her former account from this computer (she used to have an account on this machine for use when she visited). Admittedly, I did this rather recently and, yes, I should have done it a long time ago. Still, as the old saying goes, better late than never. So, when the troll posted their recent threat, I had already stopped visiting Riin's blog.

So how did I find out about the troll's threats posted there?

"My Troll Hits Riin" points out that Riin now has the troll's IP address and implies that I can't get it myself because of limitations in Blogger's interface. What it doesn't say, however, is that I can, in fact, track IPs connecting to my blog through third party services. I recently installed a tracking code on my blog called "StatCounter." Scroll down the "widgets" on the left; you'll see "StatCounter" at the bottom.

StatCounter is an incredibly powerful utility. With it, I can track exactly what IP someone signs into my blog from, the geographical location of their connecting server, what time they sign in, what pages they visit, even what operating system they're running, what screen resolution they're using and whether they have Javascript enabled or not.

I did not just "stumble upon" the comment accidentally as I imply on my blog. In reality, I found it when I saw that someone had exited one of my pages via a link to that particular posting on Riin's blog. That activity was atypical compared to the rest of the data so I thought it worth investigating; that's when I found the comment.

Until now, I wanted the troll to believe I still visit Riin's blog regularly. "My Troll Hits Riin" and "Is It Just Me" were both written deliberately to bait the troll. I was hoping they'd comment; they did. When they did, I captured this:


This is definitely my troll. The two "Exit Links" to the comment form on October 19 at 19:05:27 and on October 26 at 20:54:17 clinch it; the times and postings commented on match up with the troll's last two comments.

One thing about the data really surprised me. Whoever this is, they're connecting from Halifax, not from the United States. I had assumed all this time that my troll was Riin's Aunt Janet. It wasn't; it was apparently someone I know. Worse than that, I suspect it may even have been someone I had trusted and confided in about my troubles.

How do I know? Several clues:

1. The troll apparently knows my apartment building; their description of the area is accurate.
   
2. The troll identified themselves as "Ron Weber" in a recent posting; that's the former name of the company I work for. It's most likely someone who worked there.
3. The troll also knew things about Riin that were not publicly known. Since I've never spoken about anything online that Riin hasn't already revealed about herself, the only way this person could have known these things is if they were someone I'd confided in.
4. The troll lives in Halifax; it's very likely someone who quit/was terminated and moved away.

I contacted Eastlink, the troll's Internet service provider, Sunday night and submitted a formal abuse report. Eastlink has told me that, since I have the IP address and the exact times this person connected to my blog, it will be easy for them to trace that IP to the specific Eastlink account that was connected to those pages at those times.

Now, Eastlink can't give me that information; they can only give out private account information to the police. Here we come to the greatest irony. If the troll hadn't threatened me, the police probably wouldn't be able to do anything. However, the moment the troll threatened me, they gave me the grounds to involve the police.

Minutes before I began writing this entry, I was speaking to a constable with the Cape Breton Regional Police. I turned over to her the following letter, originally written to Eastlink Abuse:

Complainant: gelfling@syd.eastlink.ca
Complainant IP address: 142.68.131.220
Source of abuse: 24.138.32.67
Abuse type: Threats/Harassment
Details:
There is someone posting threatening and harassing comments on my blog (http://pedalingprince.blogspot.com). Using Statcounter (http://www.statcounter.com), which I installed recently, I've traced the culprit to a user of your network.

I only recently became capable of tracing this person. Prior to that, I kept a record of their activity in a posting on my blog:

http://pedalingprince.blogspot.com/2008/03/loosers.html

In this posting, I suggest the troll is a member of a former life partner's family; I have since determined this is not the case. I now believe this is someone who worked for my employer; he signed himself "Ron Weber," a former name of the company, and knows things about me that suggest he knew me personally.

Recently, after the installation of the StatCounter tracking code, I discovered that someone (evidently the same person based on the pattern of grammar and spelling mistakes) had posted to my former life partner's blog, this time with threats against me; I detail that incident here:

http://pedalingprince.blogspot.com/2008/10/my-troll-hits-riin.html

Tonight, at 20:54:17 ADT, this individual logged into one of my blog comment pages again and posted a comment to this entry:

http://pedalingprince.blogspot.com/2008/10/is-it-just-me.html

It's from the exact same IP address, so it's pretty clear it's from the same individual as all of the others.

Here is the detailed tracking information I've been able to obtain on this person from StatCounter:

[Here, I turned over all my StatCounter tracking data.]

As you can see, since the installation of the tracking code in late September, this individual has logged into my blog 12 times; the exact times of each entry and what pages were visited are listed in the above data.

I can put up with someone who's just an annoying pest, but I will not tolerate threats. I'd like to formally request that this person's account be identified and suspended. Failing in that, I will have no other alternative but to contact the authorities to deal with the matter, and I'd rather not have to take that step.

I'd like a follow up on this. If I don't hear back from you by Tuesday, I will contact you by phone to get an update.

She told me that a file would be opened with their computer crimes unit. A warrant will have to be issued for the police to obtain the account information from Eastlink. Once it is, and once they identify the person responsible, I will have the option of pressing charges against this individual under Section 264.1 of the Criminal Code of Canada for uttering threats.

I intend to press those charges.

One thing I really resent about all this is the fact that, since the troll's threat was posted to Riin's blog, not mine, I have no choice right now but to keep an eye on her blog in case any more threats are posted; the more evidence I can turn over to the police, the stronger my case. I don't want to visit Riin's blog anymore; it's too painful. I just want to close this chapter of my life but now, until this person is caught, I have to keep it open a bit longer.

Until this troll is caught, however, I am not letting this go. Whoever it is, they made the biggest mistake of their life when they called Lisa a "retard" and a "cripple." Lisa and I may be on the rocks romance-wise, but Lisa is still my friend; I will not tolerate anyone talking about her like that. That's when I decided to do a little research on IP tracing and found the StatCounter utility.

Now, finally, I have the information I need to find this troll and put a stop to this once and for all.

"Not again. The line must be drawn here! This far, no farther!" - Captain Jean-Luc Picard, Star Trek: First Contact.