For over a month, Twitch is trying to track down a group of anonymous trolls that spam the platform with violent images of the Christchurch shooting in the aftermath of the attack. That hunt began seriously when Twitch filed a complaint against the trolls earlier in June, but new files shows that the company has more clues to the perpetrator's identity than anyone suspected, including specific e-mail addresses for at least three people and Discord logs in which the attack was organized.
The evidence was submitted in an ex parte depot on Thursday, which included a fallout from an incident response engineer at Twitch. According to the documents, Twitch has identified a specific user who, according to her, is responsible for coordinating the attack – a previous offender who uses the Skel or Sketyal handle – and who linked that account to a series of email addresses, Twitter accounts, Discord channels and at least one website. From his incident response work, Twitch also collected 35 different IP addresses that were used to serve the Twitch accounts that are carrying out the attack for seven different providers.
Twitch is still unclear about the person behind all those accounts, so the company's lawyers are seeking a court order in which Twitter, Discord, and various web hosts are required to convert all the information they have linked to each account. In both cases, the company looks for something that is linked to a real name, whether it is an address, payment information or even another account for which another court decision can be made. Once Skel has been identified, Twitch is looking for a permanent injunction against them that will ever reuse the company's services, as well as unspecified financial damages.
In particular, many of the Discord channels used to coordinate the attack were left open to every visitor with the link. Based on the screen images in addition to the statements, it turned out that Twitch's security teams had infiltrated the channels and recorded a large part of the activity.
The spam attack caused considerable chaos when it was first launched, eventually forcing Twitch to suspend new streams during the first seven days after an account was created. The most flagrant spam was the video of the Christchurch attack, but trolls also streamed pornography and prohibited content differently, often using bot networks to get the streams up so that they would be promoted to feeds from other users.