[[link removed]]

REVEALED: THE OPERATORS BEHIND FOUR MAJOR NEO-NAZI X ACCOUNTS  
[[link removed]]


 

Steven Monacelli, Tristan Lee / Texas Observer
December 4, 2024
Texas Observer
[[link removed]]


*
[[link removed]]
*
[[link removed]]
*
*
[[link removed]]

_ Anonymity has long been a tactic used by extremists to spread their
ideology while avoiding social consequences, from Klansmen hoods to
online pseudonyms. _

, Texas Observer

 

_“THIS ARTICLE WAS ORIGINALLY PUBLISHED BY THE TEXAS OBSERVER
[[link removed]], A NONPROFIT INVESTIGATIVE NEWS
OUTLET AND MAGAZINE. SIGN UP FOR THEIR WEEKLY NEWSLETTER
[[link removed]], OR FOLLOW THEM ON FACEBOOK
[[link removed]] AND X
[[link removed]].”_

Under owner Elon Musk, the social media site X, formerly known as
Twitter, has become a hotbed of white supremacist
[[link removed]]
and neo-Nazi content
[[link removed]].
A recent headline in the_ Atlantic_ doesn’t mince words: “X is a
white supremacist site.
[[link removed]]”

Musk has allowed
[[link removed]]
formerly banned far-right and neo-Nazi
[[link removed]]
accounts back on the platform, and, in some instances, he’s directly
responded to accounts that traffic in white supremacist and neo-Nazi
rhetoric. Meanwhile, anonymous accounts that regularly promote racial
hate on the platform have seen their follower counts grow
substantially
[[link removed]]
as Musk has taken a more hands-off approach to moderation compared to
the social media network’s prior owners. 

Anonymity has long been a tactic used by extremists to spread their
ideology while avoiding consequences, from Klansmen hoods to online
pseudonyms. With such ideas spreading rapidly on X, the _Texas
Observer _has identified the operators of four anonymous accounts that
regularly share racist, antisemitic, and neo-Nazi content on the
platform. Three of the operators appear to live or have claimed to own
property in Texas, where X moderation operations are based and Musk
resides.

Through reviewing posts on X, web archives, leak databases, and other
social media profiles, the _Observer_ identified the following
individuals as the anonymous operators of neo-Nazi X accounts, which
had a collective 500,000 followers at their peak: Cyan Cruz, a
40-year-old marketing professional who appears to have lived in Austin
and Amarillo and operates the X account TheOfficial1984; Michael
Gramer, a 42-year-old retired mechanical engineer who has lived in New
Hampshire, operates the X account 9mm_SMG, and has claimed to have a
house in Galveston and to be spending time in Dallas; Robert
“Bobby” Thorne, a 35-year-old vice president at JP Morgan Chase in
Plano, who operates the account Noble1945 and previously operated the
account Noble_x_x_; and John Anthony Provenzano, a 30-year-old who
appears to live in Virginia, operates the account utism_ (formerly
known as JohnnyBullzeye), and, according to a tip and a records
request response from the U.S. Navy, works at the Naval Surface
Warfare Center in Indian Head, Maryland—where the Navy manufactures
explosive ordnance.

These individuals are part of a broader ecosystem of far-right
accounts that have rapidly expanded their reach in recent months. They
are among the most popular white nationalist and neo-Nazi accounts on
X whose operators have not yet been publicly identified. (While this
article was in production, the Anti-Defamation League also identified
Cruz [[link removed]] as the operator of TheOfficial1984.)
Their rise to prominence tracks with a dramatic decrease in moderation
of hateful content on the platform, which dropped from 1 million
moderated accounts in 2021 to only 2,361 accounts in the most recent
2024 X transparency report
[[link removed]].
Posts from these individuals have received tens of millions of views
over the last year and a half. The accounts have also attracted the
attention of major public figures. Two of the accounts have received
replies from the X account of Elon Musk [[link removed]], who
has said
[[link removed]]
he writes all of his own X posts and who, as reported by _Mother
Jones,_ has amplified users who promote pseudoscientific arguments
that those of European descent are biologically superior
[[link removed]].
Three of the accounts are followed by a sitting congressman, and many
other right-wing media figures and outlets follow at least one of the
four accounts.

Number of followers over time for the four operators identified. Data
from SocialBlade.com

All four accounts follow the other three, and all four have interacted
with at least two of the other three in posts, replies, and spaces on
X. The host of a June 2024 X space, an online voice chat room on the X
platform, focused on “JQ 101”—“JQ” being an abbreviation
used by anti-semitic extremists for the “Jewish Question
[[link removed]]”—tagged
all four of the accounts in a post promoting the gathering
[[link removed]], in which
three of the four accounts participated
[[link removed]].
Nearly 17,000 listeners tuned into the conversation.

On July 9, Musk posted two replies
[[link removed]]
to Cruz’s account TheOfficial1984, which Cruz has used to post
pro-Hitler [[link removed]], Holocaust denial
[[link removed]], and other antisemitic content
[[link removed]]. Musk’s posts were in response to
TheOfficial1984’s call
[[link removed]] to
reinstate a prominent neo-Nazi account, Lucas Gage
[[link removed]], who had been
banned for six months. In the replies, Musk explained that Gage had
been temporarily banned for “repeated and clear calls for
violence” and identified one of Gage’s many antisemitic posts as
the specific reason. While Gage cannot currently post, his virulently
antisemitic posts from prior to the ban remained visible on X, with
many having hundreds of thousands of views.

On July 23, Musk replied to Gramer’s account 9mm_smg, which Gramer
has used to make posts referring to neo-Nazi tropes such as the “14
Words
[[link removed]]”
and “blood and soil
[[link removed]]”
and identifying himself as a white nationalist. Musk’s reply was a
laughing emoji [[link removed]] in response to a post about
a community note [[link removed]]—a feature that allows
users to add context under a post if enough users vote on it—that
described Vice President Kamala Harris as former TV host Montel
Williams
[[link removed]]’
“main hoe,” which 9mm_smg described as “the greatest community
note of all time.” 

Musk’s engagement with these accounts may fit a pattern of the mogul
amplifying far-right views
[[link removed]]
on X, including promoting Tucker Carlson’s interview with a Nazi
apologist
[[link removed]],
in a since-deleted post, and explicitly agreeing
[[link removed]] with an
antisemitic conspiracy theory, for which he later apologized
[[link removed]].
Musk’s attention to TheOfficial1984 and 9mm_smg may also be due to
the fact they boast sizable follower accounts and “verified” blue
checks, which can be acquired by paying a monthly fee for X Premium or
may be provided for free to those with more than 2,500 verified
followers. Verified users who pay for X Premium receive the
opportunity to get paid for engagement from other premium users
[[link removed]].

In October 2022, Musk committed
[[link removed]] in another
post on X to ensuring “negative/hate tweets” would be “deboosted
and demonetized” and not generate revenue for the social media
platform. In practice, this promise appears to have been sometimes
broken. The _Observer _found advertisements in the replies to posts
from all four accounts, including posts that featured pro-Nazi
[[link removed]],
antisemitic
[[link removed]],
pro-Hitler
[[link removed]],
or neo-Nazi content
[[link removed]].
On September 4, TheOfficial1984 posted a screenshot of an email from X
that said the account had been “temporarily paused for revenue
sharing” for violating creator monetization standards, though
ads—from which X likely profited—appeared in the replies to two
[[link removed]] of the account’s posts
[[link removed]]
that same day. On October 7, TheOfficial1984 posted
[[link removed]] that it had been permanently demonetized
for violating the website’s “hate and extremist content”
standards. As of late November, the _Observer _did not find ads in
replies to TheOfficial1984’s posts, though ads still appeared under
the content of 9mm_smg and Noble1945.

X did not respond to a request for comment.

These accounts have drawn the attention of conservative commentators,
activists, and even elected officials. The X account belonging to
Republican U.S. Representative Thomas Massie of Kentucky follows three
of the four neo-Nazi accounts, while the account belonging to GOP
Arizona state Senator Wendy Rogers follows two. The account belonging
to Sebastian Gorka, former and future deputy assistant to Donald
Trump, follows 9mm_smg, and the account belonging to Chuck DeVore, an
executive at the Texas Public Policy Foundation
[[link removed]],
has retweeted one
[[link removed]]
of 9mm_smg’s posts.

Cyan Cruz/TheOfficial1984

Screenshot of Twitter/X profile of @TheOfficial1984 account 

Cruz’s X account, TheOfficial1984, regularly posts antisemitic
[[link removed]], pro-Hitler [[link removed]], and
Holocaust denial [[link removed]] content on X, racking up
hundreds of thousands or even millions of views. His account was
recently disallowed from receiving subscription or ad sharing revenue
for violating X policies, but ads still appear in the replies to his
posts. Cruz has now been identified by the Anti-Defamation League in
addition to [[link removed]]the _Observer._

In an April 2023 tweet [[link removed]], TheOfficial1984
mentioned another X account CyRebel as his “main account.” This
username is included in a 2023 Twitter data breach
[[link removed]]
and is linked to the address “[email protected].” Google reviews
[[link removed]] associated with that email show the
username “1984” and reveal a response from a reviewed business
that reads, “Thank you for the kind review, Mr. Cruz.”

Cropped profile photo from Cyan Cruz’s LinkedIn account
Further corroboration linking the username “CyRebel” to the name
“Cyan Cruz” comes from Venmo
[[link removed]]
and Bandlab [[link removed]] accounts that feature the name
“Cy Cruz” alongside the username “CyRebel.” Cruz has an
extensive digital footprint under the CyRebel username, including two
publicly accessible dating profiles on Tinder
[[link removed]] and FriendFinder-X
[[link removed]], the latter of which lists the same 1984
birth date as that listed for the only Cyan Cruz in public data
[[link removed]] maintained by
the Texas Department of Public Safety (DPS).

Requests for comment directed to Cruz’s email and phone number went
unreturned. However, when messaged from an Android device, Cruz’s
phone number showed the username “1984” and a profile photo that
reads “Handy Rebel,” the name of a defunct business that was
registered under Cruz’s name with the Texas Secretary of State. The
Handy Rebel business was formed in 2020 with Cruz as the managing
member, listing his address as an apartment in southeast Austin, and
it forfeited existence in 2022. After sending a request for comment to
the TheOfficial1984 account via direct message on X, the
_Observer_’s reporter was blocked from sending further messages.

According to his recently deleted LinkedIn, some details of which can
still be seen via data aggregator site ContactOut
[[link removed]], Cruz has lived in Amarillo
and Austin and listed himself as the president of Rebel Management
Group, for which the _Observer _could not find a business registration
in Texas. He also listed himself as the CEO of Shining Star Management
LLC, which was registered with the Texas Secretary of State in 2015,
listing an Amarillo address for Cruz, and forfeited existence in 2017.
Cruz, whose last name suggests and whose DPS database record lists
that he is of Hispanic descent, may fit into a broader trend of
Latinos drawn to neo-Nazi ideology
[[link removed]].

Michael Gramer/9mm_smg

Screenshot of Twitter/X profile of @9mm_smg account

Gramer’s account, 9mm_smg, features antisemitic
[[link removed]] posts, references to neo-Nazi slogans and
concepts such as the “14 words [[link removed]]” and
“blood and soil [[link removed]], and discussions about
national socialism [[link removed]] and fascism
[[link removed]], which he has said he would prefer to our
current democratic [[link removed]] system
[[link removed]]. He has also expressed admiration for
Oswald Mosley [[link removed]], an early 20th century
British fascist politician who espoused antisemitism and was closely
associated with leaders of the German Nazi party.
[[link removed]]

According to his own posts, Gramer is a “white nat[ionalist]
[[link removed]]” who attended a white nationalist music
festival [[link removed]] and
discusses the “JQ [[link removed]],” but also insists he
is not a fascist [[link removed]], neo-Nazi
[[link removed]], or white supremacist
[[link removed]]. 

Hannah Gais, a senior research analyst at the Southern Poverty Law
Center, said far-right extremists should be categorized by “the
words that they themselves say. … If [Gramer] has any issues being
called a neo-Nazi, then I don’t know why he would reference a slogan
coined by David Lane
[[link removed]].”
(Lane, who died in 2007, was a member of the neo-Nazi terrorist
organization The Order
[[link removed]]
and originated the “14 words.”)

Gramer’s account was created in September 2018 but saw rapid growth
over the last year and a half. The earliest Web Archive of the account
is from March 7, 2023, when it had 2,083 followers. By May 7, 2023,
the account had nearly 10 times that amount
[[link removed]],
and as of this writing, it has more than 220,000. 

The email address behind 9mm_smg, included in the same data breach as
Cruz’s, provided a first initial and last name. That same email
address was associated with a Google contributor
[[link removed]]
named Michael Gramer that has posted reviews of businesses in the
Boston area, as well as a Duolingo account named “Mike.”

A number of personal details were revealed in 9mm_smg posts: He says
he is a New Hampshire landowner and resident whose first name is
“Mike,”
[[link removed]]
his last name is “German
[[link removed]],”
he owns a summer home in Galveston [[link removed]], and he
“contracted for” SpaceX, Boeing, Hispano-Suiza, and other
aerospace companies
[[link removed]].
In an August 2024 post, he shared his age in an X post
[[link removed]]. ZoomInfo, a database and intelligence
platform that aggregates detailed contact and business information,
listed a Michael Gramer who previously worked for New Hampshire Ball
Bearings
[[link removed]],
a company that has contracted with Boeing
[[link removed]]
and Hispano-Suiza
[[link removed]]. 

Other than what’s found in the Twitter breach, Gramer has a minimal
digital footprint, though he has posted several censored pictures
apparently of himself on X, showing distinctive tattoos on his arm and
hands.

Pictures posted to X by 9mm_smg showing distinctive arm and hand
tattoos

After the _Observer_ reached out to two people with apparent ties to
Gramer, based on Facebook posts and property records, 9mm_smg sent a
message on X: “Hi. I’ve been told you had questions about me.
I’m right here.” 

When asked if he is the same Michael Gramer who worked for New
Hampshire Ball Bearings, 9mm_smg said “yes.” Gramer then defended
the “14 words” slogan, saying “The words themselves are not
extreme,” before he stopped responding to other questions about his
posts.

Three weeks after we contacted Gramer, he posted on X that he was in
Dallas [[link removed]] and would be there “for a
while.” In mid-November, Gramer posted that he had decided to spend
the winter at a friend’s rental house in Highland Park
[[link removed]], a wealthy enclave in Dallas where Gramer
said he has “a lot of friends [[link removed]].”

Robert Thorne/Noble1945 (formerly Noble_x_x_)

Left: screenshot of Twitter/X profile of @noble1945; Right: screenshot
of archived snapshot of now-suspended Twitter/X profile of @noble_x_x_

Thorne’s former account noble_x_x_ was suspended
[[link removed]] for violent speech in mid-June 2024, at
which time it had at least
[[link removed]] 31k
followers. The specific violent tweet [[link removed]] he
was suspended for says: “The streets are a much safer place with
both of them gone”, referring to George Floyd and another Black man
who was killed by police
[[link removed]]
while reportedly experiencing a mental health crisis. 

The account had previously shared pictures of swastikas
[[link removed]], statements of Holocaust denial
[[link removed]], and the phrase “Sieg Heil”
[[link removed]], and had repeatedly identified its operator
as “a Nazi” [[link removed]] and “National
Socialist” [[link removed]]. 

A second account featuring the same profile picture, noble1945, was
created in October 2023, writing in one tweet
[[link removed]]: “If you’re following me on this
account check out my main account at @noble_x_x_ I’m only here
because of a week long ban on that one.” This account is still
active at the time of publication and has around 7,000 followers.

Neither username noble_x_x_ nor noble1945 appear in the Twitter
breach. However, another Twitter account with the same Twitter user ID
(313782690) as noble_x_x_, with the username “fakebobbythorne,”
does appear in the breach. The fact these two accounts share the same
user ID number indicates that fakebobbythorne was switched to
noble_x_x_ at some point, explained Travis Brown, a researcher who has
built tools [[link removed]] to research and analyze X
data.. 

“Every X account has a numeric identifier that is unique to that
account and cannot be changed,” said Brown. “A particular account
or tweet may have multiple URLs associated with it if the account
owner changes the screen name, but the account ID will always be the
same and can be found by viewing the source of the profile or tweet
page in a web browser. This makes it possible to identify profile
changes by comparing current account IDs and their screen names with
IDs and screen names from archives such as the Wayback Machine.”

In one September 2020 tweet, fakebobbythorne replied to
[[link removed]]
Goldman Sachs Senior Chairman Lloyd Blankfein, writing “Lloyd-
we’ve missed you! Glad you’re back.” 

An email address linked to the fakebobbythorne username in the Twitter
data breach appears in other data breaches, where it’s associated
with street addresses and IP addresses in Salt Lake City, Utah. Three
private data aggregator sites tied the email address to the LinkedIn
profile [[link removed]] of a
Bobby Thorne listed as a vice president at JP Morgan Chase in the
Dallas suburb of Plano. The same employment information appears for
Robert Thorne in a database maintained by the private regulatory
entity FINRA
[[link removed]].
According to the LinkedIn page, Thorne attended the University of Utah
in Salt Lake City from 2010 to 2011 and previously worked at Goldman
Sachs between 2015 and 2022. The fakebobbythorne account was created
in 2011, during the period that LinkedIn lists Thorne as attending the
University of Utah.

Noble_x_x_ posted an apparent selfie [[link removed]] in
June 2023 that facial recognition tools identified as a
high-probability match both with the LinkedIn profile picture
[[link removed]] and with the old profile photo
[[link removed]]
for the fakebobbythorne X account. The apparent selfie was taken
inside a gym. A Google account linked to Thorne’s email address
posted a review [[link removed]] of a gym in Dallas, and a
review of the gym’s social media posts and an in-person visit to the
gym identified machines and a background matching the noble_x_x_
photo.

 

Thorne did not respond to requests for comment sent to his email
address or a message left on his voicemail. 

In response to a request for comment from the _Observer_, Michaela
Ross, vice president of media relations and executive communications
with JP Morgan Chase, responded via email: “The employee in question
is on leave while we complete our investigation. We do not tolerate
hate speech of any kind.”

In another email subsequent to this story’s publication, Ross
stated: “This person is no longer at the firm. We do not tolerate
hate in any form and take incidents such as this very seriously.”

John Anthony Provenzano/Utism_

Archived snapshot of the now deactivated @utism_ account

Prior to being deactivated in October, the account utism_ (screen name
Bullzeye) had around 70,000 followers and regularly posted pro-Nazi
[[link removed]], pro-Hitler [[link removed]], and
antisemitic [[link removed]] content.

Based on memory.lol [[link removed]] (a tool developed by
Travis Brown that tracks changes to X accounts), the account appears
to be the second or third account created by the same user after prior
accounts with the username JohnnyBullzeye were suspended. 

An old profile photo preserved in web archives from when
Provenzano’s account was still named JohnnyBullzeye features the
same words in a circle around the photo as the utism_ account:
“You’ve just been fucked by psyops because physical wounds
heal.” The old profile photo provided a face that image recognition
programs matched with high probability to photos on other social media
platforms including on an old Facebook account named “John
Anthony” with the username “johnprovenzan0.” 

Left: Archive of previous Twitter account with username
“JohnnyBullzeye”; Center: screenshot of Instagram post showing a
man with a similar looking face according to facial recognition tools,
tagged with the username “bullzeye_”; Right: Screenshot of
Facebook account of a man named “John Anthony” with the username
“johnprovenzan0” that facial recognition programs indicate is a
high-probability match

A database of hacked or leaked emails shows that Provenzano used the
same username, JohnnyBullzeye, to create accounts on other websites
that were associated with emails that include his first initial and
last name. 

Public traffic citation records link Provenzano to an address in the
area of Arlington, Virginia, as of 2020. Employment and location
information for John Anthony Provenzano also appeared in the
employment database Leadar [[link removed]] and other
private databases, indicating he has a work history as a project
engineer for construction companies in Virginia.

In the course of investigating Provenzano’s background, the
_Observer _received a tip that Provenzano had taken a civilian job at
the Naval Surface Warfare Center in Indian Head, Maryland, about an
hour away from Arlington. When asked about Provenzano’s employment
and apparent posts on X, a public affairs officer at the Naval Surface
Warfare Center at Indian Head provided the following statement: “The
Navy has a zero-tolerance policy for extremist conduct and takes all
allegations of personnel involvement in extremist groups seriously.
These allegations are under investigation. It would be inappropriate
to comment further at this time.”

A response from the Navy to an _Observer_ Freedom of Information Act
(FOIA) request for Provenzano’s personnel records provided further
evidence of his employment there. 

“Upon our review, we are withholding any records that would be
responsive to such a 

request pursuant to FOIA Exemption (b)(6), 5 U.S.C. §552(b)(6), which
allows the Government to withhold information about an individual
employee where the disclosure of such information would constitute a
clearly unwarranted invasion of personal privacy 5 U.S.C.
§552(b)(6),” the response reads.

By contrast, the _Observer _previously requested records in another
case
[[link removed]]
about a different extremist who had expressed interest in joining the
Navy, and the Navy responded saying it had “no records.” 

Provenzano did not respond to requests for comment sent to his email
or X account. Less than a week after the Navy provided comment for
this story, the utism_ account was deleted.

SIGN UP FOR TEXAS OBSERVER EMAILS

Get our latest in-depth reporting straight to your inbox.

Sign Up [[link removed]]

_Update: The characterization of one X account’s interaction with
9mm_smg_ _has been corrected; the _Observer_ regrets the error_. _An
additional comment from JP Morgan Chase has also been incorporated_.

* Elon Musk
[[link removed]]
* X
[[link removed]]
* Neo Nazi
[[link removed]]
* hate speech
[[link removed]]

*
[[link removed]]
*
[[link removed]]
*
*
[[link removed]]

 

 

 

INTERPRET THE WORLD AND CHANGE IT

 

 

Submit via web
[[link removed]]

Submit via email
Frequently asked questions
[[link removed]]
Manage subscription
[[link removed]]
Visit xxxxxx.org
[[link removed]]

Twitter [[link removed]]

Facebook [[link removed]]

 




[link removed]

To unsubscribe, click the following link:
[link removed]