The Iron March Data Dump Provides a Window Into How White Supremacists Communicate and Recruit

During a hearing in front of the House Judiciary Committee on Feb. 5, FBI Director Christopher Wray stated that the bureau was elevating “to the top level priority racially motivated violent extremism so it is on the same footing in terms of our national threat banding as ISIS and homegrown violent extremism.” The decision comes as a majority of the FBI’s domestic-terrorism investigations since October 2018 were found to have a nexus to white supremacy. Understanding how white supremacist and neo-Nazi networks operate and recruit is critical to mitigating this threat, and one way to collect intelligence on these groups is to track their activity on certain public and restricted websites. A recent hack and data-dump of a white supremecist website gives us a window into exactly that activity.

On Nov. 6, 2019, the entire SQL database behind Ironmarch.org was posted on Internet Archives. The data, released by an unknown individual, includes private messages, user account information and the site’s forum posts. Over the past two months, investigative journalists associated with Bellingcat analyzed the activity of prominent neo-Nazi and white supremist groups on the site. Articles on Vice and the Southern Poverity Law Center (SPLC) website also provided historical context for this leak by discussing Iron March’s significance in facilitating neo-Nazi and white supremacist movements around the world. Additionally, a researcher associated with the Twitter account @jewishworker created the website Iron March Exposed to allow others to easily search the leaked Iron March data and identify former Iron March users and their activity on the site.

Using the data from Iron March, open source research and the Maltego platform supplemented by the Social Links add-on, we tried to answer the following questions: (a) What is the profile of an “average” Iron March user? (b) What drove activity on Iron March? and (c) How effective was Iron March at connecting like-minded white supremacist and neo-Nazis?

When the data from Iron March is analyzed with respect to these questions, it seems to indicate that white extremists and neo-Nazis on this site were not extremely concerned with law enforcement surveillance and regularly used Iron March to recruit, coordinate their activity and refine their personal fascist beliefs.

Background: What Is Iron March?

Bellingcat reports that Iron March was founded in 2011 and shut down in November 2017, likely due to repeated hacking designed to disrupt the site. The leaked data shows Iron March was created by a Russia-based individual going by the alias Alexander “Slavros” Mukhitdinov, referred to as “Slavros.” According to the SPLC’s research, Slavros kept very close control of the public posts on the site and also managed another site, Slavros.org, which was registered under the name Alisher Mukhitdinov and posted similar content. After Iron March was taken down in November 2017, Slavros appears to have halted online activity and no one has reported contact with him. On a site built to follow Iron March, called Fascist Forge, members speculated that Slavros was arrested by the Russian government.

Iron March was structured as a standard web forum/message board. It allowed any visitor to view and read material, while providing members with the capability to make public posts on the several broad threads created by the administrator. Additionally, the site had a private message feature and hosted administrative material, including member guidelines and a calendar, which primarily noted the birthdays of historically significant facsist figures.

During its six years of activity, Iron March acted as a hub for neo-Nazi and white supremacist groups around the world. The website had approximately 1,200 regular users and was affiliated with at least nine different neo-Nazi or white supremacist groups. Among them are Atomwaffen Division (or atomic weapons division) in the United States, the United Kingdom-based and now banned National Action, the Scandinavian Nordic Resistance Movement, and the Australian Antipodean Resistance.

Provided by Vice: An infographic made by Iron March users claiming links to neo-Nazi and far-right groups and encouraging users to create their own.

Using Ironmarch.org, these groups and other Iron March users recruited and refined their violent white supremacist ideology. According to SPLC, Iron March users and associated groups did not strictly adhere to any one doctrine. Rather, the website allowed its members to actively discuss global fascist literature and adopt their own interpretations of fascist doctrine.

SPLC has also reported that groups associated with Iron March were linked to numerous instances of white extremist violence around the world. In July 2017, the Nordic Resistance Movement was responsible for an attack on a Swedish refugee center as well as several other bombings. In October 2017, an unnamed member of the U.K.-based National Action movement was accused of plotting with the group’s leader to assassinate Rosie Cooper, a 67-year-old Labor member of the U.K. Parliament. A year earlier, the British government made being a member of National Action illegal after one of the group’s members killed Jo Cox, a British member of parliament, with a homemade rifle.

In the United States, Atomwaffen Division’s founder, Brandon Russell, a member of the Florida National Guard, was convicted on Jan. 9, 2018, of charges related to explosive materials found on his premises. Prior to Russell’s conviction, he worked closely with Slavros on Iron March to build Atomwaffen and recruit members.

Through Iron March, Russell and early Atomwaffen leadership discovered the writings of James Mason, a Charles Manson acolyte and an American neo-Nazi. Mason’s collective works, entitled “SIEGE,” were written in the 1980s and advocate for white revolution through terrorism conducted by individual cells. Atomwaffen Division fully adopted this ideology and received direct support from James Mason. The group’s members have been linked to a range of violent activity, including an attempted bombing and heavy weapons assault on a Halifax mall in Canada. More recently, in November 2019, the leader of an Atomwaffen Division cell based in the state of Washington was stopped in Texas with illegal assault-style rifles and up to 2,000 rounds of ammunition.

Active Iron March users were also critical decision-makers behind the Unite the Right rally that took place in Charlottesville, Virginia, on Aug. 11-12, 2017. The rally led to numerous instances of violence enacted by white supremacist groups against counter protesters, including a vehicular attack that killed Heather Heyer and injured 28 others. A civil complaint was filed on Sept. 17, 2019, in U.S. District Court for the Western District of Virginia against 25 individuals and organizations related to the Charlottesville rally. At least five of the individuals or organizations listed in that complaint had active accounts on Iron March.

What Is the Profile of an “Average” Iron March User?

Iron March members’ IP addresses, account information and posting habits provide some insight into the site’s users. When it was shut down in November 2017, Iron March had 1,207 regular users. Of these, 183 reported their age on the site, and 1,185 users did not appear to hide their IPs. These users wrote more than 195,000 public posts and had 4,500 private conversations. This data suggests that many Iron March members were young adults largely from English-speaking countries.

The average self-reported age of the 183 users was 28 and the median was 26. The accuracy of this data is questionable because users self-reported their ages. But these findings mirror similar results from data collected by the SPLC profiling white supremacists responsible for 12 deadly attacks since 2015. Additionally, 16 of the 18 Iron March members we positively identified through open source research were white males, while the remaining two individuals were white women in their early 20s.

Of the 1,185 accounts that did not appear to mask their IPs, at least 73 percent were created in English-speaking countries. Fifty-two percent were American, 9 percent were citizens of the United Kingdom, 7 percent were Canadian and 5 percent were Australian. The remaining 27 percent were from 59 other countries and mostly communicated in English.

Vice and Bellingcat have also reported that at least eight members of Iron March and Atomwaffen Division are currently serving in the U.S. military. These individuals have openly discussed their military involvement on Iron March. While they may be exaggerating the number of neo-Nazis or white supremacists currently serving in the U.S. military, their statements, if true, indicate that a community exists. As one Iron March user stated:

In my unit (infantry) I’ve met quite a few rightists—some openly NS, lots of neo-Nazis, others just nationalists, others red-pilled conservatives, others blue-pilled militiamen, even a couple Mormon extremists. You see plenty “of our kind” in the combat arms.... On most bases you can see the occasional right-wing symbol. Sun wheel there, 88 here, Mussolini’s face over there, a Templar cross tattoo. The symbols of SS units are especially common, even on things as public as cars, flags, and helmets.

Using the IP addresses provided from the Iron March database, Bellingcat created an interactive map geolocating all the activity on Iron March originating near or from U.S. military bases in the continental United States. Very little direct evidence exists to link these IP addresses to U.S military bases. But the same research team also created an Excel spreadsheet of all the conversations involving Iron March members who appeared to have served or be serving in the U.S. military. In addition to Bellingcat’s findings, other Iron March members also mention being current or former U.S. military or seeking to join their country’s military.

What Drove Activity on Iron March?

Data from Iron March suggests that activity on the site was driven primarily by two forces: influxes of new American members eager to contribute content and meet like-minded individuals, and neo-Nazi or white extremist groups’ periodic use of Iron March to recruit members and coordinate activity between related organizations. The second factor is discussed in the next section.

Out of 1,174 users who posted at least once on the site, the top 20 percent of posters were responsible for approximately 87 percent of the posts. The top 5 percent (58 users) wrote 54 percent of all the public posts. However, as the rate of posts increased starting in 2015, the posting rate of the top 5 percent remained constant or waned, as shown in the graph below. Between January and June 2016, there was a sharp drop off, from 55 percent of all posts to 38 percent. From April 2016 onward, the top 5 percent account for only 26 percent of posts, and from October to November 2017 they were responsible for only 15 percent of posts.

A closer look at the data reveals that this trend was driven by an influx of new users eager to post on the site. Starting at the end of 2015, Iron March experienced a steady stream of new members who posted regularly. This caused overall posts to increase and the share of posts written by the top 5 percent to decrease.

Americans made up most of the new members, and American posting was largely responsible for the fluctuations in the amount of public content. In September 2014, posts by American users jumped from approximately 600 to 900, increased again to 1,100 in November and rarely dipped below 1,000 posts per month afterward. Additionally, American posting rates were almost entirely responsible for the posting spikes in the fourth quarter of 2015 and the second quarter of 2017.

Most of the activity related to private messages on Iron March was also attributable to American members. Slavros is the only exception to this trend. He alone was responsible for approximately 24 percent of private communications, and no other user was responsible for more than 1.5 percent of the remaining 76 percent. But Americans as a group started 37 percent of the conversations (approximately 1,665 total).

The number of private conversations on the site also seems to follow a similar, but not identical, pattern to those of the public posts. After a spike in private messages between October 2013 and March 2014, the number of conversations dropped and then slowly began to rise. Two more spikes followed. The first was in April 2016. The second mirrored that of the public posts, occurring between March and August 2017.

During the first spike in private messages in the fourth quarter of 2013, American-initiated private conversations jumped from 18 to 187, accounting for almost the entire rise. In another spike during the second quarter of 2016, a little over half of the 70-conversation increase was due to American use. Finally, the rise in conversations between January and June 2017 was also largely due to American messages, but a rise in Canadian messages contributed as well.

An analysis of both public posts and private messages on Iron March also shows that activity on the site increased in proximity to significant events related to the far-right in the United States and around the world. On its face, this data presents the possibility that Iron March activity was partially in response to these events. As shown in the graphs above, a rapid increase in new membership coincides with the 2016 U.S. presidential election, increased news coverage of “alt-right” activity in the United States, and the growth of ultra-conservative European political parties during the European migrant crisis.

A prior Iron March user, who was a source for Bellingcat, provided some support for this theory when the source asserted that Iron March members used Trump’s presidential campaign as a “way for us to connect.”

But Trump was rarely a topic of vibrant discussion on the forum. From June 16, 2015, when Trump announced he was running for president, until the site was discontinued in November 2017, only about 1,100 public posts mentioned the president. These posts did not drive overall activity on the site, which had approximately 36,000 posts from American members alone within the same period.

Furthermore, the 1,100 posts discussing Trump show that many Iron March users believed his platform was too moderate and were angered by his decision to support Israel. Additionally, some posts expressed hatred toward the president’s son-in-law and senior adviser, Jared Kushner, who is Jewish.

Other public posts during this time did not mention Trump directly but stressed that the ideology espoused by Iron March was unapologetically further to the right of the “alt-right” and other members of Trump’s base. Unlike the “alt-right” or other extremely conservative groups, which focus largely on peaceful protest and voting, Iron March users made it clear that they wanted to install a fascist U.S. government using violence. As Slavros said on Feb. 8, 2016:

You know how the Alt-Right talks about “don’t punch to your Right”? i.e. don’t cause “in-fighting on the Right” so that they can have their all inclusive tent? It’s essentially like their own version of the Progressivist “Don't punch downwards” (don’t make fun of/insult/etc the “oppressed”) principle. Well fuck’em, the only thing to our Right is the fucking Wall.

This also explains why the 2017 Unite the Right rally in Charlottesville, Virginia, did not appear to drive the volume of public posts on Iron March. Slavros repeatedly, and derisively, called the rally “the big tent event” and downplayed it as too peaceful. While some Iron March members expressed approval for the rally, others agreed with Slavros. As one member stated: “The thing is, you can’t defend alt-right here while claiming to support Iron March/Atomwaffen. Pick one because you cannot be on both sides at once.”

How Did Iron March Connect Like-Minded White Extremists and Neo-Nazis?

The secondary reporting discussed above describes in broad strokes the importance of Iron March to the development of several white supremacist and neo-Nazi groups. Private conversations related to recruitment, coordination and philosophical discussions accounted for approximately 15 percent of all the private conversations between Iron March members starting at the end of 2015. Analyzing these messages provides more detail into exactly how white supremacist and neo-Nazi groups shared information, recruited new members and coordinated their activity. This research produced two conclusions. First, the networks and relationships developed on Iron March did not appear to be replicated on public social media platforms, suggesting that the platform was critical to connecting like-minded individuals and helping white supremacist and neo-Nazi groups recruit new members; and, second, most Iron March users did not appear concerned about law enforcement surveillance on the site and did not take measures to hide their activity.

A total of 877 Iron March members used the site’s private message feature. Maltego’s link analysis capabilities allowed us to map all these communications and determine how users on the site interacted with each other. This analysis, found in the image below, shows that Iron March members did not appear to message only an exclusive set of friends but instead interacted regularly with a community of users. The most frequent users, like Slavros, Atomwaffen Division’s leadership, and the organizers of the Charlottesville Unite the Right rally, used private messaging to communicate with new members and message each other. Less active users also appear to have supported a vibrant online community by not exclusively interacting with any one set of members.

Link Analysis of All Private Conversations on Iron March

This relatively open community created a fertile ground for recruitment and coordination. Iron March members regularly promoted and shared James Mason’s book “SIEGE” and used the platform to meet the leadership of U.S.-based groups like Atomwaffen Division and American Vanguard. (See here and here, respectively.) Similarly, British groups used the site to promote the London Forum—a semiannual conference of U.K. (and sometimes U.S.) white supremacist groups. Iron March members also regularly leveraged the site to meet active members of non-U.S. based groups like SKYDAS (a Lithuanian nationalist organization), the Azov Battalion (a highly capable Ukrainian white nationalist organization that has actively fought Russian troops in the Donbass region of Ukraine), the Nordic Resistance, the Antipodean Resistance and Scottish Dawn. Iron March’s flat structure allowed the leaders of these groups to easily meet individuals interested in joining and to recruit others.

The website’s culture also encouraged users to continue their discussions on platforms that allowed for more direct communications. Iron March members regularly invited each other to group chats on Skype, Discord (essentially Skype for video gamer enthusiasts) and Telegram (an encrypted private messaging application). All three of these platforms allowed hosts and invitees to continue and broaden the conversations they started on Iron March using a more interactive and less formal platform.

Interestingly, this close-knit network of users did not appear to exist on more public social media platforms. Using the research capabilities provided by Maltego and the Social Links add-on, we discovered 293 Facebook pages, 151 Twitter accounts, 357 possible Instagram accounts and 102 VK accounts linked to various Iron March members. Neither the VK nor Instagram accounts identified followed each other or had any friends in common. Furthermore, only 25 Facebook accounts and 20 Twitter accounts linked to Iron March users were connected as “friends” or “followers” or had at least one mutual “friend” or “follower.”

Analysis of Iron March-Linked Twitter Accounts

(Possible Identifying Usernames Cut)

Analysis of Iron March-Linked Facebook Accounts

(Possible Identifying Usernames Cut)

It is evident from the above images that the 25 relevant Facebook accounts had many more friends in common than the 20 connected Twitter accounts had followers in common. We suspect that there are two reasons for this. First, the most followed and prolific of the 151 Twitter accounts were already deleted by Twitter. Of the 151 Iron March-linked Twitter accounts, only 66 were still active when we conducted our searches because Twitter had suspended the remaining 85. According to conversations about Twitter on Iron March, it appears that Iron March members regularly used Twitter instead of Facebook to share propaganda and spread their message. As a result, the most active and widely followed Twitter accounts were more likely to be flagged and suspended than the relevant Facebook accounts. Second, many of the relevant Facebook accounts’ mutual friends appear to be from the same or similar geographic regions. This suggests that these Iron March-linked Facebook accounts were owned by individuals who knew each other in the real world or lived in the same geographic region.

Interestingly, this lack of a robust public presence on social networking sites does not suggest that most Iron March users took steps to hide their real identities. As noted above, only 22 users registered their Iron March accounts with hidden IP addresses. Either legal process by way of subpoena or even open source searching could be used to identify them and their location. Furthermore, 76 percent of the accounts on Iron March were registered with email addresses from major email service providers such as Gmail, Yahoo and Hotmail. A subpoena to any of these email providers for data concerning one or more of these accounts could also yield identifying material. Additionally, many of these same email accounts were used to set up public-facing social media with the users’ real names and other identifying information. For that group of emails, a subpoena would likely be unnecessary to identify the users.

Concluding Analysis

As white supremacist and neo-Nazi groups around the world continue to be investigated by various law enforcement agencies, users on forums like Iron March will have a growing incentive to hide their true identities and mask their communications. Using forums like Iron March will continue to expose members of white supremacist and neo-Nazi groups to hacktivist “doxing” (or the hacking, stealing and release of information designed to expose the people in question to public scrutiny) and law enforcement observation.

But the history and internal dynamics of Iron March show that a website that facilitates an open and vibrant online discussion can be critical to the early success of the white supremasist and neo-Nazi organizations like the ones discussed in this piece. As noted above, several groups, like Atomwaffen Division, got their start, defined their group doctrine and recruited their first members using Iron March. As white supremacist and neo-Nazi groups continue to create and manage more secure web platforms for this exact purpose (see here and here), the recently leaked Iron March data provides critical insight into how these types of online platforms may continue to operate and what factors drive activity on those sites.