He called himself the “BotGod.” But the cybersecurity student was so bad at, well, cybersecurity, that he allegedly exposed a neo-Nazi swatting ring that counted him as a member.
John William Kirby Kelley, 19, is accused of leading a notorious troll team loosely affiliated with the neo-Nazi group Atomwaffen Division. Through 2018, Kelley’s online chat group allegedly compiled personal information and led swatting attacks (hoaxes in which trolls try to trick an armed police force into showing up at an innocent person’s house) against politicians, businesses, journalists, and historically black churches.
Kelley and his circle, who convened on a series of online chat rooms, “all appeared to share racist views, with particular disdain for African Americans and Jewish people,” according to a probable-cause statement from an FBI agent involved in his arrest last week.
ADVERTISEMENT
Although Kelley was majoring in cybersecurity and allegedly acted as the group’s tech support, he left a wide internet trail that could send him and alleged associates to prison. The case suggested that even as far-right groups have shown a disturbing ability to organize online, hangers-on may be just as likely to invite the feds to their doorstep. Kelley’s lawyers declined to comment for this story.
A violent extremist group, Atomwaffen members have been suspects in at least five killings since 2017. Although the group has a real-world paramilitary presence, it also has a larger and more nebulous online footprint. Multiple men affiliated with the group’s online outposts and spinoff groups have recently been arrested, including one who allegedly planned a violent attack on Jewish sites in Las Vegas.
Kelley, who was arrested on Jan. 10, was allegedly fueled by the same prejudices. Feds say his phone contained pictures of him with Atomwaffen recruiting materials. Meanwhile, he and his online circle allegedly livestreamed swatting campaigns, and even ran a publicly viewable list of future targets’ addresses, earning them notoriety online.
But the group’s apparent quest for infamy left them exposed—especially when Kelley allegedly tried calling in a bomb threat to his own school, Old Dominion University (ODU) in Norfolk, Virginia.
In November 2018, Kelley allegedly posted in a chat room asking the group to swat his college. “norfolk next,” he wrote, according to chat logs included in the probable-cause statement. “I dont want to goto class on wed.”
Later that month, ODU received a phone call from a blocked number. The person on the other end of the line claimed to have an AR-15 rifle, and said he’d placed bombs in campus buildings, according to the FBI. But three hours later, the person called back and apologized for making what he described as an accidental call. This time, the person forgot to block the number. The caller in question was Kelley, the feds have alleged. And not only did Kelley call from his own phone number, but he’d previously listed it as his contact with ODU, they said. When campus police looked up the number, they found it in Kelley’s school records.
With Kelley’s name associated with the crank calls, police started looking into a spate of other bomb threats across the U.S. and Canada, from California to Quebec. They soon found him associated with email addresses and Google Voice numbers that they said had been used in other swatting attempts.
Despite studying cybersecurity and allegedly acting as tech support for the neo-Nazi-affiliated group when it struggled to livestream, Kelley wasn’t exactly difficult to find online. Although he went by “carl” in the alleged swatting group, he reused the moniker across other social media, where he shared links to the chat rooms he is said to have administered. A Twitter account, identified as Kelley’s by the Anti-Defamation League’s Center on Extremism, contained a link to group on the Nazi-beloved chat platform Discord, where a user named “carl” listed himself as “BotGod.” (The FBI also listed “BotGod” as one of Kelley’s aliases.)
Kelley was well-known enough, and posted under enough overlapping usernames, that his internet monikers trailed into his personal social media. On an Instagram account that referenced his Twitter handle and an old screen-name Kelley used on gaming sites, he apparently posted a picture of himself holding an anime body pillow. “Carl,” one of his followers wrote. “The fuck, bro?”
While the group’s antics may have played out mostly online, Kelley and his friends appear to have posed with guns in social media posts. The FBI affidavit also referenced pictures of weapons, some of which were deemed to be fake or replicas, others authentic.
In videos he allegedly uploaded to the swatting chat channel, Kelley not only referred to himself as “carl,” but also explained how he came up with the name. He also appears to have handed out his ODU email address online. At one point, a co-conspirator asked Kelley for his ODU email address, so he could use it to make a Facebook account, according to the documents filed in his case.
It was an infosec error he’d inadvertently predicted when he got into ODU in early 2018.
“holy ASS I got into college,” the account identified as Kelley's by the ADL tweeted. “time to go onto irc and watch as everyone sucks my dick for a .edu shell.” (Kelley appears to have been offering to farm out his college email address so his friends could use it to register fake accounts.)
Other privacy slip-ups led the feds to the alleged swatting whiz. During a livestream of a swatting attack, Kelley accidentally left open a computer tab that was logged into his Old Dominion accounts, where he was completing a survey for a class, according to the probable-cause statement. He was expelled from ODU in January 2019 after being charged with possession of controlled substances like LSD and shrooms.
Two sets of linguists reviewed audio of the swatting calls, according to the feds: An ODU appraisal concluded that they matched Kelley’s voice, while a Secret Service analysis suggested they did not.
Feds interviewed him in late November 2019, and he agreed to turn over his electronic devices, which he’d allegedly used to oversee the swatting chat group. (He admitted to calling the school, but said it was an accident.)
After Kelley’s interview, the group appeared to turn on each other, but not beef up its privacy. “you guys ratted him out on the swat,” a member called Slimebox said in chat logs appraised by the feds. “he got busted. shit got seized.” “HJOLY FUCK ITS GONNA GET REAL,” replied another person, who blamed Kelley for his own woes. “he burnt himself,” the person wrote.
Another insisted that “Carl fucked himself over,” likely referring to the second ODU call he appears to have placed without hiding his number.
The group speculated that Kelley’s apartment had been bugged after his arrest. Nevertheless, he was allowed to rejoin days later, according to chat logs included in the probable-cause document. Within hours of Kelley logging on, members were allegedly looking for new swatting targets. The group discussed finding a new, more secure place to host the chat server, but ultimately appear not to have made the switch. Instead, despite knowing of Kelley’s arrest, denizens continued to discuss the ODU swat.
“First step, DON’T BOMB THREAT YOUR OWN SCHOOL,” one wrote. “you hear that carl”?
“carl u dummy,” another said.
“Rule #1 If you call in a bomb threat to your own school, make sure you tell the school it was you,” a third person said, apparently referencing the call to ODU under what the feds determined was Kelley’s phone number.
Two chat members are listed as “co-conspirators,” with the FBI noting their identities were tied to an “ongoing investigation,” suggesting the potential for further arrests.
Many of the social-media accounts that include pictures of Kelley's face alongside the monikers now named in the feds' affidavit remain online. His Instagram bio includes what appears to be a jokey reference to his alleged internet activities.
“FBI,” the bio reads, “this is a parody;Don't click/arrest me.”
The FBI did not hear him.
