The UK “Freedom Convoy”

I’ve been extremely tangentially following the Freedom Convoy activity as part of wider opposition-monitoring efforts, including discussions being held on fascist social media about it. Because these things can be very time sensitive and change before anyone has logged them online, I’m going to write down a walk through available evidence without a particular narrative. This shouldn’t be used to draw any particular conclusions necessarily. This is just me exploring evidence available for a thing, and writing down what I find. This process itself is vulnerable to my own confirmation biases, as well as biases associated with my starting point and knowledge, and people should be aware of that while reading.

I’ll summarise my findings quickly before the details:

1. Yes, the England side of the Convoy Protest was unequivocally started at least in conjunction with far right groups.
2. Whoever put this propaganda out appears to have a budget for spinning up a fresh relatively untraceable brand out of nowhere, within a short amount of time, and populating it with interest from people in conspiracy theory spaces on Telegram who follow instructions willingly, without having an obvious visible actual grass roots basis behind it or funding.
3. All of the information relating it traces back if you go back far enough to far right groups. The actual traceable activists online are in a variety of far right spaces, and originating groups were posting content from extremely antisemitic sources.
4. There is a lot of chopping around and re-use of resources which suggests attempts to rebrand and exploit a potentially gullible or lower tech competence userbase and their inability to look back through the digital history of web resources.
5. There are general signs of attempts to avoid having any long term persistent presence online which might gather enough reputation that damaging it could be harmful to the organisers.
6. At points, they make much more of an effort to look multicultural and less than far right. Some of the people involved do not appear to be white.

Details

So today I was passed a warning that Manchester BNP and EDL (an occasionally secretly Nazi party and a defunct street fascist movement) were going to be coming to party in Manchester tomorrow, February 5th, Saturday, in Picadilly Gardens, from about 1pm-5pm, as part of the “Freedom Convoy” protest which is happening in the UK. So I decided that I would do a little OSINT, for a treat. The protest itself was advertised at hxxps://timetocometogether.co.uk/, with an associated Telegram chat. Second-hand screenshot of the Telegram below.

I obviously visited the telegram itself to check in on what was happening there, and didn’t find much of note. User X did not appear particularly influential within the group, and had faced some pushback making probing questions about possible fascist involvement ahead of posting this exuberant claim that they knew fascists who would be coming, which was itself largely ignored. However another more prominent and apparently coordinating user in the group was posting Tommy Robinson links so it doesn’t seem too much of a stretch to suggest that this was a group that was not concerned about the presence of support for fascism. Additionally there was a lot of coded antisemitic stuff in the channel about “Cabals”

So in terms of the channel itself, the first message was made on the 30th of January. So let’s look at the website do some background hunting on the domain name there.

That’s giving me some pretty intense nationalist vibes. The fluttering Union Flag. The white fist icon. And the slogan “Make Britain Great Again”.

Let’s check out when this domain was registered:> whois timetocometogether.co.ukDomain name:
       timetocometogether.co.ukData validation:
       Nominet was able to match the registrant's name and address against a 3rd party data source on 26-Feb-2021Registrar:
       Stablepoint Limited [Tag = STABLEPOINT]
       URL: http://stablepoint.comRelevant dates:
       Registered on: 07-Sep-2021
       Expiry date:  07-Sep-2022
       Last updated:  07-Sep-2021

Ok, so was this demonstration planned from September 2021? That seems wild for a demonstration capitalising on the success of a Canadian protest only a week or so ago.

Let’s look at the wayback machine to see what was up there before then.

Ok the first thing we can see here is that this is a much different vibe. The earliest archive log we’ve got is from 1st of January, not from September last year though. But it’s very much signalling “professional” rather than “nationalist”. Ugly web design but maybe that’s an artefact of the archiving process. Let’s see if we can fingerprint the origin.

There’s a link there, it was/is a wordpress. It’s got an upload from December with an “MHRA Yellow Card”.

The Wordpress URL suggests it may have been published or downloaded on 24th November 2021, the URL suggests it was uploaded in December 2021.

We can download it and check the metadata for it and it was created on 6th December, which is a 3rd date, but okay. Whatever. The locale it was generated in was en-GB, so probably British.XMP Toolkit                     : Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22
Create Date                     : 2021:12:06 09:38:24Z
Metadata Date                   : 2021:12:06 09:38:27Z
Modify Date                     : 2021:12:06 09:38:27Z
Creator Tool                    : Adobe InDesign CC 14.0 (Windows)
Instance ID                     : uuid:f881f136-0045-4bd2-82fa-c887b2b41b7f
Original Document ID            : xmp.did:ce658935-2515-904c-a3bf-beadc69df16a
Document ID                     : xmp.id:b1197dd1-0713-7949-bdaf-114ab6ed90e5
Rendition Class                 : proof:pdf
Derived From Instance ID        : xmp.iid:d556f0b9-9f67-c04e-94ee-78bcc38f0c91
Derived From Document ID        : xmp.did:f9b274a7-c98c-4545-b250-b128b4ef7ba7
Derived From Original Document ID: xmp.did:ce658935-2515-904c-a3bf-beadc69df16a
Derived From Rendition Class    : default
History Action                  : converted
History Parameters              : from application/x-indesign to application/pdf
History Software Agent          : Adobe InDesign CC 14.0 (Windows)
History Changed                 : /
History When                    : 2021:12:06 09:38:24Z
Format                          : application/pdf
Producer                        : Adobe PDF Library 15.0

This shares some significant text fragments with an advert which was placed by Steven Thomas in the Forest of Dean and Wye Valley Review, which had complaints upheld against it, which you can read about here.

At the bottom of the reverse side of this PDF leaflet is a Telegram QR code for the group People for the People’s Information Channel, as well as urls for prominent coronavirus conspiracy theory outlets, including Vernon Coleman who notoriously spread disinformation around the original outbreak of the HIV/AIDS epidemic. This seems obviously moderately well funded design behind this. The Light newspaper which it shows a little illustration is based in Manchester, and has been long criticised for it’s ties to coronavirus hoaxes, and is under active proposal to be struck off after running overdue on publishing its accounts in September 2021, but at the same time, the latest issue published online is dated 17th January 2022 at the time of writing.

When the paper was founded, it was registered to a residential address in Poynton but appears to have been handed over to a Darren Nesbit, who we’d assume is the same Darren Nesbit who’s known for singing conspiracy theory songs about the “New World Order” in Manchester’s St Peter’s Square.

Looking at the author-sitemap.xml file provided by the Wordpress Yoast SEO plugin we find only one author on the site, “WED2020”.

This corresponds to a web design company I won’t name because it appears to be a small local web designer with no obvious contacts to relevant stuff for this investigation, based in Oxfordshire. The user was created/last modified in July 2021, which seems a reasonable estimate for the most recent that the site could have been created.

So we look at the posts that this author has written which aren’t linked from the front page and see that most of them are not coloured correctly for us to read the text, but there is some sinister stuff here when we highlight it:

Interestingly the only hit I can find for this James Clevedon on a search engine alongside “Vaccine” is this website itself:

The other names for “victims” of vaccines showcased on these posts which are fully accessible to Google and other spidering engines but not foregrounded on the splash page are Phillipa Hend and Jenny hannah[with that capitalisation]. Each of the posts has “Death attributed to Covid-19 vaccine” or similarly morbid notes attached despite the lack of any actual deaths to report on the site. Alarming!

The earliest post dates to July 2021 matching the age of the WED2020 account running the website.

A lot of the stock art in the site has references to covid in some way (whether vials of vaccines, or cgi images of the virus), but none of the pages have been fleshed out. It’s likely that this was a mock up while the client was waiting to provide material for the site.

So we’ve spent a little while without finding out anything useful. At a point like this it tends to be smart to pivot. Which means to change technique and see if we can use information we already have to find another avenue of interest.

First Let’s take a quick look at the Telegram link from the original archive page we saw, hxxps://t.me/itistimetocometogether:

There’s no real obvious avenue to follow up here. There are no users chatting or banter to ponder on.

So let’s search the URL on Twitter (using a private account because I’m obnoxious on main, and a lot of people block me):

This looks more like it. Conspiracy theory slogan in the username. Lots of right wing follows/following, but nothing that stands out in terms of fascism/white supremacist/etc content. September 17th is quite early on. But as you can see from the ?fbc at the end of the URL, this link was shared/copied from being shared on Facebook, so it’s quite likely even though this link was shared first by this user on Twitter, it was already being shared around on Facebook much earlier and she’s unlikely to be the source. We can’t reverse the link id, but Facebook probably can. I do a link search on Google, but come up empty for hits.

Fine, let’s go back to the archive page again. There’s an video that won’t play. Let’s dig into the source to grab the URL and see what’s up with that:

This is more promising, cut and paste the video source address, and we’ve got the full video. It’s an anti-vax protest call out for 11–12–21.

The video is very slickly shot, focuses heavily on a multi-cultural selection of anti-vaxxers (compared with my experience of encountering anti-vax protests) and is branded People for the People which was the name of the “information service” Telegram above.

It opens with this little graphic which might give us an idea of the producer’s brand:

Neither Yandex (which is typically the GOAT for this stuff) nor Google images turns up a hit for this image. Weird.

Really weird, if I search for this brand with the name of the protest listed on the archive site.

Ok, let’s go to social media again.

Quite a few hits from people who were watching their demonstrations.

Let’s look at where these people are tweeting from!

Others tweeting about it in Dutch. There’s no news coverage of this protest.

Ok, despite the Youtube video being set to private, the Bitchute version has been left up. Weird that a video of a protest would run live, and then be hidden from the public afterwards.

Interestinly this video launches straight into a Yellow Vest over a Union Flag. The Yellow Vests in the UK, at least from my experiences in the North were tightly linked with far right grifters like James Goddard who racially abused people, which is a weird thing to be seeing here, and this brings back in the Nationalistic feel more generally that we’ve seen on the Trucker convoy

And now a dude. Okay my dude who are you?

It looks like this might be MrHellvis69 who originally uploaded the file, and has conveniently given us his Gab account (the far right social media network) as well.

There’s not much on his Gab, but this is his gab profile.

There’s some previous background here from left wing group Swindon Solidarity on the Swindon Yellow Vests indicating that they are locally seen as a far right organisation, much as the Manchester Yellow Vests were, pre-dating the Coronavirus pandemic. Other accounts on Facebook feature members of the Swindon Yellow Vests doing nazi salutes with Union flags on their back.

Editing here to add further material on Swindon Yellow Vests:

Here’s a post they shared internally from well known fascist Vinnie Sullivan

Ok so we’ve managed to trace back to some of the individuals involved in the original protest that this was advertising previously. We’ve gotten a brand for their protesting (“People For The People”). We’ve shown that there are at least limited ties to some far right stuff, but nothing conclusive. We have shown a possible tie to Oxfordshire (via the web design company used). There are absolutely clear cut ties to conspiracy theorist groups in the previous propaganda, and there are reasonably solid reasons to believe this website was previously hosting a completely different brand of propaganda with a very small following (109 subscribers in the associated previous telegram group), before being completely retooled for the new purpose of the Convoy protest, with a new identity and branding and new Telegram group.

Going back to the original Telegram group we go back among the earliest posts made there, and confirm that Real Media (who has also been sharing links to the far-right celebrity Tommy Robinson) is definitely an admin of this Telegram.

This rapid influx of users early on appear to be being directed to be active to make it appear like there’s bustle there presumably so that new users visiting the group feel like they’re joining something active.

The very earliest message is:

The users have been forwarded in via the link in that post from the Unvaccinated Lives Matter Telegram, which has it’s own ultra-nationalistic rhetoric, but only a handful of users in comparison.

This ULM chat is absolutely full of Tommy Robinson material. Almost every post is a forward from TR, around the time that the new chat got created.

This channel in turn was created in June 2021

It’s worth noting that this channel has in recent days (after widespread conversations about radicalisation on Mumsnet) started targetting Mumsnet for recruitment:

Damningly this originating group was sharing material from the neonazi chat “Jew World Order”.