“Hello World. It’s time I share with you a little secret…I’m Gay and Proud!!
It’s not a tweet you’d expect from a Twitter account belonging to an ISIS member. But the account was hijacked by a hacker who goes by the name WauchulaGhost.
The profile name on Twitter, which originally referenced jihad, has been replaced with “Jacked by a Ghost,” the signature of the hacker who’s waging an online campaign against ISIS.
Over the past month, WauchulaGhost says he’s hacked over 250 Twitter accounts associated with ISIS members and replaced the content with pornography and gay pride messages.
“There was a few of us… that discovered a vulnerability,” he told CNNMoney. “We thought, ‘Hey let’s go start taking their accounts … and humiliating them.'”
Initially, WauchulaGhost replaced the jihad-related content with pornography to offend ISIS, but started posting gay pride messages following the attack of a gay nightclub in Orlando that left 49 dead.
“You had all those innocent lives lost,” he told CNNMoney. “I just felt there’s something I could do against the Islamic State to defend those people.”
When he takes over the accounts, WauchulaGhost replaces images of ISIS flags with rainbows and gay couples embracing. He says he also direct messages its followers to cause confusion.
“I’ll talk to them for a few minutes, either in Arabic or English, and I’ll just have a normal conversation,” he told CNNMoney. “Then I’ll let them know it’s the ghost and not who they thought it was.”
(He added that he doesn’t speak Arabic but has “contacts all over the world who translate for me.”)
As ISIS uses social media to spread its message, a growing number of hackers are taking matters into their own hands, often operating illegally to take down content.
WauchulaGhost, who said he’s received death threats from ISIS members, identifies as a part of hacking collective Anonymous. He was previously part of a hacktivist group called Ghost Security Group, which is made up of former counterintelligence officials and computer specialists, but split off from the group in November and currently operates alone.
He says there are hundreds of “hunters,” scouring Twitter for ISIS-related accounts. Those people include Anonymous members and citizens who document ISIS accounts.
He criticized companies like Twitter for not doing more to shut down the accounts, although he said that lately accounts are being suspended more quickly, which doesn’t given the users time to get as many followers.
“So far all but three accounts that I have taken are suspended,” he added.
A Twitter spokesperson says the company condemns the use of its service to promote terrorism and has suspended over 125,000 ISIS-related accounts since the middle of 2015. “Twitter rules make it clear that this type of behavior, or any violent threat, is not permitted on our service,” the spokesperson told CNNMoney.
WauchulaGhost wouldn’t disclose his real name or location but says he hacks in his free time. He spends eight hours a day in an office and another eight in the evening taking down ISIS-related accounts. He started hacking at 16, after becoming curious about computers. And while he calls himself an “average Joe” hacker, he claims to be able to breach an account within 60 seconds once he has the information needed to break in.
After receiving feedback from people who support the cause but not necessarily the porn, WauchulaGhost said he doesn’t plan to post images of pornography. Long term, he doesn’t know what he’ll replace it with, but for now, gay pride is a message he’s sticking with.
“Sometimes you have to stand up for what you believe in,” he told CNNMoney. “If you want change, you have to make that change, even if it means doing something illegal.”