Over the past month, seemingly spontaneous protest sites have popped up throughout the country that advocate for an end to lockdowns various states have mandated in an attempt to curb the spread of the coronavirus. Now, security researchers have tied much of this seemingly grass-roots activity to a single person.
Aaron Dorr is a well-known activist and lobbyist who has long been known for his advocacy of firearms ownership. Over a five-hour span on April 8, he registered six domains—reopenohio.com, reopenpa.com, reopenmn.com, reopeniowa.com, reopenwyoming.com, and reopenmissouri.com—and nine days later purchased reopentxnow.com.
He and his brothers then used a variety of state-specific Facebook groups, which according the the Des Moines Register have a total of more than 200,000 followers, to drive massive amounts of traffic to the newly registered addresses. In turn, the domains redirected visitors to a host of state-specific gun advocacy sites, such as Iowa Gun Owners. Each gun ownership site used a different organization name and prominently displayed banners decrying the lockdowns in their respective states.
“The various groups seemed loosely affiliated and seem to be run by different people in each state, but tie back to a Mr. Aaron Dorr,” researchers with Internet analysis tool provider DomainTools wrote in an analysis published on Friday. “As we looked further we would find that this is more of a small group’s astroturfing effort.”
Common threads
At least 13 of the firearms coalition sites are maintained with website tools provided by One Click Politics, which describes itself as a nonpartisan online advocacy site. The tools allow a single person to create and manage content, run email campaigns, and raise money on multiple sites. All of the sites also use the WordPress content management system that are set up in a similar manner and often carry almost identical language. Although the sites’ domain registrants were obscured through a proxy service, it appeared all of the sites were run by the same person or entity.
Then the DomainTools researchers found something else. The site at iowagunowners.org, a domain that was registered in 2007, listed a contact phone number that was included in an Iowa state lobbyist report completed by Dorr. The researchers also discovered that historical HTTPS certificates for all of the sites referenced Dorr’s personal site, as well as gun coalitions in other states.
Another similarity among the gun ownership sites: they all use a donate button provided by Anedot, a donation site for churches, charities and non-profit organizations. Almost all of the configurations for the buttons are identical.
“We can say that these initial domains and the campaign behind them are definitely a small group-run astroturfing effort and that the Dorrs plan to continue operating these nation-wide campaigns,” the DomainTools report said.
Friday’s report came four days after KrebsOnSecurity also linked several of the sites to Dorr. Reporter Brian Krebs said that at least two of the gun ownership sites included the same Google Analytics tracker in their source code. The same tracker was present on reopentexasnow.com, reopenwi.com, reopeniowa.com and several anti-gun control sites registered to the Dorr brothers.
Dorr declined to answer questions for this post or to provide a statement. A text message he sent me contained a link the the previously mentioned Des Moines Register article. The article quotes Dorr saying: “This virus has claimed the lives of (0.002%) of the state’s population, while sending over 160,000 Iowans into horrific financial devastation. Our members asked for a vehicle with which to make their voices heard, and we are happy to give them that voice.”
