The Themis Report
Anatomy of infiltration in the grassroots health freedom movement - October 6, 2021
The Themis Report, our flagship project, is an investigation of "bad actors" who have shown intent on taking control of the health freedom movement. Our report (including the in-depth Appendix 2) does a deep dive of who these characters are, how they operate, and suggestions for how communities can keep them at bay.
The Problem
As conflicts over the vaccine mandates heat up, grassroots organizations have been cropping up all over the globe, including here in America. Scores of everyday heroes have begun to work at the ground level organizing meetings, rallies, and protests, as well as connecting with government officials and advocating for better legislation. This movement has workers from all walks of life—as a true grassroots movement should—with volunteer activists using different social media platforms to navigate censorship and communicate with their fellow-organizers.
These technologies have led to a rapid rise in communication and capacity to organize. At the same time, however, activists are faced with the challenges of holding on to the reins of virtual world social-media technology where things can “go viral” in a matter of minutes. More ominously, activists are brought face to face with an unsavory real-world aspect of organizing people: the dangers of getting infiltrated by government agents or proxies for forces opposing the health freedom movement.
Health freedom organizers from New York to California have become aware that there are repeated attempts to infiltrate and hijack existing authentic grassroots movements to steer them into unproductive or even destructive channels (see Appendix 1). It is essential for all health freedom activists to realize that this is indeed a real part of the struggle in which they are involved and must be taken into account with an alert eye.
It is not an easy subject to address since a typical activist takes part in a group in the hopes that at least here, like an oasis in the desert, fellow members are reliable and have no ulterior agenda. Having sought out this oasis in their spare time, if it is discovered that the oasis is also compromised, despair or paranoia can become crippling.
Fortunately, it is possible to navigate these situations since there are clear patterns in the way these “hijackings” occur. Understanding infiltration tactics is not usually in the repertoire of the average grassroots organizer. Hence, this anatomy of a grassroots infiltration serves not only as a wake-up call, but also a guide for exposing widespread tactics, some requiring urgent attention.
The government and powerful allied forces are working overtime to brand our heterogenous health freedom movement as a monolithic right-wing group so that they can officially classify us as “extremists,” if not “domestic terrorists.” Simultaneously, Big Tech and Big Pharma are all-in on establishing a permanent medical tyranny. Thus, it should come as no surprise that our organized resistance is a target for infiltration tactics.
It is important to maintain hope, knowing any worthy cause that threatens to upset the existing power structures is always a target of opposition. Groups that resist infiltrations can bounce back much stronger than before.
The Strategy
Overall, the primary strategy of the infiltrators is to undermine the strength and unity of the health freedom movement. Their strategy towards that end entails:
1. Infiltrate and co-opt the health freedom movement
2. Harvest information on participants in the health freedom movement
3. Steer and guide groups in the health freedom movement toward radical right-wing extremism and violence
The Tactics
Since the majority of health freedom organizing takes place these days on Telegram chat groups, this platform has been one of the primary targets for infiltration and serves as a good case study for the tactics employed by infiltrators. Though virtual tactics differ from in-person infiltration, the principles are illustrative of the overall pattern for both live and online group interactions.
Appendix 2 examines in detail the methods of how one group in particular has managed through the Telegram platform to penetrate a large number of groups in the United States. An overview of the tactics entail:
1. Mimic existing groups
2. Target group owners and install bots
3. Take charge of content that can be shared
4. Steer the group into unproductive channels
5. Implement damage control when exposed
6. Harvest private data and movement information
1. Mimic existing groups
A large, highly decentralized, international organization called World Wide Demonstration (WWD) has been active for more than a year in facilitating demonstrations in major cities around the world against the pandemic restrictions and vaccine passports. Branches of this group had begun in the U.S. as well with the flyers of these demonstrations all having the same branded look and feel.
In May 2021, a group called WorldwideUSA appeared in the U.S., primarily as a WorldwideUSA Telegram group (see Appendix 3). In addition, almost overnight, WorldwideUSA Telegram groups were formed in all 50 states. Unlike World Wide Demonstration, the WorldwideUSA organization is highly centralized and hierarchical. Also, these groups all use the same logo—the Statue of Liberty—which is different than the World Wide Demonstration’s logo as shown above.
This, of course, sows confusion. People in states that had an existing World Wide Demonstration Telegram group began joining the new groups due to the similarity of the name. All the new groups in the 50 states have a similar group of administrators. The top two admins running the entire Worldwide network allegedly are “Harry” who claims to be in Germany and “Gina,” who claims to be an American expat in the UK. A third operative, “Carolina Bonita,” an American, claims to have been made an administrator of all U.S. Telegram groups. The likelihood of the same people having “grassroots” groups in all 50 states is minuscule. In addition, all the admins retain the same Statue of Liberty logo for their profile, further increasing the visibility of the alternative group.
In addition, the original authentic grassroots group, World Wide Demonstration, gets blamed on some pretext.
2. Target group owners and install bots
Telegram groups are by nature decentralized, so it is hard to find the same people in different groups in different states. However, there is a backdoor used to gain access to group owners: the spam protection bot. Under the guise of offering spam protection, the owner in the example below, Reishi (username LumiFae) is convinced to allow Harry to install a bot named “Rose” in the group.
Note above that Harry is offering to help the rally become “official WWD” (i.e., World Wide Demonstration). This is an example of posing as a top organizer of WWD when in fact his network of groups is called WorldwideUSA and is not affiliated with WWD in any way.
Through programming Rose the bot, each state group is connected nationwide in a "US federation," making the whole structure very centralized. Rose is given admin privileges. She requires anyone joining the group to say where they live. With this US federation in place, if a user gets banned from a group, Rose knows to keep the user out of all the other groups in the federation. On occasion, an admin will "drop code" (i.e., issue a "bot directive") to engage Rose in some task.
3. Take charge of content that can be shared
Once the bot has been established, the original owners or admins are usually blocked, and the new admins put themselves in charge. The hijack by a handful of centralized admins of the local, authentic Telegram group is complete. The new, self-appointed group leaders then post canned messages (posts that via bots efficiently go to all state groups at the same time) and launch an effort to steer the group into organizing rallies with their branding and in their style (i.e., WorldwideUSA’s).
Once they have established themselves as owners and admins, they recruit unsuspecting people from the groups who are actually physically located in the group’s state to become additional admins and organizers. This report describes in detail the modus operandi of disruptive operatives and offers activists suggestions for safeguarding both their own organizations and the health freedom movement at large located in the group’s state to become additional admins and organizers. Because real, in-person operatives are increasingly infiltrating organizing communities across the country, it is becoming extremely difficult to discern whether the recruited local admins are unwitting, authentic organizers who have unknowingly been swept up in this operation, or if the centralized operation control center on Telegram (i.e., Harry, Gina, Carolina) is increasingly working with boots-on-the-ground operatives all over the country.
Months ago, our team was aware of live operatives infiltrating organizing communities in New York, California, Florida, and Texas. At this point, there is credible evidence of boots-on-theground operatives in most states across the country.
Once control of a Telegram group has been established, those running the operation post their branded flyers for the upcoming rally to be organized, publish polls, post propaganda about WorldwideUSA, and post other messages meant to inspire people to action. At this point, the average member of the group gets used to the new “identity” of the group.
The operative admins spend a lot of energy telling people not to share media in the groups, and eventually they shut content sharing off. This ensures material in the group is tightly controlled.
4. Steer the group into unproductive channels
At this point, the control is more or less held by the small number of inauthentic admins who have no true relationship with the grassroots community they now direct and steer. The members can now be distracted, diluted, made confused, or have their attention focused on right-wing issues. Examples of such group manipulation include:
Setting up numerous protests to exhaust the group.
Setting up conflicting events to confuse the group such that people’s efforts can be divided. For example, a legitimate rally scheduled at Point A is scheduled for the same date and time by the infiltrated group at Point B.
The group as a whole can be nudged to fit the prototype of the “far right extremist” by deliberately encouraging the members to bring guns to events.
Dissidents get blamed for not being “active enough” and can be banned.
These steps establish the centralized control over 50 groups (i.e., 50 U.S. states) in terms of people, content, and aims. By now, the infiltration is virtually complete.
5. Implement damage control when exposed
Sometimes people figure out that there is something odd going on in the group. When the dynamics of the central control group begin to be exposed, then it is time for damage control. This can take many shapes. Since the owners and admins of the central control group are not actually physically local, they begin providing excuses for not attending rallies and events. They can even engineer a “limited exposé” of a few of the group members, leaving the rest to continue the infiltration after a re-branding of the logo (see new logo: eagle with arrows below). All in all, the goal of damage control makes sure that, on the whole, no group steps out of line and is always watched by someone in the group.
6. Harvest private data and movement information
Most perniciously, thousands of unsuspecting members are having their personal information harvested by entities like Rose the bot.
These infiltrating groups are designed to not only co-opt and guide the trajectory of the health freedom movement, but they are also designed to collect information on individuals and organizing groups, events, and trends within the movement. Trends include legal action, legislative action, exemptions, petitions, homeschooling support, etc. By posting “fishing” comments such as “Who knows a doctor in this state who doesn’t require the shot?” the success of list-building is high.
Groups such as this one of Harry and Gina’s called Worldwide New York is an example of a local group still using Rose the bot to harvest data on its members.
Analysis
Infiltration is only possible when members of the groups are not alert to the mechanisms of takeover and allow the entire process to proceed unchallenged. For example, the addition of a bot to reduce spam becomes the “technical Trojan horse” which many new users of social media may not be aware of. Just as activists across many movements have developed the ability to detect infiltration of their organizations, so too must health freedom activists add these detection skills to their toolkit.
It is important for activists to be aware and knowledgeable about infiltration. The true strength of our movement after all is at the grassroots level where people selflessly volunteer their time, money, and energy to promote the cause of health freedom. We owe it to each other that freedom be maintained in every small group throughout the country.
The network of U.S. Telegram channels in the above example has adapted and changed numerous times. Because a brand can be changed and new accounts with new names set up at any time, it is essential that folks learn to identify the behavior itself as pattern recognition since it is nearly impossible to keep abreast of the ever-changing operations and players.
Re-organizational developments
Recently, a handful of operatives complicit in the Harry/Gina operation outlined above made efforts to convince legitimate leaders in our movement that they had “broken off” from Harry and Gina. In order to be truly convincing, they offered insider details in the form of an Internal Memo. This memo outlined Harry and Gina’s tactics of taking over existing groups and bullying people. It also detailed the complex use of Rose the bot, and it was confirmed that Rose was indeed harvesting member's private data, though the extent is still unknown. (See Appendix 4 for the complete Internal Memo.)
The primary concern remains the clear attempts to marry the health freedom movement to groups or activity that would easily be classified as “right-wing extremism.” Because these groups in multiple states went so far as to encourage folks to attend rallies armed with weapons, there is serious concern that this operation aims to frame members of the health freedom movement via some kind of false flag event.
The operatives mentioned as having “broken off” from Harry and Gina have since the July 24 third Worldwide Freedom Day gone on to re-brand their channels yet again. This new nationwide network is called “Operation Take Back America.” There are new admins (or new accounts) in addition to the original team. Tactics remain the same (e.g., shame people to rile them to take action).
In this new iteration of the operation, the admins are explicit that the organizing be focused on “taking back America,” America’s last stand, overthrowing politicians, etc. Patriot Front has been suggested by admins as a good organization upon which to model activity. Rightly or wrongly, Patriot Front is depicted by mainstream hate monitors as a white supremacist, nationalist group.
Unfortunately, the Harry/Gina/Carolina operation has been and increasingly is employing real boots-on-the-ground people infiltrating real organizing communities across the country. These operatives all run Telegram channels and use them to network with existing, authentic groups to leverage legitimacy, build a following, organize rallies, and typically pose as experienced, longstanding organizers—though no one in the movement knew who any of these folks were prior to May 2021 (with the exception of a small handful of operatives known on the scene as early as January 2021).
The Players
The following Telegram groups and channels have made it explicitly clear they are knowingly working directly with the Harry, Gina, Carolina operation. These groups include but are not limited to:
American Frontline Doctors - Citizen Corps – Citizen Corps was launched relatively recently in May 2021 as an AFLDS organization designed to organize Americans at the local level (see Appendix 5). It is another example of top-down organizing of already existing local grassroots groups. Citizen Corps leaders have routinely supported and collaborated with operatives running the Harry/Gina/Carolina infiltration. In some states, the individuals running the Citizen Corps state groups are the exact same people running WorldwideUSA.
Operation Take Back America – Phase 2 of the WorldwideUSA operation run by Carolina Bonita which she and her team began August 24, 2021.
The Constitutional Freedom Initiative – A break-off group run by operatives in California.
Covid Vaccine Victims – A break-off group run by operatives in New York.
The World Wide Wakeup – A break-off group run by operatives in New York.
Freedom Groups – Groups run by an individual operative who can be found in dozens of groups across the country (e.g., Freedom Group New England).
Share-Facts – A channel run by Harry listing groups around the world
Note: At this point, there are many, many more groups on Telegram connected to this operation. They are ever changing and popping up almost daily. There has been an amplified flurry of new channels connected to this operation springing up, especially over the last two weeks of September. A tip for assessing the authenticity of a group is to scroll back through the feed to see how recently the group was created. If it was created in the last month, be very cautious. If it was created in the last six months, try establishing some credibility of those who run it and be on the lookout for any of the behavior outlined in this report.
Suggestions
Activists themselves must ultimately take responsibility for the safeguarding of their local group.
To help activists stay aware of suspicious activities, below are some suggestions for assessing whether your group is being targeted.
The flier you created for your upcoming rally is now circulating with changed time or
location—or has been canceled.
Unknown groups are claiming they organized your event.
You find yourself in some unknown Telegram group you didn’t join.
You find yourself in any of the Telegram groups listed in this report.
You find yourself in a group that uses a bot to solicit personal information. Many
legitimate organizers use bots on Telegram to keep spam to a minimum. Be in particular on the lookout for bots that are used to maintain hyper control of groups, especially multiple groups or ask for private data.
You find yourself in a group with admins who shame members into action.
You find yourself in a group that continually marries health freedom causes with hot-button issues for right-wingers such as audits/elections, critical race theory (CRT), or partisan politics.
(We can care about these causes and aim to be inclusive with an honest respect for diversity, but if you are in a group that cannot remain nonpartisan or separate alternative causes from core health freedom issues, there may be a problem.)
Out of the blue, you find yourself dealing with “drama queen” organizers, such as you have not quite encountered before even though you’ve been organizing rallies for years.
(These people might be operatives there to cause division, chaos, and disintegration.)
Be very careful sourcing and sharing information related to legal help, exemption forms, alternative medicine, etc.
Be very careful sharing anything that asks for personal information about yourself or others: signing petitions, answering questions about organizers, doctors, lawyers, yourself, etc. Assume lists are being built. Source information from trusted organizations you have learned to trust.
Stay away from any talk of violence, guns, militias, overthrowing the government, America’s last stand, etc. that does not align with the health freedom movement as a peaceful movement.
• Be on the lookout for a new kind of infiltrator. Unlike times past when they were obvious muscular men wearing dark sunglasses, today’s operatives are more likely to be multiracial, sassy, brassy millennials, or even innocuous-looking homemakers.
Support those colleagues who have a hard time digesting why it is not strategic to
engage with infiltrators.
A paradox with being alert and cautious is the possibility of becoming paranoid and overly suspicious, including even of trusted members. A judicious balance is paramount, and yet most activists have little experience with such a dilemma. Developing greater self-awareness and listening to your own intuition can help resolve uncertainties. Two resources for activists are:
Citizen Ninja: Stand Up to Power by Mary Baker
Cognitive Infiltration of the “Alternative” Media by James Corbett
We need to be careful that we don’t provide legitimacy to known operatives. Some activists may say “no harm done,” but likely the operative is simply being on good behavior. Over time, however, once trust is publicly established, the messaging and actions could subtly begin to shift in ways that are designed to not support the health freedom movement. This is how “controlled oppositions” typically work. The term “limited hangout” is important to understand.
If we do not identify infiltrator “brands” in the movement, our authentic health freedom voice could become ever more diminished as the collective controlled opposition messaging aims to crowd us out. Given the many historical examples, a modicum of education on COINTELPRO might be instructive.
One of the infiltrators’ planned outcomes is to leave activists dispirited. Do not lose heart! Learn the tactics and how to divert them while remaining focused on our movement’s shared goals of freedom and peace for humanity. Use challenging situations as opportunities to explore your need for authority and guidance from without. Are you dependent on organizations to guide your work? Or are you your own trusted leader?
When we collaborate with other trusted, longstanding organizers in our communities, make safe spaces, and encourage a culture that remains focused on the movement’s goals, we will prevail!
Conclusion
Infiltration tactics have been used worldwide for decades to dis-empower resistance movements. Understand that infiltration is an expected response from established authorities, especially as directives like mandates roll out. It is a sign that well-organized, grassroots resistance by the citizenry is extremely threatening to the powers that be.
All of the statements made in this report and its appendices are supported by an immense amount of documentation, only a portion of which are in Appendix 2. The report is not a series of accusations, but an outline of activity that has been and still is taking place in a variety of ways. We encourage folks who question the information in this report to do their own research and not simply accept or dismiss the evidence at face value.
Part of that research should include talking to trusted, longstanding organizers as it becomes clear that groups across the nation are increasingly dealing with challenges that come with U.S. infiltration. We are a heterogeneous movement that offers a multitude of diverse voices of experience. It is out of a spirit of supporting organizers, their work, and the success of our health freedom movement that this extensive research has been undertaken and an actionable report published.
Appendix 1
Statement from Children’s Health Defense - July 23, 2021
Children’s Health Defense Condemns Violence in Advance of Worldwide Freedom Demonstrations
Appendix 2
Evidence from Telegram screenshots - October 6, 2021
Appendix 3
Background on WorldwideUSA - September 19, 2021
Worldwide USA -Organized Protests
Appendix 4
Appendix 5
Manual from AFLDS Citizens - July 13, 2021
AFLDS Citizen Corps: NE Regional Leader Meeting