Two months ago, we wrote a column describing how a local business faced an onslaught of aggressive harassment and negative reviews online. While the column was well-received, a few readers accused us of making up a story.
Rest assured, the story is true. The business is Rocket Express Car Wash, at 12345 W. Fairview Ave. in Meridian. Joe Russell, the owner, engaged my firm’s services. He agreed to be named and to share his experience for this follow-up.
“Late last year, while the car wash was under construction, we received an employment application from [a local man],” Russell told me. “We didn’t interview him.
“In early January he messaged us via Facebook that he had visited the car wash, and it had damaged his truck. We asked if he had spoken with a manager and completed an incident report. He said he had told us about it on the previous Sunday. I replied that we close on Sunday, and that he must be confused because nobody would be there. He continued to claim to have a receipt from that day, even though it was impossible.
“Over the following weeks he created a Facebook page for the sole purpose smearing myself and Rocket Express. He placed our personal banking information on the page and created activity on the page to smear us, primarily with conversations between the numerous fake Facebook profiles that he’d created, and [a local woman].”
According to Russell, before this incident, the woman had alleged that her vehicle was damaged in the car wash. He said she had told the general manager that “if he didn’t settle up with what she wanted, she was going to harm the business via social media.” She had apparently already paid for repairs, and was asking for an “insurance reimbursement” payment of $6,300.
Finding this suspicious, Russell told her he “would not simply reimburse her ... and would require the matter either go to court, or be investigated by her insurance company.”
Soon afterward, Russell said, he “began to see negative ratings and comments on each of the internet-based rating services” from the man and the woman, “the fake aliases, and some of their friends and family.” At the same time, a Facebook share on the woman’s profile went viral: a screenshot of an alleged email from Russell whose author spewed “disgusting language and threats” directed at her. Russell knew this had been fabricated.
Upon our request, we were provided with the full email and its headers by the woman’s attorney. Almost immediately, we determined that the email headers were not correct for Russell’s actual email address, but instead the email originated from “emkei.cz,” a well known email spoofing service. Through further investigative work we learned that the job applicant had accessed emkei.cz and addressed a fake email to the woman from Russell’s address, on the exact date and time the forged email was sent.
Any potential for doubt as to the origin of that email had vanished. But was the woman the applicant’s accomplice, or a misguided victim? Had he used his knowledge of this woman’s hatred for Russell to his advantage, knowing that she would react in such a way if he crafted such an email?
Through a combination of digital forensics and meticulous online investigating, we determined a number of details that illustrated the connection the woman had to the vengeful job applicant. Numerous Facebook messages between the two detailed their common rage at Russell. In one message they discussed the nuances of the best way to harass Russell’s son.
Further research showed that a year before this incident began, both individuals had written similar scathing negative reviews for a different Boise car wash, unassociated with Rocket Express. The man had created a fake Facebook page for that business and used numerous fake profiles — some of the same ones used in the Rocket Express case — to smear that business.
To quote from “V for Vendetta”: “There are no coincidences, only the illusion of coincidence.”
Neal Custer is president of Reveal Digital Forensics & Security, a subsidiary of Custer Agency Inc., and an adjunct professor at Boise State University. Written with Dylan Evans, Reveal’s vice president of operations. firstname.lastname@example.org. This column appears in the July 20-Aug. 17, 2016, edition of the Idaho Statesman’s Business Insider magazine. Click here for the daily Statesman e-edition, including Business Insider (subscription required).