Under owner Elon Musk, the social media site X, formerly known as Twitter, has become a hotbed of white supremacist and neo-Nazi content. A recent headline in the Atlantic doesn’t mince words: “X is a white supremacist site.”
Musk has allowed formerly banned far-right and neo-Nazi accounts back on the platform, and, in some instances, he’s directly responded to accounts that traffic in white supremacist and neo-Nazi rhetoric. Meanwhile, anonymous accounts that regularly promote racial hate on the platform have seen their follower counts grow substantially as Musk has taken a more hands-off approach to moderation compared to the social media network’s prior owners.
Anonymity has long been a tactic used by extremists to spread their ideology while avoiding consequences, from Klansmen hoods to online pseudonyms. With such ideas spreading rapidly on X, the Texas Observer has identified the operators of four anonymous accounts that regularly share racist, antisemitic, and neo-Nazi content on the platform. Three of the operators appear to live or have claimed to own property in Texas, where X moderation operations are based and Musk resides.
Through reviewing posts on X, web archives, leak databases, and other social media profiles, the Observer identified the following individuals as the anonymous operators of neo-Nazi X accounts, which had a collective 500,000 followers at their peak: Cyan Cruz, a 40-year-old marketing professional who appears to have lived in Austin and Amarillo and operates the X account TheOfficial1984; Michael Gramer, a 42-year-old retired mechanical engineer who has lived in New Hampshire, operates the X account 9mm_SMG, and has claimed to have a house in Galveston and to be spending time in Dallas; Robert “Bobby” Thorne, a 35-year-old vice president at JP Morgan Chase in Plano, who operates the account Noble1945 and previously operated the account Noble_x_x_; and John Anthony Provenzano, a 30-year-old who appears to live in Virginia, operates the account utism_ (formerly known as JohnnyBullzeye), and, according to a tip and a records request response from the U.S. Navy, works at the Naval Surface Warfare Center in Indian Head, Maryland—where the Navy manufactures explosive ordnance.
These individuals are part of a broader ecosystem of far-right accounts that have rapidly expanded their reach in recent months. They are among the most popular white nationalist and neo-Nazi accounts on X whose operators have not yet been publicly identified. (While this article was in production, the Anti-Defamation League also identified Cruz as the operator of TheOfficial1984.) Their rise to prominence tracks with a dramatic decrease in moderation of hateful content on the platform, which dropped from 1 million moderated accounts in 2021 to only 2,361 accounts in the most recent 2024 X transparency report. Posts from these individuals have received tens of millions of views over the last year and a half. The accounts have also attracted the attention of major public figures. Two of the accounts have received replies from the X account of Elon Musk, who has said he writes all of his own X posts and who, as reported by Mother Jones, has amplified users who promote pseudoscientific arguments that those of European descent are biologically superior. Three of the accounts are followed by a sitting congressman, and many other right-wing media figures and outlets follow at least one of the four accounts.
All four accounts follow the other three, and all four have interacted with at least two of the other three in posts, replies, and spaces on X. The host of a June 2024 X space, an online voice chat room on the X platform, focused on “JQ 101”—“JQ” being an abbreviation used by anti-semitic extremists for the “Jewish Question”—tagged all four of the accounts in a post promoting the gathering, in which three of the four accounts participated. Nearly 17,000 listeners tuned into the conversation.
On July 9, Musk posted two replies to Cruz’s account TheOfficial1984, which Cruz has used to post pro-Hitler, Holocaust denial, and other antisemitic content. Musk’s posts were in response to TheOfficial1984’s call to reinstate a prominent neo-Nazi account, Lucas Gage, who had been banned for six months. In the replies, Musk explained that Gage had been temporarily banned for “repeated and clear calls for violence” and identified one of Gage’s many antisemitic posts as the specific reason. While Gage cannot currently post, his virulently antisemitic posts from prior to the ban remain visible on X, with many having hundreds of thousands of views.
On July 23, Musk replied to Gramer’s account 9mm_smg, which Gramer has used to make posts referring to neo-Nazi tropes such as the “14 Words” and “blood and soil” and identifying himself as a white nationalist. Musk’s reply was a laughing emoji in response to a post about a community note—a feature that allows users to add context under a post if enough users vote on it—that described Vice President Kamala Harris as former TV host Montel Williams’ “main hoe,” which 9mm_smg described as “the greatest community note of all time.”
Musk’s engagement with these accounts may fit a pattern of the mogul amplifying far-right views on X, including promoting Tucker Carlson’s interview with a Nazi apologist, in a since-deleted post, and explicitly agreeing with an antisemitic conspiracy theory, for which he later apologized. Musk’s attention to TheOfficial1984 and 9mm_smg may also be due to the fact they boast sizable follower accounts and “verified” blue checks, which can be acquired by paying a monthly fee for X Premium or may be provided for free to those with more than 2,500 verified followers. Verified users who pay for X Premium receive the opportunity to get paid for engagement from other premium users.
In October 2022, Musk committed in another post on X to ensuring “negative/hate tweets” would be “deboosted and demonetized” and not generate revenue for the social media platform. In practice, this promise appears to have been sometimes broken. The Observer found advertisements in the replies to posts from all four accounts, including posts that featured pro-Nazi, antisemitic, pro-Hitler, or neo-Nazi content. On September 4, TheOfficial1984 posted a screenshot of an email from X that said the account had been “temporarily paused for revenue sharing” for violating creator monetization standards, though ads—from which X likely profited—appeared in the replies to two of the account’s posts that same day. On October 7, TheOfficial1984 posted that it had been permanently demonetized for violating the website’s “hate and extremist content” standards. As of late November, the Observer did not find ads in replies to TheOfficial1984’s posts, though ads still appeared under the content of 9mm_smg and Noble1945.
X did not respond to a request for comment.
These accounts have drawn the attention of conservative commentators, activists, and even elected officials. The X account belonging to Republican U.S. Representative Thomas Massie of Kentucky follows three of the four neo-Nazi accounts, while the account belonging to GOP Arizona state Senator Wendy Rogers follows two. The accounts belonging to Sebastian Gorka, former and future deputy assistant to Donald Trump, and Chuck DeVore, an executive at the Texas Public Policy Foundation, both follow 9mm_smg.
Cruz’s X account, TheOfficial1984, regularly posts antisemitic, pro-Hitler, and Holocaust denial content on X, racking up hundreds of thousands or even millions of views. His account was recently disallowed from receiving subscription or ad sharing revenue for violating X policies, but ads still appear in the replies to his posts. Cruz has now been identified by the Anti-Defamation League in addition to the Observer.
In an April 2023 tweet, TheOfficial1984 mentioned another X account CyRebel as his “main account.” This username is included in a 2023 Twitter data breach and is linked to the address “[email protected].” Google reviews associated with that email show the username “1984” and reveal a response from a reviewed business that reads, “Thank you for the kind review, Mr. Cruz.”
Further corroboration linking the username “CyRebel” to the name “Cyan Cruz” comes from Venmo and Bandlab accounts that feature the name “Cy Cruz” alongside the username “CyRebel.” Cruz has an extensive digital footprint under the CyRebel username, including two publicly accessible dating profiles on Tinder and FriendFinder-X, the latter of which lists the same 1984 birth date as that listed for the only Cyan Cruz in public data maintained by the Texas Department of Public Safety (DPS).
Requests for comment directed to Cruz’s email and phone number went unreturned. However, when messaged from an Android device, Cruz’s phone number showed the username “1984” and a profile photo that reads “Handy Rebel,” the name of a defunct business that was registered under Cruz’s name with the Texas Secretary of State. The Handy Rebel business was formed in 2020 with Cruz as the managing member, listing his address as an apartment in southeast Austin, and it forfeited existence in 2022. After sending a request for comment to the TheOfficial1984 account via direct message on X, the Observer’s reporter was blocked from sending further messages.
According to his recently deleted LinkedIn, some details of which can still be seen via data aggregator site ContactOut, Cruz has lived in Amarillo and Austin and listed himself as the president of Rebel Management Group, for which the Observer could not find a business registration in Texas. He also listed himself as the CEO of Shining Star Management LLC, which was registered with the Texas Secretary of State in 2015, listing an Amarillo address for Cruz, and forfeited existence in 2017. Cruz, whose last name suggests and whose DPS database record lists that he is of Hispanic descent, may fit into a broader trend of Latinos drawn to neo-Nazi ideology.
Gramer’s account, 9mm_smg, features antisemitic posts, references to neo-Nazi slogans and concepts such as the “14 words” and “blood and soil, and discussions about national socialism and fascism, which he has said he would prefer to our current democratic system. He has also expressed admiration for Oswald Mosley, an early 20th century British fascist politician who espoused antisemitism and was closely associated with leaders of the German Nazi party.
According to his own posts, Gramer is a “white nat[ionalist]” who attended a white nationalist music festival and discusses the “JQ,” but also insists he is not a fascist, neo-Nazi, or white supremacist.
Hannah Gais, a senior research analyst at the Southern Poverty Law Center, said far-right extremists should be categorized by “the words that they themselves say. … If [Gramer] has any issues being called a neo-Nazi, then I don’t know why he would reference a slogan coined by David Lane.” (Lane, who died in 2007, was a member of the neo-Nazi terrorist organization The Order and originated the “14 words.”)
Gramer’s account was created in September 2018 but saw rapid growth over the last year and a half. The earliest Web Archive of the account is from March 7, 2023, when it had 2,083 followers. By May 7, 2023, the account had nearly 10 times that amount, and as of this writing, it has more than 220,000.
The email address behind 9mm_smg, included in the same data breach as Cruz’s, provided a first initial and last name. That same email address was associated with a Google contributor named Michael Gramer that has posted reviews of businesses in the Boston area, as well as a Duolingo account named “Mike.”
A number of personal details were revealed in 9mm_smg posts: He says he is a New Hampshire landowner and resident whose first name is “Mike,” his last name is “German,” he owns a summer home in Galveston, and he “contracted for” SpaceX, Boeing, Hispano-Suiza, and other aerospace companies. In an August 2024 post, he shared his age in an X post. ZoomInfo, a database and intelligence platform that aggregates detailed contact and business information, listed a Michael Gramer who previously worked for New Hampshire Ball Bearings, a company that has contracted with Boeing and Hispano-Suiza.
Other than what’s found in the Twitter breach, Gramer has a minimal digital footprint, though he has posted several censored pictures apparently of himself on X, showing distinctive tattoos on his arm and hands.
After the Observer reached out to two people with apparent ties to Gramer, based on Facebook posts and property records, 9mm_smg sent a message on X: “Hi. I’ve been told you had questions about me. I’m right here.”
When asked if he is the same Michael Gramer who worked for New Hampshire Ball Bearings, 9mm_smg said “yes.” Gramer then defended the “14 words” slogan, saying “The words themselves are not extreme,” before he stopped responding to other questions about his posts.
Three weeks after we contacted Gramer, he posted on X that he was in Dallas and would be there “for a while.” In mid-November, Gramer posted that he had decided to spend the winter at a friend’s rental house in Highland Park, a wealthy enclave in Dallas where Gramer said he has “a lot of friends.”
Thorne’s former account noble_x_x_ was suspended for violent speech in mid-June 2024, at which time it had at least 31k followers. The specific violent tweet he was suspended for says: “The streets are a much safer place with both of them gone”, referring to George Floyd and another Black man who was killed by police while reportedly experiencing a mental health crisis.
The account had previously shared pictures of swastikas, statements of Holocaust denial, and the phrase “Sieg Heil”, and had repeatedly identified its operator as “a Nazi” and “National Socialist”.
A second account featuring the same profile picture, noble1945, was created in October 2023, writing in one tweet: “If you’re following me on this account check out my main account at @noble_x_x_ I’m only here because of a week long ban on that one.” This account is still active at the time of publication and has around 7,000 followers.
Neither username noble_x_x_ nor noble1945 appear in the Twitter breach. However, another Twitter account with the same Twitter user ID (313782690) as noble_x_x_, with the username “fakebobbythorne,” does appear in the breach. The fact these two accounts share the same user ID number indicates that fakebobbythorne was switched to noble_x_x_ at some point, explained Travis Brown, a researcher who has built tools to research and analyze X data..
“Every X account has a numeric identifier that is unique to that account and cannot be changed,” said Brown. “A particular account or tweet may have multiple URLs associated with it if the account owner changes the screen name, but the account ID will always be the same and can be found by viewing the source of the profile or tweet page in a web browser. This makes it possible to identify profile changes by comparing current account IDs and their screen names with IDs and screen names from archives such as the Wayback Machine.”
In one September 2020 tweet, fakebobbythorne replied to Goldman Sachs Senior Chairman Lloyd Blankfein, writing “Lloyd- we’ve missed you! Glad you’re back.”
An email address linked to the fakebobbythorne username in the Twitter data breach appears in other data breaches, where it’s associated with street addresses and IP addresses in Salt Lake City, Utah. Three private data aggregator sites tied the email address to the LinkedIn profile of a Bobby Thorne listed as a vice president at JP Morgan Chase in the Dallas suburb of Plano. The same employment information appears for Robert Thorne in a database maintained by the private regulatory entity FINRA. According to the LinkedIn page, Thorne attended the University of Utah in Salt Lake City from 2010 to 2011 and previously worked at Goldman Sachs between 2015 and 2022. The fakebobbythorne account was created in 2011, during the period that LinkedIn lists Thorne as attending the University of Utah.
Noble_x_x_ posted an apparent selfie in June 2023 that facial recognition tools identified as a high-probability match both with the LinkedIn profile picture and with the old profile photo for the fakebobbythorne X account. The apparent selfie was taken inside a gym. A Google account linked to Thorne’s email address posted a review of a gym in Dallas, and a review of the gym’s social media posts and an in-person visit to the gym identified machines and a background matching the noble_x_x_ photo.
Thorne did not respond to requests for comment sent to his email address or a message left on his voicemail.
In response to a request for comment from the Observer, Michaela Ross, vice president of media relations and executive communications with JP Morgan Chase, responded via email: “The employee in question is on leave while we complete our investigation. We do not tolerate hate speech of any kind.”
Prior to being deactivated in October, the account utism_ (screen name Bullzeye) had around 70,000 followers and regularly posted pro-Nazi, pro-Hitler, and antisemitic content.
Based on memory.lol (a tool developed by Travis Brown that tracks changes to X accounts), the account appears to be the second or third account created by the same user after prior accounts with the username JohnnyBullzeye were suspended.
An old profile photo preserved in web archives from when Provenzano’s account was still named JohnnyBullzeye features the same words in a circle around the photo as the utism_ account: “You’ve just been fucked by psyops because physical wounds heal.” The old profile photo provided a face that image recognition programs matched with high probability to photos on other social media platforms including on an old Facebook account named “John Anthony” with the username “johnprovenzan0.”
A database of hacked or leaked emails shows that Provenzano used the same username, JohnnyBullzeye, to create accounts on other websites that were associated with emails that include his first initial and last name.
Public traffic citation records link Provenzano to an address in the area of Arlington, Virginia, as of 2020. Employment and location information for John Anthony Provenzano also appeared in the employment database Leadar and other private databases, indicating he has a work history as a project engineer for construction companies in Virginia.
In the course of investigating Provenzano’s background, the Observer received a tip that Provenzano had taken a civilian job at the Naval Surface Warfare Center in Indian Head, Maryland, about an hour away from Arlington. When asked about Provenzano’s employment and apparent posts on X, a public affairs officer at the Naval Surface Warfare Center at Indian Head provided the following statement: “The Navy has a zero-tolerance policy for extremist conduct and takes all allegations of personnel involvement in extremist groups seriously. These allegations are under investigation. It would be inappropriate to comment further at this time.”
A response from the Navy to an Observer Freedom of Information Act (FOIA) request for Provenzano’s personnel records provided further evidence of his employment there.
“Upon our review, we are withholding any records that would be responsive to such a
request pursuant to FOIA Exemption (b)(6), 5 U.S.C. §552(b)(6), which allows the Government to withhold information about an individual employee where the disclosure of such information would constitute a clearly unwarranted invasion of personal privacy 5 U.S.C. §552(b)(6),” the response reads.
By contrast, the Observer previously requested records in another case about a different extremist who had expressed interest in joining the Navy, and the Navy responded saying it had “no records.”
Provenzano did not respond to requests for comment sent to his email or X account. Less than a week after the Navy provided comment for this story, the utism_ account was deleted.
