After riots overtook West Baltimore on Monday, a hashtag began to appear on Twitter and other social media — #BALTIMORELOOTCREW — linking together posts that depicted pilfered prescription drugs and demolished store shelves.

But that "crew" was not actually in Baltimore protesting the death of Freddie Gray, according to a local cybersecurity company. Many photos shared using that label, and others, were taken years ago, and often not even in the United States, employees at Federal Hill-based ZeroFox found.


Bad actors and so-called "hacktivists" descended on Baltimore — electronically, at least — this past week, flooding social media with automated accounts and inauthentic images, said James C. Foster, CEO of the social media risk management firm. Law enforcement and cybersecurity experts said such barrages increasingly target areas of unrest around the world, spurring violence and challenging efforts to contain it.

"There's a global reach now where they don't have to be here to further instigate it," Foster said.

The company's specialty is rooting out cyber criminals lurking on social media. And when West Baltimore erupted in rioting Monday, its employees felt compelled to apply their skills. ZeroFox worked into the night tracing tweets and Facebook accounts that shared photos of looting and violence.

What they found was that much of the activity was coming from well outside of Baltimore, in some cases from Russia, China, India and the Middle East.

"I just killed a pig," wrote one tweet, showing a bloodied police officer slumped on the ground. Not only was the photo of an officer in South America, but the account sharing it was not in Baltimore.

Another tweet, which appeared to be coming from the Baltimore police, asked, "Why are we even tweeting?" and suggested that the protesters couldn't read. It also referred to them with a racial slur.

But the account was one of nearly 100 impersonating police, Mayor Stephanie Rawlings-Blake, Gov. Larry Hogan and the Maryland National Guard that popped up amid the protests.

While there was no proof that such misinformation led to any specific acts of violence, ZeroFox officials said cutting through it requires significant effort that takes away from investigations of legitimate threats.

Officials with Baltimore police and the administrations of Rawlings-Blake and Hogan declined to answer questions about cyber crimes. David Garcia, state secretary of information technology, declined to comment, saying an operation was ongoing.

— Scott Dance