September 17, 2017 started like any other day for @Team_Trump45. The Twitter account posted a meme depicting Hillary Clinton, splayed out on the ground, saying “Help! I’ve lost and I can’t shut up!” Then the account shared another Clinton meme, showing the cover of her book What Happened alongside a phony cover featuring President Donald Trump and the words I Happened. Soon after, @Team_Trump45 turned abruptly personal, posting about their “daughter” Nicky. “Well her temperature is going up fast 102-104,” the tweet said. “We gotta go to the hospital.”
Then the account—which would later change its handle to @DeepStateExpose—returned to tweeting about Trump. It posted three memes in three minutes: one showing a map of the US, all red, and the words “Keep it up Libs. This will be 2020”; an illustration of Trump pulling a barge carrying items meant to represent various industries; and an image of Trump alongside money signs and arrows, meant to symbolize the economy. Several hours later, it tweeted a fourth meme, about the “Trump Train.”
Those four posts attracted the attention of Trump, who retweeted them to his 38 million followers. This was the same day that the president posted a tweet referring to Kim Jong Un as “Rocket Man” and a GIF depicting Trump hitting Clinton with a golf ball. The day of controversial tweets earned the president headlines. The New York Times referred to @Team_Trump45 as one of the president’s “fans.” @Team_Trump45 must have been elated, though not surprised; it wasn’t the first time Trump had retweeted the account, but it made the nonstop posting about the president worth it. Millions would see @Team_Trump45’s tweets, and they would even live on in the presidential record. The question was: What did the account want with all the exposure?
>
At the time, @Team_Trump45 had 161,000 followers and went by the display name “Trumpism 5.0 ™.” (The trademark wasn’t real, and the display name changed often.) The user’s profile said, “Trumpism epitomizes Conservatism, Capitalism, patriotism, & respect for the Constitution. #MAGA.” The account posted constantly, almost always pro-Trump tweets, but the rest were about Nicky. In May 2017, the account first shared the link to a GoFundMe campaign to “help Nicky fight her battle with cancer.” The campaign had been created that month, and the goal was set at $100,000. @Team_Trump45 referred to having a “daughter with cancer” and posted descriptions of what it said were the girl’s tumors. It continued sharing the GoFundMe link into September, around the time of those Trump retweets.
Pictures of Nicky that @Team_Trump45 posted showed a young girl with big blue eyes. She was smiling but appeared to be lying in bed, dressed in a hospital gown. Nicky apparently made a painting, which @Team_Trump45 posted, of a woman in a blue gown with a cape billowing behind her that looked like a starry sky. The woman had reddish hair, like Nicky’s before she lost it. Nicky called the painting “Night.”
On the day after Trump’s retweets, @Team_Trump45 posted another update: “Nicky is still fighting, blood transfusions, platelet transfusion, high fever, she turned blue but she’s still fighting somehow. Thank you.” Over the next few months, the account gained 13,000 followers. Donations poured in, reaching over $30,000. But some people were getting suspicious about whether the campaign was legit.
Of course, Trump is famous for retweeting dubious accounts. One account Trump thanked in a tweet, @10_gop, which claimed to be a Tennessee-based source of “conservative, daily news that you won’t find on mainstream media,” later appeared on a list of accounts operated by the Internet Research Agency, a Kremlin-backed troll farm. Another account Trump once retweeted, @Blacks4Trump16, had identified its operator as “a black woman” but later started regularly retweeting the account @Identitarian14, which described itself as “pro-white.” Twitter has suspended at least a dozen accounts Trump retweeted or quoted, and at least 16 more have since been deactivated, according to an analysis by the nonprofit Media Matters for America.
Experts on disinformation typically break down malicious actors on Twitter into three types: human trolls, like the IRA employees, who constantly tweet to manipulate public discourse; bots, automated accounts that produce or engage with content to amplify it; and cyborgs, troll-bot combinations that share a mix of automated and human-written content. All three tweet at influential accounts, like Trump’s, since retweets get them bigger audiences and more credibility. “Prominent figures [need] to be a bit more careful about the accounts that they’re interacting with,” says Bret Schafer, who monitors digital disinformation as a fellow at the Alliance for Securing Democracy.
Was @Team_Trump45 one of these malicious actors, attempting to cash in on its growing popularity with a fake cancer story? Twitter users decided to do some digging.
When Trump retweeted @Team_Trump45, it put the account in front of tens of millions of the president’s followers. One user who learned of @Team_Trump45 from those retweets clicked on the profile and began to investigate. The more they saw about requests for donations, the more suspicious they became. To this person, it seemed odd that the parent of a sick girl would spend so much time tweeting memes.
@Team_Trump45 had never revealed their identity. The account’s profile photo at the time depicted Mark Wahlberg in Lone Survivor, a film about a Navy SEAL who in real life has been an outspoken Trump supporter. For a location, it said “U. S. Of A.” The GoFundMe listed “Nailya Trostle” in Germantown, Maryland, as the campaign organizer and “Jeffrey Granzow” as the beneficiary. Given the wording of @Team_Trump45’s tweets about the GoFundMe, it seemed obvious that the person behind @Team_Trump45 was Granzow. The donation campaign used the same #MAGA hashtag as the Twitter account profile. Plus, an earlier PayPal link that @Team_Trump45 once posted, seemingly unrelated to Nicky, also listed the recipient as “Jeffrey Granzow.”
So when the user discovered Granzow’s name, they pounced. In October 2017, the person started an entire account, @busterfraud1, devoted to “exposing” Granzow. They dove into public records and posted what appeared to be Granzow’s mug shots—there were at least 11 of them in a mug shot database—and criminal history. @Busterfraud1 tweeted a screenshot that appeared to show that Granzow had once pleaded guilty to sexual battery.
Soon @busterfraud1 wasn’t the only account investigating @Team_Trump45. More accounts began tweeting supposed findings, like @Ricky55870269 and @LAG1RL123. Many of the accounts retweeted each other and directed their followers to @busterfraud1. These accounts were often anonymous, and it’s possible that the same person was behind multiple accounts. (The operator of @LAG1RL123 says in a direct message that they were not behind @busterfraud1.)
>
These sleuths combed @Team_Trump45’s past tweets for clues or inconsistencies. They cited how he wrote that Nicky had stage-five cancer, even though the designations for cancer only go up to stage four. Apparently there was a warrant for Granzow’s arrest for criminal trespass, one person tweeted. Amid the panic over Russian election interference, they pointed out that Nailya Trostle, the other person listed on GoFundMe, had a Russian-sounding first name. @LAG1RL123 claimed that the money was “going to Russia.” When @Team_Trump45 posted an apparent photo of Nicky holding a handwritten sign that said “Trumpism,” the skeptics argued that it appeared Photoshopped. The sleuthing even spilled over onto Reddit, where more people joined the investigation.
@Busterfraud1 remained the ringleader. The account posted more than 1,000 times about Granzow, often tweeting at people who had said they donated. Around this time, I first learned about the controversy. When I messaged with @busterfraud1 in November 2017, the user declined to reveal their identity. But the person wrote about Granzow, “He is on Twitter 24/7 but his kid is dying from cancer in hospital. It just smelled bad all around.” The person sent me dozens of messages containing theories about Granzow, along with screenshots meant to back them up. The user said they were “concerned about the future of our democracy.”
The evidence seemed irrefutable: @Team_Trump45 was Granzow. And despite the skeptics, Granzow was determined to keep going. He shared links to fundraising campaigns for Nicky on other platforms. “Warning: Whoever would harass a little girl with Cancer and her family for political reasons is a low piece of sh*t. You know who you are,” he tweeted. When I messaged @Team_Trump45 asking to talk, the owner blocked me. Then he pulled my profile photo and pasted text over it to create a meme calling me a “leftist.” In a tweet accompanying the meme, he said I was “a political no talent lowlife.” This seemed to delight @busterfraud1, who messaged me, “He just called you out in a tweet. He must think you’re gettin close,” along with a smiley face emoji. (Granzow did not respond to multiple requests for comment. A phone number listed in a court record for him now belongs to someone else. Trostle also did not respond to messages.)
But the critics were working—and winning. @Busterfraud1 and the others reported Granzow to the fundraising platforms he’d been using. The platform Plumfund removed a campaign started there. Sara Margulis, CEO and founder of Honeyfund, which owns Plumfund, told me by email that the third-party payment processor had blacklisted the campaign, so Plumfund closed it and refunded donors, who had contributed a few hundred dollars. Jeremy Milk, who was then a spokesperson for WePay, the payment processor, wrote in an email, “If we deem an account to be illegitimate based on our proprietary models and reviews, we close the account. In this particular campaign, multiple red flags were identified.” WePay had asked the campaign administrator for information, but the “information was not subsequently provided before we closed the account,” Milk explained.
Another platform, FreeFunder, suspended a campaign under Trostle’s name after it raised $295. “It was not possible to definitively determine whether or not the person running the campaign on our platform was legitimate, so the safest answer was to disallow the campaign,” FreeFunder creator John Symonds says by email. “Knowing that the person had already raised significant amounts of money on other platforms, knowing they had already been suspended on other platforms, having more people complaining than the number of people contributing, and having an unusually high ratio of declined transactions to completed transactions, all contributed to our decision to suspend the campaign.”
Granzow and Trostle tried another platform, IDIDIT, seeking $59,000. It received no money or backers. Eventually they tweeted out a PayPal link so that people could send money directly. IDIDIT and PayPal did not respond to requests for comment.
After creating those other campaigns, and after the FreeFunder and Plumfund suspensions, Granzow and Trostle deactivated the GoFundMe themselves. “Because of the scope of our audience we feel it has become far too political,” they wrote in a final campaign update in December 2017. They had raised $33,078. Even though GoFundMe used the same payment partner as Plumfund, Bobby Whithorne, a GoFundMe spokesperson, said by email. “This campaign did not violate GoFundMe’s terms of service. It was simply removed by the campaign organizer.”
By some people’s lights, the sleuthing went too far. @Team_Trump45’s supporters and opponents attacked each other in replies. Sometimes they switched sides and blocked their former allies. Sleuths lost track of what was true. They got so caught up in spinning webs of allegations that they later deleted tweets or walked back claims when they realized they had probably gone too far. “It became overwhelming and intense,” says Glorida Budde, in a Twitter message. Budde is a Trump supporter in St. Louis who mentioned @Team_Trump45 or @busterfraud1 in more than 90 tweets before blocking them both. (Records indicate that Budde is who she says she is.) “Their intentions were too much, and I decided to not be involved,” she says. “I don’t like hurting anyone or dealing with drama. It wasn’t healthy for me.”
Granzow and Trostle are real people. As of late 2017, there was a registered Republican by Granzow’s name in Germantown (and there still is). A people-search showed results for a Nailya Trostle in that city, too. They were romantically involved at the time, according to two people who knew them. Trostle has appeared in an Instagram photo with Granzow’s mother, and @Team_Trump45 has tweeted photos of Trostle.
According to a high school yearbook and court records, a person by Granzow’s name grew up in Maryland, near Washington, DC. Public records indicate that he wound up in Logan, Utah. An online comment he appears to have written says he moved there a few years after high school. A LinkedIn page that appears to be his claims he graduated in 2012 from “Bridgerland Applied Technology College” at “University State University.” A representative for the school, which in 2017 changed its name to Bridgerland Technical College, and where credits can count toward Utah State University, confirmed that a Jeffrey Granzow graduated in 2012. The LinkedIn profile, which seems outdated, lists Granzow’s current employer as Viom Networks, an Indian telecommunications company. Two phone numbers of people listed as Granzow’s references were not working, and a person in a neighboring county whose name matched one of the references says he’d never heard of Granzow.
>
Granzow, whom records indicate is 43, was once married. He got divorced in Utah in 2010, according to public records. A source who once knew him and requested anonymity to speak candidly says he had a daughter with his first wife, but that the daughter was not named Nicky. His ex-wife considers him her “greatest mistake,” the source says. He allegedly told his ex that he had made a living by flipping used cars, before going to technical college. During the marriage, he made them put everything in his wife’s name, like credit cards and utility bills, according to the source.
The sleuths were right about Granzow’s criminal history. He has been involved in 14 or more court cases in Utah. Sometimes he spent days, weeks, or even months in jail, according to the mug shot database. As the online detectives found, court records include a charge of sexual battery, as well as charges ranging from reckless driving involving drugs or alcohol and attempted theft to assault involving domestic violence and interfering with an arrest to criminal mischief endangering human life. He pleaded guilty to all of those. He was also at least twice found guilty of violating protective orders.
Multiple women were named as victims or witnesses. As a condition of his probation in the sexual battery case, the judge ordered him to complete a “psychosexual evaluation and any recommended treatment” and “sex offender treatment” and ordered him to abide by certain sex offender conditions. Additional charges of criminal trespass, electronic communication harassment, and telephone harassment were dismissed.
He does not appear to have been an easy legal client. Robert Culas, a lawyer for Granzow in half of those 14 cases, recalls his former client as “pleasant,” though “he failed to appear in some of the cases that I was handling, and I believe I withdrew when he was not appearing in court. I guess he mentioned something about he was ill.”
Case records show that Granzow often skipped appearances and failed to comply with orders. According to a case docket, one time he called the courthouse and told the clerk he would “sue me and the city” over his arraignment date, the clerk noted. Another time, according to a separate case docket, he called the courthouse and “wanted to argue” with the clerk about a warrant. Such behavior is “not typical unless you really have some kind of mental issue,” Culas says.
Apparently the judges thought so too; in multiple cases, they ordered Granzow to undergo mental health assessments and programs. The records of those assessments have since been destroyed, but court records show that he failed to go to mandatory therapy as well as domestic violence and DUI programs. He also had to complete anger management.
Granzow returned to Maryland around 2014, records indicate. He might have been fleeing Utah, since in January of that year a court there issued a warrant for his arrest for failing to appear. In Maryland, he again ran into trouble. Court records in that state show that multiple debt collection agencies have sued him. (The Utah warrant remains active.)
As for Trostle, she was previously married too and had lived in Wisconsin. According to Wisconsin state court records, she and a man named Samuel Trostle filed for divorce in 2009. The divorce record listed her address as Moscow, Russia. Again, the sleuths had been right—Trostle was Russian. People-search results indicate that she, like Granzow, has previously lived in Utah.
But none of that proved whether Nicky existed or had cancer. Reverse image searches didn’t turn up any duplicate pictures for the ones of Nicky.
There was one clue, in the Trostle divorce records. Under “additional text” in the petition, a note said: “For divorce (with minor child).” Was that child Nicky?
Sam Trostle had gotten far away from his ex-wife, Nailya. By late 2017, he had traveled to the Philippines, where he had opened restaurants with his new wife, Joreen. Like so much of this story, Sam and Joreen’s background revolves around the internet. The two met in an online chatroom in the early 2000s while Joreen was in her native Philippines. After Sam divorced Nailya, he and Joreen met in person and eventually got married. Their romance was the subject of an hour-long Filipino TV episode.
I reached Sam and Joreen over Facebook in late 2017. Sam said Nicky was real—and so was the cancer. “My daughter Nicky does have terminal cancer, sarcoma cancer, stage 4,” he wrote to me. “It started in her left arm but has since spread to the lymph nodes and lungs. I have been to meetings with doctors at Johns Hopkins, a leading sarcoma expert at Children’s National in DC, and it’s real.” He added, “I have seen how my daughter suffers because of this sickness.”
I asked Sam if he had any documents to confirm this, but he said he couldn’t find any. Debbie Asrate, who at the time was a spokesperson for the Children’s National Health System, and Helen Jones, a spokesperson for Johns Hopkins Medicine, both confirmed that a patient named Nicky Trostle had been treated at their facilities. Jones said Nicky had been released. Citing patient confidentiality, they wouldn’t say more.
Nicky was real, even if she was Nailya’s daughter, not Granzow’s. This meant that in trying to expose Granzow as a scammer or a Russian troll, the Twitter sleuths had sabotaged his fundraising campaigns. A real girl, who seemed to really have cancer, needed money for care and might not get as much as she could have.
A couple of weeks after I learned the truth about Nicky, Sam Trostle’s wife, Joreen, messaged me. “Nicky passed away,” she wrote. Granzow tweeted the news on December 10, 2017: “Nicky is dead. Thanks every good friend here that helped her and gave her hope when alive. She's gone now.”
These days, Granzow is more influential than ever. That’s because after Nicky’s death, he found something new to tweet about. In February 2018, he posted a link to buy a blackjack strategy book he apparently had written, Get the Blackjack Advantage: How to Use Advantage Strategies to Rob the House. It was self-published under the name “Jeremy Stone.”
Less than three weeks later, he posted a link to another book by Jeremy Stone, The Deep State: The Novel. This was the start of a whole new web identity for Granzow. He rebranded as Jeremy Stone, changing his Twitter handle to @DeepStateExpose and launching a website. He described himself as a “bestselling author” and the “world’s foremost authority on the deep state.”
He went on to self-publish a three-volume History of the Deep State. He tagged the description of at least one book with #WWG1WGA (“Where we go one, we go all”), a hashtag associated with QAnon, the conspiracy theory that the FBI has warned poses a domestic extremism threat. The books discuss the Illuminati, mind control by the mainstream media, and how past US presidents used dark magic to influence elections.
Since finding this niche on the conspiratorial fringe of the pro-Trump Twittersphere, Granzow’s following has more than doubled to 347,000. Trump shared another meme of his in March 2019, garnering “Jeremy Stone” attention from The Washington Post and The Independent, though the newspapers didn’t mention his real name. People with more than 100,000 followers have promoted his books, including a 2001 Playboy Playmate. The reviews are mixed, but people are buying them. He has continued to conceal his real identity, publishing through an anonymous entity, Jeremy Stone Publishing LLC, and not registering the copyrights.
Lately, Granzow has expanded his mission beyond Trumpism: The news analysis company NewsGuard identified @DeepStateExpose as one of 10 “super-spreader” accounts for Covid-19 misinformation. In another recent analysis, Marc Owen Jones, an assistant professor at Qatar’s Hamad Bin Khalifa University who tracks social media disinformation, found that @DeepStateExpose was one of the most retweeted accounts posting a conspiracy theory about Covid-19 and 5G technology.
In fact, Jones found that @DeepStateExpose was influential in his analyses of other conspiracy theories, too. “Every time there’s something trending, there’s a good chance that Jeremy Stone is going to be a prominent figure in making that trend,” he says. “He’s reached a point within whatever his network is, a largely right-wing network, where he is able to shape the discussion. It just goes to show that someone of unknown provenance can yield a disproportionate amount of influence without having to validate any specific credentials.”
>
“Without fail, the most cohesive community of accounts spreading the information are these right-wing, pro-Trump, Make America Great Again accounts,” Jones adds. He assumes some of these users are real Trump supporters who have bought into the president’s post-truth messaging. But he says other accounts belong to malicious actors “trying hard to get something to trend, to be put on an agenda somewhere.”
Asked for comment about @DeepStateExpose, Twitter spokesperson Lauren Alexander says the platform reviewed the account and found it was “not currently in violation of our rules” regarding Covid-19 misinformation, which say the platform will “remove demonstrably false or potentially misleading content that has the highest risk of causing harm.”
With the pandemic, the protests against racism and police violence, and the upcoming presidential election, people are looking online for answers—and finding fake ones. Researchers at Carnegie Mellon University and elsewhere have found that malicious actors are exploiting these events, and the head of the National Counterintelligence and Security Center recently warned that Russia continues to use social media to meddle. Twitter has even added warning labels to some of Trump’s tweets, calling them “misleading.” Schafer, from the Alliance for Securing Democracy, describes this moment as “the perfect storm of information warfare.”
Now real people, like Granzow, are mimicking malicious actors. “You just wouldn’t think a real person would have the ability to tweet 200 times a day in support of Trump, but then you track it to a real person,” Schafer says. “I’ve certainly seen enough evidence at this point that there are real people who engage in behavior that is quite similar to what we saw coming from state-backed trolls.” As the number of malicious actors multiplies, and as those actors get better at blending in, people begin to doubt reality. “You get people to the point where they just can’t believe their own eyes anymore and start questioning everything,” Schafer says.
In the weird world of pro-Trump Twitter trolls who mimic the behavior of Russian operatives, and anti-Trump Twitter sleuths who create new conspiracy theories while trying to debunk existing ones, a girl with cancer who needed money for care got caught in the middle. Nicky was a victim of the age of disinformation.