AT A GLANCE

• Willyn Trabajador aka Lyn Ouvrier faces a criminal complaint before the Department of Justice for allegedly posting a bomb threat and assassination plot against the President
• The criminal complaint filed by the police misses important information about the account that posted the threats, specifically details that support Trabajador's claims her account was cloned
• Trabajador says the police investigation against her was done irregularly and claims the subpoena she received had no attached criminal complaint, making her unable to counter the police's accusations

---

READ: Part 1: For anti-Duterte netizen, online troll attacks turn into real world nightmare

MANILA, Philippines – Is Willyn Trabajador the person who posted a bomb threat and assassination plot against President Rodrigo Duterte on Facebook? Or was her account really cloned by a Duterte troll, as she claims?

Trabajador is facing a criminal complaint filed by the Philippine National Police (PNP) before the Department of Justice (DOJ) for a crime she said she did not commit.

Trabajador is being accused of having posted a bomb threat and assassination attempt against the President in March. After the threats were posted by a Facebook account named Lyn Ouvrier – an alias Trabajador has used before to criticize the government – Trabajador found herself harrassed by death threats and the subject of a criminal complaint by police.

She claims her Lyn Ouvrier account was cloned as a trap to frame her as a terrorist – an allegation that the police, she said, took hook, line, and sinker .

She also pointed out various flaws in the police's affidavit against her and raised doubts about the quality of the investigation conducted by the Major Crimes Investigation Unit (MCIU) of the Criminal Investigation and Detection Group (CIDG).

Fabricated evidence?

Trabajador said the police falsely claimed that the bomb threat was first shared on the anti-Duterte Facebook page Resbak Operatives (RO), which Trabajador operates.

“They even stated a false allegation in their affidavits that the threats first appeared on the RO page. An outright lie,” she told Rappler.

In the evidence the police provided, Rappler found that the PNP failed to provide a screenshot of the threat that it claimed appeared on the Resbak Operatives page. Rappler also could not find any online records showing the threat appeared on that Facebook page.

Instead, all online records pointed to the threat being first shared by a certain Khayri Woulfe, a fake account that supports Duterte.

Trabajador said Khayri Woulfe had vowed to take her down in the lead up to the bomb threat. She said Woulfe had pretended to be anti-Duterte and joined the Resbak Operatives group, to find out who the group's administrator was.

“Khayri Woulfe was the same DDS troll who has been threatening and harassing me since early February. He was the first to expose me as the founder of Resbak Operatives,” she said.

“Ironically, he was the one being credited by the pro-Dutertes as the person who ‘uncovered’ the threats.”

Trabajador said the attacks started when she was first identified as the administrator of Resbak Operatives in February, the same month that columnist and Duterte propagandist Antonio Contreras wrote about the group on The Manila Times , tagging them as “Cyber Talibans.”

A Rappler review of the wall of Trabajador's Lyn Ouvrier confirmed that Ouvrier and Khayri engaged in heated arguments for months. A post by Lyn Ouvrier dated February 12 slammed Khayri for harrassing her friends and spreading lies against her.

Trabajador also pointed out that the only evidence of the bomb threat from the Lyn Ouvrier page is one screenshot – the same screenshot Woulfe shared.

Rappler's research confirmed there are no other screenshots of the post taken by anybody else and no other record of it exists online.

FIRST POST. The bomb threat was first shared by a fake account called 'Khayri Woulfe for President.' Screenshot from Willyn Trabajador

The one screenshot has a dateline of “2 mins,” meaning the screenshot was taken two minutes after it was posted. There were also no embeds of the post or links to the alleged account that posted it.

The account Khayri Woulfe, which first shared the threats, is no longer on Facebook.

Major contradictions

While Khayri Woulfe provided an archived link of the alleged threat on his post, Rappler found significant discrepancies. An archived link provides an authentic snapshot of a webpage that will always be online even if the original page disappears.

The archived version of the threat is credited to Lyn Ouvrier with the Facebook url facebook.com/willyntrabajador/posts . The url link raises questions.

DISCREPANCIES. The archived post of the alleged threat exposed the user's real name, and showed a boost button. Screenshot from archive.is

Trabajador’s Lyn Ouvrier profile url is facebook.com/authorlyn . The url that posted the threat is a Facebook page, not a Facebook profile.

Trabajador pointed out that if she was hiding behind a fake account to hide her real identity when she posted the threat, then it made no sense that the url would contain her real name.

“The FB url that the clone account used is… my real name. Now who in his sane mind will do that? Only the person whose full intent is to lead the authorities to me,” she said.

Rappler found that the archived link was saved at 4:29 pm, Manila time (8:29:16 UTC). The screenshot of the bomb threat showed it was posted just two minutes earlier or at 4:27pm – meaning Woulfe saw it as soon as it was posted by the Lyn Ouvrier page.

When Woulfe shared it to the world at 4:35 pm, he did not provide a direct link to the Lyn Ouvrier page that posted the threat and instead shared an archived link, because the page was presumably gone already. During the maximum 6 minutes that the post was up, not a single netizen but Woulfe got a screenshot of the threat or claimed to have seen it.

Past archived links of the url facebook.com/willyntrabajador/posts also showed that the mysterious Ouvrier page that posted the assassination plot was written by a certain "Zoroastrov S. Vukovic." The Russian name was removed in a subsequent screenshot just 3 minutes later, suggesting a cover up.

RUSSIAN NAME. The first archived link bears a Russian name as the person who posted the plot.

GONE. The Russian name was gone in a subsquent screenshot 7 minutes later. Screenshot from archive.is

The dates on the archived links of that url also show the assassination plot was online as early as March 19, yet no one appeared to have seen it over the course of 6 days. It did not go viral until it resurfaced conveniently on March 25 when Khayri Woulfe shared the bomb threat. Kharyi Woulfe also shared the post on the assassination plot.

The page, it appears, was only known to Khayri Woulfe.

Finally and most curiously, the archived links of the assassination plot and bomb threat show a “Boost Unavailable” button underneath the posts. The boost button on Facebook is only ever seen by the creator of the post, or the administrator of the page . The boost button is never visible when a netizen simply visits a page.

This means that whoever took the screenshot or archived the link, was also the creator or the administrator of the Lyn Ouvrier page.

The original screenshot is traced back to Khayri Woulfe, having had the earliest and only record of posting it, lending support to Trabajador's claims that it was Khayri Woulfe who had cloned her account and posted the threats.

Irregular police activities

The discrepancies on the archived link were not once mentioned in the police affidavit. Khayri Woulfe was never mentioned either, despite the fact that he was the sole person who had allegedly seen the threat, and was the account that spread it.

Based on its affidavit, the PNP never reached out to the owner of the Khayri Woulfe account nor exerted any effort on finding out who was behind it.

"I find it questionable that CIDG (MCIU) didn’t do that. Even more odd is the lack of mention about Khayri in their affidavits,” Trabajador said.

She also questioned acts of police harassment during the course of their investigation.

She said that the week after the threat was posted, two CIDG cops from Canlubang visited her and introduced themselves only “as SPO1 Reyes and PO3 Alipay.” The two did not show her any IDs. She said she spoke to them at the Barangay Captain's office with the barangay captain himself present, but while she was at the barangay, some unidentified individuals “went into the compound of my boarding house to take pictures of my house, according to my neighbor.”

“They also showed my pics around and told people I posted bomb threats on Facebook,” she said.

She said another cop, “SPO1 Bernal from Dasmariñas PNP” visited her on April 11 asking to take her photo which she declined. She said Bernal interrogated her about her background and her online activity, but when she asked why, he denied there was a probe against her. On April 21, cops from CIDG Crame, one of whom she remembers as “Police Inspector Romeo E. Encinares” invited her to police headquarters in Camp Crame.

“I didn’t go because they did not have official documents to show me, to prove they were conducting an official investigation,” she said. “He also confirmed I did not have a case or complaint against me. So I didn’t go. That was the last visit I got from the authorities.”

Trabajador said she asked them to subpoena records of the threat from Facebook, “as I was and still am more than willing to subject my account for scrutiny as long as it goes through due process.”

Trabajador said that agents from the National Bureau of Investigation in Region VI from San Dionisio, Iloilo, also visited her family home. Since then, strange men have also visited the Dasmariñas City home she used to rent – she had left it for fear of her life – asking her neighbors about her new location or where she moved to.

Aside from moving residences, she said she even closed her shop in Cavite because of the threats.

“I’ve been getting death threats since March,” she said.

It was on August 24 when her former landlady told her there was a subpoena addressed to her from the DOJ.

She said the subpoena was delivered Thursday, but she received it on Friday, August 25. She was asked to submit her counter affidavit a week later by Thursday, August 31.

"They were asking me to submit a counter affidavit and other supporting documents to the DOJ on August 31, at 2:30 pm. But they only sent the subpoena. No other attached documents like copies of the complaint and their so-called evidence that I would need in order for me to file my counter affidavit," she said.

“And I was expected to submit the counter affidavit and find witnesses and evidences in less than 3 days."

Trabajador only got the documents that collated evidence against her when she herself went to the DOJ to ask for them. The CIDG document submitted to the DOJ falsely said she was "at large."

She also requested for an extension to submit her counter affidavit, which was approved by DOJ Prosecutor Moises Acayan.

"He consented to giving me time until Monday (September 18) to submit my counter affidavit. And he also said, I am allowed to draft my own counter affidavit and to submit it on Monday if I can't find a lawyer," she said.

Trabajador, who has no financial resources to pay for private counsel, has approached various public lawyer groups but has yet to find a lawyer willing to take on her case.

She fears a warrant of arrest will be issued if she is unable to find legal help and file a solid counter affidavit, adding she is "100% sure they will bring me to court."

Destroying dissent?

Lawyer Pao Celeridad of the Commission on Human Rights (CHR), one of the groups Trabajador approached for legal help, admitted to Rappler he has "never" encountered a case like Trabajador's.

He said they advised Trabajador to look for private counsel or go to the Public Attorney's Office (PAO) "because strictly speaking, this is the mandate of PAO."

"It is regrettable we can't help out in this kind of matter. It does involve human rights but this has taken a criminal angle which we can't take," Celeridad told Rappler.

He also expressed concern over the unusual case "because it's taking advantage of information people put out in the public forum that is the internet."

"Simply with a person's picture and name, people with ill intent can easily frame them up for investigation by our prosecution service. And with an investigation infrastructure that's still not designed to adapt to the nuances of cybercrime, it's hard to trust that cases will be processed fairly and thoroughly," he said.

"It's going to put unnecessary burdens on people to make sure that nobody is parading their names and pictures online."

As for Trabajador, what she finds concerning is the efforts to silence critics like her.

She said that she is convinced it is not her the officials are after, but online groups like Resbak Operatives, who counter the pro-Duterte online machinery.

“I’m very insignificant for the CIDG to devote almost half a year to, regardless of my online and offline activism. It’s not me they’re after. It’s my group. If my suspicions are correct, the administration see us a threat to their main propaganda machine on social media,” she said.

But she said attacking her will not scare off Resbak Operatives.

"My team will continue to operate without me. They know the routine and the procedures, they have a ready leader to fill in my shoes in the event that something happens to me.”

In a Facebook post , she said what she has gone through "is a clear case of political persecution."

"A political persecution aimed to take me down at all cost because of my relentless stand against the extrajudicial killings in this country and for my openly encouraging Filipinos to take a strong stand against the oppression and tyranny of the present Duterte administration and his rabid supporters." – Rappler.com

Weaponizing the internet series:
Part 1: Propaganda war: Weaponizing the internet
Part 2: How Facebook algorithms impact democracy
Part 3: Fake accounts, manufactured reality on social media
Inside Martin Andanar's man cave

Bloggers as propagandists series:
Part 1: State-sponsored hate: The rise of the pro-Duterte bloggers
Part 2: Blogger-propagandists, the new crisis managers