The Saga of Harassment by Way2Enjoy:
Home | 2018 | 2019 | 2020 | 2021 | 2022 | 2023
(Last Updated 17 March 2023)
November
Between November 21st and the 27th, the Plugins team received over 30 emails in 9 email ‘chains’ (that is, using the same subject and replying to himself). The first few replies were replied to in kind, reminding Mr. Tiwari that he, the Way2Enjoy account, and his company had their fair chances and they squandered it. As of the 28th, emails were not replied to for 24 hours in an attempt to allow Mr. Tiwari to cool down. At that time, Mr. Tiwari was again informed as to his numerous violations, and asked to stop emailing or their actions would be treated as harassment.
The emails did not stop. 21 more replies that week were sent following that via three separate email addresses.
Bribery
On Saturday November 24th, two bribery attempts were made via PayPal, for first $5 and then $10 USD. The money was refunded without comment. As both payments included the request to ‘forgive,’ it was seen as a direct attempt to coerce Mrs. Epstein to restore his plugins in exchange for money.
In order to prevent further bribery attempts, Mrs. Epstein was forced to block non-US addresses and contacted PayPal’s abuse team for help, as she could not block the user specifically and they were attempting to bribe her. PayPal recommended legal action, but since the sender was outside the US, there was little to be done from their side.
Harassment
Following this, Mr. Tiwari began to email Mrs. Epstein’s personal address again. As she had preemptively blocked his email following the bribery attempt, all emails from Mr. Tiwari bounced. He took that as impetus to find another point of contact and instead emailed her rarely used gmail address.
It’s important to recognize here: Her emails were never provided to them. It is not difficult to guess them, but they were never offered. This contact occurred AFTER Mr. Tiwari was asked to please stop emailing, or it would be seen as harassment.
Multiple emails were sent, with varying degrees of attempts to garner sympathy. The most unique one was the claim that he was getting married on December 20th, but this would not happen because he can’t promise her father that he can provide for her. None of these emails were replied to, however they were filtered to a ‘Harassment’ folder and Google informed of the ongoing harassment as it’s a violation of Gmail’s terms to make multiple accounts or to use them to harass or bribe.
Admission of Guilt
On Sunday, November 25th, Mr. Tiwari confessed to another guideline violation: having multiple people use one forum account. This behaviour is not permitted due to security concerns. That is, allowing multiple users within one account means it’s impossible to tell who uploads what code, and puts the entire plugin at risk. The WordPress.org plugin team has advocated that people add their non-development staff as ‘Support Representatives’ which affords them a higher status in the forums. This is documented and often emailed to all plugin developers as a reminder.
Mr. Tiwari also admitted to never having read the previous emails in detail. This is confusing since he (or someone using his email account) did mention some of the aspects of the email he was now claiming not to have seen before.
Partial proof of Mr. Tiwari’s fake accounts is that they used the same IP address for all the accounts, and actually replied to themselves. It’s really not that hard to connect when no one else used those IPs in that timeframe.
Escalation
Around this time, Mr. Tiwari escalated to cc’ing Mr. Mullenweg and Mr. Wood in emails. At this time, Mr. Wood was already well versed in the situation, and cautioned Mrs. Epstein to continue not replying (she had already ceased doing so). Mr. Wood did not reply from the Plugin email, and communicated privately with Mr. Mullenweg regarding the situation. The decision was made that even if Mrs. Epstein had overstepped in banning Mr. Tiwari and his company, the subsequent responses were unwelcome and created a situation that made it impossible to rescind the ban.
As of Wednesday, November 28th, he sent a (non credible) threat:
I begged for one last chance but you people are laughing. Now I pray to Lord ventaetshwara, tirupati balaji the greatest god who is richest in world because whatever wish you ask he fulfill immediately that is the reason I went 10 times there and millions of people go every Year If I am not given last chance, I request Lord balaji to take away your all name, fame, respect, wealth everything.
Jai tirupati balaji show your power to arrogant
Venkateswara is one of the aspects of Krishna (a form of Vishnu), and generally is someone against greed [wikpedia].
Finally on November 30th, he went to IRC and complained there. OpSec (who manages IRC) banned him, but he promised not to email for 10 days.
December
Regardless of his claim to not email for ten days, emails to Plugins from Mr. Tiwari persisted. In addition, there were multiple attempts to email Mrs. Epstein’s personal gmail account. Since he was blocked, Mrs. Epstein did not get the emails but she was able to see them cc’d to Plugins’ email. There were also three cases where a ‘user’ emailed plugins asking to know why the plugin was removed. It is believed these users are also fake accounts made by Mr. Tiwari, based on the language used and the digital footprint (ip address etc).
From December 4th through the 8th, no emails were sent by Mr. Tiwari nor his company. However on the 8th, the email tactics changed to what was deemed a non-credible threat:
I would have met you and begged for pardon if you are nearby but you are In USA. It will cost 5000$ minimum for to and fro from here. we can’t afford that much. We are requesting few of our engineering friends who is settled in USA to meet you but all are in different parts and USA is too big.
We are trying to request some Los Angeles local also to meet you but i am scared that it may not increase your anger more towards us.
While this did not happen, Mrs. Epstein looked into legal action via a restraining order against whoever attempts to accost her in person. The possibility of Mr. Tiwari doing this was considered unlikely, as acquiring a U.S. Visa is complicated at best, and the risk for deportation rather high for anyone who has one and commits crimes. Still, the U.S. State Department was contacted for directions as to reporting such situations.
Legal Threats
On December 9th, Mr. Tiwari decided Mrs. Epstein was abusing her powers with a lifetime ban, and again the conversation shifted. He explained that Trump made mistakes and he should be forgiven. Emails vacillated between accusations of Mrs. Epstein’s immaturity and abuse of power, but also with her overall ‘godhood’ and power. Either he was begging forgiveness or he was telling Mrs. Epstein that she was evil. This behaviour persisted through to the current day.
Mr. Tiwari offered to skype (that was ignored), and also attempted to send an audio apology (he forgot to attach it and the link 404’d). He provided ‘proof’ of Mrs. Epstein’s ability to apologize by pointing out she had apologized to WP-Spamshield and redacted their ban. This is actually incorrect, as WP-Spamshield was permanently banned and their access has not been restored since, for guideline violation and overall abusive behaviour.
After that, Mr. Tiwari sent images of cats and flowers for about 2 days but also posted an apology in the forums with yet another new account. This was removed by the Forums team. He asked about using the cat-cone Mrs. Epstein’s wife made for his dog, making it evident he was stalking Mrs. Epstein via social media. His subsequent use of content posted by Mrs. Epstein on social media prompted her to review all her followers and block any suspect accounts.
Starting on December 11th, Mr. Tiwari’s tone changed to one of hatred and anger. He claimed Mrs. Epstein was playing “dirty politics” and had high blood pressure issues. Legal threats were now made to plugins and Mr. Mullenweg directly:
I am thinking to file one case in India as well. I will update if my case was registered tomorrow.
The next day he made another account in the forums and via email he threatened a new forum post every day until an independent review was made. At this point Mrs. Epstein asked Mr. Wood about escalating the ban, and Mr. Wood explained he had been emailing Mr. Tiwari regularly, asking him to stop. However at the same time, improvements to blocks on the WordPress.org servers were made.
Mr. Wood Attempts to Reason
Mr. Wood replied to Mr. Tiwari via the Plugins account and asked him to stop. Mr. Tiwari instead said he would file legal action in India and made the following claims:
- He had gone 7 days without emailing – email logs show he never went more than four
- The Plugins Team prevented him from contacting Mr. Mullenweg – He emailed Mr. Mullenweg directly
- He was not given a chance – He was given at least six
- It’s not harassment to email someone 50+ times after being asked to stop emailing
He also attempted to bribe Plugins again ($100 this time) and said he actually knew what he’d done was wrong, and he tried to cover it up by editing his post. The implication there is apparently it’s okay to do bad things if you delete it or take it back.
Sadly after this the emails picked up again, coming every six hours or so. The basic gist was begging forgiveness.
Additional Legal Threats
Mr. Tiwari escalated again, asking Mrs. Epstein to come to WordCamp Pune in February to talk to him, and to bring her wife. Again, her personal relationships were never discussed with him. Researching someone online isn’t illegal at all, but underscores his actions of overstepping commonly understood boundaries.
Mr. Tiwari also emailed five (5) separate people from WordPress.COM to complain about this. Those actions brought the situation to the awareness of Automattic.
Mr. Tiwari added in a ‘500$ unconditional bank guarantee to wp.org’ to prove his sincerity in never violating the guidelines again. However he also determined on his own that the problem somehow was his request that moderated accounts be allowed to @-contact people and everyone should be allowed to delete a comment without repercussions. Both of those are conscious decisions made to protect the general population. In order to hold people accountable for their actions, limitations must be enforced.
On December 16th, Mr. Tiwari claimed he would contact the “California Police” at 9am on the 17th and file “a case.” For $10 million dollar (presumably USD). He requested personal information in order to file his complaint. As he never filed a legal demand for the information, none was provided.
Per Craigslist v 3Taps in the state of California, it’s a protected right to block people from your website. Furthermore, emails constitute a valid “Cease and Desist.” Since Mr. Tiwari cannot claim he wasn’t notified of impending sanctions (he replied to the email), the best he can say is he did not understand them. However that means that WordPress is well within their rights to decline the privilege of hosting.
Spamming Personal Websites
On December 22nd, the attack changed to a personal website. Both as ‘Ravi’ and ‘Sonam’ they used the contact form on LezWatch.TV to harass Mrs. Epstein’s co-developer on the site. 10 emails were sent in the morning, and another that evening. Specific code was written to prevent this from continuing and developed to be shared with others in similar situations. The emails contained useless and unwelcome advice on how to run and design a website, as well as a tale that his marriage was called off:
I am trying to please mika madam as she has banned my plugin and it’s more than 30 days. My marriage was also called off because of ban and we don’t have any food even to eat. So mika madam pardon is must so I am trying to please her. Plz don’t read message as it is for mika madam. I beg her for pardon
At this time, his anonymous email host (mailsac) was contacted directly and asked how one reports such issues of abuse when the emails were used to get around blocks. Said host took appropriate action per their terms of use.
Mr. Tiwari continued to email, prompting Mr. Wood to reply and tell him again to please stop as he was harassing people. Instead, Mr. Tiwari insisted that it’s not harassment, he’s just begging. Also he claimed it was illegal to ban people from websites.
Conversations began with the system and code maintainers on WordPress.org on how best to filter these emails and protect the community.
On December 24th, he emailed to wish Plugins Merry Christmas, and implied he would not be contacting plugins again until the new year:
See you in new year. Its my job to try hard for unban of our plugin and its your job to safeguard WordPress. I hope you wont take things personally in this disagreement.
Bye for now.
Emails started up again on December 29th, following apparently successful submissions into Joomla, recommending Plugins adopt their automated tool.