Anonymous (hacker group)

• 1. Introduction

  ›

  Anonymous is a decentralized collective of activists and hacktivists. One voice speaking for it once explained the whole enterprise in a single line: "we are doing it for the lulz." The speaker described people on the Internet who wanted an outlet for doing as they wished, something ordinary society would not permit.

  Supporters of the collective have called its members "freedom fighters" and digital Robin Hoods. Critics have called them "a cyber lynch-mob" or "cyber terrorists." Time magazine put Anonymous on its 2012 list of the 100 most influential people in the world.

  Those two portraits cannot both be complete. How does a crowd with no leader, no membership list and almost no rules manage to act at all? How did a prank culture on a nameless message board end up staging protests and breaching governments? And what happened to the people who took the name seriously enough to get caught?

  17119

• 2. Imageboard Origins

  ›

  The name Anonymous dates to 2003 on the imageboard 4chan, where any visitor who posted without giving a name was tagged as Anonymous. Users sometimes joked that this tag belonged to one single person. In 2004 an administrator switched on a "Forced_Anon" protocol that signed every post that way. As imageboards grew more popular, a collective of unnamed individuals became an Internet meme.

  The board called /b/ was devoted to random material and to raiding other websites. On the 12th of July 2006, large numbers of its readers invaded Habbo Hotel, a Finnish social networking site, all wearing identical avatars. The avatars blocked ordinary guests from the pool and announced, in crude language, that it was closed.

  As traffic on the board swelled, users began plotting their pranks elsewhere, using Internet Relay Chat, or IRC. The raids earned the first mainstream press story about Anonymous, a report by the Fox station KTTV in Los Angeles. The station labeled the group "hackers on steroids," "domestic terrorists" and an "Internet hate machine."

  One person drawn into the scene at this time was Topiary, who invited large audiences to listen to his prank phone calls over Skype. He would later become a member of LulzSec.

  27333230

• 3. Leaderless By Design

  ›

  British journalist Carole Cadwalladr of The Observer compared the structure of Anonymous to that of al-Qaeda. She reduced the rules of membership to one sentence: "If you believe in Anonymous, and call yourself Anonymous, you are Anonymous." Anyone who wishes to state that they belong, belongs.

  Parmy Olson, an author who followed the group closely, once described Anonymous as a "brand." By 2012 she preferred the word "movement," calling it a nebulous crowd of people working together for various purposes. She also criticized coverage that made the group sound organized. In her words: "There was no single leader pulling the levers, but a few organizational minds that sometimes pooled together to start planning a stunt."

  The rules that do exist are few. Members should not disclose their identities, should not talk about the group, and should not attack the media. Quinn Norton of Wired added another in 2011, saying the group is not anyone's personal army, which she called Rule 44. Members often sign off with a tagline: "We are Anonymous. We are Legion. We do not forgive. We do not forget. Expect us."

  Brian Kelly writes that three traits mark the collective. The first is an unrelenting moral stance on issues and rights. The second is a physical presence that accompanies online hacking. The third is a distinctive brand. Even so, Gabriella Coleman has written that gauging the motives of thousands of participants may be impossible. Many of them leave no trace of their thoughts.

  Since 2008, members have repeatedly argued over whether to focus on pranks and entertainment or on serious and sometimes political activism. Some protest by legal means. Others use DDoS attacks, which flood a site with traffic, and hacking. Most operations target governments, organizations and corporations accused of censorship, and the group was an early supporter of the Occupy movement.

  Norton warned that reporting on Anonymous is unusually hard. In her words: "Anons lie when they have no reason to lie. They weave vast fabrications as a form of performance." She added that they sometimes tell the truth at unexpected and unfortunate times.

  An observer named Landers offered a different image in 2008, comparing Anonymous to a flock of birds. How do you know they are a group? Because they travel in the same direction, while more birds can join, leave or peel away at any moment. That same year, the flock found its first great destination.

  202138916

• 4. Masks Over Scientology

  ›

  On the 15th of January 2008, the gossip blog Gawker posted a video in which celebrity Scientologist Tom Cruise praised his religion. The Church of Scientology responded with a cease-and-desist letter, citing a violation of copyright.

  Users of 4chan organized a raid in retaliation. They prank-called the Church hotline, sent black faxes designed to drain ink cartridges, and launched DDoS attacks on its websites.

  Those attacks began with two applications, Gigaloader and JMeter. Within days they were replaced by the Low Orbit Ion Cannon, or LOIC. This network stress-testing tool lets users flood a server with TCP or UDP packets. It became a signature weapon of Anonymous. It also led to the arrest of less experienced Anons who failed to hide their IP addresses. Some operators in the IRC channels told new volunteers, falsely, that using it carried no legal risk.

  Meanwhile, a group of Anons uploaded a YouTube video. In it, a robotic voice told the leaders of Scientology that Anonymous would expel them from the Internet, partly for the laughs. Within ten days, the video had hundreds of thousands of views.

  The organizers' IRC server now had more than 10 thousand followers waiting for instructions, so they felt they had to produce something. They settled on a worldwide protest. Because all protesters were meant to stay anonymous, they wanted a mask that could serve as a unifying symbol.

  Time was short, and shipments were a problem. So the organizers improvised, phoning costume and comic book shops in major cities around the world. The only mask available everywhere was the Guy Fawkes mask from the graphic novel and film V for Vendetta. In that story, an anarchist revolutionary battles a totalitarian government. The suggestion was well received.

  On the 10th of February 2008, thousands of Anonymous supporters joined simultaneous protests at Church of Scientology facilities in 142 cities in 43 countries. The stylized Guy Fawkes mask soon became a popular symbol for the group. Some Anons also disguise their voices with voice changers or text-to-speech programs.

  Protests continued through the year, including "Operation Party Hard" on the 15th of March and "Operation Reconnect" on the 12th of April. By mid-year, turnout had shrunk and many organizers in the IRC channels had drifted away. By the start of 2009, Scientologists had stopped engaging with protesters and had improved their online security.

  283539225

• 5. Payback and the Botnets

  ›

  After the Scientology campaign faded, infighting broke out. Politically engaged members, called "moralfags" in the parlance of 4chan, clashed with trolls who wanted to provoke for entertainment. By September 2010 the group had gone a year with little publicity. Raids had shrunk and moved largely off IRC, back to the chan boards, particularly /b/.

  Then Anons learned of Aiplex Software, an Indian company. Film studios hired it to launch DDoS attacks on sites used by copyright infringers, such as The Pirate Bay. On the 17th of September 2010, Anons coordinating through IRC shut down the Aiplex website for a day. Using LOIC, they then took down the sites of the Recording Industry Association of America and the Motion Picture Association of America.

  On the 19th of September, Mustafa Al-Bassam, known as Tflow, and other Anons hacked the website of the Copyright Alliance. They posted the name of the operation: "Payback Is A Bitch," or Operation Payback for short. A press release accused the industry groups of feigning to aid artists. It said of them: "In their eyes is not hope, only dollar signs."

  IRC network operators began shutting down networks that were involved in DDoS attacks. In response, Anons organized a group of servers into an independent IRC network called AnonOps. The targets multiplied. They included the British law firm ACS:Law, the British nightclub Ministry of Sound, the Spanish copyright society Sociedad General de Autores y Editores, the U.S. Copyright Office and the website of Gene Simmons of Kiss. By the 7th of October 2010, the sites attacked had been down for a combined 537.55 hours.

  In November 2010, WikiLeaks began releasing hundreds of thousands of leaked U.S. diplomatic cables. Amazon.com booted the organization from its servers, and PayPal, MasterCard and Visa cut off its service. Operation Payback widened into "Operation Avenge Assange." Anons used LOIC to knock out the PayPal blog, the Swiss financial company PostFinance, the web-hosting company EveryDNS, and the website of U.S. Senator Joe Lieberman, who had supported cutting off services.

  The attack on PayPal's main site on the 8th of December went differently than it appeared. Topiary, who was in the command channel, said LOIC proved ineffective. The Anons relied instead on the botnets of two hackers, which marshaled hijacked computers into one concentrated assault. Security researcher Sean-Paul Correll reported that the involuntary "zombie computers" supplied 90 percent of the attack. Topiary said he and others "lied a bit to the press to give it that sense of abundance." That account was disputed.

  PayPal.com went down for an hour on the 8th of December and for another brief period the next day. Visa and MasterCard were disrupted as well. Anons had also announced plans to bring down Amazon.com but failed, allegedly because of infighting with the hackers who controlled the botnets. PayPal estimated the damage at US$5.5 million, then gave the FBI the IP addresses of 1,000 attackers, which led to at least 14 arrests. On the 5th of December 2013-13 of the PayPal 14 pleaded guilty.

  4746484950

• 6. HBGary and LulzSec

  ›

  In January 2011, Anons began actions first called Operation Tunisia, in support of Arab Spring movements. Tflow wrote a script that Tunisians could use to shield their web browsers from government surveillance. Hector Xavier Monsegur, alias Sabu, and others allegedly hijacked servers from a London web-hosting company to knock Tunisian government websites offline. In Operation Egypt, Anons worked with the activist group Telecomix to help dissidents reach censored websites.

  In February 2011, Tflow, Sabu, Topiary and Ryan Ackroyd, known as Kayla, turned on Aaron Barr, the CEO of the security firm HBGary Federal. Barr had researched Anonymous and threatened to expose its members. The four exploited a SQL injection weakness to hack the HBGary site. They used Barr's captured password to vandalize his Twitter feed with racist messages. Then they released a huge cache of company e-mails as a torrent on Pirate Bay.

  Those e-mails showed that Barr and HBGary had pitched Bank of America a plan to discredit WikiLeaks. The site was preparing to leak the bank's documents. The leak badly damaged the firm's public image, and one U.S. congressman called for an investigation. Barr resigned as CEO before the end of the month.

  In May 2011, the same four formed a hacker group called Lulz Security, or LulzSec. Its first attack was against Fox.com, leaking passwords, LinkedIn profiles and the names of 73,000 X Factor contestants. Its attack on the American Public Broadcasting Service posted a fake story. It claimed that rappers Tupac Shakur and Biggie Smalls were alive in New Zealand. LulzSec said some hacks, including that one, were meant to defend WikiLeaks and its informant Chelsea Manning.

  On the 14th of June 2011, LulzSec took down four websites at the request of fans, calling it "Titanic Take-down Tuesday." The targets were Minecraft, League of Legends, The Escapist and the spyware company FinFisher. The group also attacked the login servers of the multiplayer game EVE Online. Official targets followed. LulzSec released e-mails and passwords from senate.gov on the 13th of June. On the 15th it took cia.gov offline for several hours.

  From June 2011, hackers from Anonymous and LulzSec worked together on "Operation AntiSec." On the 23rd of June, they struck back at Arizona's immigration bill SB 1070. They released documents from the Arizona Department of Public Safety, including the home addresses of many officers. On the 18th of July, they vandalized the website of the British newspaper The Sun over a phone-hacking scandal. They also released 90,000 military e-mail accounts and passwords taken from the defense contractor Booz Allen Hamilton.

  In December 2011, AntiSec member "sup_g," alleged by the U.S. government to be Jeremy Hammond, and others hacked Stratfor, an intelligence company. They vandalized its web page, published 30,000 credit card numbers and later handed millions of its e-mails to WikiLeaks.

  On the 26th of June 2011, the core LulzSec group announced the end of its "50 days of lulz." Sabu had already been secretly arrested on the 7th of June and released to work as an FBI informant. His cooperation led to the arrests of Ryan Cleary, James Jeffery and others. Tflow was arrested on the 19th of July, Topiary on the 27th of July, and Kayla on the 6th of March 2012. Topiary, Kayla, Tflow and Cleary pleaded guilty in April 2013. In that month Australian police also arrested the alleged LulzSec leader Aush0k, but prosecutions failed to establish the police claims.

  586255

• 7. Arrests and Verdicts

  ›

  In November 2009, Dmitriy Guzner, a 19-year-old American, pleaded guilty to "unauthorized impairment of a protected computer." He was sentenced to 366 days in U.S. federal prison, making him the first person jailed for taking part in an Anonymous DDoS attack.

  British police arrested five male suspects, aged 15 to 26, in January 2011. On the 19th and the 20th of July 2011, twenty or more suspected Anons were arrested across the U.S., the UK and the Netherlands. Homes were raided in states from Alabama to Ohio. A 16-year-old was held in south London under the Computer Misuse Act 1990, and four people were held in the Netherlands.

  On the 13th of June 2011, Turkish officials arrested 32 people in cities including Istanbul and Ankara. They were accused of DDoS attacks on government websites, launched after the government asked ISPs to install filters that many saw as censorship.

  Chris Doyon, alias "Commander X," was arrested in September 2011 for a cyberattack on the Santa Cruz County website in California. He jumped bail in February 2012 and fled into Canada. In September 2012, journalist Barrett Brown, who often spoke to the media for the group, was arrested. He had posted a video hours earlier that appeared to threaten FBI agents. He was charged with 17 offenses, including publishing credit card information from the Stratfor hack.

  Christopher Weatherhead, alias "Nerdo," was a 22-year-old AnonOps administrator. In December 2012 a UK court convicted him of conspiracy to impair the operation of computers, and he received 18 months in prison. In 2013, a 38-year-old truck driver pleaded guilty to taking part in a 2011 attack on Koch Industries for one minute. He received two years of federal probation and was ordered to pay $183,000 in restitution. Anons generally protest such prosecutions and call the defendants martyrs. The arrest of Topiary became a rallying point, producing a widespread "Free Topiary" movement.

  Evaluations of the group's effectiveness have swung widely. Blogger Patrick Gray wrote that private security firms "secretly love" Anonymous for publicizing security threats. In 2012, Public Radio International reported that the U.S. National Security Agency saw the group as a potential national security threat that could develop the capability to disable parts of the power grid. CNN reported the same year that industry experts did not consider the group a major player, since DDoS attacks only briefly disable websites.

  One security consultant compared the group to a jewelry thief who steals jewels, then waves them around and tosses them to a crowd. McAfee's 2013 threat predictions said the group's technical sophistication was in decline. It was losing supporters through "too many uncoordinated and unclear operations."

  The Megaupload episode drew sharp criticism. On the 19th of January 2012, the U.S. Department of Justice shut down the file-sharing site Megaupload over alleged copyright infringement. Anons answered with DDoS attacks that took down the sites of the RIAA, the MPAA, Broadcast Music, Inc. and the FBI. Molly Wood of CNET said the attacks felt like car-burning hooligans inciting a riot. Dwight Silverman of the Houston Chronicle said they hurt the campaign against the SOPA and PIPA bills.

  Oxford Internet Institute researcher Joss Wright pointed out that Anonymous, anonymously and without accountability, censors websites whose positions it dislikes. Critics raised a related objection after October 2011. Then the group hacked a website on the Tor darknet that hosted child sexual abuse images and shut down the computers involved. That campaign, Operation Darknet, also released 1,589 usernames from a site called "Lolita City." Graham Cluley of Sophos argued that removing such sites is a job for authorities, not Internet vigilantes.

  Gabriella Coleman compared the group to the trickster archetype. She said it dramatizes the importance of anonymity and privacy as both erode amid vast databases and surveillance. Asked what good the group had done, Parmy Olson credited its support for pro-democracy demonstrators in the Middle East. She also listed unnecessary harassment of people and stealing customer data just for laughs as bad. Norton wrote in 2011 that she loved Anonymous without thinking of its members as heroes: "The internet has no neat endings."

  Fiction took notice too. Sam Esmail told Motherboard that Anonymous inspired him when he created the USA Network hacktivist drama Mr. Robot. Wired called that show's fictitious hacker group, the "Omegas," a clear reference to LulzSec.

  3426577355

• 8. Return to the Streets

  ›

  On the 5th of November 2013, Anonymous protesters held the Million Mask March. Demonstrations in 400 cities around the world coincided with Guy Fawkes Night. Two days later came Operation Safe Winter, a call from Anonymous UK to raise awareness about homelessness by collecting and redistributing resources. It inspired clothing drives and community potluck dinners in the UK, the US and Turkey.

  In August 2014, after the fatal police shooting of Michael Brown in Ferguson, Missouri, a hacktivist group claiming ties to Anonymous organized cyberprotests. On the 14th of August, an Anonymous Twitter account posted what it said was the name of the officer involved. Police said the name was wrong, and Twitter suspended the account. On the 24th of November 2014, Anonymous shut down the Cleveland city website after the shooting of twelve-year-old Tamir Rice.

  The group's claims were often contested. On the 28th of October 2015, it announced it would name up to 1,000 members of the Ku Klux Klan. On the 2nd of November, a list of 57 phone numbers and 23 e-mail addresses circulated, but the "@Operation_KKK" Twitter account denied releasing it. Names were later revealed on the 5th of November.

  After the November 2015 Paris attacks, Anonymous vowed to hunt down ISIS. ISIS replied on Telegram by calling them "idiots" and asking "What they hack?" By the next day Anonymous claimed 3,824 pro-ISIS Twitter accounts, then more than 5,000 on the third day, then 20,000 a week later. Twitter called the lists "wildly inaccurate," noting they included academics and journalists. The BBC found most of the listed accounts still active. Another claim that year came from a group calling itself AnonSec, which said it had taken almost 276 GB of data from NASA servers. NASA denied that drone control was ever compromised.

  In late 2017, the QAnon conspiracy theory first emerged on 4chan, using terminology and branding similar to Anonymous. In 2018, anti-Trump members of the collective warned that QAnon was stealing their branding and vowed to oppose it.

  In February 2020, Anonymous hacked a server of the United Nations Department of Economic and Social Affairs. It created a page for Taiwan, which has had no UN seat since 1971. On the 28th of May 2020, after the murder of George Floyd, a video appeared on Facebook. Titled "Anonymous Message To The Minneapolis Police Department," it vowed to expose the department's crimes. The Minneapolis police website went down. BBC News described the DDoS attack as unsophisticated, and CNET confirmed that leaks attributed to the hack were false.

  On the 19th of June 2020, Anonymous published BlueLeaks, 269.21 gigabytes of internal U.S. law enforcement data, through the activist group Distributed Denial of Secrets. That group called it the largest published hack of American law enforcement agencies. The files, produced between August 1996 and June 2020 by more than 200 agencies, came from a breach of the web developer Netsential. In Maine, the data showed a fusion center keeping records on people who had protested legally. Also in 2020, DDoS attacks took down Nigerian government websites in support of the #EndSARS movement.

  The Texas Heartbeat Act took effect on the 1st of September 2021, and anti-abortion groups set up "whistleblower" sites. On the 3rd of September, Anonymous announced "Operation Jane" to exhaust the investigative resources of those trying to enforce the law. On the 11th of September, it hacked the Republican Party of Texas website. On the 13th, it released private data from Epik, a web host that had briefly served one of the whistleblower sites. Distributed Denial of Secrets described the data as 180 gigabytes. Bootable disk images of Epik's servers followed on the 29th of September. More images, plus documents from the Republican Party of Texas, appeared on the 4th of October.

  On the 25th of February 2022, accounts linked to Anonymous declared a cyber operation against the Russian Federation over the invasion of Ukraine. They disabled RT.com and the Defence Ministry website. They leaked 200 GB of e-mails from the Belarusian weapons manufacturer Tetraedr. They also hacked Russian TV channels to play Ukrainian music. On the 7th of March, two Anons claimed to have hacked 400 Russian surveillance cameras in what they called "Russian Camera Dump."

  After the death of Mahsa Amini, YourAnonSpider hacked the official webpage of Iran's Supreme Leader Ali Khamenei on the 18th of September 2022. On the 23rd, a hacktivist named "Edaalate Ali" interrupted Iran's state television to show CCTV footage of its prisons. On the 23rd of October, the Iranian group Black Reward published material from Iran's nuclear program. It covered 324 e-mails holding more than a hundred thousand messages, plus over 50 gigabytes of files.

  Later in 2022, a branch calling itself "Anonymous OpIran" turned toward China. In response to the COVID-19 protests there, it launched Operation White Paper, took down government-controlled websites and leaked some officials' personal information.

  8384899197