by Benjamin Cheah
The action of hacker group Anonymous is becoming one of the defining moments of the Internet age. Being a voluntary association, all it takes to become a member is to say you are part of it. Without a leadership structure, it is driven by ground-up initiatives and collaboration across the Internet. Through Anonymous, a single person can leverage its operating principles to wield the power of a group and enjoy the comfort of not having to meet anybody or compromising personal security.
Anybody can be Anonymous
The great lure of Anonymous is that anybody can be Anonymous. With a decent computer, an Internet connection and a basic understanding of coding and software, anyone can seek out Anonymous and participate in raids. Get a microphone, a voice distorter, a means to make and edit videos, and anyone can upload a video on the Internet claiming to speak for Anonymous.
th3j35t3r calls himself a “proud infidel and hacktivist for good’’. He made his mark on the Internet taking down websites affiliated with the Taleban, al-Qaeda and their allies, then widened his net to include individuals and organisations he believed were threats to America’s military and national security. These targets include Wikileaks, the Westboro Baptist Church and LulzSec.
On the other end of the spectrum, LulzSec compromised tens of thousands of accounts belonging to Sony, game websites, and a pornography website. Then it hacked InfraGard, a non-profit associated with the Federal Bureau of Investigation, the British National Health Service, the United States Senate website, and took down the websites of the FBI and Central Intelligence agencies. LulzSec hacked into, stole and published classified information from police and government agencies. th3j35t3r alleged that among the compromised information were the identities of undercover operatives, threatening both them and their families.
th3j35t3r vowed to expose LulzSec, eventually pinpointing two of its leaders. Later, he allegedly unearthed links between Anonymous, LulzSec and terrorism. In 2012, th3j35t3r discovered a website, multiboot, on an Internet Relay Chatroom run by members of Anonymous. The IRC admin also owned multiboot, and he gave a demonstration on the chatroom. Posing as a Middle Eastern hacker, th3j35t3r tricked the admin into revealing he hired out multiboot to Izz ad-Din al-Qassam Cyber Fighters.
Qassam’s claim to fame is Operation Ababil, targeting American financial institutions over a period of time. The Washington Post reported that the attacks came from Iran, though Qassam claims it is an independent group. Security expert Michael Smith claims the size of the group’s attacks is more consistent with the capabilities of a state actor instead of a typical hacktivist group, suggesting some kind of state sponsorship.
th3j35t3r claims that Anonymous and Occupy Wall Street have been infiltrated by terrorist organisations. AnonymouSabu used his fame to promote a rapper called Beast1333, who sells bullet-resistant vests, sings about Anonymous and possibly recruits for militant organisations like Hamas on his website. AnonymouSabu himself used the Hamas flag as his profile picture on Twitter. In addition, as seen in this video, protestors are combining the symbols of Occupy Wall Street, Anonymous and al-Qaeda in Egypt. th3j35t3r points out other symbols here, indicating it is not a one-off event. Among OWS’s flags is a black flag with white writing—resembling the banners used by jihadist groups. On 27 November 2012, Islamic Jihad leaked the personal information of numerous Israeli soldiers; a week earlier, AnonyBroadcast had published that same information as part of Anonymous-initiated OpIsrael.
Anyone can be Anonymous and anyone can benefit from Anonymous’ activities, and that ‘anyone’ includes terrorist groups and rogue regimes.
Between the State and Vigilante, the Mob
In the realm of cyber-actors, Anonymous occupies an uncomfortable niche in between the state actor and the solo player. Neither fish nor fowl, it has the weaknesses of both and the strengths of neither.
The state actor is a government that has the power of its institutions: the military, the police, and intelligence agencies. They have resources no one person—and no group of ordinary citizens—can hope to get, ranging from supercomputers to cyberwarfare tools to specialized training. While possessing great power, in a functional democratic country these groups are also held in check. Their actions need to be derived from principles of justice and proportionality, targeting only the guilty and doing only what is necessary to detect, defend, and deter. They need to obey the law, have internal investigation bodies, answer to courts and oversight committees, and need to face the scrutiny of the media and the court of public opinion. As a side benefit of having watchdogs, state actors are hardened against espionage and other threats.
Individuals like th3j35t3r are just the opposite. They have few resources and answer to nobody. They are anonymous, utilising Internet handlers and privacy protectors. Working solo, they can transition rapidly from planning to execution and back without needing to coordinate with anybody. The elite among them take measures to verify their identities and actions. th3j35t3r tweets ‘TANGO DOWN’ when taking down a website, posts a historical quote and a YouTube video in every blog post, and focuses mainly on what he believes to be national security threats. These measures are designed to build their personal brand, prevent people from copying them, and to signal that they are indeed who they say they are instead of someone operating from a hacked account. Through their deeds they demonstrate their sense of personal ethics for the world to see and judge.
Anonymous has the anonymity of the individual actor but not the anti-subversion measures. Anonymous’ mystique lies in the appearance of being everywhere at once, but its actual operational abilities are limited by lack of access to specialised tools, training and personnel. Anonymous claims to act for the greater good, yet it lacks the accountability mechanisms of the state or the integrity of the individual, and groups affiliated with it have arguably harmed innocent people. Anonymous draws its strength by acting in concert but it is divided by internal dissent, so it has neither the operational cohesiveness of the state nor the agility of the individual.
The idea of Anonymous has spread to Singapore, and hackers claiming to be affiliated with Anonymous have pulled off a few hacks. For now, Anonymous Singapore has not done the kind of damage its international counterparts have done over the past few years. This could be for any number of reasons: lack of access to attack tools, little practical experience, taking the route of least resistance. But with Anonymous having few to no internal safeguards against subversion, and with Anonymous Singapore reaching international attention, it’s only a matter of time before third parties with malicious intent infiltrates Anonymous.
Already we have seen Anonymous Singapore operating with less-than-pure intentions. They hacked a Straits Times blog page after the newspaper misquoted them, claiming Anonymous had declared war on Singapore instead of the government of Singapore. They hacked the Ang Mo Kio Town Council website after Member of Parliament Ang Hin Kee made a remark on overcrowding.
They compromised the Twitter account of actor Ridhwan Azman for the ‘crime’ of insulting them online. These actions speak of pettiness. Thus far it appears Anonymous Singapore’s hacks are designed to gain media attention, instead of targeting institutions or individuals who have genuinely caused harm to society in a way that redresses these wrongs or prevents future ones. Given this behaviour, it is not a large step away from assuming Anonymous Singapore will one day decide to indiscriminately target their critics, or like LulzSec, compromise the data of innocent Internet users to make their point. Or that someone will use the mask of Anonymous Singapore to justify harming ordinary people.
If anybody can be Anonymous, anybody will be Anonymous.