Crude, Inconsistent Threat: Understanding Anonymous

Adrian Crenshaw Dubious Disclaimer Most of the time I cover technical topics. I regularly give classes and presentations on "how this protocol works" or "how do I hack X?", those sorts of things. This time, I want to delve into a little psychology/sociology. Normally I like to stick to technology because the answers are easier to test and less subjective. When people are being measured things become a lot more muddy and less definitive. When I think of the social sciences I think of the Ernest Rutherford quote: All science is either physics or stamp collecting. My general impression of the social sciences is that there is a lot of room for personal beliefs to skew the results via bad experiment design, faulty assumptions, confirmation bias and the like. I likely have biases of my own so take this paper with a boulder of sodium chloride. Also please note that to better immerse you into the Internet culture Anonymous comes from I will be linking off to many not safe for work (NSFW ) sites. After reading enough excerpts from chan culture you will hopefully begin to get a better feel for the nature of Anonymous. Abstract A lot has been said and written about a "group" referred to as Anonymous. This paper will go into Anonymous' motivations, organization (or lack thereof) and how the term "group" is sort of a misnomer. Unfortunately, group is a misnomer I will use throughout the paper because I lack a better word. For those familiar with "chan" culture, this article may not be of much use, but for those that read about Anonymous and just don't get it, this paper may be of assistance. The paper is not intended to condemn nor promote, but just to help folks understand "cyber-lynch mobs" and perhaps their security ramifications. Mostly Im just tired of hearing the news get it wrong concerning the nature of the organization. What and who is Anonymous? The first misconception I see about Anonymous is that it is a group in the organizational sense of the word. Anonymous is really not a cohesive group, if you can even call it a group. While looking in a Thesaurus for an alternative to the word group, it suggested mess, which might be more apropos. Adrian Sanabria suggested I use the word label, which is a more accurate term when it comes to Anonymous. From my perspective, Anonymous seems to have only three vaguely unifying principals: 1. Do it for the lulz. 2. Internet censorship is bad. 3. Don't hurt cats. For those not familiar with Internet culture and memes, what I just wrote wont make a lot of sense. If I use an odd term or a strange spelling, it may be a meme or a bit of jargon worth looking up with Google or better yet in EncyclopediaDramatica (So NSFW), What Port 80 or Know Your Meme. The main point is that Anonymous needs to be seen not as an organization, but as a banner term for loosely organized actions using a shared meme as a somewhat common culture and brand. If you really want to follow the changes in the Anonymous meme over time, check out the older Anonymous entries at EncyclopediaDramatica via the Wayback Machine: http://replay.waybackmachine.org/20070607170247/http://www.encyclopediadramatica.com/An onymous You can see the cause-oriented Anonymous start to creep in around late January 2008 with project Chanology, from there things begin to slowly snowball.

A second misconception is that Anonymous is a highly skilled hacker collective. First off, the definition of hacker is too contentious for me to want to go into, but the medias definition is often at odds with mine. My definition of a hacker would be along the lines of: Someone who tries to bypass limitations in largely unexpected ways to achieve a goal, and seeks knowledge to do as such. That said, some people who self-identify as being part of Anonymous are most likely highly skilled hackers (whatever metric you use to decide that), just not everyone. A better description to use instead of hacker collective is somewhat motivated people who have time on their hands collective, but that just doesn't have the same ring. Never underestimate the power of people with a little tech knowledge (and perhaps friends with a lot) that have time on their hands. For those interested in reading about someone who self-identifies with Anonymous and seems to have some skills, read the story about Kayla. A lot of details in the story set off peoples bullshit detectors, and there is not a lot that can really be confirmed about Kayla. Others who self-identify as being part of Anonymous may merely be people who know how to run someone else's script or app, or just cheer from the sidelines. What is a meme? Rather than try to define it in my own words, Ill Ligatt the definition from elsewhere: Meme: a cultural unit (an idea or value or pattern of behavior) that is passed from one person to another by non-genetic means (as by imitation); "memes are the cultural counterpart of genes" Sauce: http://wordnetweb.princeton.edu/perl/webwn?s=meme Or to put it another way: A meme is basically an idea that is easily transferable from one mind to another. Think "catchphrases". Memes are created when a large group of users come to identify with a particular image or slogan. Their continued [mis]use will bring about the destruction of the universe. Source: http://www.4chan.org/faq#meme If you read any posts by Anonymous, or hear any interviews by someone calling in as being part of Anonymous, expect memes. Sometimes these memes are used as shared cultural references or as a short hand for some deeper (or just humorous) meaning. Its sort of like that episode of Star Trek TNG named Darmok where the phrase "Darmok and Jalad at Tanagra" is used as a metaphor to indicate two warriors coming together and becoming friends after defeating a common enemy. By using that TNG reference Im labeling myself under the meme of Basement Dweller. Some common catch phrases you will see in chan culture are: Over 9000, marble cake, the game, etc. Why the Anonymous meme then? What do I mean when I say Anonymous is more of a meme than a real group? In the case of Anonymous, the meme stems from the use of image boards (commonly labeled as chans) where unclaimed posts are labeled Anonymous. The conceit is that people started using the term Anonymous as if its a real identity as opposed to just a place holder. The group could just as easily have been called Incognito if there were more fans of Sid Meier games on the various chans. Someone may make a request on an image board, like give me some Ernest Borgnine rule 34, and when someone posts the requested content without signing their name to it, then it can be said that Anonymous Delivers.

Cohesiveness? The overarching theme of this paper is that organizations, especially news organizations, should stop viewing Anonymous as one cohesive group. For that matter, law enforcement should also not bother to think of Anonymous as anorganization with a ring leader or a strict hierarchy. Certain subsets and factions might have leaders in the sense of main players, but Anonymous as a whole does not. People may want to look at
Anonymous and try to come up with some hierarchy in their minds (hell, even some people in Anonymous may envision there being a hierarchy). While not all actions performed under the

Anonymous banner may properly be considered raids or operations, this raid flowchart may best help you understand how decisions are made in the collective: http://images.encyclopediadramatica.com/images/thumb/6/62/RaidChart.gif/300px-RaidChart.gif In essence, the progression is something like the following: 1. Someone on a chan/insurgency wiki/Anonymous meme themed website or IRC channel posts hey, this is wrong/messed up/has lulz potential. I think we should give them grief! 2. Those that agree follow suit with sometimes vague details given as to their intentions and tactics. 3. Lulz ensue or they dont. 4. If Lulz ensue, go back to step two and see if more people join the action. Or... 5. Lose interest because of attention deficit or the target seems thoroughly beaten. The nature of these attacks can be anything from:

Dropping someones docs (doxing or other spellings): Revealing private information about the target, like address, phone number, wifes name, etc. This information is often found via Open Source Intelligence (OSInt) sites and social networks. In Real Life (IRL) pranks using the information above: This could be anything from an unwanted pizza delivery to a spoofed threatening call to the police to get a SWAT team called out to the residence (referred to as Swatting). Defacing of websites or social network profile pages to embarrass and annoy. Denial of service attacks: Sometimes referred to as bandwidth raep depending on how they are done. Use of the Low Orbit Ion Cannon (LOIC) tool has been mentioned a lot recently, but there are many other more sophisticated methods that could be used.

Some may view the Denial of Service actions done under the name Anonymous as hypocritical. If Internet censorship is bad, isnt DoSing someones site and making it so they cant express their opinions also censorship? The thing that keeps this from necessarily being hypocritical is that "Anonymous" is not really one group. What one group of people do under the banner of Anonymous may not be agreed with by others who use the banner Anonymous. For example, in response to the Westboro Baptist Church, one group under the banner of Anonymous said: Additionally, as your "Press Release" failed to understand: When Anonymous says we support free speech, we mean it. We count Beatrice Hall among our Anonymous forebears: "I disapprove of what you say, but I will defend to the death your right to say it." Source: http://anonnews.org/?p=press&a=item&i=512 At the same time websites like http://partyvan.info and http://insurgen.cc seem to advocate the use DoS attacks as part of their raids and in effect censor. Many of the sites affected may be businesses (like Scientology :)) and perhaps the use of these attacks is not viewed as being the same since its stifling commercial speech and not general private individual speech. Still, the view that We count Beatrice Hall among our Anonymous forebears does not seem to be a universally held tenet. Some anons may also think of DDoS using LOIC as little different than a sit-in and not something that should be illegal. I really cant agree and think even sit-ins can be wrong if they interfere with others rights to engage in commerce with whom they wish. Public protest outside of the store front or on web sites however is AWWRIGHT.

To illustrate the varying goals of Anonymous, and the lack of there being anyone behind the wheel, lets look at a few past "Anonymous" actions (Ive included videos where I can for the ADHD amongst us): 0. Habbo Hotel Raids Basically they trolled the social network/game by showing up as an avatar that looks like Jules from Pulp Fiction, and tell people the pools closed due to AIDS. Does that make sense? Probably not, but thats ok because it was done for the lulz.