When nearly eight thousand people had rushed into the main AnonOps IRC channel on December 8, eager to avenge WikiLeaks, the dozen or so operators in #command were stunned and then overwhelmed. Hundreds had been clamoring for direction, and the obvious one was to download and use LOIC. The operators made sure that at the top of the main chat channels there was a link to downloading the program, along with a document explaining how to use it.
But no one knew for sure if LOIC was safe. There were rumors that LOIC was tracking its users, that the feds were monitoring it, or that it carried a virus. More confusingly, the LOIC that Anons were downloading in droves during Operation Chanology three years ago was very different from the LOIC that they were downloading now for Operation Payback. In the fast-moving world of open source software, developers were tweaking things all the time, and there was no one deciding if they should be helping or hindering Anonymous. One person who took a closer look at LOIC realized it was doing the latter.
Around the same time that the PayPal attacks were getting under way, a highly skilled software developer hopped onto AnonOps IRC for the first time. The programmer, who did not want to reveal his nickname or real name, had worked with WikiLeaks in the past and was keen to help attack its detractors. When he downloaded LOIC from the link at the top of the main chat channels, he thought to look at the program’s source code.
“I took it apart,” he said, “and it looked like shit.”
The big problem was that the application was sending junk traffic directly from users’ IP addresses. It did nothing to hide their computer in the network. This meant the people who used LOIC without also using anonymizing software or a proxy server were just asking to get arrested.
The programmer quickly sent private messages to a few of the operators and let them know his concerns, asking them to remove the LOIC link at the top of the channel. About half of them agreed—but the other half refused. According to the programmer, the operators who refused didn’t understand the technology behind LOIC. Making things more complicated was the range of operators, all offering different interpretations of LOIC on the chat network. AnonOps had different levels of operators—network operators at the top, and channel operators below them. The channel operators were like middle managers, with the ability to kick people out of channels with a few simple commands. One young female student who went by the nickname No managed to work her way up to channel operator by the time of the PayPal attacks, and she became known for banning people from the main #operationpayback channel if they tried to tell others not to use LOIC. (Ironically, police ended up tracking down No and arresting her a few months later because she had used LOIC.)
New volunteers and operators alike also assumed there was safety in numbers. Anonymous, as the saying went, was everyone and no one. “Can I get arrested for doing this?” a person called funoob asked in the #setup channel on December 8.
“Nah, they won’t arrest you,” answered someone called Arayerv. “Too many people. You can say you have spyware. They can’t charge you.”
Another called whocares concurred: “If you get arrested just say you don’t know but it’s probably a virus.”
“I hope in a way to get arrested,” one called isuse joked. “The trial would be hilarious.” (Those who did go to trial for using LOIC later on most likely don’t agree.)
“They honestly believed that because of the amount of people it would be impossible to prosecute any single individual,” the programmer later remembered. “No one talked about prosecutions. They didn’t want to hear about your IP being exposed or anything like that.” And the overwhelming sense of camaraderie and accomplishment dominated reasonable argument. The world’s media were paying attention to Anonymous and its extraordinary hive mind; the last thing they needed was to start fiddling with the technology they were relying on and slowing things down.
Even when Dutch police swiftly arrested sixteen-year-old AnonOps IRC operator Jeroenz0r and nineteen-year-old Martijn “Awinee” Gonlag on December 8 and 11, 2010, people on AnonOps initially didn’t believe it.
“BS, no one is getting arrested,” said a user called Blue when links to the arrest stories started getting passed around. Then, when more articles about the arrests started appearing online, a flood of new Dutch supporters poured into AnonOps. There were so many that a new channel was started to host them all, called #dutch.
Around December 13, a rare digital flyer was released warning anyone who had recently used LOIC that they were at “high risk” of arrest and needed to delete all chat logs. The organizer shitstorm said: “Ridiculous. This is an obvious ploy to try and scare people away.”
“It’s a troll,” another organizer told Panda Security’s Correll.
The operators, including one who went by the name Wolfy, continued to encourage people to use LOIC even as Correll reported on the Panda Security blog around December 9 that LOIC didn’t mask a user’s IP address.
“People were so excited,” the programmer recalled. “They were in the Christmas spirit and were going crazy.”
The programmer wasn’t giving up. He decided to help build a new tool to replace LOIC. He started asking around on AnonOps for any interested volunteers who could prove they were developers. After gathering a team of eight from all over the world, they met on a separate IRC server and spent the next three weeks doing nothing but rewriting LOIC from scratch. It was the fastest program making he had ever experienced, fueled by a sense of justice against corporations and the governments and the idea of contributing to the wider collective. The programmer was at his computer all day including during work at his day job, skipping meals and drinking alcohol at the same time as his new colleagues in other parts of the world.
The team added new features to the program, which was like LOIC but let users fire junk packets at a target through Tor, the popular anonymizing network. The tool was not only safer than LOIC but more powerful and far-reaching, too. The programmer claimed it got two hundred thousand downloads on AnonOps IRC when it was finally completed on December 23. When it was posted on a popular blog run by an AnonOps IRC operator named Joepie91, it was downloaded another 150,000 times. Still, many newbie Anons continued to download LOIC because it was so well known. The link to LOIC download was still everywhere on AnonOps IRC. And the programmer’s new tool was more complicated to set up. LOIC may have even acquired a veneer of legitimacy from frequent mentions in the mainstream press— from the New York Times to BBC News.
Later, in March 2011, the programmer and his crew disassembled LOIC again and found it had indeed been trojaned, or infected with a malicious program. “It had a code that would record what you sent and when you sent it, then send it to a server,” he said, adding it was possible that users’ IP addresses were being sent to the FBI.
As it happened, the FBI had been investigating Anonymous since the attacks on copyright companies in October and November 2011, and had also been working closely with PayPal since early December. Two days after the December 4 DDoS attack on the PayPal blog, FBI agents spoke on the phone to PayPal cyber security manager Dave Weisman. As the attacks intensified, the two parties kept in touch while a security engineer at PayPal’s parent company, eBay, took LOIC apart and analyzed its source code.
On December 15, a member of PayPal’s cyber security team gave a small USB thumb drive to the FBI. It was the mother lode. The thumb drive contained a thousand IP addresses of people who had used LOIC to attack PayPal, the ones who had sent the largest number of junk packets. Once the Christmas holidays were over, the FBI would start serving subpoenas to broadband providers like AT&T Internet Services to unmask the subscribers behind some of those IP addresses. Then they would start making arrests.
“Switch is basically under a shoot on sight watch list,” the operator Owen told other operators on December 20. The botmaster who had helped make the PayPal attacks happen in early December had gone AWOL after making trouble on the network and getting banned from a few of the main chat rooms, including #command. He had become aggrieved that his contribution to the attacks hadn’t led to more power.
Civil was said to be similarly bitter. After the Visa and MasterCard attacks, he told AnonOps operators like Owen that he was being used, and that they were pretending to like him for his bots. Though it wasn’t the case for all botnet masters who supported AnonOps, Civil and Switch were largely uninterested in the activism that Anonymous was publicly fronting, according to Topiary, and more keen to parade their power to the Anon operators, getting the wow factor with their ability to take down a major website on a whim.
Meanwhile, as their former allies started attacking the AnonOps network from December 13, its operators found themselves overwhelmed with extra maintenance work. With folks like Civil, Switch, The Jester, and God knows who else attacking the network, there was no time to dictate a central strategy from #command.
The result was that the masses of original participants started splintering off and starting their own operations. Often they were legal and coherent. One former operator called SnowyCloud helped start Operation Leakspin, an investigative op calling on people to trawl through the WikiLeaks cables and then post short summaries of them on YouTube videos that could be searched with misleading tags like Tea Party and Bieber. There was also Operation Leakflood, where Anons posted a digital flyer with the headquarters fax numbers of Amazon, Mastercard, PayPal, and others with directions to fax “random WikiLeaks cables, letters from Anonymous…” People were creating the flyers in #Propaganda, where Topiary was still spending much of his time. From #Propaganda a few spearheaded Operation Paperstorm, calling on Anon to take to the “real life” streets—not in protest this time, but to plaster them with printed logos of Anonymous on Saturday, December 18. Another channel called #BlackFax listed the fax numbers of several corporate headquarters and encouraged Anons to send them ink- draining black faxes.
Soon, AnonOps was splintering into all sorts of side operations, often under agendas completely different from WikiLeaks, but always as “Anonymous.” In mid-December, a few Anons hit Sarah Palin’s official website and Conservatives4Palin with a DDoS attack, and a group of about twenty-five attacked a Venezuelan government site to protest Internet censorship. Another operation called Operation OverLoad saw Irish hackers team together to map their government’s entire network in an effort to deface every .gov and .edu site they could.
Each time someone would produce a press release announcing an attack by Anonymous, the media would suggest it was coming from the same “group of hackers” that hit PayPal and MasterCard. Not only were these people not all from the same group, more often than not they weren’t even hackers and didn’t know the first thing about SQL injection. They were armed mostly with an ability to coordinate others and with access to free software tools they could get on 4chan’s /rs/ board.
Topiary had been dipping into some of the different operations that had briefly taken off after the PayPal and MasterCard attacks. In late December, while he was lurking in #operationpayback, he noticed a number of people talking to a participant called 'k. “So you’re THE Kayla?” someone asked. They asked about an incident on 4chan—someone had taken full control of the /b/ board and spammed it with repeated loops of “Kayla <3” in 2008. 'k said yes and added a smiley face. Another name, Sabu, was lurking among the participants, not saying anything, just listening.
Soon Sabu and Kayla had moved into another secret channel that was slowly replacing #command as a tactical hub for Anonymous: #InternetFeds. This channel was so highly classified that it wasn’t even on the AnonOps network but allegedly on the server of a hardcore hacktivist with Anonymous. About thirty people had found their way in, mainly via invitation. They included Sabu, Kayla, and Tflow, some of the original AnonOps operators, and a botmaster or two. Most were skilled hackers.
of the original AnonOps operators, and a botmaster or two. Most were skilled hackers.
Here they could share flaws they had found in servers hosting everything from the official U.S. Green Party to Harvard University to the CERN laboratory in Switzerland. Sabu even pasted a list of exploits—a series of commands that took advantage of a security glitch—to several iPhones that anyone could snoop on. They threw around ideas for future targets: Adrian Lamo, the hacker that had turned in WikiLeaks’s military mole Bradley Manning, or defected botmaster Switch.
“If someone has his dox,” said Kayla, “I can pull his social security number and we can make his life hell.” To those who didn’t know her, Kayla came across as someone who was especially keen to dish out vigilante justice.
As the InternetFeds participants got to know each other more, they also saw that Sabu was the one with the loudest voice, the biggest opinions, and the strongest desire to coordinate others into action. Sabu, who was well connected to the underground hacker scene, wanted to relive the days of the so-called Antisecurity movement and would eventually realize he could do so with an elite group of Anons like Kayla, Topiary, and Tflow. What’s extraordinary is that, while his actions gradually betrayed the rhetoric, Sabu was gradually positioning himself as Anonymous’s most spectacular revolutionary hero.