CSOC Assessment of the Activities of Anonymous in Australia

Overview
Anonymous first emerged in 2003 on internet imageboards as a group of individuals who carried out coordinated
operations termed ‘raids’ against random targets for their own amusement. In their early years,
Anonymous relied primarily on virtual sit-ins and distributed denial of service attacks.
Anonymous claims to be a leaderless collective of individuals who work towards a common interest,
however, monitoring by international intelligence agencies has shown that Anonymous has a clearly
defined structure (see below). Leaders of the group tell its members it is an organic organisation, “like a
suit without a head” (from which its logo is derived).
Since 2008, Anonymous’ operations have become more coherent, organised, frequent and damaging.
Anonymous’ justifies its activities as pursuing justice, human rights and freedom of speech.
Up until 2011, Anonymous maintained the mentality of embarrassing its targets rather than causing
major damage, taking websites offline and leaking unimportant confidential information. Since 2011
and the emergence of the ‘LulzSec’ subgroup, Anonymous’ activities have become more focused on
leaking confidential information and attacking governments. It credits itself with being responsible for the
overthrow of governments during the Arab Spring, although it is believed that Anonymous’ claims in that
regard are entirely overstated.
In the United States, Anonymous is viewed by the Department of Homeland Security and Federal Bureau
of Investigation to be a risk to United States national security. Internationally, Anonymous’ release of
confidential information is a concern, with no discretion given to what is released. In Australia operatives
seem far more restrained in this area.

Structure and Culture
Anonymous presents itself as a unified ‘digital brain’ with no clearly defined leadership structure.
Members are expected to act in the name of the group according to the group’s own norms. The group
claims that anyone can act in the name of Anonymous, but those who announce operations without the
approval of Anonymous leadership are denounced on social media sites such as Facebook and Twitter.
Leadership of Anonymous consists of a core group of individuals known as Sabu, Topiary (captured in
the UK), Owen, CommanderX, EleChe, Kayla, JoePie91 and Tflow who are heavily supported by a large
group of around 150 commanders who lead operatives in a particular region or on a particular operation.
Beneath the commanders are lieutenants who are responsible for recruiting and training new members,
research computer system vulnerabilities, conduct reconnaissance on potential targets and co-ordinating
attacks. The lieutenants appear to be the most active of the group.
Below the lieutenants are operatives which are the most diverse of the group. It is estimated that there
are around 15,000 operatives globally, with at least 2,000 in Australia. These are the foot soldiers
of Anonymous and range from those who join in on attacks using tools provided by Anonymous to
professional hackers. Since 2008, an increasing number of operatives operate offline distributing fliers
and participating in protests.
Tools and methods
Anonymous makes extensive use of the internet to conduct its operations. When carrying out these operations, Anonymous personnel hide their identities using open proxies, the onion routing network and
the invisible internet project network. Anonymous’ online activities include recruitment, reconnaissance,
exploitation of systems, website defacement, theft of confidential data and denial of service.
Primarily, Anonymous relies on tools developed by others for penetration testing. It’s primary toolset
includes the Backtrack Linux distribution and Low Orbit Ion Canon (LOIC) on Windows. The use
of LOIC by inexperienced operatives has allowed the intelligence community and law enforcement
to identify a number of individuals through Microsoft’s Windows Error Reporting platform. Senior
leadership of the organisation leave junior operatives vulnerable, considering them to be chumps and
easily replaceable.
Australian targets
It is believed that Anonymous has had operatives in Australia since at least 2003-2004. Their operations
had been minor within Australian borders up until the commencement of ‘Project Chanology’ in 2008.
Project Chanology
Project Chanology was Anonymous’ campaign against the Church of Scientology following the removal
of a video from video sharing website YouTube. Anonymous began an international campaign against
the church and through the media’s coverage recruited massive numbers of persons in the 14-25 year old
age group. Authorities believe that Project Chanology was a stunt organised by Anonymous leadership to
recruit more members to the organisation.
On February 10, 2008, large numbers of protesters turned out in Melbourne, Adelaide and Sydney to
protest against the Church coinciding with protests around the world.
On March 15, 2008 protesters turned out in Melbourne, Brisbane, Adelaide, Perth and Sydney.
On April 12, 2008 the only major Australian protest occurred in Sydney.
At these protests, people hid their identities using masks. Anonymous leadership claimed this was to
show the world that Anonymous was “united as one”, however authorities understand that it was to avoid
Police attention as many of the hackers were in attendance at the protests.
These masks led to the call by Police to be given powers to force the removal of attire covering a person’s
face known as ‘burqa laws’.
During the protests, electronic attacks were carried out by what Anonymous terms ‘online operatives’
against Church of Scientology’s telecommunications infrastructure.
Operation Didgeridie
Australian authorities began monitoring Anonymous more closely in September 2009 after the Federal
Bureau of Investigation contacted the AFP’s High Tech Crime Operations Unit and warned them that
attacks on Australian targets were being planned by Anonymous operatives in Australia and abroad.
Plans to attack Australian infrastructure were made in response to the Rudd Government’s planned
internet filtering which would block access to Anonymous imageboards and forums.
On 9 September 2009, the Prime Minister’s website was taken down through the use of a distributed
denial of service attack orchastrated by Anonymous. The attack only lasted an hour and was seen by
many in Anonymous to be a failure.
Operation Titstorm
Monitoring of Anonymous by the CSOC indicated on 5 February, 2010 that an attack on government
websites by Anonymous was imminent. Anonymous leadership had been planning attacks since
September 2009 in response to the Rudd Government’s internet filtering. Anonymous leaked a list of sites
proposed to be in the filter to Wikileaks.
On 8 February, 2010, Anonymous operative ‘jordotube’ posted a video message to the Australian
government on YouTube telling it that nobody messes with the Internet. They demanded that plans to
filter the internet be abandoned and for the resignation of Minister for Broadband, Communications and
the Digital Economy, Stephen Conroy. They threatened that failure to meet their demands would result in
Anonymous’ ‘full-fledged wrath’.
Attacks on the website of the Australian Parliament commenced on 10 February, 2010 at 8:00PM and
continued for two days. Government offices were flooded with spam, black faxes and prank phone calls.
The amount of bandwidth required to disrupt the website was small at 17Mbps and measures have since
been put in place to avoid such a low-scale attack causing disruption in the future. Current testing shows
that all Ausralian government websites can withstand at least 25Mbps before services are disrupted.
Small protests occurred in Brisbane, Sydney, Adelaide and Melbourne on 20 February, 2010 under the
banner Project Freeweb.
Australian Federal Police arrested Matthew George, 22 from Newcastle for taking part in the 10 February
attacks.
Operation AntiSec
Operation AntiSec was an international operation targeting government agencies and information security
contractors. On 28 June, 2011, Mosman Council’s website was hacked by Anonymous as part of the
operation. Four website databases were leaked to the internet.
Operation Ability
Anonymous ‘declared war’ on the NSW Department of Education and Communities on 25 July, 2011.
The operation’s commander appears to be an individual using the name ‘anon2790’ who appeared on
the day of the declaration. Initial assessments by CSOC believed the operation to have been carried out
as a means of intimidation of staff of Carenne School, Bathurst by persons associated with the Carenne
Gate Affair blog, however monitoring of Twitter and Anonymous websites indicate that the operation is
endorsed by Anonymous leadership.
Operation Ability has involved hacking of the NSW Department of Education and Communities, NSW
Police Force, Facebook and Blogger.
Structure and Organisation
While Anonymous claims it has no formal leadership structure, assessments by the international
intelligence community have discovered that it has a clear leadership structure.
Persons of Interest
auanon
Forums: Twitter, Facebook
Activities: Commander of Anonymous in Australia, facilitates communication among Australian
operatives using Twitter and Facebook.
Involved in Project Chanology, Operation Didgeridie, Operation Titstorm and Operation AntiSec.
Profile:
‘auanon’ is likely a 19-22 year old female university student studying public relations or journalism. Their
writings are always concise and designed to grab attention.
‘auanon’ is buoyed by their support on Twitter, having over 300 followers, mostly Anonymous members.
belladonna
Forums: whyweprotest.net
Activities: Organiser of Project Freeweb
Profile:
‘belladonna’ is most likely a male aged between 16-22 based upon postings on whyweprotest.net and
conversations on IRC. He often speaks of topics involving beastiality, small-breasted women and anal
sex. He organised the Operation Titstorm.
anon2790
Forums: Twitter, opability.blogspot.com
Activities: Organiser of Operation Ability
Profile:
‘anon2790’ claims to be in the Lithgow-Bathurst-Orange region of NSW, however analysis of their
writings indicate that they are from the North-East of the United States. Most leaks related to Operation
Ability are placed on the internet by ‘anon2790’. They are most likely male, aged 24-30.
fred_lowry
Forums: Twitter, opability.blogspot.com
Activities: Involved in the dissemination of information obtained under Operation Ability
Profile:
‘fred_lowry’ appears to be a middle-aged Australian male, most likely from Northern Queensland. Their
writings are blunt, to the point and sometimes ocular.
Assessment
Anonymous presents a real threat to the security and stability of Australia due to its alliance with
Wikileaks and its willingness to post confidential information on the internet without consideration to the
potential implications of such postings.
Anonymous also presents a threat to government agencies, corporations and individuals through its denial
of service and telecommunications interruptions.
As time goes on, Anonymous has become far more brazen in its approach and is generally considered to
be ‘out of control’. This general cockiness will lead to the downfall of its leadership who strongly hold
the belief they cannot be found.
Recommendations
Further monitoring and penetration of Anonymous cells needs to be carried out by the law enforcement
community. It is recommended that the law enforcement community conduct investigations into
Anonymous by gaining the trust of Anonymous members and joining in their activities.