Cyberactivists warned of arrest

By Joseph Menn in San Francisco

Published: February 4 2011 23:23 | Last updated: February 5 2011 00:40

An international investigation into cyberactivists who attacked businesses hostile to WikiLeaks is likely to yield arrests of senior members of the group after they left clues to their real identities on Facebook and in other electronic communications, it is claimed.

Supporters of the internet group – known as Anonymous, which gained wide attention after it co-ordinated attacks that crashed the websites of some businesses that had broken ties with WikiLeaks – have continued to ambush high-profile targets, recently forcing government sites in Egypt and Tunisia to close.

However, a senior US member of Anonymous, using the online nickname Owen and evidently living in New York, appears to be one of those targeted in recent legal investigations, according to online communications uncovered by a private security researcher.

A co-founder of Anonymous, who uses the nickname Q after the character in James Bond, has been seeking replacements for Owen and others who have had to curtail activities, said researcher Aaron Barr, head of security services firm HBGary Federal.

Mr Barr said Q and other key figures lived in California and that the hierarchy was fairly clear, with other senior members in the UK, Germany, Netherlands, Italy and Australia.

Of a few hundred participants in operations, only about 30 are steadily active, with 10 people who “are the most senior and co-ordinate and manage most of the decisions”, Mr Barr told the Financial Times. That team works together in private internet relay chat sessions, through e-mail and in Facebook groups. Mr Barr said he had collected information on the core leaders, including many of their real names, and that they could be arrested if law enforcement had the same data.

Many other investigators have also been monitoring the public internet chats of Anonymous, and agree that a few seasoned veterans of the group appear to be steering much of its actions.

But he does not plan to give specifics to police, who would face hurdles in using some of the methods he employed, including creating false Facebook profiles.

In their main online chat rooms, which are accessible to anyone, Anonymous members have affected an air of bravado, apparently believing that if enough ordinary computer users download the tools to make their cyberattacks on websites simultaneously, only a small minority will face prosecution.

Behind the scenes, however, key Anonymous figures are fretting that they will soon face charges, which can bring sentences as long as 10 years, it is claimed.

Officials last month said they had arrested five suspected UK members of Anonymous while 40 court-authorised searches in the US were carried out, with few details.

Anonymous presents itself as a loose collective and polls its members about which websites should be hit with what are known as denial-of-service attacks.

Ordinary members take charge of specific projects, such as Twitter postings on Tunisia or closed Facebook chats on strategy for harassing the Egyptian government’s online presence.

Mr Barr said he penetrated Anonymous as part of a project to demonstrate the security risks to organisations from social media and networking. He is presenting his research later this month at a conference in San Francisco.

HBGary Federal is part-owned by HBGary, run by Greg Hoglund, a respected security researcher based in California.

The FBI declined to comment on the research or the timing of arrests.

Using LinkedIn, Classmates.com, Facebook and other sites, Mr Barr also burrowed deep enough into a US military group and a US nuclear plant that he could trick workers there to click on web links that, if they had been malicious, could have installed spying software on their computers. Such “social engineering” hacks are a major vulnerability for companies targeted in industrial espionage.

The Anonymous effort was similar but included such tricks as comparing the times that members logged on to Facebook and to Internet Relay Chat to make educated guesses as to which electronic identities belonged to the same person.