Yet Another Report Showing 'Anonymous' Data Not At All Anonymous

from the what-privacy dept

As companies expand the amount of data hoovered up via their subscribers, a common refrain to try and ease public worry is that consumers shouldn't worry because this data is "anonymized." However, time and time again studies have highlighted how it's not particularly difficult to tie these data sets to consumer identities -- usually with only the use of a few additional contextual clues. It doesn't really matter whether we're talking about cellular location data, GPS data, taxi data or NSA metadata, the basic fact is these anonymous data sets aren't really anonymous.

The latest in a long stream of such studies comes from MIT, where researchers explored (the actual study is paywalled) whether they could glean unique identities from "anonymous" user data using a handful of contextual clues. Studying the purportedly anonymous credit card transactions of 1.1 million users at 10,000 retail locations over a period of three months, the researchers found they could identify 90% of the users' names by using four additional data points like the dates and locations of four purchases. Using three clues, including more specific points like the exact price of a purchase, allowed the identifying of 94% of the consumers. Intentionally trying to make the data points less precise didn't help protect consumer privacy much:

"The MIT researchers also looked at whether they could preserve anonymity in large data sets by intentionally making the data less precise, in order to examine whether preserving privacy would still enable useful analysis. But the researchers found that even if the data set was characterised as each purchase having taken place in the span of a week at one of the 150 stores in the same general area, four purchases would still be enough to identify more than 70 percent of users."

Note they're not saying they can ascertain your personal identity from this data alone, but they (or a hacker that nabs this data) can identify you if they have just a smattering of other contextual clues as to who you are. In an age when cellular companies track and sell your daily location down to the minute, and your automobile, insurance companies and toll payment systems are all gathering even more precise data, that's not going to be a particularly difficult task. The gist of the study isn't going to be a shock to most of you: privacy in the modern age -- unless you're willing to go to extreme lengths -- is an illusion.

"We are showing that the privacy we are told that we have isn't real," study co-author Alex "Sandy" Pentland of MIT said in an email...The study shows that when we think we have privacy when our data is collected, it's really just an "illusion", said Eugene Spafford, director of Purdue University's Centre for Education and Research in Information Assurance and Security. Spafford, who wasn't part of the study, said it makes "one wonder what our expectation of privacy should be anymore."

That said, it's very important to remember that we can probably trust that companies rushing head first toward vast new revenue generation opportunities are spending the time and resources necessary to ensure consumer privacy is at the very top of their list of priorities.

Filed Under: anonymous, anonymous data, data

FBI Added Lulzsec Hactivist Jeremy Hammond To The Terrorist Watchlist A Year Before He Was Arrested

from the terrorism-is-just-things-we-don't-fully-comprehend dept

Jeremy Hammond -- a member of various Anonymous offshoots -- had the misfortune of being prosecuted in the United States. While his UK accomplices in the Stratfor hack were sentenced to 1-3 years, Hammond received a 10-year sentence (along with three years of supervised release) for his participation. The length of Hammond's sentence was mainly due to the CFAA (Computer Fraud and Abuse Act) being a horribly-written law (and there's a possibility it will get much worse in the future), and the FBI's willingness to toss the hacktivist under the bus for the sins of Anonymous, while glossing over the fact that it was an FBI informant (Hector Monsegur, aka Sabu) who handed out hacking targets to Hammond.

Hammond's lengthy prison sentence may also have to do with other bad laws written by legislators who didn't have a full understanding of the issues they were attempting to address. A leaked document obtained by the Daily Dot [pdf link] shows the FBI put Hammond on the government's terrorist watchlist more than a year (Date/Time Entered: 1/19/2011) before he was arrested for the Stratfor hack.

A leaked document originating from the New York State Division of Criminal Justice Services (DCJS) reveals that Hammond was considered a "possible terrorist organization member," and indicates that he was placed on the multi-agency Terrorist Screening Database (TSDB), alongside individuals suspected of ties to Al Qaeda, Somalia-based extremists al-Shabaab, and Colombia's leftist FARC guerilla movement.

Here's the pertinent information is all of its teletyped glory:



The document also includes Hammond's rap sheet, which up to that point, only includes fraud and unauthorized computer access related to the theft of credit card information from a conservative website. What it doesn't include is anything that might justify his addition to the terrorist watchlist -- unless the FBI considers protests to be a terrorist activity.

Of course, the government agencies that have the power to place US citizens on terrorist watchlists don't seem interested in providing justification for their decisions. Just having a vague sense of unease seems to be all the "evidence" any agent/official needs to declare a person a threat to this country. Nearly 40% of those currently on the government's terrorist watchlist have "no known affiliation to recognized terrorist groups."

The government has long shown it doesn't understand hacking and is no fan of activism -- generally viewing both activities as some sort of threat. So, on the watchlist Hammond went, something that presumably played a part in the prosecution's push for a decade-long sentence for the hacktivist. His actions and motives were often far from pure, but his imprisonment appears to be a result of the FBI throwing an unwitting operative onto the judicial scrapheap before moving onto its next sting operation.

Filed Under: anonymous, doj, fbi, jeremy hammond, lulzsec, terrorist watch list, tsdb

Barrett Brown Sentenced To 63 Months In Jail For Daring To Do Journalism On Hacked Info

from the bad-and-dangerous-precedent dept

We've written a few times about the ridiculous case against Barrett Brown, a journalist who took a deep interest in Anonymous and various hacking efforts. As we noted, a key part of the initial charges included the fact that Brown had organized an effort to comb through the documents that had been obtained from Stratfor via a hack. The key bit was that Brown had reposted a URL pointing to the documents to share via his "Project PM" -- a setup to crowdsource the analysis of the leaked documents. Some of those documents included credit card info, so he was charged with "trafficking" in that information. Brown didn't help his own cause early on with some immensely foolish actions, like threatening federal agents in a video posted to YouTube, but there were serious concerns about how the government had twisted what Brown had actually done in a way that could be used against all kinds of journalists.

While the feds eventually dismissed the key "linking" claim (equating linking to trafficking), they still got Brown to agree to a plea deal on other charges. After many months, he was finally sentenced today to 63 months in prison, more than double the 30 months that his lawyers asked for (30 months being the time he's already served in prison). He also has to pay $890,000 in restitution. For linking to some files he didn't have anything to do with leaking.

Before the sentencing, Brown made a statement to the judge that is well worth reading. He admits that the threatening videos were "idiotic" and apologizes for it, but delves more deeply into what's really at stake in his case. Here's just a tiny bit:

Every journalist in the United States is put at risk by the novel, and sometimes even radical, claims that the government has introduced in the course of the sentencing process. The government asserts that I am not a journalist and thus unable to claim the First Amendment protections guaranteed to those engaged in information-gathering activities. Your Honor, I’ve been employed as a journalist for much of my adult life, I’ve written for dozens of magazines and newspapers, and I’m the author of two published and critically-acclaimed books of expository non-fiction. Your Honor has received letters from editors who have published my journalistic work, as well as from award-winning journalists such as Glenn Greenwald, who note that they have used that work in their own articles. If I am not a journalist, then there are many, many people out there who are also not journalists, without being aware of it, and who are thus as much at risk as I am.

Your Honor, it would be one thing if the government were putting forth some sort of standard by which journalists could be defined. They have not put forth such a standard. Their assertion rests on the fact that despite having referred to myself as a journalist hundreds of times, I at one point rejected that term, much in the same way that someone running for office might reject the term “politician”. Now, if the government is introducing a new standard whereby anyone who once denies being a particular thing is no longer that thing in any legal sense, then that would be at least a firm and knowable criteria. But that’s not what the government is doing in this case. Consider, for instance, that I have denied being a spokesperson for Anonymous hundreds of times, both in public and private, ever since the press began calling me that in the beginning of 2011. So on a couple of occasions when I contacted executives of contracting firms like Booz Allen Hamilton in the wake of revelations that they’d been spying on my associates and me for reasons that we were naturally rather anxious to determine, I did indeed pretend to be such an actual official spokesman for Anonymous, because I wanted to encourage these people to talk to me. Which they did.

Of course, I have explained this many, many times, and the government itself knows this, even if they’ve since claimed otherwise. In the September 13th criminal complaint filed against me, the FBI itself acknowledges that I do not claim any official role within Anonymous. Likewise, in last month’s hearing, the prosecutor accidentally slipped and referred to me as a journalist, even after having previously found it necessary to deny me that title. But, there you have it. Deny being a spokesperson for Anonymous hundreds of times, and you’re still a spokesperson for Anonymous. Deny being a journalist once or twice, and you’re not a journalist. What conclusion can one draw from this sort of reasoning other than that you are whatever the FBI finds it convenient for you to be at any given moment. This is not the “rule of law”, Your Honor, it is the “rule of law enforcement”, and it is very dangerous.

The judge didn't seem to care, however. Judge Sam Lindsay claimed that Brown was "more involved than he wants the court to believe" despite no such evidence being presented. Furthermore, it appears that even though the charges related to the link sharing were dropped and the plea was over other charges, sharing that link is part of why his sentence was so high.

This is a very dangerous ruling for those who believe in freedom of the press. Rulings like this put anyone reporting on any hacked or leaked info at risk. While some don't like it, reporters need to be free to report on things, from the Stratfor documents to the Sony Hack documents to the Snowden revelations. A sentence like this puts a massive chill over journalism and the First Amendment in general.

Filed Under: anonymous, barrett brown, free speech, hacks, journalism, linking, sam lindsay

Intel Turns Off Russian Forums, Blogs & Comments In Response To Russian Blogging Law

from the silence-all-of-you dept

Back in April of last year, we were among the first to report on a very dangerous new law in Russia targeting bloggers, requiring any blogger or social media user with more than 3,000 "visitors" a day to register their real name with the government. The idea, obviously, is to put a massive chill on free speech among popular bloggers and social media users -- making it clear that the government is tracking everything they do. Just recently we noted how various social media platforms were responding to Russian demands that they censor or take down accounts related to opposition politician Alexei Navalny, or other critics of the government.

But the blogger/social media law has now gone into effect, and it's having an impact in all sorts of places. For example, chip giant Intel has now announced that it is basically turning off all ways to contribute to its Russian Intel Developer Zone in order to comply with the law.

In order to be compiant with the Russian Internet Bloggers Law the following changes will be implemented to Russian Intel® Developer Zone community as of January 1st 2015:

• Blog post contributions will be disabled
• Forum contributions will be disabled
• All commenting will be turned off for russian content

While it's unlikely that those in power in Russia today think this is a very big deal, recognize that taking Russians out of forums and discussions concerning key technological developments could certainly come back to haunt Russian technology development. This also comes about a month after Google closed down its Russian engineering office, in response to a different regulatory shift: a "data handling law" that would require all information from Russian users be kept in Russia (making it more easily accessible by Russian officials and the intelligence community).

All of these moves may be designed to shore up the existing leadership's political power, but it seems like a fairly short-term strategy, given that the end result is likely to hold back technological expertise and talent at a time when staying on top of technology is so important.

Filed Under: anonymous, blogger's law, blogs, forum's, free speech, registration, russia
Companies: intel

Feds Dismiss Charges Against Barrett Brown For Linking After Realizing They Had No Case

from the and-it-shouldn't-be dept

Well, well, well. We were about to put up the post below, describing the arguments that Barrett Brown's lawyers filed about why the criminal charges against him for sharing a link (which they claimed was trafficking in stolen credit card details) were completely bogus... and it appears that the DOJ itself was convinced. Just hours after Brown's lawyers filed their comprehensive argument, the DOJ has filed a motion to dismiss the criminal charges that stem from the cutting and pasting of the link. The other charges, concerning threatening acts (described below) and "obstruction of justice" (for hiding his laptop in a cabinet) remain, meaning that he is still facing significant jail time. But the core charge, concerning cutting and pasting a link, is now being dismissed. Of course, it's still a travesty that the DOJ ever included that in the indictment in the first place.

Our original post, about Brown's now obsolete filing is below:

---

We've covered the deeply troubling case of Barrett Brown before. The DOJ has been working overtime to lock up Brown, whose main "crime" appears to have been taking a link that was publicly available that pointed to documents taken by members of Anonymous from the consulting/media company Stratfor, and pasting that link into an online chat. Brown did not hack Stratfor. Instead, he was working on his ongoing project to dig into the various documents leaked via Anonymous for journalistic purposes. While Brown's case was initially messy due to some ill-advised public statements by Brown (in which he ranted publicly about law enforcement, to the point of threatening to shoot those who came after him), when you dig into the fundamentals of the case, there's not much there other than taking that publicly available link and pasting it into a chat room. The government is claiming that since the documents from Stratfor included credit card info, Brown's copy/paste was the equivalent of trafficking in stolen credit cards. Think about that for a second.

Brown's legal team has now filed a motion asking the court to dismiss the key claims concerning the copy pasting of the link, which underpin pretty much the entire case. This is an issue that is important to anyone who believes both in the freedom of the press as well as the idea that merely sharing a link shouldn't make one liable (especially criminally liable) for what's in the content that's being linked to. The filing makes three basic arguments.

First, it notes that merely sharing a link clearly does not meet the standard of a criminal act under the law that Brown is being charged under, with the key question being whether merely pasting a link is "transferring" ... "authentication features."

As a matter of pleading, the Indictment is fatally flawed because (1) it fails to allege an essential element—“the transfer of authentication features”—altogether, and (2) it fails to allege that Mr. Brown “transferred” anything other than a hyperlink. Instead, the government claims that Mr. Brown violated the statute by republishing a (publicly available) hyperlink which caused a (publicly available) file to be made “available to others online.” However, as shown in POINT I, the government’s theory of the case fails to satisfy any valid construction of the charging statutes.

Second, the filing notes that even if the court actually believes that merely copying and pasting a publicly available link is "the transfer of authentication features" under the law, then that law clearly violates the First Amendment:

First, Mr. Brown is alleged to have engaged in pure speech, not merely conduct with expressive elements. The act of republishing a hyperlink is unquestionably an act of pure communication and expression. Thus, applying Section 1028 to Mr. Brown’s republication of a hyperlink is a substantial burden on his right to free speech. Pure speech also warrants the highest protection, and laws burdening pure speech must face heightened scrutiny. Only a “‘need... of the highest order’” can justify “a regulation of pure speech.”....

Second, Mr. Brown’s speech (by republishing the hyperlink) addressed political issues—namely the uncovering of improprieties within the private intelligence contracting industry. As such, it is entitled to the First Amendment’s highest protection. “[L]awful political speech [is] at the core of what the First Amendment is designed to protect.” ....

Third, Mr. Brown’s speech (by republishing the hyperlink) was part of his routine press activity: gathering, disseminating and publishing information about the Stratfor hack and, more generally, private intelligence contractors.

If the court still isn't convinced, Brown's lawyers offer up a third argument, noting that even if copying and pasting the link is covered by the specific law and if pasting a link isn't protected by the First Amendment (as it clearly should be), then Brown's lawyers point out that the law in question, 18 USC 1028 is "unconstitutionally vague on their face" and "unconstitutionally overbroad and chills speech in violation of the First Amendment."

This is going to be an important case to follow. In the past whenever we've covered Brown, we've heard from some people who had personal run-ins with Brown and didn't like him, as if that means that his legal case isn't important and the legal issues should be overlooked. We disagree. No matter what people think of Brown, the key legal issues in this case are vitally important in an era when federal prosecutors are piling on excessive charges against people they don't like and, even worse, when there has been a ratcheting up of rhetoric against journalists reporting on leaked information. Some of the most important cases you will see involve people that you probably wouldn't like very much in person -- but that matters little when it comes to the importance of the underlying legal points and the wider impact they may have. In fact, it makes the issues more important, because once the precedent is set, they can be used against people you do like in the future.

Filed Under: anonymous, barrett brown, doj, free speech, linking
Companies: stratfor

Victims Of GCHQ's Denial Of Service Attacks Start Asking Who Are The Real Criminals?

from the doesn't-seem-right dept

Earlier today, we wrote about the latest Snowden docs, in which it was revealed that the UK spy agency, GCHQ, was engaged in DDoS attacks on people participating in Anonymous chats and other events, while also helping to identify certain participants, leading to their eventual arrests and convictions. Basically, it looks like GCHQ was engaged in widespread DDoSing, while at the same time helping to convict some kids for doing their own DDoSing. We've already questioned whether or not GCHQ is even supposed to be doing that to UK citizens (they're supposed to be focused on foreign targets), but some of those convicted are already questioning how it's right that they were convicted of the same thing that the GCHQ itself was doing to them.

Chris Weatherhead was sentenced to 18 months in prison for participating in a DDoS against Paypal, Mastercard and Visa (one of the first big Anonymous DDoS attacks, in response to those 3 companies cutting off payments to Wikileaks). Now he's pointing out that GCHQ was DDoSing his own servers, and he wonders how that's right:

My Government used a DDoS attack against servers I owned, and then convicted me of conducted DDoS attacks. Seriously what the fucking fuck?

— Chris Weatherhead (@CJFWeatherhead) February 5, 2014

Meanwhile, another Anonymous participant, Jake Davis, who was arrested and banned from the internet seems equally angry about things for pretty good reasons:

I plead guilty to two counts of DDoS conspiracy and to my face these GCHQ bastards were doing the exact same thing - http://t.co/Y4vo1qeN4I

— Jake Davis (@DoubleJake) February 5, 2014

Davis has also written a long piece concerning all this that is absolutely worth reading, asking a simple question: who are the real criminals here?

Why do British government spooks so brazenly attempt to inhibit the activities of acephalous online collectives and not, say, the hate-filled Westboro Baptist Church, or chat networks that encourage racism or paedophilia?

Or maybe the more important question: how can they even be permitted to launch these attacks at all? There's no justification for how nonchalant a democratic government can be when they breach the very computer misuse rules they strongly pushed to set in place.

When we look at what Western governments are doing - snooping on our emails, infecting our computers, intercepting our phone communications, following our avatars around in online games, backdooring our public encryption, discrediting our Internet viewing habits, encouraging illicit activity and even engaging in their own illicit activity - we have to ask ourselves: who are the real criminals here?

Others have similarly wondered if GCHQ is going to have to face charges over this, given that these actions appear to be entirely outside of its mandate and mission, and seem more compelled by just general dislike of some kids messing around.

Filed Under: anonymous, chris weatherhead, ddos, gchq, jake davis, legality, uk

Snowden Docs Show GCHQ Tried To DDoS Anonymous

from the picking-the-wrong-target dept

The latest Snowden revelation is just bizarre. According to a new report at NBC (with help from Glenn Greenwald), UK spies at GCHQ decided to mount a DDoS attack against Anonymous and Lulzsec.

The documents, from a PowerPoint presentation prepared for a 2012 NSA conference called SIGDEV, show that the unit known as the Joint Threat Research Intelligence Group, or JTRIG, boasted of using the DDOS attack – which it dubbed Rolling Thunder -- and other techniques to scare away 80 percent of the users of Anonymous internet chat rooms.

As the report notes, this seems like incredible overkill. While it's true that Anonymous had been somewhat successful in DDoSing some websites, for the most part, those were just basic defacements. They were the equivalent of kids messing around with graffiti -- hardly the sort of thing you send in the intelligence community to disrupt. Similarly, there are some quite reasonable arguments that the kind of attacks that Anonymous was doing were the equivalent of a sit-in, making them a form of expression.

“Targeting Anonymous and hacktivists amounts to targeting citizens for expressing their political beliefs,” said Gabriella Coleman, an anthropology professor at McGill University and author of an upcoming book about Anonymous. “Some have rallied around the name to engage in digital civil disobedience, but nothing remotely resembling terrorism. The majority of those embrace the idea primarily for ordinary political expression.” Coleman estimated that the number of “Anons” engaged in illegal activity was in the dozens, out of a community of thousands.

NBC News gets former White House cyber security official Jason Healey to point out how ridiculous this kind of attack is:

Jason Healey, a former top White House cyber security official under George W. Bush, called the British government’s DDOS attack on Anonymous “silly,” and said it was a tactic that should only be used against another nation-state.

[....] “This is a slippery slope,” said Healey. “It’s not what you should be doing. It justifies [Anonymous]. Giving them this much attention justifies them and is demeaning to our side.”

Further documents show that GCHQ agents more or less infiltrated Anonymous, trying to buddy up with some key members -- and the documents leaked by Snowden show that GCHQ happily explains that the "outcome" of this effort resulted in charges, arrest and conviction against Edward Pearson, who was involved with Anonymous as GZero. Of course, we thought GCHQ was supposed to be focused on non-UK persons. But Pearson is British. The report details a few other UK hackers arrested because of GCHQ spying -- including one who notes that in the documents concerning his arrest, it is never detailed how he was found.

What's not mentioned in the report is that the intelligence community has a history of totally overreacting to Anonymous. Back in 2012, we wrote about NSA boss Keith Alexander's bizarre attempt to spread FUD by claiming that Anonymous was the equivalent of a terrorist group that might shut down power grids -- a move that seems way outside of the kinds of things participants in Anonymous have any interest in. The actions they've taken, historically, have been to expose hypocrisy and wrongdoing -- not to actually put anyone's lives in danger. But it seems that kind of overreaction to Anonymous went beyond just the NSA and across the pond to GCHQ, which didn't just freak out, but actually spent taxpayer funds to launch offensive denial of service attacks on a bunch of mostly innocent teenagers.

Filed Under: anonymous, ddos, ed snowden, gchq, nsa, uk

Shameful Business: Corporate Giants Target Activists And Non-profits For Corporate Espionage

from the can't-take-the-heat dept

It's no secret that big companies, especially the giant multinationals, often have very advanced corporate espionage teams (sometimes staffed by former government spooks). The practices can sometimes be extreme and problematic, like when HP used its corporate espionage team to spy on board members and journalists. However, it seems that with the rise of consumer interest groups and very effective activists, many of these giant companies are using their corporate espionage team to spy on those non-profits and activists instead.

Many of the world’s largest corporations and their trade associations — including the U.S. Chamber of Commerce, Walmart, Monsanto, Bank of America, Dow Chemical, Kraft, Coca-Cola, Chevron, Burger King, McDonald’s, Shell, BP, BAE, Sasol, Brown & Williamson and E.ON – have been linked to espionage or planned espionage against nonprofit organizations, activists and whistleblowers.

Many different types of nonprofit organizations have been targeted with corporate espionage, including environmental, anti-war, public interest, consumer, food safety, pesticide reform, nursing home reform, gun control, social justice, animal rights and arms control groups.

Corporations and their trade associations have been linked to a wide variety of espionage tactics against nonprofit organizations. The most prevalent tactic appears to be infiltration by posing a volunteer or journalist, to obtain information from a nonprofit. But corporations have been linked to many other human, physical and electronic espionage tactics against nonprofits. Many of these tactics are either highly unethical or illegal.

The full report includes plenty of examples, including the famous HBGary Federal/Hunton & Williams/Bank of America attempt to infiltrate Anonymous (and Wikileaks). It also includes stories about Stratfor, Monstanto and others. There was one example in there that I was unaware of, involving the giant pharmaceutical lobbying group PhRMA trying to spy on Jamie Love and Knowledge Ecology International. Love is a friend and KEI has done amazing work in informing the world about dangerous efforts by PhRMA and others to use international trade agreements to push through rules and laws that harm the public around both copyright and patent issues. So, perhaps it's not a surprise that they'd spy on him, but it's still quite troubling. The same report notes that a bunch of others, including Microsoft, hired another company closely associated with former IP czar Victoria Espinel to try to spy on Love and KEI:

Shortly after the passage of the Affordable Care Act, Love says he received a visit in his offices from a man who said he was recently let go from his job at Pharmaceutical Research and Manufacturers of America (PhRMA). “He said his job involved monitoring what I was doing, every day.” Love said. “He told me that PhRMA had hired a private investigator to investigate us, from the West Coast.” Separately, from 2007 to 2008, Love says that PhRMA and some companies in the copyright sector funded efforts to investigate the sources of funding for NGOs working on intellectual property issues, and to press those foundations to end their support of consumer advocacy.

Around 2008 or 2009, General Electric, Microsoft, Pfizer and other firms funded an effort by the National Foreign Trade Council (NFTC) to provide intelligence on NGOs working on intellectual property issues. Love says, “They approached someone we knew, with a proposal to provide information on Knowledge Ecology International and other NGOs working on intellectual property issues, as part of a program to counter NGO advocacy efforts on behalf of consumers.” Eventually, Love says, the NFTC contracted with the Romulus Global Issues Management, an “international policy consultancy” that advises “several members of the Fortune 100.” The managing partner of Romulus is John Stubbs, whose wife is Victoria A. Espinel, a former Romulus employee. Espinel was U.S. Intellectual Property Enforcement Coordinator (IP czar) for the Obama administration, and is currently the CEO and President of the Business Software Alliance (BSA).

This is really playing dirty. While these companies may not appreciate what public interest groups like KEI do, digging into their activities and spying on them seems to go way beyond reasonable.

Filed Under: activists, anonymous, corporations, espionage, non-profits
Companies: hbgary federal, kei, phrma, us chamber of commerce, walmart

Anonymous Indictment Raises Serious Question: Is It Really A CFAA Violation To DDoS A Website?

from the questions dept

Way back in the fall of 2010, we wrote about how it was a really dumb idea for people associating themselves with Anonymous to run a series of DDoS attacks, under the name "Operation Payback," focused on the RIAA, MPAA, US Copyright Office and other websites. The attacks were protesting attempts to take down The Pirate Bay, as well as a variety of other complaints about general acts of copyright maximalism and copyright trolling. As we noted, such attacks do a lot more harm than good. Either way, the feds have finally gotten around to indicting thirteen individuals for somehow participating in that fall spree of DDoS attacks. While the indictment tries to make it out like this is a big conspiracy, it's unclear how connected some of the various attacks are, as it appears (as is frequently the case with Anonymous) that some individuals simply chose some sites to DDoS on their own and announced they were doing it as Anonymous. It's difficult to see a conspiracy when there's no real connection.

That said, there's a much bigger question here. While DDoS attacks can be a nuisance, are they really criminal? In the midst of these attacks, we questioned if they were really criminal acts or more like the equivalent of a sit-in, in which people were disrupting a business for the sake of public protest. In fact, some people arrested for DDoS attacks have been making this claim in court -- and there was even a White House petition asking it to recognize DDoSing as a valid form of protest.

Instead, as the indictment shows, the feds are hitting these thirteen individuals with CFAA violations -- the broad, troubling anti-hacking law that is regularly abused by the feds for any crime that involves a computer. In this case, the focus is on 1030(a)(5)(A) which targets people who:

... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

But is a DDoS really "damage"? I can see how there's a reasonable argument both for and against that. But I have trouble seeing how, as the feds claim, these DDoS attacks did more than $5,000 in damage to the various sites they took down. Furthermore, you can make an argument that these weren't done "without authorization," because all a DDoS does is point a ton of traffic at a website. If that web server is open to the public, then isn't there authorization? It's just that the web server gets flooded.

Again, I'll make clear that I think DDoS attacks are dumb, counterproductive and immature. But I have trouble seeing how they're criminal acts, that could lead to five years in jail.

Also, there's some oddities, in that one of the lawyers for one of the accused folks claims that he had been working out a settlement, which has now been "scuttled" by the indictment. I imagine that most of the accused will eventually come to some sort of plea bargain deal. The DOJ stacks the deck so that you're often crazy not to plea your way out of these deals. And it's unlikely that any of the individuals will appear particularly sympathetic for their alleged actions here. But I'm still quite troubled by the idea that these actions add up to that much in damage, and a computer hacking crime deserving of significant jail time.

Filed Under: anonymous, cfaa, ddos, protest, sit-in

The Weapons Of The Geek: Putting Anonymous Into Context

from the politics-and-power...-technology-and-anonymity dept

Professor Gabriella Coleman, who has studied hacking culture, Anonymous and a variety of related topics for years, recently published a new paper, entitled Anonymous in Context: The Politics and Power behind the Mask. It's a quick, but very worthwhile read. If you've followed Anonymous for years, you'll probably already be aware of much of what's in the paper, but it does a really nice job running through much of the history of Anonymous, the misconceptions about Anonymous, and frequent (failed) attempts by the press to accurately describe Anonymous. It also does a really nice job discussing the concept of the "weapons of the geek," and how Anonymous is really a fascinating demonstration of how technology is allowing a group of technologically savvy folks to get involved in activism and protest in ways that simply weren't possible before. If you're interested in this stuff (and you should be), go check it out.

Filed Under: activism, anonymous, expression, gabriella coleman, geeks, protest