What is Anonymous? Inside the group plotting to attack Islamic State/ISIS

If you ask anyone to name a hacktivist group, chances are they’ll say “Anonymous”. While other groups like LulzSec, Lizard Squad and Team Poison may rise to prominence every so often, their castle inevitably crumbles, while Anonymous carries on, and has done for decades.

The answer to the question “who is Anonymous?” is part of the reason Anonymous has been so successful at avoiding infiltration and dismantlement like the others – Anonymous is no-one. Whereas most other groups have an internal structure, Anonymous is anarchic by design, with no head (indeed, the group will attack any individual claiming to represent them) and no command structure.

What’s more, in theory at least, anyone can use the name “Anonymous”, although hardcore “Anons”, as members sometimes call themselves, will act to stop anything that’s particularly outside the group’s recently established ethics.

But Anonymous has evolved significantly from its birth on one of the more seedy sites on the web. Here, we’ve collected information about the group’s shadowy beginnings, the operations they’ve carried out and the media coverage they’ve garnered since their inception.

Anonymous in 2015 – Anonymous vs CloudFlare

You won’t like Anonymous when they’re angry, and recently it was the turn of Silicon Valley firm, CloudFlare, to incur the collective’s wrath. Why? It alleges that CloudFlare has been protecting pro-ISIS websites from DDoS attacks.

CloudFlare’s USP is simple: it optimises the speed of websites by distributing data all across the world, so that page load more quickly wherever you are in the world. Part of their service protects users from DDoS attacks, and it does this by routing connections via its own website in the event of a denial of service attack.

In this instance, Matthew Prince, CEO and co-founder of CloudFlare, claims that Anonymous’ allegations are unfair. Talking to The Register, he suggested that it was somewhat hypocritical of Anonymous to claim that CloudFlare weren’t permitting DDoS attacks. “It’s hard to take seriously. Anonymous uses us for some of its sites, despite pressure from some quarters for us to take Anonymous sites offline.”

“Even if we were hosting sites for ISIS, it wouldn’t be of any use to us,” said Prince. “I should imagine those kinds of people pay with stolen credit cards and so that’s a negative for us.”

Anonymous in 2015 – Operation Paris #OpParis

In the wake of the Paris attacks of 13 November, Anonymous directed its members to target ISIS with renewed vigour under the mantle of Operation Paris (#OpParis).

It’s not the first time the group has attacked ISIS and Islamic State, with Anonymous targeting them in wake of the Charlie Hebdo attacks with Operation Isis (#OpIsis), but the group has now “declared war”.

The collective released a video on its YouTube account where it vowed to “track down the members of the terrorist group responsible for these attacks”. Since the video was released to the public, Anonymous claims that it has been responsible for the removal of more than 5,500 Twitter accounts related to the militant group.

 

This, however, is only the beginning. As Anonymous’ goal is to expose ISIS, they have stated that they “will do all that is necessary to end their actions [and to] expect a total mobilisation on our part”. The group’s various Twitter feeds give some feeling as to the scale of the operation.

With thousands of allegedly ISIS-related Twitter accounts already taken down within 72 hours of the events in Paris, it’s clear that this is only the beginning – the next step is widespread DDoS attacks co-ordinated with hacking groups worldwide.

However, while Anonymous may now be associated with a Robin Hood-esque attitude, this wasn’t always the case – it was spawned from rather grubbier beginnings.

Continues on page 2

Anonymous and 4chan – Where it all started

The group, if it can be really described as such, was spawned on imageboard 4chan, one of the grubbier yet, strangely, most creative corners of the internet – while it’s home to gore and porn, it’s also where Lolcats and Rickrolling originated. Most posters to the board also use the default “anonymous” username, from whence Anonymous draws its name.

Through 4chan, groups of anonymous members would organise “raids”, where they would descend on other messageboards or proto-social media networks and sabotage or troll them (in the original sense) – or a bit of both – or make prank phone calls.

Pretty much all activities were carried out “for the lulz” – i.e. for entertainment, with the ensuing hijinks documented in Encyclopaedia Dramatica, which is still updated today (we strongly advise against visiting – it’s one of the most offensive sites on the net).

That’s not to say everything, or even most things, were good-natured fun though – it was sometimes quite the opposite.

Because none of us are as cruel as all of us

The group adopted the slogan “because none of us are as cruel as all of us” to sum up the bravado mass anonymity brings, giving the participants the necessary cover and coersion to behave in ways they wouldn’t have done otherwise.

This included quite nasty pranks, such as sending dozens of pizzas to people’s houses – with YouTuber Jessie Slaughter being a notable victim – or deliberately targeting the bereaved to cause them further grief, purely for amusement (griefing).

Anonymous and hacktivism

If you’ve only come across Anonymous in the past seven years or so, the above may not sound particularly familiar. This is because, in 2008, the group started to shift from trolling and raiding for the hell of it to so-called hacktivism.

Project Chanlology

In January 2008, the Anons took a break from trolling and cat pictures to take on a rather more sizeable enemy – the Church of Scientology.

Their ire was provoked when the organisation issued YouTube, Gawker and several other sites with legal demands to remove a video of Tom Cruise talking about his values and beliefs as a Scientologist, claiming it was copyrighted material that had been pirated.

While Project Chanlology has been referred to as an attack on attempts to censor the internet – something Anonymous hit out at subsequently in the form of Operation Digeridie – the original “call to arms” post on 4chan’s /b/ board, dated 15 January 2008, seemed to take issue more with the general behaviour of the Church of Scientology than the takedown requests specifically.

“People need to understand not to … talk about nothing for ten minutes and expect people to give their money to an organisation that makes absolutely no … sense. It’s time to use our resources to do something we believe is right,” it said.

Within 24 hours, the main Scientology home page was under heavy DDoS attack, which continued for a little over a week, culminating with 24 hours of complete downtime on 25 January.

Anonymous also managed to carry out a “Google Bomb”, pushing the main Scientology website up the Google rankings to become the top result when users searched for “dangerous cult”. Scientologists tried to hit back, with a site called Anonymous-Exposed.org, which lambasted Anonymous as cybercriminals. However, Anonymous also managed to hijack that campaign with a dedicated Rickroll, hosted at the (deliberately) confusingly named AnonymousExposed.org.

It was during Chanology that real-life protests started to pop up, with protesters wearing the now familiar (and more widely used) Guy Fawkes mask from V for Vendetta, which have since been seen at Occupy camps and various anti-establishment protests.

Operation Avenge Assange

Operation Avenge Assange took place in December 2010 as a continuation of an earlier campaign called Operation Payback.

While Payback was primarily a campaign targeting anti-piracy groups, the Avenge Assange offshoot instead targeted major financial and payment organisations in retaliation for freezing donations to WikiLeaks in the wake of the release of the Iraq War Logs, Afghan War Logs and the video Collateral Murder.

Anonymous once again used DDoS attacks as its weapon of choice and managed to take down both the Visa and MasterCard websites. The group also disrupted PayPal slightly, until it agreed to unfreeze the funds of an organisation that was raising money for WikiLeaks. Amazon was also targeted, but the attack ultimately failed, due to the sheer scale of the company’s infrastructure.

It was during this particular “operation” that Anonymous really came to worldwide attention. The attacks on two of the main global card payment companies caused significant public concern, despite reassurances from MasterCard and Visa that the sites hadn’t been hacked, customer data hadn’t been compromised and their payment processing operations were unaffected.

While Avenge Assange only lasted three days, and Payback itself consisted of sporadic 24-hour attacks over the course of three months, this is when the organisation gained a reputation for hacktivism, and apparently a taste for it too.

The following year, the group teamed up with hackers LulzSec – with which it shared some “members”, notably British hacker Jake Davis, aka Topiary – in a new series of attacks, dubbed Operation AntiSec.

Almost without exception, AntiSec targeted government entities, normally in relation either to attempts to censor or restrict access to the internet, or crack down on activities such as their own.

Anonymous has also carried out a number of smaller attacks in the intervening years, normally with a similar philosophy. They came out in support of protesters in Hong Kong in 2014, against the Ferguson police department following the fatal shooting of unarmed teenager Michael Brown, and against the Cleveland Police Department in 2012, also following a shooting of two apparently unarmed individuals.

Cat and mouse in the Middle East

Anonymous vs the Syrian Electronic Army

Latterly, Anonymous has become involved in a game of cat and mouse with other hackers and online activists linked to the Arab Spring and the civil war that ensued in Syria.

The organisation came out in support of anti-regime protesters at the very beginning of the Arab Spring, including hacking the Syrian Ministry of Defence’s website.

This brought them into conflict with the Syrian Electronic Army (SEA), a pro-regime hacking squad, which memorably hacked into the BBC Weather Twitter account in order to spread some rather odd propaganda.

The tension between the two groups was initially caused by Anonymous hacking into Syrian president Bashar al-Assad’s email, successfully stealing hundreds of emails from both al-Assad and some of his closest advisors.

In retaliation, the SEA successfully hacked a number of Western media outlets, including the Twitter accounts of Reuters and Associated Press news agencies and the Washington Post.

This tit-for-tat carried on for a while until Anonymous found itself a new and better known enemy – the Daesh, aka ISIS.

Operation ISIS

In June 2014, Anonymous launched Operation ISIS – a campaign against the extremely web-savvy terrorist group currently occupying about half of Syria and a third of Iraq.

It’s not clear what the group got up to in the immediate term after publishing the video, but it managed to strike quite a blow about nine months later.

In a video published on YouTube on 6 February called “Operation ISIS Continues”, a supposed Anonymous spokesperson said: “The terrorist state that are calling themselves ISIS are not Muslims. ISIS: we will hunt you, take down your sites, accounts, emails and expose you.

“From now on, [there is] no safe place for you online. You will be treated like a virus and we are the cure. We own the internet now, some of ISIS’ Twitter accounts that were taken offline by Anonymous Red Cult Team.”

Within days, Anonymous published a list of nearly 8,000 Twitter accounts they claim to have taken control of, although Alphr has found some are still active at the time of writing.

Quite what effect, if any, Anonymous’ efforts will have on ISIS’ online activities, let alone in the real world, is debateable.

ISIS does have a strong online presence, and has used social media to promote its message and even distribute videos of murders and mutilations it carries out. However, social media organisations like Facebook, Twitter and especially YouTube have so far done a fairly good job of policing their own sites. By removing any such uploaded content quickly, they have diminished the impact of Anonymous’ actual and promised hacking of these accounts somewhat.

That said, on widely accessible and popular sites, may at least have a small impact both in terms of preventing the publication of propaganda and impeding recruitment efforts (although retaining and recruiting personnel seems to be something of a problem for ISIS at the moment anyway).

More significantly, Anonymous also claims to have taken offline around 1,000 of ISIS-affiliated websites that host these videos, messages, text and pictures, either by compromising the sites themselves or through DDoS attacks. Most of those listed appear to still be offline, although Alphr has found a handful that have been resurrected.

Additionally, the organisation claims to have “doxxed” a number of site administrators, making public their email addresses, names and, in some cases, their physical location.

We suspect, though, that the security services of the US, UK and others are carrying out similar activities that will likely have graver consequences for the targets than anything Anonymous can manage.

How much damage the group does to ISIS’ online presence, and how long Operation Isis holds their attention remains to be seen, as does how long Anon will maintain its current hacktivist form. But for now it seems the group is content to wage anti-jihad on the web, at least until another target takes their eye.

But what happens to the hackers that get caught by government agencies? Click here to explore what happened to the hacktivists who were unmasked.