In January 2011, Assange was jailed for seven days in the same Wandsworth Prison cell that, according to his lawyer, once housed the writer of his favorite quote on the power of anonymity: Oscar Wilde. Out on bail and fighting extradition to Sweden, he was confined to house arrest in the Norfolk mansion of a war reporter friend and wealthy heir named Vaughan Smith, on the condition that he wear a tracking bracelet on his ankle and report to the local police station daily—grating restrictions for a man who rarely spent two months in a row living in the same country.
But even as he faced potential financial ruin, humiliation, prison, and death threats, Assange continued to goad the world’s superpowers.
When the Australian met with me in London before the Cablegate release, he also told me of plans to publish a leak from a major U.S. bank in early 2011, a new chapter for the group after its series of government exposés. He wouldn’t name the bank, or what exactly was revealed in the thousands of documents WikiLeaks had obtained from its servers. But the spilled viscera of this financial institution, he claimed, would expose an “ecosystem of corruption.”
“It will give a true and representative insight into how banks behave at the executive level in a way that will stimulate investigations and reforms, I presume,” he told me.
All signs pointed to Bank of America: In 2009, Assange had said in an interview with Computer World that he had five gigabytes of data from the megabank, too much at the time for WikiLeaks to even know how to publish it in a readable form. But even after I and other journalists started making the connection to the Bank of America statement, Assange wouldn’t confirm his target. In an appearance on 60 Minutes, he poked at the financial industry again. When the show’s host, Steve Kroft, asked for more information on the bank leak, Assange revealed nothing, and seemed to delight instead in the anxiety he was causing.
“I think it’s great. We have all these banks squirming, thinking maybe it’s them,” he told Kroft.
As of this book’s writing, that leak still hasn’t materialized. Perhaps the group was too distracted by the political and digital blitzkriegs that hammered it for much of early 2011, or Assange lost focus when he faced the threat of criminal prosecution. Perhaps, as some have reported, the bank documents lacked the punch of WikiLeaks’ previous three megaleaks and Assange felt that publishing them would erode the group’s fearsome reputation. Or perhaps, as the group has claimed, the files were lost after Daniel Domscheit-Berg, the group’s German spokesperson, defected with a large slice of the group’s submissions.
Regardless, by 2011 WikiLeaks had risen to a place in the world’s perception where even a mere threat of a leak served the purpose Assange had laid out in his five-years-earlier essay on conspiracies. By Assange’s reckoning, it wasn’t the leaks themselves, after all, but rather the fear of leaks, that thickens the blood of the giants he hoped to paralyze. Leaks’ central purpose, in Assange’s original conception, was to sow such internal anxiety that corporations and governments overreacted, freezing their internal communications, or, as in Ellsberg’s case, taking their counterattack too far and embarrassing themselves.
Right on cue, Bank of America acted—or overreacted—swiftly. It commissioned an internal team of more than a dozen staffers who worked day and night to track down potential moles. It hired a chief information security officer and brought on the defense contractor Booz Allen Hamilton to audit its security and to review millions of documents in its archive that might damage the firm if they were leaked. It even began preemptively buying up website names like Brianmoynihanblows.com and Brianmoynihansucks.com, references to its CEO, as a defensive measure to prevent the domains from falling into the hands of critics.
The finance giant went so far as to call the Department of Justice for advice about who might be able to help it with its so-far speculative WikiLeaks dilemma. The Department of Justice recommended it consult with the Washington, D.C., law firm of Hunton & Williams, known for handling sensitive Beltway issues.
That law firm, in turn, put out a call to its subcontractors, including one tiny outfit: HBGary Federal.
The year-old start-up, a Washington spin-off of data security firm HBGary, had far more ambition than manpower—it employed only three staffers. But one, its chief executive Aaron Barr, was eager to turn his small company into an online gun for hire, a digital detective firm that could cut through the Internet’s most dangerous and powerful weapon: Barr wanted to make a name for HBGary Federal by defeating anonymity. Instead, he would soon become the world’s most infamous victim of Anonymous itself.
The e-mail appeared in Aaron Barr’s in-box at 3:55 P.M. on December 2. It was from John Hunt, a lawyer at Hunton & Williams. Its subject line: “URGENT—OPPORTUNITY.”
Richard and I are meeting with senior executives at a large U.S. bank tomorrow regarding WikiLeaks. We want to sell this team as part of what we are talking about. I need a favor. I need five to six slides on WikiLeaks—who they are, how they operate and how [your] group may help this bank. Please advise if you can help get something ASAP. My call is at noon.
Barr, a short, tanned forty-year-old with military shoulders, a square jaw, and hints of gray at his temples, read the message on his iPhone while on his way to a meeting with executives of TASC, an intelligence contractor division of Northrop Grumman in northern Virginia. He responded twenty minutes later, before any of the other three staffers from the two other security firms listed in the address field, eagerly promising to take the case. The project would keep him up late. But Barr wasn’t in a position to turn down work.
Earlier that same day, Barr had sent a note to the Northrop Grumman executive he was meeting that read like a thinly veiled plea for a job. HBGary Federal, the company he had left Northrop to found a year earlier, was barely treading water, and Barr was looking for a life raft.
The executives at the larger firm HBGary who had hired him to run HBGary Federal and invested in his government-focused offshoot were getting frustrated. They had put faith in his pitch that social media could solve the cybersecurity world’s “attribution” problem. Analyzing social connections, he argued, could identify the anonymous hackers plaguing government agencies and corporations. On the Internet, criminals and spies could hide their IP addresses with proxies and pseudonyms. But Barr believed that their human relationships, mapped out through online conversations and social media connections, would reveal hackers’ true identities.
As a successful defense contractor executive with a secret clearance, HBGary’s execs had taken him on as an “A player” and expected him to “walk the halls” of government agencies, preaching his social media gospel and opening a faucet of lucrative deals, as they wrote in internal e-mails. But the deals weren’t coming. HBGary was starting to consider selling its stake, and Barr was spending sleepless nights pondering the fate of his company and career.
“Everything we are chasing seems to keep getting pushed to the right and it is really causing a strain financially,” Barr wrote to the Northrop Grumman contact he was meeting that winter day.
Ted and I are looking at our books and pipeline and defining some short term gates we need to make it through in order to stay operational. We will likely make that determination soon, and if the outcome is negative I will be actively looking for the right opportunity with an organization that I believe in and trust.
Unfortunate thing is I think the area of our expertise, social media, is going to explode over the next few years, but a lot is about timing. . . . I will keep you posted.
Perhaps this WikiLeaks bolt from the blue, striking the very same day, could be Barr’s chance to prove his social media detective methods and spark some cash flow for HBGary Federal.
An e-mail from Matthew Steckman, at HBGary Federal’s Palo Alto partner firm Palantir, laid out the details of the assignment:
They are pitching the bank to retain them for an internal investiga
tion around WikiLeaks. They basically want to sue them to put an injunction on releasing any data. The Department of Justice called the General Counsel of Bank of America and told them to hire Hunton and Williams, specifically to hire Richard Wyatt who I’m beginning to think is the Emperor. They want to present to the bank a team capable of doing a comprehensive investigation into the data leak.
They have a half hour with the general counsel of the third largest bank in the world to plead their case.
Within minutes, Barr was on a conference call with Steckman and staffers from a third security firm called Berico, and then the three companies brainstormed late into the evening. Barr sent Steckman a first draft of his PowerPoint slides just after midnight.
Barr’s slides were simplistic, full of typos, and inaccurate in places. (At one point he referenced someone named John Shipton as a WikiLeaks staffer—in an homage or joke, Assange had listed his long-lost biological father’s name on the site’s registration.) But the presentation got Barr’s central points across. WikiLeaks’ data was hosted in a French data center, Barr said, and its submissions platform by a Swedish firm called PRQ. The security exec suggested “cyber attacks against the infrastructure to get data on document submitters. This would kill the project. Since the servers are now in Sweden and France putting a team together to get access is more straightforward.”
The slides went on to suggest a disinformation campaign against WikiLeaks to sow internal dissension, fake submissions to discredit it, and social media analysis to identify the key players in the group. “Need to attack the organization, its infrastructure, and its people,” Barr wrote. HBGary could offer “Computer Network Attack/Exploitation,” “Influence and Deception Operations,” and “Social Media Collection, Analysis, Exploitation,” he concluded.
By the next morning, the team of security firms had added charts that showed the geographic movement of WikiLeaks’ servers from Amazon’s cloud to a French host to the Swedish Internet service provider Bahnhof, along with a branching diagram of WikiLeaks’ supporters and their social connections. With only half an hour before the slides were to be presented to Hunton & Williams, Barr injected some last-minute addenda: “They are under increasing financial pressure because authorities are blocking their funding sources,” he wrote to Steckman. “Need to help enumerate these. Also need to get people to understand that if they support the organization we will come after them. Transaction records are easily identifiable.”
Finally he put the spotlight on one high-profile WikiLeaks supporter: civil liberties lawyer and Salon.com columnist Glenn Greenwald. “It is this level of support we need to attack,” he wrote. “These are established professionals that have a liberal bent, but ultimately most of them if pushed will choose professional preservation over cause, such is the mentality of most business professionals. Without the support of people like Glenn WikiLeaks would fold.”
The presentation, essentially offering a mix of illegal hacking, intimidation, and forgery, was packaged up and sent to Hunton & Williams with a title: “The WikiLeaks Threat.” And then the firms began the long wait for their go-ahead to act.
Hunton & Williams, it turned out, wasn’t ready to start channeling money to its subcontractors as quickly as they had hoped. Another assignment that Barr had worked on for the firm, using social media to track, analyze, and potentially disrupt pro-union enemies of the U.S. Chamber of Commerce, was stalled. Working in partnership with Palantir and Berico, HBGary had originally requested $2 million a month for the companies’ services. When the law firm balked, they reduced the cost to $200,000 a month, and eventually to free spec work in the hopes that the Chamber would start paying once their project showed results.
Barr needed to demonstrate that he had digital sleuthing skills that his clients couldn’t “push to the right.” He needed a test case for his social media strategy that would indisputably prove its brilliance. And so he began looking for a very prominent target.
He would find one in Anonymous, a phenomenon that looked like Tim May’s vision of crypto-anarchy come to life.
Anonymous was the name, paradoxically, taken by the world’s largest, most active group of black hat hackers and hacktivists. More than a traditional organization, it functioned as a loosely organized movement, or even an elaborate, participatory meme. Those who took part in the group—and anyone could be Anonymous—joined in crowd-sourced swarm attacks on whatever target offended its values, tenets like freedom of speech and anticorporatism. Anonymous’ victims, in the years since the movement emerged out of juvenile online forums and began its politically motivated missions, have included the Tea Party and its billionaire corporate supporters the Koch brothers, the antihomosexual extremist Westboro Baptist Church, Sony Corporation after it sued a hacker who reverse-engineered the PlayStation 3, and the governments of Anguilla, Australia, Brazil, Egypt, Israel, Sweden, Tunisia, Turkey, the United States, Venezuela, and Zimbabwe, among others.
One Anon, as the movement’s members call themselves, would post a call to arms online against a certain target, often an institution that seemed to be bullying a smaller entity or acting with corrupt impunity. And then, if the suggestion struck the collective’s fancy, hundreds or even thousands more would glom together across international boundaries into an attacking horde, stealing information from the target’s computers and posting it online, or flooding their victims’ Web servers with fraudulent data requests that paralyzed the machines, like flies choking the mouth and nostrils of an elephant.
And how did participants in Anonymous stay anonymous, even as they engaged in those highly illegal online attacks? By dipping into the cypherpunk toolbag. Anons, in decentralized fashion, use any anonymity tools available to them, including all varieties of proxies. One recruitment handbook of anonymity methods that the group distributed online begins by explaining how to install Tor on any operating system. Then it moves on to alternatives like the similarly structured I2P anonymity network, virtualization software that allows the user to create a cordoned-off sandbox of security on his or her machine, PGP encryption, and commercial services that act as faster but less secure single-hop versions of Tor.
Not every Anon uses those tools effectively. Dozens of the least skilled and most active denizens of the group have been identified, arrested, and imprisoned—some have been revealed to be teens as young as fifteen years old. But every police action only inspires more recruitment and hardens the group’s culture of strong anonymity. One typical propaganda poster for Anonymous shows a headless, suited man—the group’s central emblem—pointing out in Uncle Sam fashion. “ANONYMOUS WANTS YOU,” it reads, “TO GET YOUR ASS BEHIND A PROXY AND JOIN THE RAID!”
Anonymous would soon find common cause with WikiLeaks. In fact, the two groups shared many of their roots in an early enemy: the Church of Scientology.
In January 2008, the church began a campaign of suppression to prevent a leaked video of scientologist star Tom Cruise extolling the church’s virtues from spreading around the Internet and traditional media. Anonymous, until then focused on nihilistic pranks like hacking an online epilepsy forum to display blinking lights intended to cause seizures, responded with its first political action.
It began with a two-minute video posted to YouTube, a robotic voice delivering a manifesto as foreboding gray clouds drifted across the sky.
Hello, Scientology. We are Anonymous.
Over the years, we have been watching you. Your campaigns of misinformation; suppression of dissent; your litigious nature, all of these things have caught our eye. With the leakage of your latest propaganda video into mainstream circulation, the extent of your malign influence over those who trust you, who call you leader, has been made clear to us. Anonymous has therefore decided that your organization should be destroyed. For the good of your followers, for the good of mankind—for the laughs—we shall expel you from the Internet and systematically dismantle the
Church of Scientology in its present form.
. . .
Knowledge is free.
We are Anonymous. We are Legion.
We do not forgive. We do not forget. Expect us.
The video received 4.5 million views on YouTube, and was followed by close to two hundred cyberattacks on Scientology websites around the world, in-person protests at Scientology buildings attended by thousands wearing Guy Fawkes masks, and even envelopes of white powder—it turned out to be harmless wheat germ and cornstarch—mailed to dozens of the church’s addresses.
When WikiLeaks began posting Scientology documents in record numbers a few months after Anonymous’ Scientology campaign, Anonymous’ and WikiLeaks’ supporters began to blend. And when the attacks on WikiLeaks began in December 2010, it was Anonymous that attacked back.
The requisite manifesto broadcast through the Internet’s message board and blogs called for an action titled “Operation Avenge Assange.” It appeared shortly after PayPal cut off transfers to the group and quoted John Perry Barlow, a founder of the cypherpunk-affiliated Electronic Frontier Foundation: “The first serious infowar is now engaged. The field of battle is WikiLeaks. You are the troops.”
The poster went on to call for boycotts and cyberattacks, mass distribution of the cables online and off, and even a letter-writing campaign to government officials in support of Assange. A wave of digital broadsides followed as Anonymous trained its stream of crowd-sourced junk data, powered by a software weapon called Low Orbit Ion Cannon, at one target after another. PayPal’s corporate blog was temporarily blown off the Web, followed by the websites of Visa and MasterCard as well as the Swedish prosecutor’s office that was attempting to extradite Assange.
The hackers followed up with another direct action called “Operation Bradical” that focused instead on Bradley Manning, by then languishing in a Quantico, Virginia, brig, kept on suicide watch and forced to strip naked nightly by commanding officers. An Anonymous missive posted online called on Anons to “dox” the brig’s officers, digging up their personal information and using it to harass them and their families. They demanded that Manning be given “sheets, blankets, any religious texts he desires, adequate reading material, clothes, and a ball. One week. Otherwise, we continue to dox and ruin those responsible for keeping him naked, without bedding, without any of the basic amenities that were provided even to captured Nazis in WWII.”
This Machine Kills Secrets Page 21
