top | item 2200720

How one man tracked down Anonymous—and paid a heavy price

432 points| steveklabnik | 15 years ago |arstechnica.com | reply

155 comments

order
[+] _b8r0|15 years ago|reply
I've resisted discussing this but I think it's late enough after the event to chime in.

First off, disclaimer: We sell HBGary's products in the UK, I know Greg and Penny personally, as well as Jussi (who runs rootkit.com but as far as I'm aware does not work for HBGary). I'm not claiming to speak for anyone or company, just for myself on a purely personal level.

After looking into this, what happened is that HBGary invested in 15% of HBGary Federal, a company set up to do work HBGary didn't want to do. Now presumably (from TFA) they were looking at selling this off.

I don't know Aaron, but it sounds to me like he's a bit of a character at least (I'll leave it to others to resort to namecalling) and completely misunderstood what Anonymous are and how they work - FWIW we investigated Anonymous' years ago for some clients who'd been DDOSed and concluded that the simple solution is (to paraphrase Greg's irc comment) not to poke the wasps nest.

Penny, Greg and HBGary in general are in a bit of a tough situation now because of Aaron's actions and appear to have no ability to impose anything on HBGary Federal. This should serve as a warning to others that if you're going to use the name elsewhere, you better have a way of enforcing unforseen issues that may arise.

The sad thing about all of this is that Penny and Greg are really great guys, and HBGary is a good company with some insanely great technology. I'm sure they'll pull through, but I imagine there will be collateral damage for them resulting from this for some time to come.

[+] moe|15 years ago|reply
HBGary is a good company with some insanely great technology

Insane would be to trust security-related products or advice from a company that can't even secure its own mailserver.

[+] SwellJoe|15 years ago|reply
I can't believe this guy has a job in a security company doing work for the federal government. I'm getting a strong vibe that he's schizophrenic. I've known an unmedicated schizophrenic, and this is the way they talked and acted. Self-aggrandizing, convinced they have comprehended great secrets based on little to no data (schizophrenics often believe that have "other ways of knowing" or extremely heightened intuition), and a belief that once they tell the whole story of the truths that have been revealed to them the world will take notice and be amazed.

The coder in this story is an hero (OK, just a reasonably nice guy, not afraid to tell the moronic "analyst" to go to hell), and obviously prevented a lot of damage by actively working against Barr's insane plans.

I feel the tiniest bit sorry for Leavy and the rootkit guy, as they clearly weren't encouraging this stuff, but really, they knew this guy was a whack-a-mole and they kept him on anyway, I guess because his crazy ego managed to close sales. It's really hard to take pity on someone that knows there's a crazy guy using company resources to go on a personal jihad against random kids on the Internet, and doesn't do anything to stop it.

The level of invasion of privacy this guy was taking part in, against children, is pretty much inexcusable. He's not law-enforcement, and should not be allowed to act as though he has a warrant for rifling through the personal lives of dozens or hundreds of children. All 50 states have laws that cover cyberstalking, cyberharassment, and cyberbullying; in a just world, this nutjob would end up in prison. Whether these kids have done anything wrong or not is irrelevant. Barr is a private citizen, and adult, and he ought to leave law enforcement activities to the police or FBI.

Edit: I should point out that I don't think anyone should be arrested for browsing facebook or twitter or whatever. I was a bit rambling in this comment, and the entirety of my thought processes are not exactly made clear by the text. The stuff that I think is probably illegal is the stuff he was doing outside of his actual research: Dropping hints and threats in mainstream media and in IRC about the data he was gathering, using his fake persona to stir up a shitstorm by leaking that a security company was gathering data on the people he was talking to, etc. I had to google cyberstalking to even know if there were laws about this stuff (and there are, and in all fifty states). While I don't know if those laws are reasonable or not, I'm pretty sure he crossed the line into breaking some of them, particularly in the case of his underage targets.

[+] notahacker|15 years ago|reply
I'm not sure that schizophrenia is any better an explanation than straightforward arrogance. Assuming that the leaks of his work are reasonably accurate I'd be concerned if the government actually started using his research to arrest people though.

I'm not sure that Barrs interest in finding patterns in publicly available information in order to sell his intelligence is any different to advertising analysts doing the same thing. The attempt to socially engineer Anonymous via IRC is a bit more extreme, but I haven't seen any evidence that he intended harrassing them; the problem would have occurred if and when law enforcement bodies started harassing innocent people based on his dodgy intelligence. If you start making any investigative work or social network analysis carried out by private citizens online illegal on the basis of stalking laws then you risk censuring a lot of people actually doing good work.

[+] noahc|15 years ago|reply
I am not a lawyer, but I'd like to address your legal points.

Just as I don't need a warrant to view a publicly available website, he shouldn't either. What you are proposing is that it should be illegal to view public pages in a certain order or time. What is the difference of me viewing 100 of my new crushes friends pages over 2 days vs 2 years? There isn't, but the first is rifling, the second is innocent curiosity.

I don't believe he was cyberbullying anyone. However, to address cyberstalking and cyberharasamnet we first have to consider what a reasonable person would have felt had those actions been taken against us. Before the release of the data, and while this was going on, those on the list were unaware of what was occurring. Just as a reasonable person isn't threatened until they become aware of the stalking, threats, etc in real life. Being unaware of what he was doing would mean that no constitute cyberstalking, cyberharassment or cyberbullying took place.

Barr is a private citizen accessing public information and drawing crazy conclusions. There's nothing illegal about that nor should there be.

[+] cookiecaper|15 years ago|reply
IANAL but it doesn't sound like he did anything criminal to me. He's obviously misguided and silly, thinking he can draw statistical relevance from assumptions based on his personal reading of Facebook profiles, but there is nothing illegal about reading information that someone posts on the internet.

Cyberstalking, to the best of my non-lawyer knowledge, involves real, disruptive harassment, not just a guy who saw you were friends with some other guy and drew some wild conclusions from that.

Barr never dropped the names so any post-facto prosecution for cyberstalking that would have been primarily based on his use of electronic methods to "identify" Anonymous leaders is unlikely.

I don't think there's anything wrong with doing your own detective work, and you certainly don't need a warrant to follow Facebook or Twitter pages. Private investigators do this kind of stuff in the "real world" all the time (granted, they have licenses).

I agree that Barr is incompetent and/or a tinge off his rocker, but the idea that only law enforcement should be able to search publicly accessible data is silly. If I find the page of a guy I haven't seen in five years, should it be illegal if I spend some time reading his publications? What if I just want to find someone that I've heard a story about so I can ask them more information? Should that be illegal? Remember, the people publishing these things publish them by their own choice with the understanding that they are making the information publicly accessible.

Dropping a bunch of names and recklessly implicating individuals in a criminal investigation is at least a civil offense, but there's no crime in drawing wild conclusions about people while cruising Facebook -- at least as long as you use the conclusions judiciously.

[+] techiferous|15 years ago|reply
"Self-aggrandizing, convinced they have comprehended great secrets based on little to no data (schizophrenics often believe that have 'other ways of knowing' or extremely heightened intuition), and a belief that once they tell the whole story of the truths that have been revealed to them the world will take notice and be amazed."

Are you describing a schizophrenic or a newbie entrepreneur? ;)

[+] jefe78|15 years ago|reply
I think your last paragraph nails it. He apparently called out a bunch of innocent people. Imagine the damage that could do?

And agreed, the coder was a saint among men!

[+] steveklabnik|15 years ago|reply
> The coder in this story is an hero

Oh man, I'm not sure if this is funnier if you meant it, or not...

> in a just world, this nutjob would end up in prison.

Yup. I'm interested to see what happens in the weeks ahead. I really doubt that anything bad (other than getting his SSN posted to Twitter...) will actually happen to him, though.

[+] kdahfklaf|15 years ago|reply
'an hero' does not mean what you think it does.
[+] DrStalker|15 years ago|reply
Isn't anonymous less an organized group with leaders and more a bunch of people who hang out and occasionally someone says "hey, it would be cool if we all did <thing>" and whoever is listening joins in?
[+] cookiecaper|15 years ago|reply
Yes, but traditional media has a hard time grasping the concept. It's just a lot of directionless guys that latch onto whatever cause seems palatable at the time and requires no more effort than running LOIC/other simple DDOS programs. Basically the definition of script kiddies, there's just a large concentration of them on one message board system.
[+] radu_floricica|15 years ago|reply
Power law still applies. Most likely 90% of serious action is done by the same 0.1% contributors (same as it is on HN or reddit or anywhere else).

It may be a real difference if the 0.1% can be easily replaced, Stand Alone Complex style. Say they're all arrested one day, and a month after something happens (Julian Assange is extradited, there's a revolution in Iran, whatever piques Anonymous' interest). There's a good chance many people at the same time will think that something needs to be done, see that nothing is happening, and do it. Not as good as the "old guard" maybe, but they'll probably try.

We can't really know how well this replacement mechanism works...

[+] NonOrthodox|15 years ago|reply
Actually no. I had been in their IRC for some time during the first couple weeks of the Wikileaks leaks, and it isn't like that. They are a group that, just like any other, like HN, have certain common and shared values and talk, discuss and act by them. In their case, basicly, they are pro free-speech, pro internet and privacy.

They, like we here in HN, organize themselves around those ideas. Sometimes they act together against someone that goes against their values, like they just did to Aaron, and sometimes they act towards other positive goals like they did in Egypt. It is not about being cool, having fun or anything like that. That is just one of the ways they attract kids and other people to join them in their attacks and other actions. There is no central leadership, no hierarchy, but all their actions are done following certain values and ethics that you cannot really grasp unless you are part of it, just like HN.

Although they don't have leaders, at least in their IRC, there are moderators, that, at least during the leaks, when there were over 3 thousand people in a single IRC channel, would lock the channel, summarize arguments, add questions and unlock it, while they were selecting targets. But usually that only happened when there were that many people and too many trolls spamming the chat.

They are people, from all ages that act by their shared values.

[+] stcredzero|15 years ago|reply
Isn't anonymous less an organized group with leaders and more a bunch of people who hang out and occasionally someone says "hey, it would be cool if we all did <thing>" and whoever is listening joins in?

This idea is repeated so often, I suspect that there's a group of people somewhere that wants that particular message to be repeated and believed. If I were manipulating a group like Anonymous from behind the scenes, that's exactly what I'd want the net at large to think.

On the other hands, if Anonymous were really as decentralized as implied in this meme, I should think everyone would want the media to think there was a shadowy conspiracy inolved -- if nothing then just for the LULZ.

My best guess is that the truth is somewhere in the middle. Anonymous is somewhat decentralized, but there is also a core group (are core groups) that started a self-perpetuating process toward some end. This core group is a little worried that things are a little out of hand, so they are now covering their tracks using the same social-media manipulation techniques used to start Anonymous itself.

[+] citricsquid|15 years ago|reply
Based on my own minimal experience, the majority of these IRC channels are just a small group of "Anonymous" doing whatever they want, different channels will get publicised at different times through different means, "Anonymous" doesn't exist in any way beyond being a label people use, I guess it could be compared to "emo" or "jock" in high school; they have no "leadership" but people join these groups and label themselves as such.

> The show was run by a couple of admins he identified as "Q," "Owen," and "CommanderX"—and Barr had used social media data and subterfuge to map those names to three real people, two in California and one in New York.

isn't Q the bot that runs on quakenet as a proxy admin?

[+] dekz|15 years ago|reply
Possibly, but these if these "relations" are created purely from IRC dicussion, I don't think that happens on quakenet.
[+] colanderman|15 years ago|reply
I'm astounded at both the CEO's (Aaron's) lack of basic grammar skills, and predeliction for "script kiddie" talk. How do you get to be CEO of anything when you communicate (even informally) at the level of an 8th grader?

(edit: I meant Aaron; Penny was decently well spoken)

[+] memetichazard|15 years ago|reply
I assumed that all those garbled messages were from typing on an iPhone. One particular error reeked of autocorrect. If you've seen the things people post on Damnyouautocorrect...

Still no excuse for not writing professionally and at least checking up on what you just typed.

[+] unknown|15 years ago|reply

[deleted]

[+] leon_|15 years ago|reply
1. drink brain away 2. become "social media" expert 3. lie to get funding 4. ??? 5. ceo
[+] Helianthus16|15 years ago|reply
He thought that Anonymous was affiliated ("strongly linked") with Wikileaks, as if there was some secret backdoor agreement between them. Nutcase. There doesn't _need_ to be any agreement or promise between Anonymous and other parties.
[+] wipt|15 years ago|reply
Why is it so hard for some people to grasp that Anonymous are just what they claim to be - everyone and yet no one person? There is no roster, no voting, but they are still organized.

Maybe one could call it a mob mentality?

[+] bdclimber14|15 years ago|reply
It's hard because corporate leaders have an incredibly difficult time organizing their own companies to achieve comparable feats to what Anonymous can do overnight.
[+] JonnieCache|15 years ago|reply
This guy is clearly a dangerous moron. This kinda makes me feel better for being so cold about this whole affair in the other thread.

The terrifying thing is that there are still people in government who believe sentences like "specific techniques that can be used to target, collect, and exploit targets with laser focus and with 100 percent success" through social media.

I mean, who claims one hundred percent success at anything?

EDIT: Also, that coder hopefully shouldn't be buying any drinks for a while.

[+] rst|15 years ago|reply
The same people who believe that DRM can effectively prevent copying, if the people selling it say that it can. Which is to say, the ones who think of technology as wizardry, and evaluate wizards by looking for social proof. (They can't really evaluate what the guy's selling, but they sure can tell if he's the kind of person that would get respect at a cocktail party.)
[+] jdp23|15 years ago|reply
The log where the CEO of the parent company joins the IRC chat room is great reading. http://pastebin.com/x69Akp5L -- search for "HI it's me"
[+] pessimizer|15 years ago|reply
[04:15] <@blergh> Penny: What i am saying is that someone residing on your network attacked one of my boxes

[...]

[04:16] <+Penny> OK how do I know who is on my comcast network?

[04:16] <+heyguise> lol

[04:16] <+heyguise> omg that is precious

[+] prpon|15 years ago|reply
A great read. It's amazing how Aaron Barr completely believed his hunches even when his programmer said that the data doesn't backup his analysis. He is a business man trying to get paid big bucks from FBI for his hunches.
[+] stcredzero|15 years ago|reply
My read: The piece is based on Anonymous propaganda. Anonymous itself is actually an amorphous propaganda outfit. The primary purpose of their actions is to produce media. Anonymous achieves these ends in part by taking on opponents with good story value, but no consequential power. They also engage in actions against significant players, like credit card companies, but these actions are most effective in creating media while only resulting in momentary financial damage. Anon is a media entity, not a financial one.
[+] 1337p337|15 years ago|reply
Some of them are. The Guy Fawkes masks are sort of a good way of describing them: a bunch of completely unrelated people assuming the same identity for a time. Likewise, the "Anonymous" you hear of is usually the "Anonymous" that pulls this sort of stunt and then publicizes it. There are a number of people hanging out on /b/ doing nothing but humorous (depending on your sense of humor) image manipulation, also calling themselves Anonymous, and people trolling LiveJournal doing the same. They've all got a different character, but if they all use the same name, it makes them difficult to attach attributes to.

They get to be anonymous by all assuming the same name, "Anonymous"; it's tricky to talk about them as a unified group because it's a group of groups, all with the same name. "This Anonymous" versus "that Anonymous" is hard to talk about. (It's a disclosed exploit in language.)

[+] corin_|15 years ago|reply
Where's Sorkin when you need him to write a screenplay?
[+] stcredzero|15 years ago|reply
Reclining somewhere warm while drinking his FU money?
[+] rokhayakebe|15 years ago|reply
I am reading through the entire article, pausing every other paragraph to tell myself "This would make a kick ass movie"
[+] mcantor|15 years ago|reply
FTA, from one of Barr's e-mails: "... accept during hightened points of activity..."

Did this drive anyone else bonkers? I think "accept" or "hightened" alone wouldn't have bugged me. But for some reason the juxtaposition of the two in this sentence made me nerdrage.

[+] scotty79|15 years ago|reply
You just need to program as good as I talk bullshit. I think I've heard something along those lines in my professional expeirience.
[+] dalore|15 years ago|reply
Reading the story, time and time again his programmer warned him about anonymous, and said he shouldn't be messing with them.

Then what do you know, he gets attacked by anonymous. Do you think maybe his programmer is in anonymous? :)

[+] tezmc|15 years ago|reply
You don't have to have anything to do with Anonymous to have some idea of what they're capable of when they're poked with a stick.
[+] chc|15 years ago|reply
Not really any good evidence to support that conclusion unless you're using Barr's statistical methodology. That coder's responses to Barr aren't that far off from what I'd say in his position. It's not surprising that a programmer would be familiar with Internet geek subculture, and predicting that Anonymous will turn LOIC on a direct challenger is not much of a leap.
[+] johnmack|15 years ago|reply
Someone, please, bring eggs and throw them at Aaron Barr during BSides security Feb 14-15! Literally: bring eggs. Please, I'll by you a beer
[+] hardik988|15 years ago|reply
Wow, this was almost like a cyber crime thriller! Anyone for writing a book on Anonymous ?
[+] mahmud|15 years ago|reply
Anon should write it together, using Etherpad.
[+] nhangen|15 years ago|reply
I've yet to see anyone address the behavior of anonymous, and it appears as though it's been justified by most because this dude was an asshole - but why not point a finger at them both?
[+] cookiecaper|15 years ago|reply
Well, there's no story to really address there. Barr was dangerously ignorant and naive. He had a complete misconception of how these things were organized and how they worked while claiming to know all of the identities of "the leaders" by correlating Twitter posts with what someone in IRC was talking about.

If you get on the news and say, "Hello Criminal Group. We have a bunch of information on your leaders that will get them arrested, we are meeting with the FBI next week", it is only reasonable to expect some attempted retaliation. I think that no one is surprised that the targeted group compromised HBGary's servers -- there are, after all, much worse things that could happen -- except maybe the HBGary people themselves, who, as we see here, were already in way over their heads.

No one addresses the behavior of Anonymous because it is completely and totally the expected reaction. The shocking thing about the story is Barr's personality and behavior, not the idea that someone will retaliate if you threaten to decapitate their organization.

[+] michaelty|15 years ago|reply
"The coder said he didn't support all they did, but that Anonymous had its moments. Besides, "I enjoy the LULZ.""

Who among us hasn't?