by Parmy Olson
Now Sabu and Kayla had complete control of rootkit.com. First they took the usernames and passwords of anyone who had ever registered on the site, then deleted its entire contents. Now it was just a blank page reading “Greg Hoglund = Owned.” Sabu found he enjoyed working with Kayla. She was friendly, and she had extraordinary technical skills. Sabu later told others that she had socially engineered Jussi Jaakonaho, partly because the idea of being “owned” by a sixteen-year-old girl would only embarrass HBGary further.
Sabu and Kayla then got busy on HBGaryFederal.com, removing the home page and replacing it with the Anonymous logo of the headless suited man. In place of its head was a question mark. At the bottom was a link that said “Download HBGary e-mails”—Tflow’s torrent file. Now anyone could read all of Barr’s confidential e-mails to his clients as easily as they might grab a song on iTunes, but for free. The new home page also had a message written by Topiary:
This domain has been seized by Anonymous under section #14 of the Rules of the Internet. Greetings HBGary (a computer “security” company). Your recent claims of “infiltrating” Anonymous amuse us, and so do your attempts at using Anonymous as a means to garner press attention for yourself. How’s this for attention? You’ve tried to bite at the Anonymous hand, and now the Anonymous hand is bitch-slapping you in the face.
By 6:45 eastern standard time, twenty-four minutes into the Super Bowl, most of the “hacking” was over. There were no distant cheers and whoops for the football game from Barr’s neighbors, who were mostly young families. The world around him seemed strangely quiet. With some trepidation, he logged back into the Anonymous chat rooms to confront his attackers. They were ready and waiting. Barr saw a message flash up, an invite to a new chat room called #ophbgary. He immediately saw a group of several nicknames. Some he recognized from his research and others he didn’t: along with Topiary, Sabu, Kayla, there were others: Q, Heyguise, BarrettBrown, and c0s. The last nickname was Gregg Housh, a longtime Anon in his midthirties who had helped coordinate the first wave of major DDoS attacks by Anonymous in 2008, against the Church of Scientology (COS).
Topiary got things going. “Now they’re threatening us directly,” he told Barr, quoting the earlier e-mail. “Amirite?”
Barr said nothing.
“Enjoying the Super Bowl, I hope?” Q said.
“Hello Mr. Barr,” Tflow said. “I apologize for what’s about to happen to you and your company.”
Finally, Barr spoke up. “I figured something like this would happen,” he typed.
“Nah, you won’t like what’s coming next,” Topiary said.
Barr tried persuading the group that he’d had their best interests at heart. “Dude…you just don’t get it,” he protested. “It was research on social media vulnerabilities. I was never going to release the names.”
“LIAR.” This was Sabu. “Don’t you have a meeting with the FBI Monday morning?”
“Sabu, he totally does,” said Topiary.
“Ok…Yep,” Barr conceded. “They called me.”
“Oh guys. What’s coming next is the delicious cake,” Topiary said.
It was up to Tflow to finally drop the bombshell. “I have Barr’s, Ted’s and Phil’s e-mails,” he said. All 68,000.
“Those e-mails are going to be pretty,” said Housh.
“Lol,” Barr replied inexplicably. He seemed to want to keep proceedings light, or to convince himself this wasn’t as bad as he thought. “Ok guys,” he added, “well you got me right :).”
Indeed they had. Topiary made his parting shot. “Well Aaron, thanks for taking part in this little mini social test to see if you’d run to your company with ‘news’ about Anon. You did, we leeched it, we laughed.” He paused. “Die in a fire. You’re done.”
It was now well into the early hours of Monday morning. Barr was sitting in his home office in front of the laptop, his hopes of a turnaround having dwindled to nothing. On the wall in front of him was a photo he’d bought in New York in October 2011. The 9/11 attacks were still raw, and after visiting Ground Zero he’d popped into a small gallery selling amateur photographs taken during the attacks. One stood out. In the background was the chaos of the fallen towers: papers and bricks strewn everywhere, dazed commuters covered in dust, while in the foreground was John Seward Johnson’s Double Check, the famous bronze statue of a suited businessman on a park bench, looking into his open briefcase. Something about its incongruence made him like it instantly. Now Barr was that man, so caught up in his ambitions that he’d become oblivious to the chaos going on around him.
His public Twitter feed, an important reputational tool with the public, his clients, and the press, was now an obscene mess. Topiary had posted dozens of tweets filled with swear words and racist commentary. His bio now read, “CEO HBGary Federal. Cybersecurity and Information Operations specialist and RAGING HOMOGAY.” His photo had the word NIGGER defaced across it in bold red lettering. Topiary did not consider himself racist—no one in his group did. But the graffiti was perfectly in tune with the underground culture of crude humor and cyber bullying that ran through Anonymous.
Topiary felt a thrill as he then posted Barr’s home address. Then he tweeted Barr’s social security number, then his cell phone number. Anyone with an Internet connection could read this. “Hi guys, leave me voice mails!” Then the number. Then “#callme.”
Soon, hundreds and then thousands of people who perused Anonymous chat rooms, blogs, and Twitter feeds had heard about what was happening to Aaron Barr. They clicked on links to Barr’s website, now a white screen with the Anonymous logo and message. They watched the Twitter feed and called his number. Quite a few started taking his earnest corporate photo and defacing it, cutting out his head and sticking it on a movie poster for James Bond to mock his spying methods. Another bloated his chin to make him look like the grotesque cartoon from a well-known Internet comic, or “rage comic,” called Forever Alone.
Barr had been unable to tear himself away from the Anonymous chat rooms, mesmerized as people joked about the “faggot” Barr and egged each other on to call his cell phone. His phone rang through the night. He answered it once to hear a woman’s voice say something inaudible and then hang up. There were a few silent voice mails and one person singing what sounded like “Never Gonna Give You Up,” the 1987 song by Rick Astley, homage to a popular prank in Anonymous to “rickroll” someone.
Barr had called in reinforcements. Penny Leavy went online to try her luck at sweet-talking the attackers. They were friendly and polite to her at first, but her requests were met with cold answers.
“Please do not release the HBGary e-mails,” she had pleaded. “There is private information there of clients.”
“Shouldn’t be sending e-mails you don’t want your mother reading,” Heyguise had said. And the e-mails, in any case, had already been published as a torrent on The Pirate Bay.
“Dozens of innocent people could have gone to jail,” Sabu said angrily. Before their attack, his newly formed small clique of Anons, who’d found each other amid hundreds of others in the Anonymous chat networks, had no idea that Barr’s research had been so flawed, or that his e-mails would be so easy to hack into. In fact, they still didn’t know that Barr had been proposing a dirty-tricks campaign against trade unions and WikiLeaks to a government agency and a major bank. They had been motivated by revenge and a desire, intensified by group psychology, to bully someone who seemed to deserve it. Once enough people trawled through Barr’s e-mails and found out what he had done to Hunton & Williams, the attack would suddenly look more than justified, to them almost necessary. Within the Anonymous community, Sabu, Kayla, Topiary, and the others would become heroic purveyors of vigilante justice. Barr had been fair game. He’d provoked a world where taunting, lying, and stealing was how everybody got by. A world that brought euphoric highs, fun, and fulfillment, with hardly any real-world consequences.
As Barr spent the next day fielding phone calls from journalists and tr
ying, desperately, to pick up the pieces, Topiary, Sabu, Kayla, and Tflow met up again in their secret chat room. They celebrated their accomplishments, relived what had happened, laughed, and felt invincible. They had “owned” a security company. In the back of their minds they knew that agents from the Federal Bureau of Investigation would start trying to find them. But over time, members of the small team would conclude that they had worked together so well on Barr, they had to do it all over again on other targets, for lulz, for Anonymous, and for any other cause that came up along the way. No quarry would be too big: a storied media institution, an entertainment giant, even the FBI itself.
Chapter 2
William and the Roots of Anonymous
Aaron Barr would never have come face-to-virtual-face with Anonymous if it hadn’t been for a skinny blond kid from New York City named Christopher Poole and the extraordinary contribution he made to the Internet. Seven years earlier, in the summer of 2003, fourteen-year-old Poole was surfing the Web in his bedroom, looking for information on Japanese anime. Like thousands of other American teens, he was a big fan. Eventually, he found a peach-colored Japanese image board dedicated to anime called 2channel, or 2chan. Poole had never seen anything like it. Founded in 1999 by a college student named Hiroyuki Nishimura (age thirty-five in 2012), it featured anime discussion threads that moved at lightning speed. Poole would wait thirty seconds, hit F5 to refresh the page, and it would suddenly refill with a stream of new posts, numbering up to a thousand. Almost every poster was anonymous. Unlike English-language Web forums, 2chan didn’t require you to register in a name field, and hardly anyone did.
In Japan that same summer, the news media had noticed that 2chan was becoming a rather embarrassing window to the country’s underbelly. Discussions of anime had spilled over into talk of kids murdering their teachers, attacking their bosses, or blowing up a local kindergarten. And it was becoming one of the country’s most popular websites.
Poole wanted a place to talk to people in English about anime, and 2chan had started blocking English posters. So he decided to clone 2chan by copying its publicly available HTML code, translating it to English, and building from there. He put the whole thing together on his bedroom computer and called it 4chan. When an online friend asked Poole, who went by the nickname moot, what the difference between 4chan and 2chan would be, he replied with some chutzpah, “It’s TWO TIMES THE CHAN MOTHERFUCK.” On September 29, 2003, Poole registered the domain 4chan.net and announced it on Something Awful, a Web forum where he was already a regular. He entitled the thread: “4chan.net—English 2chan.net!”
4chan had almost the exact same layout as 2chan: the simple peach background, the dark red text, the shaded boxes for discussion threads. Both 4chan and 2chan have barely changed their designs to this day, apart from adding a few color schemes. After opening 4chan to the public, an English-speaking anime hub called Raspberry Heaven started linking to it, as did Something Awful. The first few hundred visitors took to it right away. Discussion boards were listed alphabetically across the top of the site: /a/ was for anime, /p/ was for photography, and so on. Poole had set ups /b/, the “random” board that would become 4chan’s most important feature, within the first two months. In one discussion with early users, moot said that /b/ was “the beating heart of this site,” but he added that it was “a retard bin.” The random board was a free-for-all.
Poole at first configured 4chan so that anyone who posted a comment could do so under a nickname. This continued until early 2004, when a 4chan user and PHP programmer who went by the nickname Shii became irritated with the enforced nicknames. That year, Shii published an essay about the value of anonymity on image boards, pointing to Japan’s 2chan as a place where anonymity could counter vanity and stop users from developing cliques and elite status. When a site forced people to register with a nickname, that also kept out interesting people with busy lives, instead attracting those who had too much time on their hands and who tended to make nasty or senseless comments. “On an anonymous forum,” he wrote, logic will overrule vanity.
Poole saw the post, liked it, and appointed Shii as a moderator and administrator on 4chan’s boards. He asked another admin to implement a new feature called “Forced_Anon” on different parts of the site. Many users were deeply upset when Forced_Anon was implemented on a few of these boards, and some typed in “tripcodes” so they could override the forced anonymity and use a nickname. Others, who embraced the anonymity feature, mocked the signers and christened them “tripfags.”
Perhaps as an omen of what was to come, conflict ensued. Supporters of anonymity and tripcodes started creating separate threads, calling on anyone who supported their own view to post a message and demonstrate support, or starting “tripcode vs. anon” threads. The tripfags began mocking the anonymous users as a single person named “Anonymous,” or jokingly referring to them as a hive mind. Over the next few years, however, the joke would wear thin and the idea of Anonymous as a single entity would grow beyond a few discussion threads. Poole would fade into the background as Anonymous took on a life of its own. Over the years, /b/ in particular would take on a dedicated base of users whose lives revolved around the opportunities the board afforded them for fun and learning. These users were mostly in the English-speaking world, aged between eighteen and thirty-five, and male. One of them was named William.
William cracked open an eye and stared ahead. It was a cold afternoon in February 2011, and the hard-core user of 4chan considered getting out of bed. In another part of the world, Aaron Barr was trying to repair the damage caused by a group of hackers with Anonymous. William was part of Anonymous, too, and sometimes he liked to attack people. He didn’t have the technical skills of Sabu and Kayla, but his methods could still have an impact.
A sheet hung from the wall of his bedroom, draped from the ceiling to the floor, tacked up with nails. More had been suspended around the room. At the end of his bed was a set of low shelves, with a pile of clutter to the left and a window on the right, hidden behind a blackout blind. The room was his cocoon in the winter, his bed a safety net. At twenty-one, he had been on 4chan most days since leaving school six years earlier, sometimes for many hours at a stretch. For various reasons, he had never held a full-time job for longer than a few months. He wanted to. But William was deeply conflicted. In the real world he was kind to his family and loyal to his friends. As an anonymous user on 4chan’s /b/, he became something more dark, even venomous.
4chan was more than just a drop-in site for random kicks that millions of people visited every day. For William and a dedicated core, it was a life choice. Beyond the porn, jokes, and shocking images, it offered targets to toy with. On 4chan, toying with or seriously harassing someone was called a “life ruin.” Using many of the same Internet sleuthing tactics as Aaron Barr, William would find people on 4chan discussion forums who were being ridiculed or deserved ridicule. Then he would “dox” them, or find their true identities, send them threats on Facebook, or find their family members and harass them, too. The jackpot was nude photos, which could be sent to family, friends, and co-workers for pure embarrassment or even extortion.
Ruining people’s lives gave William a thrill, and a sense of power unlike anything he had felt in the outside world. The only other time he felt anything similar was when he would quietly slip outside his house in the dead of night, meet up with a few old friends, and spray colorful graffiti on the local walls or trains. Graffiti was his mistress on summer nights. In the winter, it was 4chan and now, sometimes, the wider activities of Anonymous.
4chan offered some tame content and mature discussion, and plenty more porn, gore, and constant insults between users that created a throbbing mass of negativity. It sometimes got William thinking scary thoughts about suicide. But 4chan also kept him alive. Sometimes he felt depression coming on and would stay up all night on the site, then remain awake for the rest of the next day. When thoughts of killing himself came, he could hide in sleep, tucked saf
ely under his blanket, against the wall that he’d covered with a sheet.
William was brought up in low-income British housing. His parents had met at the YMCA after his mother, an immigrant from Southeast Asia, escaped an unhappy marriage and became temporarily homeless. The couple split when William was seven and he chose to live with his father. He went on to misbehave at school, statistically one of the worst in his country. He would swear at teachers or just walk out of class. It became an endless stream of detentions. He wasn’t a social outcast; William just couldn’t see the point of his education. After getting expelled at fourteen he was allowed to return, but by the following year, in October 2004, he decided to leave entirely.
By this time, William had already created a new life online. It started when he and some friends began visiting websites frequented by pedophiles, and signing up with usernames like “sexy_baby_girl” to get attention. They’d ask the men to go on webcam, and if they came on naked, as they often did, the boys would burst out laughing. To raise the stakes, they’d paste an official warning from Child Protective Services in MSN Messenger, Microsoft’s popular chat client, adding that they had the man’s IP address, a series of numbers that corresponded to his computer, which they’d make up. The man would usually just sign off, but they got a buzz knowing he was probably terrified, and that he probably deserved it.
William was always the one who would push his friends to take the joke further or get the male target more sexually excited. Eventually, he started continuing the pranks at home on iSketch.com, TeenChat.net, and other hotbeds of sexual deviants at that time. None of the images shocked William any more. He had first seen porn when he was eleven.