We Are Anonymous: Inside the Hacker World of LulzSec, Anonymous, and the Global Cyber Insurgency

by Parmy Olson

  I think it’s time for /b/ to do something big. People need to understand not to fuck with /b/…

  I’m talking about “hacking” or “taking down” the official Scientology website.

  It’s time to use our resources to do something we believe is right.

  It’s time to do something big again, /b/.

  Talk amongst one another, find a better place to plan it, and then carry out what can and must be done.

  It’s time, /b/.

  Fellow /b/ posters were immediately dubious. “Yeah, good luck with this fail,” said one of the first to reply.

  “A random image board cannot take down a pseudo-religion with the backing of wealthy people and an army of lawyers,” said another. “Even if every person who has ever browsed /b/ ONCE joined in on a mass invasion it would still amount to nothing. Plus…they would have 500 lawyers up their ass before they could say ‘litigation.’”

  “4chan vs. scientology = M-M-MONSTER FAIL.”

  “Can we take Mormonism next? Then Christianity?” another Anonymous poster asked sarcastically. “Then, if we really got balls, Islam?” A few /b/ users who had a background in Scientology also defended the religious group: “Scientology isn’t fundamentally wrong or harmful as a belief system,” one said.

  The discussion continued, but soon the original, skeptical comments were drowned out by the comments of people who supported the OP. It was as if the more /b/ thought about hitting Scientology in a big way, the more its users liked the idea. “You don’t get it do you,” said one. “We are the anti-hero, we will do good, and fuck anyone, good or bad, who happens to be in the way.”

  “This is the first step in something larger, something epic,” another agreed.

  “We can do this,” said another. “We are Anon, and we are interwebs superheroes.”

  Suddenly, the thread’s opinion was rushing toward all-out agreement on a raid. The initial skepticism and objections that /b/ was “not your personal army” were forgotten by the now-zealous throng:

  “We are thousands strong, they can’t sue all of us!”

  “I say it’s time to stop talking about shitting dick nipples and do something even half-worth while, even if it IS just pissing off a bunch of scam artists.”

  “Future generations of /b/tards will look back to this as the day we fucked with batshit insane scientologists.”

  “Let’s do it, /b/.”

  “I have three computers. How can I help?” someone asked.

  “Jesus will someone write the newfags some explanations on how to do a DDoS? And then we can get this shit underway.”

  Before Anonymous emerged, DDoS attacks had been mostly confined to use by cyber criminals against financial websites or companies from which they could extort money. But by 2008, it was already becoming one of the most popular forms of Anonymous attacks. Two years earlier, /b/ users had been DDoSing the site of white nationalist radio host Hal Turner, temporarily knocking it offline. He later tried suing 4chan, another image board called 7chan, and eBaum’s World, claiming thousands of dollars in bandwidth costs, with no success.

  You could take part in a DDoS attack simply by downloading one of at least a dozen free software tools available on 4chan’s /rs/ board. When enough people did so and flooded a target with junk traffic, the effect was like fifteen fat men trying to get through a revolving door at the same time, according to an analogy by security writer Graham Cluley. Nothing could move. The result: legitimate visitors got an error page when they visited the site, or their browser just kept loading. The downtime was always temporary—similar to when an online retailer holds a 75 percent off sale and can’t handle the flood of visitors. This may seem trivial, since anyone who surfs the net has experienced a bad connection and error pages. But downtime that lasts for hours or days can cost companies thousands in lost revenue or extra bandwidth cost. Participating in a DDoS attack is also illegal, breaking the Computer Fraud and Abuse Act in the United States as well as the 2006 Police and Justice Act in the United Kingdom; in both countries, perpetrators face a maximum penalty of ten years in prison.

  This, of course, rarely deterred /b/ and made raids seem more like a high-stakes game. With Scientology, participants agreed it was worth getting the newfags on board to create an army and spread the word to the other Internet image boards, also known as “chans.” These included 7chan, a popular image board for ex-/b/ users; GUROchan, an image board whose posts mainly consisted of gore; and Renchan, a now-defunct site whose content bordered on pedophilia. 4chan needed to gather at least a thousand people, said one /b/ user on the still-developing Scientology thread that day, and who knew, they could probably find at least five thousand willing to fight for the cause.

  People quickly got down to business. One /b/tard suggested “Phase one”: prank-calling the Dianetics hotline and rickrolling them, or asking the call center “why there’s a volcano on the cover of Dianetics…generally bug the hell out of them.”

  Another /b/tard instructed everyone to DDoS a list of Scientology sites. You could do this by simply visiting Gigaloader.com and inputting a list of URLs that pointed to eight images on Scientology.org. The Gigaloader site (now defunct) was originally meant to stress-test a server, but from as early as 2007 people figured out they could exploit it for DDoS-style attacks. You could enter several Web addresses for images on a website, and Gigaloader would constantly reload the images in your browser—that would burden the image server and eat up the site’s bandwidth, an effect multiplied by the number of people participating.

  The best part was /b/ could include a message in the traffic that was being sent. In a separate incident, a webmaster whose website was being hit by Gigaloader in 2007 said the traffic he was getting looked like this:

  75.185.163.131 - - [27/Sep/2007:05:10:16 -0400] “GET /styles/xanime/top.jpg?2346141190864713656_ANON_DOES_NOT_FORGIVE HTTP/1.1” 200 95852 “http://www.gigaloader.com/user-message/ANON_DOES_NOT_FORGIVE” “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.7) Gecko/20070914 Firefox/2.0.0.7”

  In the case of Scientology.org, 4chan was sending the message “DDOS BY EBAUMSWORLD” to the church’s servers, part of a running gag to blame 4chan’s antics on the rival, slightly tamer site. Once the thread’s participants started hitting Scientology.org with Gigaloader, another poster described “Phase 2”: /b/ would create a shell site and upload to it a video that repeatedly flashed “facts of Scientology and its inner workings.” /b/ users would then suggest links to content-sharing site Digg and upload the video to YouTube and YouPorn. Phase 3 would be when mainstream news outlets like Fox and CNN picked up on the video, and an e-mail address on the shell site got a cease and desist order from the Scientology lawyers, which would include the lawyers’ names, phone numbers, office addresses, and fax numbers. /b/ should then harass the lawyers, prank-call them, fax them pictures of shock site Goatse, and “complain to her/his boss that she/he is a crack whore/rapist/nigger whatever.”

  As the /b/ thread on Scientology continued, its contributors became philosophical. This raid was about self-preservation, said one. /b/ was dying. The board had become elitist, sniping at participants who appeared too nerdy and discussing increasingly tame subjects. “The gaiafags, furfags, all the fags that you pushed out, we need to amass a number in the thousands and then strike,” they said. “The 3-phase program that anon posted a bit up [sic] is foolproof, as long as we work together.” Longtime users who had become disenchanted with the site knew it had potential to be more than just an image board, and to live up to the immortal Fox11 line “Internet hate machine.”

  “We used to be something powerful,” another old hand said wistully. /b/ was now filled with “newfags” who would “bitch and moan” whenever a new raid was proposed. “Long ago, people would jump on the chance to cause massive lulz, annoy the hell out of people, and possibly do some good for the world. I found an army that did not belong to one person, but belonged to each other.”

  Now an Anon had p
osted Phase 4, which was getting into Scientology’s computer network. “This is the climax of everything,” the person said. “Whoever will complete this will be a god in the eyes of Anonymous.” Someone had to get into an actual Scientology church, preferably a small one in a small town somewhere. They had to bring a USB drive with a keylogger program, software that could log everything typed into a computer. “You must do whatever is possible to get behind the front desk,” they explained. “While they are busy, sneak to the tower of the computer under the desk, load the keylogger, and let it sit. Walk out, and come back in a day or two.”

  About an hour and ten minutes after that first call-to-arms post, someone noticed the spontaneous DDoS attack they’d been hoping for was working. Gigaloader.com was working. “The scientology site’s running slow as shit,” they said. It was taking two minutes to load a page that had previously been instantaneous.

  “COME ON GUYS,” shouted one Anon. “KEEP GIGALOADING!” So frenzied was the atmosphere that only four posts out of hundreds mentioned using a VPN or other anonymizing tools so that people taking part could hide their IP addresses.

  By 9:30 p.m., the raid had moved into everyone-get-in-here mode. Someone had posted an IRC network and channel for people to hop in and discuss what would happen next in more detail. The channel was called #raids, and eventually the original poster who had started the thread created a new IRC channel called #xenu. In the Scientology belief system, Xenu was the dictator of the Galactic Confederacy who first brought humans to Earth around seventy-five million years ago, then placed them around various volcanoes and killed them with hydrogen bombs.

  By now, hundreds of people were piling into #xenu, and then #target, where self-appointed planners could specify targets with a topic title at the top. Everyone was talking at once in the #xenu channel about what to do next.

  “HEY /B/,” someone wrote at 9:45 p.m. back on 4chan. The Anon claimed to have found “a bunch of” XSS vulnerabilities on Scientology.org. XSS, or cross-site scripting, was said to be the second most common hacking technique after SQL injection. “I’LL TRY TO MAKE AN EXPLOIT OUT OF IT.” The address of the IRC channel kept being spammed. There was a sense the thread was coming to an end, so a few people posted one key takeaway from the discussions on IRC: remember the date January 20. “Shit will go down.”

  The entire thread had amassed 514 posts in about three hours. Spirits were high. The third to last poster estimated that around two hundred people had been involved in the discussion. By now, Scientology centers around the world were already getting a trickle of prank calls playing the music of Rick Astley, faxes of black paper that would drain their printer cartridges, unwanted pizza deliveries, and unwanted taxis. Their main website was also loading slowly.

  The following day, January 16, someone using the nickname Weatherman started a page on Encyclopedia Dramatica, the online repository whose slogan was “In lulz we trust.” That page included a declaration of war on Scientology. Then, at 5:47 p.m. eastern standard time, the original poster who had first suggested a chan raid on Scientology congratulated the galvanized troops on /b/ and geared them up for more dramatic action.

  “On 15/1/08 [sic] war was beginning. Scientology’s site is already under heavy bombardment,” the OP said. “This is just the tip of the iceberg, the first assault in many to follow. But without the support of the chans, Scientology will brush off this attack. 4chan, answer the call!…We must destroy this evil and replace it with a greater one—Chanology!”

  The portmanteau of “chan” and “Scientology” signified an event that would unite the different image boards, turning their individual battles against pedophiles, MySpace users, and each other into a larger battle against a larger organization. Scientology may have seemed like an odd choice for a target—until then, most visitors to chans probably only knew it as a kooky religion with a few celebrity followers. Suddenly it was becoming the biggest target Anonymous had ever attacked (there were thought to be around twenty-five thousand Scientologists in the United States in 2008) with what seemed like the biggest wave of interest. No one, not even the original poster, knew where this was going, if this would be a single incident or a step forward from the creative anarchy of the Internet.

  But why Scientology? A bizarre performance by a celebrity and the unusual belief system of Scientology initially appealed to people who browsed image boards and eBaum’s World looking for the strange, new, and titillating. Then Scientology’s attempts to suppress the Cruise video invited a vigilante-style attack to right their wrong. Another factor was Scientology’s almost neurotic defensiveness. The church was well known by this time to have used intimidation tactics against its critics both in real life and on the Web, which made it perfect “troll bait” for the likes of 4chan and the increasingly organized Anons on Partyvan. Scientology’s previous scuffles with online dissenters were already so well known that Canada’s Globe and Mail dubbed its attempts to remove the Cruise video from YouTube “Scientology vs. The Internet, part XVII.” The church had been fighting a war with online dissenters for fifteen years, all the way back to the old days of Usenet newsgroups like alt.religion.scientology in 1994, when ex-members infuriated the church by leaking secret documents.

  One other reason, which often applied to the seemingly random things Anonymous did, was because they could. Technology was developing to the point where anyone with an Internet connection could access free web tools like Gigaloader and help take down a website. The Tom Cruise video and the original poster on /b/ had come in at just the right moment. As the attack developed, so did the opportunity to take part. The “firing” on Scientology.org didn’t let up; if one person stopped using Gigaloader, two or three others were getting involved.

  This was the beginning of a new chapter of Anonymous. The OP had continued on her second post: “If we can destroy Scientology, we can destroy whatever we like!” She reminded 4chan that its users had to “do the right thing” as the largest of the chans, holding the manpower that the “legion” needed. The new thread was as popular as the previous day’s, getting 587 responses, including the repeated instructions for using Gigaloader and comments like “I’M IN.”

  Soon the Anons were DDoSing other websites affiliated with Scientology: rtc.org, img2.scientology.org, and volunteerministers.org. As a result, Scientology.org shut down for twenty-four hours before the church moved its servers to an outside company called 800hosting. There were about ten different software tools that Anons could choose from to help take down the Scientology sites, but the most popular was Gigaloader.

  By now, #xenu was teeming with so many people it was becoming impossible to organize anything. Then almost out of nowhere on the second day, a male Anon who was also an administrator on Encyclopedia Dramatica yelled, ALL CAPS: “YOU GUYS NEED TO TALK TO THE PRESS. PUT A PRESS RELEASE TOGETHER. THIS IS BIG.” No one so far had organized a group of people to deal with publicity, and hardly anyone in the channel wanted to step up. But a few did. With a few clicks, one person created a channel called #press, announced to the #xenu channel that it was there, and five people joined it. At the top of the channel they had set a topic: “Here’s where we’re going to talk to the press.”

  One of the people joining the #press channel was a round-faced man in glasses sitting in his bedroom in Boston. The room doubled as a home office for his freelance software work. Gregg Housh would become instrumental in helping organize the Anons over the next few months, though like others in Anonymous, he would eventually fade into the background as a new generation of figureheads like Sabu and Topiary later emerged. Originally from Dallas, Texas, Housh loved trolling and organizing pranks and was a regular on the Partyvan IRC network. He had a commanding, talkative personality that belied any outward appearance of being a computer geek. He’d done some jail time for his part in coordinating illegal file sharing in his late teens, his term helpfully cut short after he agreed to cooperate with the FBI, according to court documents, and the judge considered his to
ugh upbringing. Housh’s father had left when he was four, and his mother was a housecleaner who also cared for a grown daughter with cerebral palsy. Having now been out of jail for a while, Housh was looking to stay out of trouble, since he also had a young daughter. But he couldn’t help feeling intrigued by what was happening to Scientology. He jumped into #press and, together with a few others in the chat room, wrote a press release called the “Internet Group Anonymous Declares War On Scientology,” listing the tongue-in-cheek source as “ChanEnterprises.” They published it.

  When the #press channel’s participants read over the press release, it sounded so dramatic and ominous that they decided something similar should be narrated in a video, too. A member of the group, whose nickname was VSR, created a YouTube account called Church0fScientology, and the group spent the next several hours finding uncopyrighted footage and music, then writing a video script that could be narrated by an automated voice. The speech recognition technology was so bad they had to go back and misspell most of the words—destroyed became “dee stroid,” for instance—to make it sound natural. The final script ended up looking like nonsense but sounding like normal prose.

  When they finally put it together, a Stephen Hawking–style robotic voice said over an image of dark clouds, “Hello, leaders of Scientology, we are Anonymous.” It climbed to new heights of hyperbole, vowing to “systematically dismantle the Church of Scientology in its current form.…For the good of your followers, for the good of mankind—for the laughs—we shall expel you from the Internet.” Housh and the group of publicity reps weren’t taking any of this seriously. But as they were putting finishing touches on the video and joking about how this “war” would be one of the funniest trolling events of all time, lasting a few days at most, a French PhD student in the group suddenly got serious with them.