Old-time hacktivists: Anonymous, you've crossed the line
Despite shared concerns, pioneers in the movement say the methods of a newer generation abridge free speech and hurt the cause.
In December 1998, a U.S.-based hacker group called Legions of the Underground declared cyberwar on Iraq and China and prepared to protest human rights abuses in those countries by disrupting their Internet access.
About a week later, a coalition of hackers from groups including Cult of the Dead Cow (cDc), L0pht, Chaos Computer Club in Germany, and hacker mags 2600 and Phrack issued a statement condemning the move. "We - the undersigned - strongly oppose any attempt to use the power of hacking to threaten to destroy the information infrastructure of a country, for any reason," the statement said. "One cannot legitimately hope to improve a nation's free access to information by working to disable its data networks."
Legions of the Underground got the message and backed down. The hackers went back to embarrassing Microsoft by exploiting security weaknesses in Windows, partying at DefCon in Las Vegas, and testing the line between white hat and gray hat security as they explored the limits and frontiers of technology.
But the line that was drawn back then is again being crossed.
This time it's hackers and online activists working under the banner of Anonymous who are using Web site defacements, distributed denial-of-service (DDoS) attacks, and data theft, ostensibly to press their campaign for Internet freedom and human rights. The group, because of its lack of leadership and organization, also finds itself calling for seemingly contradictory operations including both urging people to vote in the elections this year as part of Occupy the Vote and a "declaration of war" on the U.S. over proposed cybersecurity legislation, urging a vague destruction of the government but not a computer attack or physical protest.
The former "chief evangelist for hacktivism" at the cDc, Oxblood Ruffin, says this is not the way of a true hacktivist.
"Anonymous is fighting for free speech on the Internet, but it's hard to support that when you're DoS-ing and not allowing people to talk. How is that consistent?" Oxblood Ruffin said in an interview this week with CNET. "They remind me of awkward teenagers. I think they're trying to do the right thing, but they're stumbling around and doing some really stupid sh**."
Hacktivismo
The cDc members were early hacktivists. A member named Omega coined the term "hacktivist" in an e-mail to the group in 1996, partly tongue-in-cheek. "We were providing ridicule and social commentary," Oxblood Ruffin said. "We were opinion leaders in the computer underground."
A fun quip turned into much more, though, starting with the Hong Kong Blondes. This was a mysterious group of Chinese dissidents with handles like Lemon Li and Databyte Cowgirl, who apparently were being advised by the cDc and other hackers in the use of encryption to circumvent China's Great Firewall. In an interview with Oxblood Ruffin in July 1998 leader Blondie Wong announced the formation of a new international group called the Yellow Pages that he said would hack into the computer networks of U.S. corporations doing business with China. (Some people have questioned the veracity of the colorful stories from Wong, who claimed to be an astrophysicist. Oxblood Ruffin declined to disclose much more about the group, but promised further revelations in the future.)
In 1999 the cDc created an offshoot group called "Hactivismo" that included hackers, lawyers and activists. The hackers developed, contributed to and distributed tools designed to help dissidents in repressive regimes avoid censorship and surveillance. Those wares included: Peekabooty, which allowed people to bypass national firewalls; Camera/Shy, a steganography application that allowed people to hide content within other content; secure instant messaging client software ScatterChat; and Tor, which allows people to use the Internet anonymously.
The Hacktivismo Declaration was released in 2001 and it stated that "full respect for human rights and fundamental freedoms includes the liberty of fair and reasonable access to information, whether by shortwave radio, air mail, simple telephony, the global Internet, or other media." In addition, "state sponsored censorship of the Internet erodes peaceful and civilized coexistence, affects the exercise of democracy, and endangers the socioeconomic development of nations," it proclaimed.
Later, in a paper entitled "Hacktivism, From Here to There" that Oxblood Ruffin presented at the CyberCrime and Digital Law Enforcement Conference at Yale Law School in March 2004, hacktivism is defined as "using technology to improve human rights across electronic media." And he laid down some ground rules -- no DDoS attacks and no Web site defacements.
"In my opinion and in the UN Declaration on Human Rights access to information, access to speech, access to privacy are all guaranteed human rights," Oxblood Ruffin said this week. "So, you either believe in free speech, or you don't. You either believe in privacy, or you don't."
"Things like DDoSing, defacements, data theft, in broad strokes I don't subscribe to at all in liberal democracies. I don't agree with their tactics when they involve those things, but like many people I share their broader concerns," he said, referring to Anonymous' criticism of corporate control over the U.S. political and financial system, as well as support for the Arab Spring and uprisings in countries like Egypt, Tunisia, Libya, Syria, and elsewhere.
"When you abridge speech, when you abridge the First Amendment, people have died protecting these rights and all of a sudden we have a vigilante group deciding who can speak, and they are deciding who can access that speech," he added.
However, Oxblood Ruffin praised one operation that involved shutting down a Web site -- Operation Iran, in which hackers took down Web sites the regime was using to publish hit lists of protesters' photos for government supporters to target. "If you are saving life, then I don't have an issue with data theft or DDoS," he said.
He also said he strongly supports the use of social media such as Twitter and YouTube to promote human rights, a technique Anonymous has certainly mastered to positive effect. "That's a classic example of hacktivism," he said of Anonymous helping protesters organize and get around attempts at government censorship.
Electronic Disturbance Theater
Another long-time online political activist disagrees with the Oxblood Ruffin's criticism of Anonymous. Ricardo Dominguez, a co-founder of The Electronic Disturbance Theater (EDT) and associate professor of new media arts at the University of California in San Diego, said there are times when defacements and DDoS attacks are appropriate acts of electronic civil disobedience.
"The history of civil disobedience, with Gandhi, Martin Luther King Jr. and Henry David Thoreau, is one of blockage or trespass ... that disrupts the everyday flow of power," Dominguez said in an interview. "As a community, do we value information to such a degree that brief moments of disturbance" can not be tolerated even though they are designed for protest and to help right moral wrongs?
Formed by Dominguez and other artists and researchers in 1997, the EDT popularized the notion of DDoS for political protest and created FloodNet, one of the first tools designed to flood Web sites with so much traffic that they were temporarily crippled. They called their DDoS attacks "virtual sit-ins" and used the tool against Mexican government sites in solidarity with the Zapatista rebels in Chiapas, Mexico.
More recently, the group released the Transborder Immigrant Tool, which is a Motorola i455 cell phone with a Global Positioning System app that is designed to help people crossing the U.S.-Mexico border figure out their location and find water caches left by activists.
While Anonymous participants are anonymous out of necessity to avoid prosecution, the EDT members were committed to "radical transparency" and their online and offline personas were exposed, Dominguez said. But he can see why Anonymous hides behind their Guy Fawkes masks.
"The EDT understands there are political, government, and corporate spaces where one can not be transparent," he said. "Where any form of political protest, no matter how non-violent, will always be met with direct violence in some way."
Like the EDT, there is an offline component to Anonymous. Supporters have taken to the streets in protests against the Church of Scientology as part of Project Chanology in 2008 and in Occupy Wall Street demonstrations around the country last year. "I think Anonymous has been very effective, both as a network and as the emergence of a type of civil society and one that is extremely intimate with Net culture," Dominguez said.
Anonymous has also beefed up the firing power of its DDoS attacks compared with the early FloodNet tool, making such attacks easier to accomplish with automation. And Anonymous has been effective at recruiting supporters to lend their computers to the fire power.
'A qualitative difference'
It is this greater scale and anonymity of Anonymous operations that troubles Ron Deibert, who as director of The Citizen Lab at the Munk School of Global Affairs at the University of Toronto has been studying hacktivism for over a decade.
"With a physical sit-in, people are putting their lives on the line standing in front of a building. It's limited in scope and requires a physical commitment," he said. "Today, anyone with a $200 laptop can bring about a blockage, essentially silence a Web site into oblivion. There is no real physical risk to that, so it can be kind of frivolous. I think there's a qualitative difference between the two because of that."
There are times when it is acceptable to break the law, and those who participate in civil disobedience accept the risks, he said. "Whereas, online the ease with which anybody can create havoc and silence speech is much greater."
Deibert worries that stretching the definition of civil disobedience in this manner is prompting police and prosecutors to make criminals out of youngsters who don't understand the consequences of their actions. And he is concerned that the movement will ultimately lead to greater authoritarian control over the Internet and a diminishment of freedoms.
"I fear when the other shoe is going to drop," he said. "Among those of us who care about a free and open Internet, our attention needs to be focused on how we can restrain that type of behavior. When Anonymous attacks they play right into the hands of those who want to re-engineer the Internet because of security concerns."
Deibert agrees with the basic premise of Oxblood Ruffin's complaint, that shutting down Web sites of opponents is not viable protest.
"Impingement on free speech is not an appropriate form of political action in a democratic society," he said. "Hacktivism is a civic ethic that I think is integral to a liberal democratic society today, but with one caveat. I don't condone breaking the law."