Robin Hood Digital Wars: Is This Only The Start?

London, UK - 1st October 2010, 07:30 GMT

Dear ATCA Open & Philanthropia Friends

[Please note that the views presented by individual contributors are not necessarily representative of the views of ATCA, which is neutral. ATCA conducts collective Socratic dialogue on global opportunities and threats.]

The Robin Hood digital attacks against anti-piracy law firms and copyright-focused associations have gone on for nearly two weeks now, with a number of prominent groups involved. The protest organisers, dubbing themselves "Anonymous," have been calling on like-minded individuals through social networking sites 4chan, Reddit, Digg and Twitter to launch Distributed Denial of Service -- DDoS -- attacks against a number of media authorities involved in anti-piracy actions. Recruiting fliers -- as pictured -- have been posted all around the world in multiple languages. Thousands of online people from all around the world have been encouraged to join in, stand up, and digitally attack the anti-piracy lobby.

"Anonymous" Flyer

Dubbed "Operation Payback," the cyber protest by "Anonymous" began about two weeks ago in response to the decision by the Recording Industry Association of America (RIAA) and Motion Picture Association of America (MPAA) to contract with an Indian IT company "AiPlex Software" to shut down free file-sharing peer-to-peer hubs such as The Pirate Bay. "Operation Payback" was provoked by a preliminary digital attack carried out by the Indian firm against file sharing sites, causing the organisers of "Anonymous" to lose their balance in anger.

The online activists want to punish the legal agencies and their corporate sponsors who support the anti-piracy lobby for their aggressive assault on illegal file sharers. Some law firms have been sending out letters for over a year to online users they believed were guilty of accessing illegal peer-to-peer sites to download copyright material including music, video and movie files. Some law firms have been demanding excessive payments of between USD 750 and USD 1,000 per offence, ie, per file download, from individual citizens and organisations under the threat of court action.

Worldwide Targets

As a result, 'Operation Payback' DDoS attacks are now manifest across the globe from North America to Europe and from Asia to Australia. The hacktivists, have already attacked a number of high-profile trade organisations and law firms involved in promoting action against illegal file sharers, including:

. Motion Picture Association of America - MPAA (US);
. Recording Industry Association of America - RIAA (US);
. British Phonographic Institute - BPI (UK);
. The Australian Federation Against Copyright Theft - AFACT (Australia);
. Protection Rights Entertainment Industry Netherlands or Stichting Bescherming Rechten Entertainment Industrie Nederland - BREIN (Netherlands);
. Law firms behind the 'US Copyright Group' (US);
. Law firms involved in anti-piracy lobbies and financial extraction campaigns (Worldwide);
. AiPlex Software (India); and
. Websheriff - Web policing company (UK).

This list of targets could expand further as "Anonymous" garner further support from online vigilantes. Yet more music, video and movie groups as well as law firms could be targeted.

Time-Frame

The "Anonymous" Internet users behind "Operation Payback" aren't done yet. One of the "Anonymous" organizers has said, "There is no timeframe (for the attacks). We will keep going until we stop being angry." Given the list of issues that make the so called Robin Hood digital attackers angry, this could take a while.

Who Is Behind The Attacks?

The organisers of "Operation Payback" view themselves as anarchists with a strong moral streak. In their initial attack announcement, they claimed that anarchists had already "succeeded en-masse in distributing content to the poor, the underprivileged, the restricted." As the attackers themselves state, the most popular pirates are the Chinese, whose content filters restrict a vast amount of international content from them. The second most popular, are the global society's poor, who cannot genuinely or otherwise afford to pay for expensive digital books, music, video and movie entertainment.

These self-styled digital Robin Hoods are "strongly motivated to do what [they] can to fight back against things which are morally questionable," which means that they are now launching DDoS attacks in favour of piracy. "Sharing information" is the new morality. "Information" in this case apparently includes video, film and music tracks.

"Operation Payback" is possibly associated with the rage of those who seek more attention. "What do we have to do to be heard?" asks the original call to action. "To be taken seriously? Do we have to take to the streets, throwing Molotovs, raiding offices of those we oppose? Realize, you are forcing our hand by ignoring us. You forced us to DDoS when you ignored the people, ATTACKED the people, LIED TO THE PEOPLE! You are forcing us to take more drastic action as you ignore us, THE PEOPLE, now." (sic)

The core group of "Anonymous" hacktivists have probably been joined by those who seek to engage in periodic establishment bashing similar to the "G8 protestors". To add to the noxious digital mix, there is also the potential intervention of the black bloc that is usually looking to cause havoc for havoc's sake. The rage will apparently continue until the perpetrators feel less angry about the "rich and powerful corporations" who run the world. "In a world where our voice is ignored, we feel we have no choice but to revert to direct action." Or, as an attack organizer put it last week, "We are seeking to change our way of life OUTSIDE the 'basement' we are trapped in. This is just the beginning. This is only the start!" [Source: Excerpts from dialogue with "Anonymous" by security groups and cyberspace released before and during "Operation Payback" digital attacks.]

Technical Prowess

There is a core contingent of networking site users, especially at 4chan, who are technically -- although perhaps not morally -- adept. They are exploiting the huge following that 4chan has to orchestrate the DDoS digital attacks. In this specific case, someone -- perhaps a 4chan user -- has written Low Orbit Ion Cannon or LOIC and posted it to SourceForge.net, where other users download the malware and make synchronised DDoS attacks on command, targeting media authorities engaged in the anti-piracy lobby.

Case of ACS:Law

One of the smaller UK law firm sites -- ACS:Law also known as the 'P2P settlement letter factory' -- actually yielded the biggest bounty in the recent Robin Hood digital attacks. The webserver crashed under the load and reset to a default configuration, which allowed browsing of files on the webserver. As a result, 365 megabytes (MB) of private emails -- as well as email demand letters written by the firm's boss Andrew Crossley -- were leaked online and are now spreading out across the world. Credit card information on suspected offenders was also surrendered. BT, Sky and O2 had sent ACS:Law the evidence it needed to threaten offenders, such as computer IP addresses and the time window the users of those IP addresses were supposedly breaching copyright. Some ISPs had refused to co-operate with ACS:Law, such as TalkTalk and Virgin Media.

UK Official Response

The Information Commissioner's Office (ICO) in the UK is considering whether to take action against ACS:Law, as opposed to the "Anonymous" digital attackers, because the sensitive user data was not secured appropriately. New powers awarded to the ICO in April this year, mean that the watchdog could fine ACS:Law up to half a million British pounds (USD 750,000+).

Important Questions

"Operation Payback" DDoS attacks raise important questions over whether the imminent implementation of the Digital Economy Act in countries such as the UK and “Three Strikes” legislation in the EU could threaten the security of the internet and people's data. The UK Act, amongst others in the developed world, outlines obligations for Internet Service Providers (ISPs) to monitor illegal file-sharing activities closely, and notify web users who download illegal content that legal action may be taken. Until now chief concerns have focused on the cost of implementing this legislation and on whether curbing people's internet freedoms can be justified. But the latest DDoS attacks have flagged up a need to address the potential security issues surrounding the legislation. Experts argue that the increasing amount of customer data that will be collected because of the Digital Economy Act means that the security practices of law firms and ISPs need to be closely monitored. DDoS attacks against law firms or ISPs could easily increase with the introduction of the Digital Economy Act if the necessary security precautions are not in place. The Information Commissioner's Office -- ICO -- may also take strong action to warn other law firms considering working with the Digital Economy Act to adequately protect customer data. In the USA, a new bill has been proposed that could allow the USA to force top level registrars such as ICANN and Nominet to shut down websites, all with no fair trial.

Conclusion

It is easier to secure the law firms and ISPs than prosecute message boards such as 4chan and social networking sites such as Reddit, Digg and Twitter because it is not possible to enforce national versions of the UK's Computer Misuse Act and the Data Protection Act against trans-national internet activists outside any particular sovereign's jurisdiction. A combination of secure cloud hosting infrastructure and active management techniques can dramatically reduce the potential impact of DDoS for thousands of affected businesses.

Trying to trace down individual users causing the DDoS is fraught since botnets -- malware infected home and office computers or "Zombies" -- are being mobilised. The affected users could quite legitimately claim that their machines were infected with malware and were used to launch DDoS attacks without their knowledge or permission. Welcome to Robin Hood digital wars: Is this only the start?

[ENDS]

We welcome your thoughts, observations and views. To reflect further on this subject and others, please respond within Twitter, Facebook and LinkedIn's ATCA Open and related discussion platform of HQR. Should you wish to connect directly with real time Twitter feeds, please click as appropriate:

. ATCA Open

. @G140

. mi2g Intelligence Unit

. Open HQR

. DK Matai

Best wishes