In a scene reminiscent of a thousand police dramas, the FBI arrived at the door of 19 year old Mercedes Haefer, guns drawn, at 6am whilst she was still in her pyjamas getting ready for work.
In a scene reminiscent of a thousand police dramas, the FBI arrived at the door of 19 year old Mercedes Haefer, guns drawn, at 6am whilst she was still in her pyjamas getting ready for work. The warrant stated that they were looking for anything associated with hacking, infiltrating or Distributed Denial of Service attacks (DDoS).
Oh, and they were looking for a Guy Fawkes mask – evidence that would link Mercedes with the hacker group Anonymous and in particular, Operation Payback.
Operation Payback had seen DDoS attacks on a number of companies and in particular PayPal. Anonymous claimed the attacks as retribution for these companies decision to withdraw payment facilities from Wikileaks.
The FBI already knew that Mercedes Haefer was associated with Anonymous through her involvement on the Anonymous IRC channels where she was known as “No”. She denied having taken part directly in any of the DDOS attacks on PayPal.
In July 2011, Mercedes was indicted along with 13 others on two charges of causing damage against PayPal’s computers, charges that carry a maximum penalty of 15 years in jail and a fine of $500,000. An additional 2 others were charged separately.
Mercedes Haefer is enrolled in a journalism and media pre-major course at the Universlty of Nevada and Las Vegas. Commenting on Mercedes Haeffer, the director of the Hank Greenspun School of Journalism and Media, Professor Stout said “We don’t condone unethical behavior that results in the harm of the audience” and further, that if Mercedes had continued her studies she would have taken courses that ultimately produce journalists with a strong sense of ethics (Mercedes Haefer is still enrolled at UNLV and Professor Stout has moderated his comments).
The observations of Professor Stout were not surprising. Despite only a superficial understanding of what a DDoS attack comprises and despite the fact that she had not been tried, he was ready to brand the act and Mercedes Haefer as criminal and unethical.
In an examination of the ethics of DDoS attacks, Gabriella Coleman, a Socio-Cultural Anthropologist of NY University makes a distinction between criminal acts such as hacking and the possibility of regarding DDoS as the digital equivalent of an occupation or “sit-in”. In cases of a sit-in, the aim may have included being arrested to further draw attention to their cause. It is not clear that any of the Anons were anticipating being arrested.
The indictment used for the Anonymous 16 includes the charge of intentional damage to a computer. A DDoS works by sending repeated requests to a web site very quickly, exhausting resources and blocking access to regular users. In the grand scheme of hacks, DDoS is a nuisance but not a major threat to a company unlike loosing the details of user accounts and passwords. This was a view shared by Deputy Assistant FBI Director Steven Chabinski:
“There has not been a large-scale trend toward using hacking to actually destroy websites, [but] that could be appealing to both criminals or terrorists,” Chabinsky said. “That’s where the ‘hacktivism,’ even if currently viewed by some as a nuisance, shows the potential to be destabilizing.”
Leaving aside the consideration of whether the DDoS attacks themselves are ethical, the charge that Anons lack a sense of ethics, as laid by the UNLV academic and others, seems even less certain. If anything, it is the Anons sense of righting the wrongs of corporations and governments that underpins most of their activities.
Mercedes Haefer cited that she became interested in the activities of Anonymous in part because of a sense of injustice at inappropriate punishment for a woman accused of distributing 24 songs. She was referring to the $2m fine imposed on Jammie Thomas-Rasset for sharing music although this was later reduced to a $54,000 fine.
The case of Mercedes Haefer is interestingly contrasted by that of another female 16 year old from France who claimed the hack of the Bay Area Rapid Transport Police Officers Association in August of this year. As a result, she released the personal details of 100 officers. Going under the handle of “Lamaline_5mg” she claimed this was her first hack, that she had little experience and had simply picked up enough information to hack the site in under 4 hours. Her motivation for engaging in “hacktivism” were the killings of 3 people by BART security police over a period of 3 years. A story she changed slightly when talking to another blogger.
Whereas Mercedes Haefer claimed no technical knowledge, Lamaline was technically savvy enough to use techniques to hide her tracks making her claims to technical naivety slightly suspect. Interestingly, she had not associated herself with Anonymous and in fact some people on an Anonymous chat room had condemned the attack as irresponsible.
A confounding factor in the actions of Anons is the relatively low barrier to entry to participation. A simple search of the internet will provide links to download software to enable the participation in a DDoS. The software, such as the LOIC (Low Orbit Ion Cannon) is simple to use and takes no technical expertise. There are videos readily accessible that demonstrate their use.
Anyone can go onto the Anonymous IRC channel and listen in. You can follow the activities of Anonymous and others on Twitter.
Accompanying this ease of access is the separation of actions and consequence that is encapsulated in using DDoS software. Unsophisticated users would potentially lack the understanding of traceability of their actions.
The fact the FBI had little trouble in rounding up the 14 suspects being tried together in the DDoS attacks is more a testament to the ease of tracing individuals than a reflection of the technical abilities of the FBI.
Their single unifying feature of those arrested in connection with Operation Payback, is their young age, given most of those charged are in their twenties.
The reaction against Anonymous of the general public, lawmakers and security specialists comes across almost as a generational conflict.
This is epitomised by Haefer having to leave her father’s home because he supposedly viewed his daughter (in Haefer’s words) as “a terrorist”.
And Haefer? She still believes in the positive things that Anonymous is doing and is looking forward to making that known, without a mask, at her day in court.
Photo Credits: Alatryste