We've noted the disturbing trend by the press and politicians to totally overreact or to pump up the actual impact and/or threat of various Anonymous hacking attacks. We've also noted multiple times that such attacks can be incredibly counterproductive -- and the press and politician backlash is part of what we're talking about. However, there is a real risk in continuing to overreact to Anonymous. The most extreme example, of course, was NSA boss General Keith Alexander insisting that Anonymous might hack power grids... while also noting that it had no actual ability to do so.

Yochai Benkler has a typically brilliant essay in Foreign Affair magazine explaining why overreacting to and misunderstanding Anonymous is ridiculous and dangerous:

Seeing Anonymous primarily as a cybersecurity threat is like analyzing the breadth of the antiwar movement and 1960s counterculture by focusing only on the Weathermen. Anonymous is not an organization. It is an idea, a zeitgeist, coupled with a set of social and technical practices. Diffuse and leaderless, its driving force is “lulz” -- irreverence, playfulness, and spectacle. It is also a protest movement, inspiring action both on and off the Internet, that seeks to contest the abuse of power by governments and corporations and promote transparency in politics and business. Just as the antiwar movement had its bomb-throwing radicals, online hacktivists organizing under the banner of Anonymous sometimes cross the boundaries of legitimate protest. But a fearful overreaction to Anonymous poses a greater threat to freedom of expression, creativity, and innovation than any threat posed by the disruptions themselves.

Benkler argues that if you look at Anonymous' actions in the "context of protest," you begin to realize that what they're doing is much more about political speech than any sort of "security" risk or terrorist threat. After detailing a bunch of hacks -- where they all had political messages of sort attached to them, Benkler notes:

The political nature of these targets demonstrates why it is patently wrong to see Anonymous purely as a cyberthreat. Opinions about the justifiability of any given attack may differ, either because of the target or because of its form. The main challenge becomes one of deciding who gets to set the boundaries of legitimate protest. If one unquestioningly accepts the validity of all U.S. government decisions, as well as the current distribution of power in the private sector, the pattern of Anonymous’ attacks seems unambiguously dangerous. But surely there must be a place for civil disobedience and protest that is sufficiently disruptive to rouse people from complacence. Viewing Anonymous purely as a matter of crime reduction or national security will lead governments to suppress it and ignore any countervailing considerations. A more appropriate, balanced response to Anonymous’ attacks would err on the side of absorbing damage and making the hacks’ targets resilient, rather than aggressively surveilling and prosecuting the network and its participants.

He notes that some of Anonymous' attacks appear to go over the line from protest to something more problematic, but most of them really are just forms of traditional protest. But the overreaction threatens to hinder all sorts of online protests and speech, which is a very dangerous precedent to set. Hopefully those insisting that Anonymous is pure evil can take the time to read Benkler's full article and reconsider their views.

While we're still sorting through the crazy cybersecurity bill proposals in the US, it appears that some in the EU are going through a similar process. The EU Parliament's "Civil Liberties Committee" has approved a legislative proposal concerning "cyber attacks," which appears to ramp up criminal penalties for all sorts of broadly defined activities. It even applies criminal penalties to a company if an employee hacks into a competitor's database (even if they weren't told to do it). But where it gets scary is when it appears to directly target "hactivism" like what Anonymous does. While we still think Anonymous' DDoS attacks are incredibly counterproductive, are they really criminal?

The Committee's proposals would make it a criminal offence to conduct cyber attacks on computer systems. Individuals would face at least two years in jail if served with the maximum penalty for the offence.

A maximum penalty of at least five years in jail could apply if "aggravating circumstances" or "considerable damage ... financial costs or loss of financial data" occurred, the Parliament said in a statement.

One aggravating circumstance in which the heavier penalty could be levied is if an individual uses 'botnet' tools "specifically designed for large-scale attacks". Considerable damage may be said to have occurred through the disruption of system services, according to plans disclosed by the Parliament.

Even more ridiculous? Merely "possessing... hacking software and tools" could lead to criminal charges. Does that make everyone with a computer a criminal? This whole thing seems like a bad overreaction by politicians who are freaked out, but who clearly don't understand the technology in question.

Interesting timing. Just about the same time that we had our story concerning how LulzSec kept its own site from getting hacked, the news was breaking that the key leaders of LulzSec were being arrested, in large part because the "leader" of the group had become an FBI informant after they tracked him down last year. Of the various hacking efforts out there, LulzSec has definitely been the most brazen, so it's not a huge surprise that it would be targeted by the FBI. Also, unlike "Anonymous," LulzSec was pretty clearly an effort by a few key individuals, rather than a loose collective of folks joining and leaving at will.

As I've been saying since these various groups started their various hacking and vandalism campaigns, I think these efforts are a really bad idea, and don't do much to further the supposed causes that they're trying to support. They're only going to lead to backlash, as we're already seeing in government officials using these groups as an excuse to try to make a power grab over the wider internet.

Given that, as I've said in the past, I haven't been surprised to see the various arrests of folks supposedly associated with Anonymous or LulzSec. I expect that we'll continue to hear such stories -- in part because these kinds of stories are likely to provoke more of the same type of activity. Law enforcement keeps claiming that these arrests will frighten off others, but that shows a typical lack of understanding of what's going on. As counterproductive as these activities are, it's pretty clear that this isn't about criminal activity for the sake of criminal activity, but about dissatisfaction with what's going on in the world -- and, as such, the arrests are actually only likely to create more such activity, which is the exact opposite of what law enforcement should be seeking to do.

Not understanding who they're dealing with, and taking a top down approach to a bottom up threat, seems to be a specialty of US law enforcement.

Again, I think that the actual efforts by these folks are incredibly counterproductive and set up this "battle-siege" mentality, when the folks involved in all of this could be much more strategic in using their skills for good, rather than destruction. But that doesn't mean that we should ignore the reality of why it's happening, or how it's likely to continue to evolve. More groups will pop up, more hacks will happen and (I'm sure) more disaffected skilled computer hackers will be arrested. But none of that (either the hacking or the arrests) is likely to bring us any closer to actually dealing with the problems that created this mentality in the first place.

It's not like this wasn't easily predictable, but as the entertainment industry has "succeeded" in taking down Megaupload and continues to move against The Pirate Bay and others, anyone who's followed this space had to have known that file sharing would just move one step further underground. We've seen the same thing after every single "victory" against file sharing since Napster was shut down. Each time, it moves to a system slightly more underground and more distributed. The early ones were still easy to take down but as they get further underground, it just becomes worse for the industry (and makes it that much harder to win back those users). The latest news is that there's been massive uptake of a growing number of anonymous, decentralized file-sharing tools. As is pretty typical in these "shift" periods, it's still not clear which systems will "win" out over the others, but the leaders are starting to emerge. The Torrentfreak article above mentions players like Tribler and RetroShare. People in our comments have been discussing both, as well as Ares Galaxy. Who knows if any of these apps are actually any good, but it seems pretty clear that people are continuing to file share -- they're just finding ways to do so that are even harder to track down and stop. How long until the legacy entertainment industry starts publishing articles about these evil anonymous, decentralized file sharing systems and demanding new laws against them?

The fight to ramp up the fear mongering over cybersecurity has reached new and even more ridiculous levels -- in which an "anonymous" government source claims (without quotations) that the head of the NSA, Gen. Keith Alexander, recently briefed the White House claiming that the non-group Anonymous might be able to mount a cyberattack to take down parts of the power grid. The dubious sourcing already makes the story suspect, and without more context, the whole thing seems silly -- especially given that anyone who actually has any inkling of how Anonymous actually functions would question why it would ever seek to shut down a power grid. Anonymous tends to do things either for fun (i.e., for "the lulz") or (more frequently) out of a more vigilante sense of justice (sometimes misguided, but usually well meaning). The attacks are pretty carefully focused on causing temporary inconveniences, rather than lasting damage, as a sign of protest, or on revealing secret info that it feels deserves a wider airing. Attacking the power grid fits with exactly none of that -- a point that Anonymous itself made in response to this claim:

Why would Anons shut off a power grid? There are ppl on life support / other vital services that rely on it. Try again NSA. #FearMongering

But, even more to the point, the WSJ piece is so ridiculous that it's hard not to laugh when you read the following part:

A stateless group like Anonymous doesn’t yet have that capability, officials say. But if the group’s members around the world developed or acquired it, an attack on the power grid would become far more likely, according to cybersecurity experts.

I think Jerry Brito summed this up perfectly by saying:

Shorter version: Anonymous doesn’t have the power to attack the grid, but if they were able to get it someday, then they would have it. Got it.

You could go even further. I mean, why not just start listing out other hypotheticals using those ridiculous two sentences as a basis. I'll start:

• That baseball player doesn't yet have the capability to hit a baseball thrown by a pitcher, officials say. But, if he somehow developed or acquired it, his likelihood of being able to play baseball effectively would become far more likely, according to sports experts.
• An infant doesn't yet have the capability to drive, officials say. But, if toddlers around the world develop or acquire it, automobile accidents would become far more likely, according to automotive experts.
• Prisoners don't yet have the capability to shoot each other, officials say. But, if inmates around the world developed or acquired it, gunfights in prison would become far more likely, according to anger management experts.
• Techdirt readers don't yet have the capability to make clueless government officials get transferred to jobs washing toilets, officials say. But, if the community there develops or acquires it, dumb politicians being out of work would become far more likely, according to political pundits.

In what journalistic world is it okay to write something where the entire point of the article is to fear monger about a group having a certain power, and then brush aside the fact that it doesn't have that power... and appears to have no interest or possibility of obtaining that power... but then saying, "boy, if it did have that power, that would be dangerous!" None of the hypotheticals make any sense if there's no info on the interest or likelihood of the group in acquiring or using such capabilities. There is some speculation, based solely on Anonymous' (kinda stupid) idea to try to take down the entire internet to make a statement next month, that the group is moving in "this direction," but it still seems pretty silly.

Furthermore, you have to get 10 whole paragraphs down in the article, before it's mentioned that there really isn't any real "cyberthreat" to the power grid. It seems like that sort of information belongs at the top of the article, along with a message about how the rest of the article is fear mongering about stuff that really isn't likely to happen.

Well, this is rather incredible. With the news that Anonymous hacked the offices of the Syrian President and dumped a ton of emails online... comes the news that the hack was insanely easy. Why? Because, apparently, the password was 12345. No joke. Of course, that's considered one of the worst passwords of all time. And, as pointed out by Lauren Weinstein, this is the exact same password that was immortalized by Dark Helmet (the original one, rather than our local Techdirt hero) as being the stupidest password he's ever heard -- and the "kind of thing an idiot would have on his luggage!"

We recently pointed out that a bunch of Polish politicians wore Guy Fawkes/Anonymous masks in Parliament to protest ACTA: It appears that some politicians in Bulgaria thought that was a good idea, and have done the same thing: It's really quite fascinating how much of a meme this has become within politics. While some still like to pretend that Anonymous is just a bunch of vandalizing kids, it certainly seems that some of what Anonymous stands for is having a real impact. I still think that the DDoS attacks are dumb and do more harm than good, but it's quite fascinating to see the wider ideas of what Anonymous is fighting for percolate all the way up into politics around the globe.

There's been lots of talk today about how various EU governments are agreeing to sign ACTA (which still needs to be ratified by the EU Parliament). It's gotten the most attention in Poland, where there were mass protests -- but the government there still signed. Of course, not everyone in the Polish government agreed. Amazingly, officials from the Palikot's Movement held up the famed Guy Fawkes/Anonymous masks in Parliament to protest the vote: Of course, we should note that, from the picture, it sure looks like those masks are "counterfeit" copies of the official Guy Fawkes mask that Time Warner holds the rights to. Good thing ACTA is coming into force to stop such blatant "counterfeiting," huh?

I've been on record for a while now that I think the strategy of doing DDoS attacks on websites that people don't like is a bad idea, that will lead to backlash. Though, I will admit that I underestimated their effectiveness in some cases. Indeed, even as the Anonymous DDoS attacks on various targets in response to the Megaupload takedown is getting a ton of attention, I'm still convinced it's a bad idea long-term. I should be clear that I understand the response. Also, the response is not a surprise. If we've learned anything over the last few months, it's that large segments of the internet are exceptionally frustrated with attempts to censor speech online -- and when you get that many people frustrated, and then poke them in the eye with a big stick, it's not a surprise that they might react.

Over at News.com, Molly Wood is suggesting that DOJ did this all on purpose -- including the timing of the release -- in order to provoke just such a response. This serves multiple purposes for the government. It gives them the chance to make the (obviously bogus and laughable) argument that the wider protests were done by this same group. But, it also gives DOJ and law enforcement the chance to go even further, and use this as an excuse to crack down online and put people in jail. It also gives a (again, bogus) reason to pass far-reaching cybersecurity legislation. The end result could be a lot worse.

Supporters of these actions may claim that it's the only way to be heard. But I'm not convinced that's true. What happened Wednesday showed that there are ways to be heard without resorting to tactics that can be described as vandalism. I don't think it's fair to call it vandalism -- as I've said that I believe that such actions are a lot more like a digital sit-in. But I'm just not sure it's productive. I'm sure it feels good to vent... but the end result may not be productive at all.

I'm really beginning to wonder about the MPAA's PR people and their near total inability to think through how their statements will be perceived. It's put out a response to the DDoS attacks from Anonymous by trying to "take back" the moral high ground on the free speech issue. Yes, they're claiming that the DDoS is a free speech violation and then wrap themselves in the First Amendment:

Unfortunately, some groups believe that speech or ideas that they disagree with should be silenced. This could not be more wrong. No matter the point of view, everyone has a right to be heard.

The motion picture and television industry has always been a strong supporter of free speech. We strongly condemn any attempts to silence any groups or individuals.

The Internet is home to creativity, innovation and free speech. We want to keep it that way. Protecting copyrights and protecting free speech go hand in hand."

Ok. So then you condemn SOPA and PIPA, right? Since those are attempts to silence people. But here's the thing: "free speech" issues are about government censorship. Such as passing a bad law that allows the government to take down websites. Having some people protest you may be annoying, but it's not a free speech issue (other than, perhaps, in arguing the protesters' rights to free speech. Trying to regain the high ground on this issue is pretty transparently ridiculous by the MPAA -- and simply calls much more attention to who's actually trying to stifle free speech by passing bad laws that allow for censorship.