One of the big stories of yesterday was the wide array of raids and arrests by the FBI in order to arrest people they claimed were members of "Anonymous," who took part in various denial of service attacks. All day yesterday the number of people arrested kept growing. I first saw three, then 12 and the final tally was apparently 16
. Apparently the arrests are specific to the efforts to take down Paypal after Paypal decided to stop letting payment transfers go to Wikileaks. The specific charges are "intentional damage to a protected computer" and conspiracy.
Now, I've been very clear since Anonymous started this effort -- shutting down various websites using what is effectively crowdsourced distributed denial of service attacks -- that I think the strategy is really dumb
. Does it get attention? Yes. But it turns parties doing questionable things into victims. It doesn't open any new eyes to the problems Anonymous should be trying to highlight. It just draws attention to the attacks themselves. It just seemed really likely to backfire -- especially as law enforcement and politicians focused in on the attacks, rather than the reasons for the attacks, and we're seeing some of that now.
But I can't deny that their efforts, combined with the slightly more sophisticated hacking efforts both from Anonymous and the spinoff group LulzSec and others, have actually had a much greater impact
than I expected, especially with things like the hacking of HBGary and the release of ACS:Law files. As I noted last month when a bunch of people were arrested
in Europe with claims that they were members of Anonymous, it's not clear to me that these arrests will have much of an impact, really. Will it scare off some random kid from becoming a scriptkiddie? Maybe at the margin there will be some. But the thing is, the types of folks who get involved with these things tend to overestimate their own abilities, and dramatically underestimate the likelihood of getting tracked down or caught.
And given the very distributed nature of the group (i.e., that it's not actually a group at all), it kind of makes you wonder if the arrests will only serve to get more folks jumping into the effort, perhaps for increasingly misguided reasons. As we've stated, governments and law enforcement seem to be taking a top-down approach to this, as if they were rounding up a criminal gang, not recognizing the distributed nature of this effort and how the focus is not criminal
, but ideological. Arresting people just drives home their general fear of a world in which certain entities have too much power, leading more people to hit back.
I still don't think their strategy is smart. And I don't think it'll really create lasting positive change (in fact, the backlash could do the opposite). I also worry quite a bit about what happens when they suddenly rage against an innocent party or a group or an individual who really doesn't deserve their wrath. But, at the same time, I can't see how a big FBI crackdown does anything positive, either. It just serves to reinforce their general point. And, with something like the DDoS on Paypal, it seems a bit ridiculous to suggest that it really created that much "harm." It was, as many noted, a modern version of the sit-in
. Yes, it probably was a nuisance and cost some people money, but it lasted for a short while and it's difficult to argue there was any lasting damage.
Defenders of law and order will insist "something" needed to be done, and will believe that these arrests will scare off people from the next round of attacks. I think those people are greatly underestimating how people who feel disenfranchised by the world, but sense power through their internet connection, react in such situations. Punishment for the sake of punishment may make sense to some people, but I prefer that the focus be on actually getting to the root of the problem, rather than trying to attack the symptoms in a way that makes the cause grow bigger.