Cognitive Dissidents

Building a Better Anonymous – Philosophy

By Josh Corman & Brian Martin

2012

If you are new to this series, please begin with Part 0 and the index.

NOTE: We will post each installment here for the security industry to garner feedback for about one week prior to posting to Forbes.com and a more mainstream and business readership. Please comment toward improving/clarifying the content.

Acknowledgements

Today, Anonymous is both an identity / meme and a “group” / organizational construct (albeit amorphous and decentralized). The focus below is not to enhance or augment the identity / meme, but rather the latter. Adopting such enhancements will involve trade-offs – as everything does. The authors believe many of the current Anons (or would-be-anons) yearn for a larger impact, a better batting average, and to mitigate several complications inherent in the current approach (some of which were explored in Part 4).

When we define a “better anonymous” we realize that this may apply to as few as zero of its current participants. It is entirely possible that such an instantiation could emerge in ten years or with people currently unwilling to join the existing ranks. If it helps the reader, picture this “better Anonymous” under a different name, taking place five years from now, and sharing no members with current manifestations. While we do believe these refinements and enhancements can and would be of benefit to today’s manifestation(s) of Anonymous, this is immaterial to the following points.

Since no one “owns” Anonymous, and since its ranks are so diverse in ideology and motivational structures, it is best to judge the following ideas on their own merits – rather than expressing personal preference (positive or negative) for what the increasingly ill-fitting “they” would or wouldn’t like. Some of them will agree – some will be indifferent – and some will find these concepts detestable.

For these reasons (and others), we also expect the possibility of plural groups over time – with plural charters. Put another way, this installment may be less about building a replacement for Anonymous, but rather – “building better Anonymi” – especially where ideological and topical schisms reveal themselves.

Laying a New Foundation

In Leviathan, the philosopher Thomas Hobbes described the state of nature as a state of war. Paraphrasing slightly:

The state of nature is a state of war… “and the life of man, solitary, poor, nasty, brutish, and short”.

In contrast, John Locke considered the state of nature to be a state of inconvenience and inefficiency. Where they agreed is that out of rational selfish-interest, people must form social contracts to escape the limits of the state of nature.

To date, Anonymous has enjoyed its more chaotic lack of structure, openness, low barrier to entry, and other features. The downside of this has been an upper bounds of effectiveness, a lower batting average, a muddied focus, “brand damage”, arrests – and even catalyzing escalation with law enforcement, legislators, and other forces of “control”. As we’ve said, if not careful, Anonymous could help cause the very things they fear/oppose.

The authors believe that the current state is either untenable or of limited impact in the long run. To this we offer the following “three steps” as a straw man of “organized chaos” for consideration and dialectic, or debate. We argue that such an approach would, on the whole, improve the impact and mitigate several current challenges.

1. Statement of belief, values, objectives, and first principles – i.e. WHY you have come together
2. Code of conduct and operational parameters – i.e. HOW you conduct your pursuit of your common goals
3. A plan for streamlining success, increasing potency, and mitigating risks – i.e. WHAT will make you more successful

We will outline these three below for those who see themselves as “Chaotic Good” – as a sample use case. We will then directly link how such a system would mitigate several of today’s Anonymous challenges identified in Part 4.

#1: Statement of beliefs, values, objectives, and first principles (WHY)

To repeat, a mentor once told me:

“If you believe something, you should write it down. The more important the belief, the more critical it is that you are precise and clear in its articulation.”

Core to any meaningful group or endeavor is your purpose. Why have you come together? What are your beliefs? What are your values? What do you hope to change? What are your essential “first principles”?

For Martin Luther, it was nailing his 95 Theses to the Castle Church – sparking the Protestant Reformation to separate from what he saw as an increasingly corrupt Catholic Church. For Martin Luther King, Jr., this was the vision expressed in “I have a dream“.

It is a common purpose that binds movements together. Ad hoc bonds can be weaker bonds, but bonds formed in shared values and shared beliefs are not as easily broken. Commitment to shared purpose and objectives can serve to strengthen the resolve, staying power, and impact of those involved.

Historically, Anonymous has been ambiguous about what it stands for. Sure, there have been some more dominant themes but… too many of them. This has lead to a sort of stimulus diffusion in which ideas have been passed between people, but without the blueprint or foundation. Such diffusion can lead to an idea being refined and improved upon, or misunderstood and re-built as a hideous form of the original.

When everything is important, nothing is. Zen wisdom tells us, “He who chases two rabbits catches neither”. To reach critical mass, perhaps Anonymous needs a period of “valuable ambiguity”. To overcome its current limitations, smaller splinters may need to rally around fewer objectives, better. These splinters may not be instead of the “general population” of Anonymous, but for greater impact with less collateral damage and backlash; it may prove to be a logical necessity. For some, this personal recognition has already come. Such splinter groups may also serve another purpose; by focusing on more specific goals, the personal desires and reasons for involvement of each member are more likely to be met.

Here are some lines that a “Chaotic Good” group who cared about free speech and anti-censorship might hold:

• We believe in free speech for all.
• We reject attempts to control or limit free speech online.
• We aim to be a watchdog for the citizens of the net; to identify, expose, and rally resistance to legislation and special interests, which threaten these rights.
• We believe free speech applies to everyone – especially when we do not agree with it.
• When governments take access from their people, we will help to re-supply them with alternative access and vehicles to these basic rights.

Benefits of writing down why your group exists are numerous. First, you will attract more like-valued, and potentially more talented members. These beliefs will be the foundation of any brand to the rest of the world. It will give the group focus in the short term, and as time moves on it will give you the backbone to resist mission drift and spreading yourselves too thin. It is also your primary defense against the brand damage of False Flag operations done in your name. Further, such segmentation can insulate the group from any harm done by less aligned (and maybe less noble) members of the currently shared melting pot, general population of “Anonymous”.

When choosing your foundational beliefs and values, choose wisely.

#2: Code of conduct and operational parameters (HOW)

A “code” is not new to groups. For example, there is the bushido code way of samurai, honor among thieves, the pirate code (more what you’d call “guidelines” than actual rules)… and countless others that dominate both history and popular culture.

The hitman/cleaner in “Léon: The Professional” had a rule; “No women. No kids.”

In Fight Club: “The 1st rule of Fight Club is, do not talk about Fight Club”.

In The Transporter, “Rule #3: Never open the package.”

A code of conduct and explicit statement of operational parameters has benefits. Building upon the prior foundation of your statement of beliefs, your defined “how” will both attract like valued participants – and repel the opposite. Such statements will help to win the court of public opinion, both in establishing your “brand” and in defending it from pretenders and False Flags. Infiltrators would be more constrained to these narrower methods and False Flags would look anomalous in contrast.

A “code of conduct” actually has precedent within Anonymous. In fact, this may have been the origin of donning the Guy Fawkes mask. During the Project Chanology planning to take to the streets against the Church of Scientology, a video was posted outlining the code of conduct. Rule #17 was to cover your face to protect your identity. It just so happened that the visage from V for Vendetta was available and “top of mind”. Here are some lines that a “Chaotic Good” group who cared about free speech and anti-censorship might hold:

• In all actions, we must take great care to prevent collateral damage – or to hurt innocents.
• In our pursuit to promote free speech, it is critical that we do not impinge upon the free speech of others – even when we disagree with them.
• We will conduct our operations within the bounds of the law, leveraging FOIA and open source information.
• Much like Rosa Parks did as a last resort, and in rare cases, where transgression is required and righteous, it must be supported by our statement of beliefs and part of a pre-defined path of escalation.
• We will NEVER {INSERT SCENARIO HERE}.

For readers that have played MMORPGs such as World of Warcraft, you may recall the frequent statement from Blizzard Entertainment; “No Blizzard employee will EVER ask you for your password.” Note the utility of such an explicit, absolute statement. By making it, gamers can immediately spot imposters. Therefore, such statements can serve to mitigate some of the risk of False Flag operations and unsanctioned, brand damaging attacks done “in the name” of the more principled group.

One of the first examples of defining a code of conduct in “Hacktivism” activities can be found in a paper presented to Yale Law School by 0xblood Ruffin of the Cult of the Dead Cow (cDc) entitled “Hacktivism, From Here to There“; in which he states:

I began to formulate some hard and fast rules for hacktivist tactics. First, no Web defacements. If groups or individuals are lawfully entitled to publish content on the Web, any violation of their right to distribute information is an abridgement of their First Amendment [freedom of expression] rights. The same goes for Denial of Service (DoS) attacks.

While groups like the Electronic Disturbance Theatre (EDT) disagree about DoS, they simply wouldn’t join 0xblood or Hacktivismo due to a difference in ideology. Maintaining a code and mission statement may be, at times, prohibitive to gaining wide support, but honesty and integrity are important, even to an organization who must resort to criminal acts to achieve their goals at times.

#3: A plan for streamlining success, increasing potency, and mitigating risks (WHAT)

What will be the difference makers and secrets to greater impact? Here we will consider a few. For example, it is often smarter to do fewer things, better. Will your actions make you look like a BadAss or a DumbAss? How you are viewed in the court of public opinion can be a major success factor. Knowing what your want and stand for is critical, but remember: A goal without a plan is called a wish.

Less is More

As we’ve suggested, it is ideal to do fewer things better. Would you rather have a superficial impact on ten fronts, or a meaningful impact on one front? The very things that “need fixing” are almost by definition “non-trivial”. If something is worth doing, it is worth doing well. If there are more ills to right, this simply may require more teams. Focusing on fewer fronts also allows more time and attention to be spent on each front. This would benefit operations that publish or leak information for example; rather than dumping gigabytes of information, time could be spent to pull out key pieces of interest.

Unlocking Your Inner BadAss

Another important factor is your potency and prowess. What’s more impressive to onlookers and adversaries, a fool shooting wildly – missing all targets? Or a sniper who makes every single bullet count; “One Shot. One Kill”. When a swordsman first takes up his blade, they may flail wildly and wastefully, but a master is more deliberate and deadly – with each stroke delivering the full impact of its intention. The true master may seldom need to draw his sword. While 2011 saw many Anonymous operations, there were several misses and/or mis-steps. Imagine instead a more potent group who seldom (if ever) misses and rejects more ops, for a better op – one that hits its targets without collateral damage. A pyro-maniac will torch everything – a pyro-technician will design and execute a targeted and effective “controlled burn“. An amateur will amputate, but the skilled surgeon will remove the tumor with precision.

Measure Twice, Cut Once

Toward that end, a more potent group would do more strategizing and prep-work. When you’re taught carpentry or wood-working, most of us are equipped with the wisdom of “measure twice, cut once”. Preparation helps to avoid mistakes. Fewer mistakes conserves limited resources and helps to promote / preserve a more BadAss image to your supporters and adversaries. During the StratFor hacks in December of 2011, many criticized the “steal $1 million to give to charities” aspect of the operation – as disingenuous or naïve. Those charities did not get to keep the money, nor was that ever a possibility. Such visible/perceived mis-steps only hurt the groups brand in the court of public opinion – and are avoidable with better planning on fewer operations. For other operations, why risk arrest and incarceration to steal information that was readily obtained through a FOIA request?

Finger on the Pulse

Finally, the “court of public opinion” matters. In studying the myriad of Anonymous and LulzSec operations throughout 2011, one could watch a volatile ascension and decline of support for Anonymous depending upon how noble (or ignoble) an operation was. The good will formed from lawful enablement of Occupy Wall Street could be undone by an unnecessary or overly aggressive illegal operation from different ranks in the same week. One could almost plot public support like a stock ticker – or a presidential/job approval rating. While some may “not care”, the savvy will not only pay close attention to the “pH level” or “barometer” of public opinion, but will also seek to assure their brand and accuracy of media coverage and narrative are an asset (versus a liability). Further, gauging public perception allows you to respond, make adjustments, and improve future ops.

This is not to say popular opinion should rule the day. In our Defcon 19 Q&A after the panel, it was revealed to us that the press failed to understand or cover the more restrained / responsible hacks. Rather than investing the time to better explain their motives and decisions, Anonymous instead opted for louder and noisier ones, which a sensationalist press responded to. The sad, yet accurate, catch phrase of modern media holds; “If it bleeds, it leads”. Knowing this is the case, investment in getting the public perception and media involvement more “on point” will be a key factor in a group’s ultimate success. Perception is reality.

Conclusion and Validation

Building a better Anonymous must be done from the ground up, with a solid foundation to set the direction and tone of the group. Perhaps the best way to validate this idea and such a foundation is to consider it in the context of Part 4: Failing in Practice (aka Pyrrhic Practices). All four failures we outline would have benefited substantially had their been a well-defined foundation. The case of doing “more wrong than right” during opBART could have been avoided had Anonymous stuck to principles and followed a code of conduct. OpDarknet, which saw a single chaotic actor hurt the operation and brand, could have been easily disavowed as not following a published code of conduct. Texas Takedown Thursday could have enjoyed great success, albeit slower, through a series of legal FOIA requests and strategic leaks of information if hacking was deemed necessary. OpSatiagraha would have been streamlined and a more potent operation if only the significant emails were released and highlighted. Another benefit to all of this is that there is less time wasted creating public announcements taking credit for, or denying, operations. They will be much more evident from their actions.

Coincidentally, as we worked on this article, news broke about a new splinter group of Anonymous, called “Malicious Security” (MalSec). This news came with the group releasing a video that introduced the group and outlined their objectives. MalSec firmly states they believe in free speech, and stresses that any defacement would add text to a web site, but they would not delete content, to support this idea. Many may disagree with their activity of breaking into web servers, but in setting this foundation for the group, they are in a position to maintain their principles while disavowing anyone that attempts to tarnish their brand. This is basically the same thing that happened with LulzSec; they weren’t happy with Anonymous, split off for 50 days, formed a new charter, and operated under it.

We expect the above to be debated and discussed, but we also believe something along these lines will come as a logical necessity. If you could make a better Anonymous, an ominous anonymous perhaps, what would you build?

Copyright 2012 by Josh Corman and Brian Martin. Permission is granted to quote, reprint or redistribute provided the text is not altered, appropriate credit is given and a link to the original copy is included. Custom graphics courtesy of Mar – sudux.com.

Should you feel generous, please donate a couple of bucks on our behalf to any 501(c)(3) non-profit that benefits animals or computer security.