We are anonymous inside the hacker world of lulzse

to websites that showed the steps one needs to take to “SWAT” someone.
Details of Laurelai’s first online meeting with Kayla come primarily from interviews with Bailey. The extra context on transgender
hackers comes from e-mails I exchanged with Christina Dunbar-Hester, PhD, Affiliated Faculty, Women’s & Gender Studies, at
Rutgers, the State University of New Jersey.
Chapter 7: FIRE FIRE FIRE FIRE
The introductory paragraph, which suggests that Anonymous went quiet between Chanology in 2008 and WikiLeaks in late 2010,
comes from interviews with various key players, including Jake Davis, Jennifer Emick, Laurelai Bailey, and conversations with other
Anons, along with my own observance of a drop in news coverage about Anonymous between those dates.
The interview with Girish Kumar from Aiplex that is referred to at the start of this chapter is sourced from the September 8, 2010, article
“Film Industry Hires Cyber Hitmen to Take Down Internet Pirates” in the Sydney Morning Herald. Kumar was quoted as saying
similar things in the TorrentFreak.com article “Anti-Piracy Outfit Threatens To DoS Uncooperative Torrent Sites,” published on
September 5, 2010. It is unclear if Kumar or Aiplex were ever prosecuted for launching DDoS attacks; there are no press reports
since that suggest the company was.
Details of the discussion of Aiplex on /b/ and then the creation of an IRC channel to coordinate a raid were sourced from an online
interview with the hacker Tflow in April of 2011, and from the TorrentFreak.com article “4chan DDoS Takes Down MPAA and
Anti-Piracy Websites.” I gleaned some context on the attacks from a timeline of events that was posted on the Partyvan.info website.
The story that Anonymous supporters were herded between IRC networks, along with the names of the main IRC channels, was also
sourced from the interview with Tflow. Extra details about Aiplex and MPAA attacks come from other online articles, such as
TechCrunch’s “RIAA Goes Offline, Joins MPAA As Latest Victim of Successful DDoS Attacks,” from September of 2010, and a
blog post by IT security firm Panda Labs entitled “4chan Users Organize Surgical Strike Against MPAA,” published on September
17, 2010.
Details about Tflow’s alleged real age and location come from the later announcement (in July of 2011) of his arrest by the U.K.’s
Metropolitan Police. The description that he was quiet and “never talked about his age or background” comes from discussions with
other hackers as well as from my own observations of Tflow in interviews, in chat rooms with others, and in leaked chat logs. Details
of the way Tflow approached people in IRC channels with more technical knowledge than he, and the way that group turned
Copyright Alliance into a repository for pirated material, come from an interview with Tflow as well as from a September 2010 news
article entitled “Wave of Website Attacks Continues—Copyright Alliance Targeted” on Skyck.com. Details of the attacks on Gene
Simmons and other DDoS attacks come from various online news reports, while the notion that the campaign “went into hiatus”
comes from testimony by Tflow and Topiary. Tflow claimed that the SQL injection attack on copyrightalliance.org was the first of its
kind under the banner of Anonymous, though it is possible that similar attacks were carried out during Chanology.
Among the technical remarks that Tflow saw in the #savethepb channel that led him to collaborate with more skilled individuals was,
verbatim, “LOIC does not overwhelm its targets with packets. It’s a matter of flooding port 80. Most web servers can not handle a
vast amount of open connections.”
The account of the creation of the AnonOps IRC network comes from interviews with Jake Davis, Tflow, and one other key organizer
of AnonOps, as well as from the “History” page on the AnonOps website: AnonOps.pro/network/history.html. There, organizers
describe the original “cunning plan” of late 2010, adding that they had wondered, “How about a ship for Anons, by Anons?”
Testimony from Topiary about first “checking out” Operation Payback, and then hearing about the suicide of his father, come from
interviews with Topiary himself.
References to WikiLeaks and the leaking of 250,000 diplomatic cables come from a wealth of mainstream news reports that were
published in November and December of 2010, such as a November 28 article in the Guardian entitled “How 25,000 U.S. Embassy
Cables Were Leaked,” as well as the New York Magazine story “Bradley Manning’s Army of One,” published on July 3, 2011. The
assertion that State Department staff were barred from visiting the WikiLeaks website came from my discussions with an anonymous
State Department source. The description of the attack by The Jester on WikiLeaks comes from various news reports, such as “The
Jester Hits WikiLeaks Site with XerXeS DoS Attack,” by Infosec Island, published on November 29, 2010, as well as from
testimony by Topiary and references in leaked chat logs. The account of the subsequent nixing of funding services by PayPal,
MasterCard, and Visa to WikiLeaks comes from a range of mainstream news reports.
Details throughout this chapter about the discussions that took place in the #command channel on AnonOps—e.g., first going after
PayPal to stoke up publicity; operator names like Nerdo, Owen, and Token; or the collaboration with botmasters Civil and Switch—
were originally sourced from Topiary, who had been invited into the channel and was friends with several AnonOps IRC operators.
Much of this information was corroborated by news reports as well as by blog posts written by Panda Securities researcher Sean-Paul
Correll, who closely tracked the PayPal attacks. Though Correll has been on sick leave from Panda Securities for much of 2011 and
was unavailable for interviews, one of his colleagues e-mailed me additional, never-before-published details of his conversations with
the botmaster Switch on IRC. The operator names Nerdo, Token, and Fennic were associated with real names and faces when the
four young men accused of cyber crimes under these names appeared in Westminster Magistrates Court on September 7, 2011: Peter
David Gibson (accused of computer offenses under the nickname Peter), Christopher Weatherhead (accused of offenses under the
name Nerdo), and Ashley Rhodes (Nikon_elite). Because he was a minor, the real name of the seventeen-year-old known as Fennic
could not be revealed for legal reasons. Further details, such as the nickname BillOReilly, came from screenshots of AnonOps IRC
published on Encyclopedia Dramatica.
Details about the numbers of people piling into AnonOps IRC during the PayPal and MasterCard attacks were sourced from Sean-Paul
Correll’s research as well as from testimony by Topiary in the month or two after the attacks.
Dialogue from the public #OperationPayback IRC channel, such as “Do you think this is the start of something big?” came via an online
database of AnonOps chat logs from December 8, 2010, searchable here: http://blyon.com/Irc/.