In late October, it was reported that “hackers within the Anonymous collective [were] intensifying their campaign against the Assad regime.” To learn more about this, we speak to CIGI’s Internet governance experts Mark Raymond and Aaron Shull.
CIGI: What precedent is there for Anonymous to launch campaigns against governments?
Aaron Shull: Anonymous is a bit of unique animal in the sense that it’s a widely geographically dispersed entity. There are many civil conflicts where civil society or rebel groups within a country take action against a government. There are also cyber protests and Denial of Service (DoS) attacks against governments all the time. But there is less precedent for widely geographically dispersed, online-only entities taking action, such as espionage, against governments. I think that the scale and the particular way Anonymous has done it is something a little bit new. It’s not just DoS attacks, but also email hacks into ministry personnel files to gain sensitive information to be used as a tool and pressure point against the Syrian government itself.
Mark Raymond: One place Anonymous has acted internationally like this before, albeit targeting non-state actors, is in Mexico, where it threatened to expose information about some of the Mexican drug cartels in response to the violence that’s taken place. The interesting thing about the Syrian case is that it sparked counter-reprisals by the Syrian Electronic Army (SEA), creating a two-way electronic conflict. This is not unique. For example, there have been some instances of back and forth on the Korean peninsula, but the back and forth has been especially pronounced in the Syrian conflict.
Shull: With the reprisal attacks, what’s interesting is the collateral damage. Since Anonymous does not have a website, counter-reprisals from the SEA targeted proxies to take out their cyber aggression — websites belonging to The Washington Post and Human Rights Watch, for example.
Raymond: The SEA is responding not only to Anonymous, but also to electronic interventions by other governments. This is a conflict where attributing cyber intervention is really difficult — figuring out whether it is Anonymous or some other actor is tough, as people sometimes use Anonymous as a false flag.
CIGI: What does this case say about non-traditional intervention and Internet governance?
Shull: There is an exercise of “line drawing” that will be needed. People have referred to what Anonymous has done as an act of cyberwar against the Assad regime. The question becomes, “is it an act of war?” and if it is, do the rules of war apply? Or is it civil conflict because Anonymous is a non-state actor? Is it jus ad bellum or jus in bello? Is it civil disobedience? There are a whole series of international legal rules that would apply to how these questions are answered.
Suppose for a moment that I am a hacker and I don’t like paying taxes, and as a consequence of my dislike for paying taxes, I hack into the Department of Finance and I wipe their servers clean. Is that an act of civil disobedience, crime, war, treason, terror — all or none of the above? It depends where society wants to draw these lines, but it exposes some of the broader and deeper work that Mark and I are engaged in — trying to come up with a framework to answer some of these questions about how the Internet is governed. The simple answer is that the rules are unclear and they’re shifting.
CIGI: How would Anonymous come to agreement on unified action against the Assad regime?
Raymond: Anonymous is a network, not necessarily a group — because that implies a degree of authority and a degree of decision-making structure, processes that are not necessarily present. Anonymous does not come to unified decisions. It has internal discussions that lead to self-selective groups of people taking particular actions using the Anonymous label or tag. Gabriella Coleman’s CIGI paper does a terrific job at looking at the history and process of Anonymous and how it works. She finds that people drop in and out of particular coalitions and operations based on their own personal evaluations of what’s being done. And that’s how Anonymous has operated. They’ve done a lot of coordinating by Internet Relay Chat, which is a very old, but pretty robust and fairly anonymous, technology. These chat rooms are set up and there are coordinating groups of people that are particularly involved in a given operation, but that is not to say they are authorities within Anonymous or they speak for Anonymous as a whole — no one does that.
CIGI: Should those engaging in electronic intervention against the Syrian government fear reprisals from the regime?
Shull: The answer really depends on where you are located. In OpSyria, one of the things that started it was the capture of 15 protestors who were caught spray painting Egypt-inspired, anti-government slogans in Syria. If you’re in Syria, under the coercive apparatus of the state, you should be very scared. One thing Anonymous did was distribute kits to show people how to stay safe online, such as how to spoof IP addresses when communicating with the outside world and how to get around government censorship. Outside of Syria, you’re subject to the laws of your own state and so if you are in the US, Canada, somewhere in Europe or some other non-authoritarian regime, you probably don’t have to worry as much.
Raymond: There are many cases where anonymity is truly important — for example, if you are a genuine dissident or civil rights advocate. It is often connected to the human right to privacy and other human rights such as freedom of expression and assembly. The flip side is that anonymity can be abused and, if there’s no recourse for law enforcement, it can open up undesirable situations. If people simply exploit relatively cheap cyber capabilities to create kinetic effects through anonymity and impunity, we could end up seeing damage to critical infrastructure and even the financial system. As more and more pieces of our day-to-day life become closely integrated with Internet technology, the potential for anonymous disruption grows and gets increasingly problematic. The example of Syria shows that the barriers to getting involved are dropping. It’s getting easier to intervene more effectively, and with lower expense, from a growing distance.