Hacktivism 1-2-3: how privacy enhancing technologies change the face of anonymous hacktivism

The 2007 official launch1 of Wikileaks, a platform for potential whistleblowers designed to make sensitive documents anonymously public was a turning point in the history of computer based social activism (or hacktivism (Gunkel, 2005, p. 595), in short). The website has many distinct features which enable it to fulfill its role, such as its close relationship with mainstream media organisations, which both disseminated and fact-checked source documents. However, Wikileaks is particularly relevant for our analysis because of its use of Privacy Enhancing Technologies (PETs). PETs is a general name for a family of software and hardware solutions which aim to shield their users from surveillance of their electronic communications and promise to preserve their anonymity. While many different PETs were developed and in use before it, Wikileaks was the first to provide easy to use PETs for the masses. It was also the first PET application that hit the headlines all over the world.

The easy availability of user-friendly PETs providing military grade online security to anyone enables a plethora of social practices. These practices affect, among other, international diplomacy, state security and counter-terrorism efforts. They have strong influence on the debate around online privacy and the legal and philosophical underpinnings of basic human rights. For the purposes of this article however, we will single out one out of the many possible transformations that PETs, their users and communities are a potential source of: how online political activism and electronic civil disobedience is being transformed.

This transformation is most easily understood through the rise and fall of Anonymous - the ad-hoc online swarm of vigilante activists that represented the “face” of hacktivism 1.0, and the way the launch of Wikileaks redefined what anonymous, and its potential really is.

Anonymous 1.0

Anonymous was a name that frequently appeared in articles discussing the events around Wikileaks. It referred to a group of hacktivists who organised mass cyber-attacks in the late 2000s against various online adversaries: individuals that they deemed offensive, companies they disliked or despised. According to their self-description: “Anonymous is not a person, nor is it a group, movement or cause: Anonymous is a collective of people with too much time on their hands, a commune of human thought and useless imagery. A gathering of sheep and fools, assholes and trolls, and normal everyday netizens. An anonymous collective, left to its own devices, quickly builds its own society out of rage and hate. […] They have no leader, no pretentious douchebag president or group thereof to set in stone what Anonymous is and is not about. This makes them impossible to control or organize. Not really a collective at all - more like a stampede of coked-up lemmings. […] Anonymous is not a single person, but rather, represents the collective whole of the internet. As individuals, they can be intelligent, rational, emotional and empathetic. As a mass, a group, they are devoid of humanity and mercy.” (Encyclopedia Dramatica, 2011) 2 Anonymous, which started out as an ad-hoc online group committing mischiefs ‘just for the lulz’ (i.e., just for fun) soon transformed into a rather chaotic power of vigilante justice. They rallied against laws they thought of as unjust, they turned against what they have seen as corrupt businesses and individuals by using methods that usually bordered on (if not crossed) the threshold of legality (Coleman, 2012).

In the tumultuous last weeks of 2010 Anonymous hit the headlines again, that time because they launched a series of attacks against those companies that severed their business ties with Wikileaks. Soon after Wikileaks started to publish the Afghan war logs and the US diplomatic cables, the US government pressured several companies to stop doing business with Wikileaks. When Amazon.com kicked Wikileaks out from its servers, and when MasterCard, Visa and Paypal stopped processing donations for the organisation, Anonymous stepped in and started to organise large scale Distributed Denial of Service (DDoS) attacks against these companies in what they called ‘Operation Payback’.

Hacktivism 1.0

Anonymous was the latest manifestation of hacktivism 1.0, the electronic civil disobedience that developed in the decades before. Ad-hoc groups of individuals using technology to advance their cause started to organise political actions in the digital space as early as the 1990s. Anonymous’ predecessors, such as the Critical Art Ensemble, the Electronic Disturbance Theatre, or the Cult of the Dead Cow were small groups, experimenting with digital resistance and electronic civil disobedience, using the technology as a means for political action. (Critical Art Ensemble, 1996; Wray, 1999) Besides tailor-made interventions, these groups have experimented with what they called virtual sit-ins, or distributed denial of service (DDoS) attacks, in which they tried to take down the online web-services of target organisations by flooding them with simultaneous requests. Anonymous, which coalesced not long before the year 2008 in and around the online image board 4chan, followed that tradition, albeit with a twist: rather than being a highly selective group rooted in various artistic and/or political traditions, they were more open, less high-brow and certainly less formal. Their message was that any one and every one is a member of Anonymous who puts on stylised plastic Guy Fawkes mask borrowed from James McTeigue’s Hollywood blockbuster V for Vendetta (Kaulingfreks and Kaulingfreks, 2013), and who joins the online swarm rallying for the latest cause. Anonymous updated and democratised the methods they inherited from earlier hacktivist groups: they organised massive DDoS attacks using custom written software tools that enabled participation for even the technically unskilled (Sauter, 2013, p. 984), while more skilled members of the group performed impressive hacks (cracking and defacing websites) and doxxes, i.e., revealing highly private information on a target individual, including bank account transactions, social security data, private emails, etc.

Anonymous as a group was at its heyday in 2010-2011. They were a group that rallied against something. They were resisting something they are left out of, trying to make their voice heard, trying to get in. This is the message of Anonymous: we are united in our position of being excluded. We are united in our position of being outsiders.

The power of Anonymous is that it is a swarm which “attacks from all directions, and intermittently but consistently — it has no ‘front,’ no battle line, no central point of vulnerability. It is dispersed, distributed, and yet in constant communication. In short, it is a faceless foe, or a foe stripped of “faciality” as such.” (Galloway & Thacker, 2007) The plastic Guy Fawkes mask, which became the ultimate symbol of Anonymous was not really about actually hiding the real identity of its members. Though the participation in DDoS attacks is an offence under US law as well as under the Council of Europe’s Convention on Cybercrime, the DDoS tools the group distributed to the public made no efforts to hide the identity of its users. As a result, many who participated in Anonymous were arrested in subsequent years (Olson, 2012; Shankland, 2011). Rather, the mask symbolised the universally shared feeling of exclusion, which applied to everyone with no regard to individual differences. The mask was also a reference to the methods of hacktivists of the 1.0 kind: We re-appropriate the entertainment that was offered to us by the military-industrial-entertainment-complex as a substitute for resistance (Adorno & Horkheimer, 1979) and turn it against the status quo (Debord, 1994). Rather than just enjoying the Warner Bros. produced movie and buying the merchandise associated with it, Anonymous appropriated the props and the message, and used them as an inspiration to rally against those very structures that produced the film, which was certainly intended to be entertainment rather than educational material on how to revolt against governments and corporations.

Anonymous embodied the essence of hacktivism 1.0. The latter “breaks down into two broad streams of actions: 1. Mass virtual direct actions, which use cyberspatial technologies of limited potential in order to re-embody virtual actions, [and 2.] digitally correct actions, which defend and extend the peculiar powers cyberspace creates.” (Jordan & Taylor, 2004, pp. 114-116) On the one hand, hacktivism 1.0 gives technically less skilled individuals the chance to participate in electronic civil disobedience actions. These actions, like virtual sit-ins or DDoS attacks, fit into the tradition of sit-ins and other physical and electronic civil disobedience (Sauter, 2013). Some would argue that various social network-based actions, such as Facebook and Twitter campaigns also belong to this category, where individuals self-organise using Facebook pages and Twitter hashtags to express dissent, build resistance and achieve social change (Lindgren & Lundström, 2011). Such hacktivism requires no technical skills, it is easy to join the swarm and participate in the action. Hacktivism 1.0 could also mean complex technological stunts, committed by a few, highly skilled computer programmers. The cracking of websites and databases, the disruption of the ‘infostructure’ of the target organisations, or the development of highly specialised software tools (to aid, for example technically less skilled activists) may yield high rewards, but they are also high-risk, complex, costly and time consuming actions, and as a result they are relatively rare (Coleman, 2013). Hacktivism 1.0 is thus torn between highly effective but rare instances of hacking, and relatively frequent cyber-protests where the place of impact is separated from the place of resistance, and thus yield little more than symbolical results.

The Wikileaks related actions of Anonymous marked the apex of hacktivism 1.0. While such hacktivists gained enormous amounts of press attention, it soon turned out that this attention was the most they could hope for. The power of Anonymous was based on the belief that the sole number of participants would be enough to win any battle. But their effectiveness in terms of disrupting the everyday operations of these companies, or inducing a shift in their policies was nil. Their symbolic victories were short lived. Gladwell (2010) argues that this form of electronic civil disobedience is even counterproductive, since the technological tools of electronic civil disobedience “make it easier for activists to express themselves, and harder for that expression to have any impact. The instruments of social media are well suited to making the existing social order more efficient. They are not a natural enemy of the status quo.” The swarm-logic in itself turned out to be ineffective, and the swarm of what proved to be the important question. The lesson of Anonymous was that even if there are millions of them, the disruption technically unskilled outsiders can cause to the well-fortified corporate and governmental infostructures is very limited indeed.

Anonymous 2.0

Ironically, while everyone was busy with Anonymous (the group, with a capital A), Wikileaks quietly introduced another type of anonymous (the individual, without any capitals), that turned out to be much more important than the “stampede of coked-up lemmings” that Anonymous was.

This new type of anonymous was protected by strong and reliable crypto technology rather than a cheap plastic mask. It was individual rather than a swarm, and most importantly it was on the inside, rather than being on the outside. The anonymous of Wikileaks are those powerful individuals in privileged positions within the existing power structures, who by leaking secrets can safely subvert the very power structures that they define (and that define them), because they can rely on PETs to safeguard their identity.

Leaking classified information to the press and whistleblowing has a long tradition (Alford, 2002; Glazer & Glazer, 1989), and many countries have laws that grant protection to journalistic sources in order to encourage the watchdog role of the press (Blasi, 1971; Privacy International, 2009; Committee of Ministers of the Council of Europe, 2014; McGonagle, 2014). Wikileaks offers a technological solution to the age old problem of how to protect the identity of a source whose willingness to cooperate ultimately depends on his/her ability to remain safe by staying anonymous. Relying on the traditional methods of conspired meetings and often contested legal safeguards is costly and risky. Wikileaks hoped to lower the threat of de-anonymisation through the creation of a safe technological space in which the identity of the source is protected by strong cryptographic algorithms, obfuscation and other software and hardware tricks. The sheer number of secrets exposed through Wikileaks, and their subsequent impact proves that access to low cost, easy-to-use PETs can significantly lower the costs of exposing and confronting power from within (Lipman, 2011, p. 119-123) and thus enable a new type of hacktivism with immensely greater transformative potential than what its predecessor ever hoped to have. Anonymity in the context of Wikileaks offers, through the technological identity protection of whistleblowers, a chance for the individual to expose and confront the very structure of power from within.

Hacktivism 2.0

Keeping power under control through coerced transparency was the original idea of Julian Assange, the creator of Wikileaks. In his essay, dating back to 2006, he described the role of Wikileaks in keeping power under control: “The more secretive or unjust an organization is, the more leaks induce fear and paranoia in its leadership and planning coterie. This must result in minimization of efficient internal communications mechanisms (an increase in cognitive "secrecy tax") and consequent system-wide cognitive decline resulting in decreased ability to hold onto power as the environment demands adaption. Hence in a world where leaking is easy, secretive or unjust systems are nonlinearly hit relative to open, just systems. Since unjust systems, by their nature induce opponents, and in many places barely have the upper hand, mass leaking leaves them exquisitely vulnerable to those who seek to replace them with more open forms of governance.” (Assange 2006)

The task of keeping power transparent requires a new type of hacktivist, who has the necessary tools to coerce that transparency on power. Anonymous 2.0 is the source of a new type of hacktivism, hacktivism 2.0. While hacktivism 1.0 was the activism of outsiders, and its organising principle was to temporarily get outsiders into the territory of the other, hacktivism 2.0 is done by insiders. While it is certain that technology in itself cannot and will not be the (sole) solution to anything (Morozov, 2013), in other words one cannot solve problems through technology only, having access to the right tools at the right time when the demand is there certainly helps. Hacktivism 2.0 cannot exist without PETs, whose one important purpose is to help people get information out from an organisation. PETs, like in the way Wikileaks put them into use, shift the source of potential threat from a few dangerous hackers and a larger group of mostly harmless activists - both outsiders to an organisation - to those who are on the inside. For mass protesters and cyber activists anonymity is a nice feature, but it isn’t necessary or even desirable under every circumstance. Putting a name and a face next to a political action is sometimes the most powerful form of protest. On the other hand, for insiders trying to smuggle information out, anonymity is a necessary condition for participation.

Easy anonymity lowers the risks and costs associated with dissent, and thus radically transforms who the activist may be. It turns a monolithic, crystal clear communal identity defined solely through opposition into something more complex, multilayered, individual and hybrid by allowing the cultivation of multiple identities, multiple loyalties. Being anonymous is an identity play, and as an identity play, it is a loyalty play. As an identifiable member of the society, the individual is bound by formal and informal attachments and hierarchies, the breaches of which are severely and instantly punished. Being anonymous means that one’s identity and loyalty is up for grabs, it is fluid, it is independent, it is freed from its social base. PETs support the development of new loyalties that are detached from what is seen as corrupted and failing national identities, a debilitating chorus of corporate anthems, historical determination and the normalising judgment of Facebook peers. When this happens, one’s ‘proper’ identity, one’s real name turns into a mere pseudonym that serves to hide one’s ‘real’ identity, one’s true loyalties. “People are asked to identify personally with organisations who can either no longer carry historical projects worthy of major sacrifices or expressly regard their employees as nothing but expendable, short−term resources. This […] creates the cognitive dissonance that justifies, perhaps even demands, the leaker to violate procedure and actively damage the organisation of which he, or she, has been at some point a well−acculturated member (this is the difference to the spy). This dissonance creates the motivational energy to move from the potential to the actual.” (Stalder, 2010)

Being anonymous allows those who do not want to define themselves – at least not publicly – as activist, radical or dissenter to enter the activist scene. The promise – or rather, the condition – of anonymity in the context of Wikileaks is that one can be on the inside and on the outside at the same time. Through anonymity the mutually exclusive categories of inside/outside, cooption/resistance, activism/passivity, power/subjection can be overridden and collapsed.

Assange’s quest for a well mannered and well-behaving, ethical, productive and accountable power created by the Wikileaks transparency is very similar to the benefits Bentham assigned to his Panopticon design3, as cited by Foucault: “Morals reformed – health preserved – industry invigorated – instruction diffused – public burthens lightened – Economy seated, as it were, upon a rock – the gordian knot of the Poor-Laws not cut, but untied – all by a simple idea in architecture!” (Foucault, 1979) Wikileaks’ coerced transparency extends the Foucauldian disciplinary power to the very body of state and government by placing power under the surveillance of anonymous subjects. But while it may be true that the Panopticon produces more efficient, more productive, more obedient, and more controlled subjects, it remains to be seen whether the outcome of applying the panoptic schema to power yields anything more than more panopticism.

The way the US state apparatus has reacted to Wikileaks clearly illustrates this dilemma. In a memorandum issued on 3 January 2011, the National Counterintelligence Executive and the Director of the Information Security Oversight Office detailed the procedures by which they hoped to prevent any further leaks. The document is a 14-page long checklist covering all aspects of keeping secrets: “the measures in place to determine appropriate access for employees to classified information”; the existence of counterintelligence programmes; the use of back-up media; “a trend analysis of indicators and activities of the employee population which may indicate risky habits or cultural and societal differences other than those expected for current employees for security clearances” and the “use [of] psychiatrist and sociologist to measure the relative happiness as a means to gauge trustworthiness, and the despondence and grumpiness as a means to gauge waning trustworthiness” (Lew, 2011, p. 6).

This document, as well as the recommendations formulated in reaction to the Snowden revelations (Office of Management and Budget, 2014) is the blueprint for an internal total transparency (i.e., total surveillance) programme that is designed to maximise the control over the state apparatus by detecting potential leakers and preventing information breaches. The state reacted to the threat posed by hacktivism 2.0 by creating a transparency of its own. This is the classic example of internalisation (Scott, 1971): the state, under surveillance, has internalised the expectations and now is busy learning how to make sure that what is not to be shown stays truly hidden. Secrets to outsiders can only be protected through total transparency on the inside. This is the problem with total control: it does not annihilate undesired behaviour, it does not mute and reform inappropriate and prohibited desires, it only suppresses them, and fosters secrecy and deceit. Transparency will not break the logic of power based on panopticism: “The panoptic schema, without disappearing as such or losing any of its properties, was destined to spread throughout the social body; its vocation was to become a generalized function. […] On the whole, therefore, one can speak of the formation of a disciplinary society in this movement that stretches from the enclosed disciplines, a sort of social ‘quarantine’, to an indefinitely generalizable mechanism of ‘panopticism’” (Foucault, 1979, p. 207). The transparency of Wikileaks does not counter this process, it reinforces it. By putting the locus of power under surveillance it simply draws the state under this form of control, putting the last missing piece of the puzzle in place. In the same sense, Wikileaks only propagates the control it wishes to subvert. It only helps the logic of panopticism to fold and close upon itself.

Anonymous 3.0

There are two types of anonymity: that of the observer, and that of the subject, both immensely empowering. The transparency which Wikileaks coerces on power through the leaks of anonymous whistleblowers extends the Foucauldian disciplinary power to the very body of state and government. But while the anonymity of the subject removes the individual from existing power relations, the act of surveillance, the idea on which Wikileaks is based, puts her right back to the middle.

Anonymity, in the context of PETs offers more than just the ability for the individual to put power under surveillance. Anonymity enables the individual to – at least partially – remove herself from the pre-existing discursive determinations and power relations and consider alternatives. Anonymity is more than just a technology to control power. It is also a technology of individual and collective freedom. “If governmental rationalities operate through the nomination and specification of a positive identity through a series of constitutive exclusions, rarefactions and restrictions, then the practices of freedom are enabled by withholding the knowledge of oneself, resisting the injunction to a ‘confessional’ self-expression, declining the incitement to active participation in the governmentally sanctioned discourse. Anonymity may then serve ‘to encourage freedom by increasing the scope of actions not susceptible to official observation, records and interpretation’” (Prozorov, 2007, p. 62, citations omitted).

The Snowden revelations (“The NSA files,” 2013) perfectly illustrate the difference between the potential of anonymous 2.0, engaged in the surveillance of power, and anonymous 3.0, which uses PETs to disengage and disappear altogether from the radar screen. Without Snowden, the whistleblower (who, in this case chose not to remain anonymous and thus now lives in exile), we would not have hard evidence on how power operates in the digital age, on how the ubiquitous surveillance of electronic communications trumps fundamental human rights and on how the lack of privacy is a direct assault on a number of individual and collective freedoms (La Rue, 2013, p. 15). The subject’s position of being “a multiplicity that can be numbered and supervised”, its state of living in a “sequestered and observed solitude” (Foucault, 1979, p. 201) can only be subverted if there is a place, hidden from surveillance where we are free to make our choices (Bauman & Lyon, 2013; Bogard, 2006). PETs are important because they allow the individual to counter surveillance, and thus liberate individuals, when other safeguards of freedoms and liberties are lacking or lagging behind.

The PETs provisioned anonymity allows individuals to enjoy certain freedoms. If everyday citizens have an autonomous zone (Bey, 1991), a safe haven, hiding in the discontinuities of cyberspace, from where they not only can oversee and control the state apparatus; but which is safe from surveillance and outside interference, which is peer-produced and thus reflects the ethical and ideological consensus of its users (Bodó, 2014), then we have a virtual space which is not locked down in the oppositional struggles of the status quo, but has the potential to develop something completely independent from it. Free, autonomous individuals, having the potential to create their own world in the autonomous space without surveillance and interference: this is the promise of post-Wikileaks PETs, and the task ahead of hacktivists of the third generation.

Policy impact

As it stands now, PETs are the only at least relatively effective safeguard against total surveillance. On the other hand, the same PETs that protect the basic human rights on the digital networks are being used in a number of other situations by a number of other groups to, for example, trade drugs and arms, or exchange child pornography (Bodó, forthcoming). PETs are thus increasingly threatened by law enforcement (Masnick, 2014), and the often legitimate goals to catch PETs-using pedophiles and assassins is in clear conflict with the interest of many others who use the same technologies, the same networks to protect their privacy.

There are deeply vested economic and governmental interests to keep the network open for surveillance. If PETs are able to prevent surveillance, then we should expect a long term conflict between the technology-based and the normative and legal based agents for control. We have already seen similar conflicts in regard to file-sharing technologies, where rights holders have long been trying to delegitimise and outlaw the use of P2P software (Giblin, 2011). As a response, P2P software developers came up with ever more autonomous systems, which were always able to be one step ahead of any copyright enforcement effort. We should expect and be prepared to deal with policy interventions that aim to delegitimise and outlaw the use of PETs, in a similar manner. Unless we all have well defined and well protected digital rights, the second best option of PETs is all what we have. Academics and activists should be prepared to defend these technologies, as they seem to be one of the few technologies of freedom (De Sola Pool, 1983) we are left with.

Conclusion

With the fall of Anonymous, the era of hacktivism 1.0, done by swarms of harmless outsiders is nearing an end. It is superseded by a much more potent form of hacktivism, which relies on insiders to expose the ways power operates and create a more transparent society. This type of hacktivism, which may be an effective way to control power, relies on easily available military grade PETs to provide anonymity for insiders, making everyone a potential whistleblower. The same PETs and the same anonymity, however, allow for another type of hacktivism, which, rather than being locked in a diametric relationship with power aims to create its own autonomy through avoiding surveillance.

Which type of hacktivism is more relevant for the future? It depends on our answer to the question of how to be truly free in the age of ubiquitous surveillance. If we think that it is enough to put the observers under surveillance, then the Wikileaks introduced hacktivism 2.0, which relies on anonymous insiders coercing transparency on power may be the answer. However, Galloway and Thacker (2007, p. 41) argue that control in a networked society functions through the data produced by individuated subjects. If we agree, then negating this control is not to gather data on the observers - which is nothing more than being engaged in the oppositional (symmetrical) power relationships, but to be what anonymous really means: invisible. Invisible in its strictest sense: being beyond the determinations that define the identity and the discourse. The function of hiding behind a mask, in this context only makes sense if rather than all of us hiding behind the same Warner Bros. licensed Guy Fawkes mask, we all have our own mask to wear.

Whatever we think of the right course of action, both types of civic activism depend on the easy availability of strong Privacy Enhancing Technologies. Software technologies, such as PETs or P2P file sharing software are created in the niches between the actual, the potential and the desired. They are the products of particular social, political, economic conditions and reflect the opportunities, the threats, and most importantly the perceived failures and deficiencies in and around the contexts in which they are born. Technologies enable the emergence of new and unexpected social practices, which in turn become subject of interpretation in multiple discursive contexts. The major impetus for Tor’s development was the US military’s need to communicate without the threat of foreign surveillance. Its easy availability for everyone is based on the understanding that secret communication is best hidden in the noise created by others communicating in secret. Allowing individuals to negate control may not have been the primary aim of providing governmental funding to, or the primary goal of the development of PETs. But now, lacking any other effective legal or political protection of human rights and other constitutionally protected freedoms, we rely on PETs to have at least a modicum of privacy. This situation is far from being ideal, but currently this is the best we can hope for. For this reason it is essential that PETs be protected from efforts of delegitimisation and illegalisation. PETs may come with the cost of giving up considerable amounts of security. But this has always been the price for freedom.