HBGary Federal, the beleagured security startup that has been the target of the online mischief making group Anonymous for the last week said on Monday that [it was ceasing operations | its CEO Aaron Barr was stepping down].
The consulting firm, a wholly owned subsidiary of HBGary Inc., had been under increasing pressure from business partners, the press and its government customers in the last week, after a hack of the company’s Web servers spilled more than 70,000 confidential e-mails onto the public Internet and revealed the details of controversial and possibly illegal internal projects.
In a statement, Barr said/the company said _______.
Rumors that an announcement from HBGary Federal was imminent were in the air at the RSA Security Conference in San Francisco, an annual gathering of IT security experts sponsored by EMC Corp.’s RSA Security division. Barr had originally been scheduled to present his analysis of Anonymous at the Security B-Sides, a small, independent gathering that takes place in the shadows of RSA and other major shows. That talk was withdrawn by HBGary last week. Asked on Monday whether there would be changes in personnel at the small security services firm, HBGary President Penny Leavy declined to comment, citing an ongoing criminal investigation into the hack. (?!)
Leavy also declined to say whether HBGary Federal, which counted U.S. intelligence and defense agencies among its customers, had lost business due to the breach. But with thousands of personal e-mails suddenly exposed, the firm and Barr, himself, had become the subject of withering attacks. At the heart of the controversy were proposals, apparently prepared at the bequest of D.C. law firm Hunton and Williams, for camapigns on behalf of “a major bank” and the U.S. Chamber of Commerce to discredit Wikileaks and public employee unions.
Published reports, based on the content of the leaked e-mail messages, depicted an abrupt shift in focus on the part of Barr and HBGary Federal from malware forensics and analysis to consulting work around Barr’s area of expertise: combing social networks for data that can be used to profile target firms and their employees. The e-mails paint a picture of a novice CEO on the cusp of failure: unable to land lucrative federal contracts and in need of new sources of revenue to keep his fledgling company afloat. The cyber offensive operations proposed to H&W appear to have been stop-gaps: cash generating operations that would give HBGary some breathing room. But Barr’s proposals, which included disinformation campaign and the compromise of systems used by Wikileaks and others for the purpose of stealing data and identifying contributors stepped well over the line that separates legal security investigations from illegal hacking.
“If you look at the presentation (Barr) did with Palantir, I would never consult a client to do these things,” said Chris Hadnagy, a security consultant and founder of the non profit group social-engineer.org. “You’ve got disinformation, fake messages, submitting false documents that you then call out as errors. They propose cyber attacks against opposing infrastructures.”
But if HBGary Federal and Barr were in dire straights before the leak, they were even worse off after it. Partner firms like Palantir and Berico moved quickly to distance themselves from the scandal, while potential customers like the U.S. Chamber of Commerce ardently denied that they ever sought out help with offensive cyber operations of the type Barr was proposing. The belegured executive was also under pressure. He told Forbes.com on February 7 that his home computers were being targeted by unknown individuals and that he and his family had received prank calls and e-mails.
In the end, the decision to [wind down HBGary Federal | leave HBGary Federal] was a simple one, Barr said.
[quote]
