The UK’s Metropolitan Police swooped down on the remote, weather beaten Shetland Islands last week to arrrest what the authorities claim is a top ranking member of the international hacker collective Anonymous, which has been terrorizing governments and high profile corporations for most of the last six months. The arrest of Jake Davis, aka “Topiary” capped a busy month for law enforcement in the U.S. and U.K., with raids on dozens of homes and the arrest of reputed leaders of both Anonymous and the affiliated Lulz Security, including Marshall Webb, the Ohio man known online online as “m_nerva,” Ryan Cleary, the alleged botnet operator known as “Ryan,” and a fellow Brit known online as “Tflow.”
The details of the cases against these men haven’t yet been presented and their innocence, of course is presumed. What’s known about them, publicly, is anecdotal. But what is clear is that they’re all young. Webb and Cleary: 19, Davis 18, and the minor known as Tflow reportedly just 16. Presuming the evidence against them holds up, should we be surprised to find the faces of adolescents staring out at us from behind the Guy Fawkes masks? History and science say: “no.”
More than a decade of psychological, medical and scientific research suggest that adolescents are particularly susceptible to the kinds of risky, spontaneous and harmful attacks that became Anonymous’s hallmark. The question for the security community – and for society – is how to stop it from happening again.
The stereotype of the brilliant but socially isolated hacker-teen has gone hand in hand with society’s awareness of computer hacking itself. Look no further than seminal Hollywood films like Wargames (1983) or Hackers (1995) for that. In recent years, however, there’s been a concerted effort to dispel that myth. The media (including yours truly) have written time and again about the professionalization of malware writing and cyber crime. Criminal syndicates took over the business of creating, releasing and monetizing malicious software, so the story goes. Cybercrime became a vertical industry with specialties, sub-specialties and lots of money. Finally, nation and nation-backed actors got into the cyber game, with a focus on espionage and control of critical infrastructure. The days of the hobbyist hacker were gone – or at least that’s what we thought.
Of course, that was never the whole story. In the last decade, Anonymous and other like-minded groups flourished in the shadows of the Internet: amorphous and anarchic collectives that congregated on IRC and on image boards like 4Chan. What eventually became known as “Anonymous” was born in that freewheeling, no-holds-barred world, then inexorably expanded its activities from obscure attacks and protest actions to full fledged hacking and DDoS campaigns against governments, The Church of Scientology, Visa, Paypal, Sony and a wide range of other private and public organizations perceived as hostile to Anonymous’s ever shifting list of pet causes.
The advent of Anonymous, Lulz Security and similar groups remind us that hacking for laughs – or “lulz” – never went away. It only faded into the background. But we shouldn’t have been surprised. Indeed, none of the underlying trends that draw smart, technically adept young men (mostly) and women to malicious hacking have abated. To the contrary, changes in the computing environment have put even more firepower into the hands of would-be hackers. Anonymous’s frequent use of free services like YouTube, pastebin, the Low orbit Ion Cannon distributed denial of service (DDoS) software and other tools make clear how free and Web-based tools and technologies make it possible to communicate, coordinate and carry out potent online attacks anonymously. And, as has always been the case, the particular “condition” of adolescents puts them at risk for gravitating to this type of activity.
Early studies, such as Sarah Gordon’s work on the psychology of hackers and virus writers, found a correlation between adolescents and both hacking and virus writing, but made a distinction between adolescents who might engage in those behaviors and their older colleagues. The youths, Gordon found, were motivated by social and intellectual challenges: solving a puzzle and an age appropriate desire to rebel and gain credibility with peers, feel special or get “famous.” Adults engaged in the same activities, Gordon found, fit the more standard psychological profile of criminals.
The latest scientific research tends to back up Gordon’s findings. New brain imaging studies show that the brain undergoes dramatic change during adolescence. Because of this, adolescents, are less able to employ empathy in helping to make decisions, according to studies.
Other research shows that the cerebellum, which
coordinates our cognitive processes — our mental grace, if you will — changes
dramatically throughout adolescence and into one’s early 20s. Finally, teens, though adult-seeming, are still in the process of socializing. By and large, they socialize by observing the behavior of those around them – conducting a type of “social learning” that goes on throughout life, but especially during youth and adolescence. No surprise, then, that hours spent online with groups that include adults or trusted friends who are inclined towards criminal behavior might just help to normalize that behavior for an adolescent.
What does this tell us about the teenagers who found themselves with their finger on the trigger Anonymous’s LOIC DDoS cannon? Nothing and everything. It’s long been clear that Anonymous’s claims to be “leaderless” were just posturing. We’ll have to wait for the courts and attorneys to help us understand the real actions and motivations of those who carried out the attacks against HBGary Federal, Sony and other organizations – who was the general and who was the loyal foot soldier.
However, reporters who have covered the group’s exploits and winced at the ruthlessness of attacks on individuals like Aaron Barr won’t be surprised that the individuals behind faceless personas like “Topiary” and “Tflow” hadn’t seen the other side of 20. The juvenile banter, unquenchable thirst for attention (press or otherwise) and prank playing all screamed “teenager,” even as members of the group projected an air of adult confidence and righteous indignation in the press. Just underneath all the posturing, however, lay the kind of dangerous moral disengagement that researchers long ago spotted in adolescent hackers and virus writers and the cocktail of dissociative effects that go along with online relationships – what one researcher has termed the “online disinhibition effect.” These factors made it easy enough for Anonymous and Lulz Security’s leadership to cook up easy and comfortable justification for their malicious acts. “He was out to get us. ” “Their security was a joke.” “They’re hostile to a cause we support.” “They deserved it.” Judging from the text of the leaders’ IRC chats, the prospect of getting caught and arrested wasn’t alien, though it’s almost certain that the reality of that is more sobering than the theory of it.
The moral of Anonymous may be that, in the end, the group’s slogan – “we are legion” – wasn’t that far off after all. The flurry of arrests in recent months suggest that Anonymous did have a healthy following who, if not legion, were at least numerous. Indeed,the particularities of adolescence almost guarantee a willing and wired population of followers who might easily be swayed to join in the fun.
We in the media, however, didn’t do a good job spotting the juvenalia and seeing it for what it was. All our talk about Chinese hackers, mobsters and “advanced persistent threats” had us swallowing Anonymous’s line that they were latter day Robin Hoods out to expose the wickedness in the Beltway and the board room. There may be something to that, but they were also teenagers huddled away in the basement and the bedroom with their laptop and a broadband connection.
As a community, we need to pick up the threads of that conversation we collectively dropped almost a decade ago, asking ourselves what factors -social, psychological, economic – might draw smart, young people into groups such as Anonymous and LulzSec that, in the end, were bent on committing illegal acts. Once we can answer those questions, it becomes easier to figure out what steps – be they education or outreach – might prevent the next iteration of Anonymous, Lulz Security or Antisec from finding its feet.
