Hacktivism: the Perfect Recruitment Tool for Terrorist Organizations

The book The Art of Intrusion by hacker and security researcher Kevin Mitnick

tells the story of two boys who were taken advantage of by a man known as Khalid the

Terrorist. Two young hackers, known as ne0h and Comrade, were approached in a

hacker hangout on Internet Relay Chat (IRC) by a man who challenged the boys to

break into government and defense computers. After all, being able to hack into those

systems was considered a holy grail. The terrorist used two simple tactics, one of which

will work on most hackers. Rather than threatening the boys, Khalid challenged their

skills and made them feel that they had to prove they could hack into these systems. He

later used bribery as well. The information given to Khalid by ne0h and Comrade is

suspected to be some of the information that was used to plan the Taliban hijacking of

Indian Airlines flight IC-814. The boys did not truly realize they were aiding a terrorist

until after the fact (Mitnick & Simon, 2005). So, as you see, it would not be so far

fetched that a terrorist group such as Hamas would use Anonymous/LulzSec as a front

to recruit support or to entice young hackers to commit acts that would promote a

terrorist cause.

Criminological Theories That Explain the Hacker’s Potential For Recruitment

Looking back to criminology, the effectiveness of using social media and a

“hacktivist” movement to recruit supporters or perhaps operatives makes sense.

Individuals commit digital crimes for many different reasons. Although not all hackers

are criminals, criminological theories perhaps best explain the factors that contribute to

a hacker’s vulnerabilities and, in turn, the potential ways in which an organized crime

ring or terrorist group may target those vulnerabilities to recruit hacker talent. The

Choice Theory asserts that an individual makes a conscious and rational decision to

commit a crime after weighing the risks and benefits. The Deterrence Theory supposes

that offenders choose to commit a crime because the penalty for that crime does not

deter them from committing the crime. Some individuals do not think incarceration or

even the death penalty are unpleasant enough that they would like to avoid those

punishments. If an individual is “guaranteed” anonymity, he or she may also boldly

commit an act that would otherwise have severe consequences. The Social Structure

theories, in particular the Strain Theories view crime as a result of deprivation or

perceived deprivation, feelings of inadequacy, or perhaps another stressor such as the

loss of a loved one. These theories suggest that stress and strain drive people to use

criminal means to seek material wealth or other things that “compensate” for their

condition in life (Taylor, et al., 2006).

The Subculture Theory suggests that criminals hold values, norms, and beliefs

that are in opposition to what is socially acceptable. Subculture Theory and the related

Differential Opportunity Theory and Delinquency and Frustration Theory teach that

disadvantaged upbringing, lack of opportunity, and inability to obtain middle class or

desired status cause affected individuals to band together and form their own

subcultures with their own ideals. These subcultures may simply act in ways contrary to

the social norm or may turn to crime, violence, and gang membership to fulfill their

needs for acceptance. Social Structure Theories are related and suggest that when

traditional goals are blocked, individuals look for new and creative ways to pursue

goals. This innovation often leads to criminal activity. The other response when goals

are blocked is for individuals to rebel by rejecting societyʼs goals and the means to

attain those goals. This can lead to an alternative economy with alternative opportunity

structures and an alternative view of what is and is not acceptable. This theory often

explains the origins of criminal hackers, particularly those who seemed convinced that

what they are doing is not wrong but is a way to correct a social injustice (Taylor, et al.,

2006). The related Neutralization or Drift Theory supposes that some criminals do have

traditional values but temporarily suspend these values due to circumstance. The

techniques a person may use to neutralize his or her sense of right and wrong include

denial of responsibility, denial of injury, denial of victim, condemnation of the

condemners, and appealing to higher loyalties. Taking on an online alter-ego may also

allow the criminal to distance himself from his real world character and allow him to

perform acts he would not otherwise consider (Taylor, et al., 2006).

Social Process Theories perhaps best explain the development of virus writers,

as the process of learning to write viruses entails a learning and social conditioning

process by peers in the hacker or virus writing community. Many of these virus writers

must “prove themselves” when first starting, or the rest of the community will be

unwilling to teach them anything. Positive reinforcement following a successful virus

appeals to the personʼs ego and/or deep need for acceptance. The virus writer also

often adopts the viewpoint that writing viruses can actually help people by exposing

vulnerabilities, or he or she may subscribe to other skewed values promoted by the

community that can lead the person to think computer crime is justified. This theory can

also explain why some individuals would be drawn to Anonymous/LulzSec, even if they

do not necessarily adhere to the group’s ideals. Anonymous/LulzSec becomes a

proving ground for their skills and a way to seek acceptance. Political Theory explains

why many hacktivists and terrorists turn to computer crime. The overwhelming political

objective that they wish to achieve drives them to seek any means necessary, including

means that are considered to be digital crime (Taylor, et al., 2006).

Although many of the individuals involved with Anonymous/LulzSec are merely

riding the bandwagon or are script kiddies at best, the group does seem to have a few

hackers at its disposal. Most hackers are extremely intelligent (many are even

geniuses), which often leads them to question everything, including the logic behind the

legal system, particularly by what logic the laws were derived, for what purpose, and by

whom. I think some of the previously discussed theories on criminal behavior help to

explain hackers, particularly criminal hackers. Borrowing from the Strain Theory and its

assertion that “lack of opportunity” often leads one to criminality, one can begin to see

how the hacker becomes marginalized in the first place (Taylor, et al., 2006). Because

many hackers are abstract-minded, geniuses, or “gifted”, they at one point faced the

same disadvantages of other gifted children. Gifted children are often marginalized

because their intellect sets them apart from peers. Although it is a bit different from the

traditional “underprivileged child” scenario, these little geniuses are literally held back by

the social norms and education that others strive to obtain. These children become

bored, frustrated, or resentful because they are not able to exercise their full potential

due to the constraints of the school curriculum that was intended for average children

(Gross, 2004).

As a gifted child grows older, if he is not given the space to grow or develop, then

he may exhibit behaviors that cause him to be labeled as a “troubled” individual.

However, most hostility or aggression exhibited by these individuals can be traced to

loneliness, bewilderment, and intellectual frustration (Gross, 2004). Unfortunately, the

strain caused by such an experience often follows the individual well into adulthood, and

the effects can be exacerbated when the individual is continually limited by forced

mediocrity. It is at this point that the Subculture Theory becomes applicable. Hackers

who spent their entire childhoods and perhaps a significant part of their early adult lives

being marginalized for their intellect are likely to develop values, norms, and beliefs that

do not align with those of the dominant culture. Rather than being truly disadvantaged,

as are the subjects of most Strain Theory or Subculture Theory case studies, the

hackerʼs intellectual advantage puts him or her at a disadvantage at the hands of

others. Eventually, these marginalized geniuses-turned-hackers find one another and

naturally develop their own subculture. Unfortunately, this sometimes leads to an

involvement in criminal hacking or even terrorist activity (Taylor, et al., 2006).

The Role of Social Media in Recruiting Hacktivists and Terrorists

The social media phenomenon, which has proven to be an effective tool for

political campaigns and marketing campaigns alike, has also been heavily used by

terrorist organizations to recruit, communicate, seek support, and to extend the

organization’s sphere of influence. By definition, social media have three components: a

concept, media, and social interface. The concept is a category, such as art,

information, or political speech. Media are user-generated content such as electronic

documents, digital photographs, audio recordings, or video. The social interface aspect

of social media may be based on direct communication, community engagement,

feedback and review systems, social viral media, electronic broadcasts, syndication,

and other formats (Li & Bernoff, 2008). Popular examples of social media include

YouTube, MySpace, Facebook, and Twitter. In order for social media to be effective, it

must be connectivity based, providing a “one-to-many” model of communication and

information dissemination (Defense Science Board, 2007). Social media also allows the

creation of exclusive groups which can be targeted with carefully crafted content. This

creates a sense of community and makes users feel more comfortable with sharing their

true thoughts and opinions. The artificial sense of belonging can also enhance the

social media’s intended impact on a target audience. For these reasons, social media is

quickly becoming an important tool for both public and niche influence (Shirky, 2008).

Anonymous/LulzSec has used social media sites, blogs, and IRC chat rooms in

order to recruit supporters to aid in their DDoS and SQL injection attacks on corporate,

federal, defense, and political entities. Some supporters of Anonymous voluntarily

submitted their computers to a malware program based on Low Orbit Ion Cannon

(LOIC), effectively making their computers zombies in the Operation:Payback LOIC

Hivemind botnet used to launch the DDoS attacks (Correll, 2010). Anonymous/LulzSec

clearly understands how to leverage content in such a way that the content drives the

vision. Anonymous/LulzSec uses social media such as YouTube, Twitter, blogs, and

PasteBin posts to name their targets, to leak information, or to take credit for an attack

after the fact. The group claims that their desire is to correct social injustice and to

expose what they view as government and corporate corruption. Their messages incite

action by promising empowerment and a sense of belonging to their followers. The

group also uses social media posts to grab the attention of mass media outlets (Ragan,

2011).

The social media activities of Anonymous/LulzSec closely mimic the social media

techniques used by terrorist organizations. Terrorist groups have been known to use

social media for a variety of information operations functions including recruitment,

indoctrination, communication, and command and control warfare tactics. Ayman al-

Zawahiri, a senior al Qaeda leader, reportedly wrote in 2005, “We are in a battle, and

more than half of this battle is taking place in the battlefield of the media”. Radical

Islamic terrorists often soften their image and use social media tools such as YouTube,

Facebook, and MySpace to spread propaganda in order to gain sympathy from

Westerners and others who would reject more radical messages. These terrorists also

employ harsher messages and interactive social media platforms to recruit young

Muslims, to indoctrinate them, to incite jihad, and to instruct them in terrorist methods

such as bombmaking. The terrorists have clearly learned how to leverage these tools to

expand their spheres of influence. Like Anonymous/LulzSec, they also rely on

anonymity to help avoid detection (Theohary & Rollins, 2011).

Conclusion

It appears as though the members of Anonymous/LulzSec joined the movement

largely for a sense of belonging, to prove their self-proclaimed hacking skills, or to join

seemingly likeminded individuals in what they believe to be a necessary political and

social overhaul. The Neutralization/Drift Theory, Social Process Theories, and Political

Theory seem to best explain the behaviors and mindset that cause these individuals to

become marginalized and in some cases morally degraded. This, in turn, leaves them

vulnerable to being inadvertently drawn to what may very well be a terrorist

organization. Social media has been used effectively by both terrorist organizations and

by the instigators behind Anonymous/LulzSec to recruit, to organize, and to influence. It

is difficult to say whether the hacktivist collective known as Anonymous/LulzSec

originally began as a terrorist venture or if it merely has the potential to be hijacked by

terrorists who may view it as a golden opportunity to recruit young misguided hacker

talent who could be used as scapegoats if need be. However, it is becoming apparent

that there is more to Anonymous/LulzSec than what meets the eye.

References

Correll, S. P. (2010). In ʻTis the season of DDoS - WikiLeaks edition. Retrieved from

http://pandalabs.pandasecurity.com/tis-the-season-of-ddos-wikileaks-editio/#lieb

Defense Science Board. (2007). Challenges to Military Operations in Support of U.S.

Interests. Washington, DC: Office of the Under Secretary of Defense for

Acquisition, Technology, and Logistics.

Gross, M. (2004). Exceptionally gifted children. London: Routeledge.

Li, C. & Bernoff, J. (2008). Groundswell, Winning in a world transformed by social

technologies. Boston, MA: Harvard Business.

Mitnick, K. & Simon, W. (2005). The art of intrusion: the real stories behind the exploits

of hackers, intruders, and deceivers. Indianapolis, IN: Wiley Publishing.

Ragan, S. (2011). In Anonymous: government contractor has weaponized social media.

Retrieved from http://www.thetechherald.com/article.php/201111/6939/

Anonymous-Government-contractor-has-weaponized-social-media?page=1

Shirky, C. (2008). Here Comes Everybody: The Power of Organizing Without

Organizations. New York, NY: Penguin.

Taylor, R., Caeti, T., Loper, D., Fritsch, E., & Liederbach, J. (2006). Digital crime and

digital terrorism. Upper Saddle River, NJ: Pearson Prentice Hall.

Theohary, C. & Rollins, J. (2011). Terrorist use of the Internet: information operations in

cyberspace. Congressional Research Service. Retrieved from http://www.fas.org/ sgp/crs/terror/R41674.pdf

Sabu, known as anonymousabu on Twitter, is thought to be a member of both Anonymous and LulzSec. Although Sabu’s identity is still largely unknown, it seems that he/she/they may have terrorist connections. Anonymous/LulzSec have attacked both federal and DoD/contractor targets. Their fan base is worldwide, and Sabu seems to be using this fame to steer traffic toward a rapper whose site appears to be recruiting for Hamas. I have provided all of the possible evidence I have gathered thus far.

1) Please see other attached document for possible origins of the name “Sabu” and for hints suggesting a link to Hamas. Sabu uses a Hamas flag as his Twitter icon.

2) I have been carefully watching Sabu’s posts. He has been promoting a rapper called Beast1333. More on Beast1333 below. The Beast1333 website seems to be some kind of recruiting site for Hamas and even sells bullet proof vests. Could not make this stuff up if I tried.

3) These are more circumstantial, but Sabu tends to call people “brother” and “sister” a lot. Sabu uses the words “resistance” and “movement”, which are common terms used by Islamic radicals to describe their activities. In fact, Hamas is an acronym for “Islamic Resistance Movement”. Anonymous’ taglines include “We are Legion”. Although this could reference a number of things including Biblical and Roman origins, it is possible that they are referring to the Arab Legion, part of Hitler’s SS forces in WW2. Sabu also uses the word “nein” - German for “no”. The main significance here is that Mein Kampf, the book by Adolph Hitler, is said to be a book of choice for radical Muslims, particularly Hamas members. The Hamas charter has even been compared to Mein Kampf.

Arab Legion explained http://www.knowledgerush.com/kr/encyclopedia/Arab-Nazi_relationship_during_World_War_II/

4) The number 1333 (or perhaps the year) seems to have some significance to Muslims. I think it had to do with them coming to power and forcing Jewish people to either convert to Islam or be killed. Maybe someone more familiar with Islamic beliefs and history can decipher that one.

5) Links

YouTube vid of Beast1333’s song about Anonymoushttp://www.youtube.com/watch?v=1XFSAeLo65QSidebar of that page has links to more of his songs. Very sneaky lyrics, might I add.

Sabu Twitter: https://twitter.com/#!/anonymouSabuBeast1333 Twitter: https://twitter.com/#!/beast1333Beast1333 Website: http://www.beast1333.com/home

Correlates with the “Three Levels of Faith” screenshot: http://www.aljazeerah.info/Islamic%20Editorials/2007/May/Three%20Levels%20of%20Faith%20Islam,%20Iman,%20and%20Ihsan%20By%20Hassan%20El-Najjar.htm

The rest of what I found is below with a few annotations in red.

Has Anonymous’ Sabu been promoting a terrorist recruiting site?

Step 1: Download the Islamic Imagery Project document from the West Point Combating Terrorism Center here http://www.ctc.usma.edu/posts/the-islamic-imagery-project

Step 2: Compare the symbols used in the imagery below to the symbols explained in the document you downloaded in Step 1.

The images are from the Beast1333.com site. Who is Beast1333? A rapper that Sabu, member of Anonymous and Lulz Sec has been promoting on his Twitter feed. Sabu proudly sports a Hamas flag as his Twitter icon. All quotes taken from the Islamic Imagery Project document and are borrowed for informational and educational purposes only. Red arrows on images were added by me.

“The lion is more generally associated with the early companions of the Prophet and their heroic deeds in the field of religious battle (jihad). In the modern era, it has been deployed by Islamist authors such as Sayyid Qutb, and has become a key motif in jihadist propaganda. It is employed as a term of honor for both major jihadi leaders and for low-ranking suicide bombers/jihadi militants.”

“The snake is a common symbol in the Islamic tradition. It suggests treachery, tyranny, and general evil. The snake is often employed by jihadists to describe their enemies.”

“Jihadi visual propaganda uses the globe, or Earth, to globalize specific issues and conflicts, as well as to articulate the global aims of particular groups.”

“The eagle is used to denote fierceness in battle. It generally suggests qualities of strength, power, speed, and victory in the jihadi struggle...It is used to highlight and emphasize specific individual jihadi fighters or groups, especially in Palestine and among the Palestinian diaspora.”

“Weapons are symbolically important in Islamic culture and are commonly used as motifs in jihadi visual propaganda...Pre-modern weaponry includes swords or spears, and is used to suggest the violent reality of the jihadi struggle. These images also link jihadi struggle to early Islamic history and the first generation of Muslims...depictions of the sword indicate a desire to link the current jihadi movement and its aims to those of the early Islamic ancestors, and to thus legitimize and depict current jihadi activities as the modern extensions of successful early Islamic jihadi campaigns.”

“Modern weapons, such as rifles and RPGs, illustrate the violent nature of jihadi warfare and also exaggerate the power of the jihadists’ military technology...Modern weapons are also used by jihadi soldiers and martyrs to associate themselves with violent jihadi activism and construct their identities as participants in jihad.”

“Greenery – plants, trees, forests – is very common in jihadi imagery. While greenery is usually non-specific and used as a background element, it almost always conjures up notions of the Islamic concept of heaven being a lush garden (janna).”

Eagle

Sword

AK-47

Greenery

“Red can have many meanings in the Islamic tradition; however its usage in jihadi imagery is generally simple and straightforward. It most often represents blood, war (and thus jihad), tyranny, oppression, defeat, and victory.”

“Weapons can also be used in different combinations, or presented in different ways, to evoke more complex sentiments. One of these methods is the “crossed” motif. It is employed by various groups throughout the Muslim world, and is usually done with swords, rifles, and RPGs. While this motif evokes all of the meanings associated with each weapon used, it is also used more generally to suggest a group’s participation in, or espousal of, the contemporary jihadi movement.”