Welcome to the cyber sit-in: Many 'Payback' protesters easily identified, study finds

Update: 'Anonymous' announces 'Operation Loveback': a campaign to send Christmas cards to Bill O'Reilly

During the civil rights era, the sit-in became a popular and effective form of protest against businesses that denied service to black people. Though legally ambiguous at first, the harsh reactions of authorities against the peaceful protesters ultimately won over public opinion.

Something similar is happening today on the Internet.

A wave of distributed denial of service attacks (DDoS) in the past weeks knocked the world's two largest credit card providers and the web's largest payment processor offline, stopped business as a Swiss bank and crashed servers for Swedish prosecutors. It was all done allegedly in response to the censorship of secrets outlet WikiLeaks, in an effort dubbed "Operation Payback."

All of these actions were attributed to the "hacktivst" group "Anonymous," which has adopted a low-tech response to high-tech censorship by way of clogging a website's servers with traffic and repeatedly asking it to do what it was designed for: serving pages. Until this point, most high profile DDoS attacks were carried out for unsavory purposes, by networks of hacked computers being manipulated without users' knowledge.

This time, it's different.

Using a piece of old server stress-testing software called "Low Orbit Ion Cannon" (or "LOIC," a name taken from PC strategy game Command and Conquer), protest participants point their Internet connections at a server and begin sending requests. If enough people join in, the servers can ultimately be overwhelmed by traffic, resulting in a denial of service to other users.

For businesses like PayPal or Amazon, which exist primarily online, this can be costly and even lethal -- but the protest is not exactly a crime. Not yet, anyway. It's not exactly "anonymous," either.

Researchers in the Netherlands, at the University of Twente, found that using the LOIC exposed users to being identified unless traffic was routed through anonymous relay software, like Tor.

"[Attacks] generated by this tool are relatively simple and unveil the identity of the attacker," they wrote. "If hacktivists use this tool directly from their own machines, instead of via anonymization networks such as Tor, the Internet address of the attacker is included in every Internet message being transmitted."

Operating the LOIC directly, they said, is akin to "overwhelming someone with letters, but putting your address at the back of the envelope."

So far, a lone, Dutch 16-year-old has been arrested for the protests that brought down MasterCard's website and halted transactions for several hours. In addition to participating in the DDoS, he's accused of running a chatroom and helping to organize more voluntary contributions to the protest.

Still, much of the international press characterizes the efforts as "hacking" and "attacks" against private industry. This appears to be a mis-perception according to Evgeny Morozov, who wrote in Foreign Policy that voluntary DDoS networks represent the new sit-in.

"[Both] aim at briefly disrupting a service or an institution in order to make a point," he opined. "As long as we don't criminalize all sit-ins, I don't think we should aim at criminalizing all DDoS."

"Like it or not, legal or illegal, various forms of protest and civil disobedience have always been part of the politic process in the USA and elsewhere in the world," a blogger on LockerGnome opined. "If a DDoS or any other type of cyber attack is launched by like-minded individuals and it is for some cause, I can not view it as anything other than some newer form of civil disobedience. Furthermore, if there are like-minded individuals out there who do view it as such, it has already become such."

A similar tactic was used to protest the invasion of Iraq in 2003, when protesters staged a series of cyber sit-ins and brought down sites connected to the British government.

The "Anonymous" group, mostly amorphous and lacking a single spokesperson, has taken to YouTube to wage a battle for public opinion and pull in others to their cause.

"Anonymous is a spontaneous collective of people who share the collective goal of protecting the freedom of information on the Internet," a recent video said. "Anonymous is not always the same group of people. Anonymous is a living idea. Anonymous is an idea that can edited, updated, remanded, changed on a whim. We are living consciousness.

"We ask for the world to support us, not for our sake but for your own. When governments and corporations control information, they control you. When governments are allowed the power of censorship, they are able to commit grave atrocities and act in corrupt ways, free from the scrutiny of those from who their power derives. When corporations are capable of using their vast amounts of wealth to manipulate or influence the free flow of information, they control you. We are taking a stand against this. We refuse to be deceived."

The group's latest update focuses on "Operation Leakspin," an evolution of their campaign against WikiLeaks' opponents. "Anonymous" plans to disseminate across the Internet the "best, least exposed leaks" in the stolen US State Department cables.

WikiLeaks has said that it is in no way connected to "Anonymous," but added that they neither approve nor disapprove of their actions.

This video was posted to YouTube by user LetterFromAnon on Dec. 9, 2010.

(h/t CNet)