Edward Snowden documents show that agents helped identify and prosecute hacktivists

Feb 5, 2014 07:54 GMT  ·  By

Documents stolen by Edward Snowden from the United States National Security Agency have revealed that a division of Britain’s Government Communications Headquarters launched a denial-of-service (DOS) attack against the IRC servers used by hacktivists, particularly Anonymous and LulzSec.

The unit responsible for these attacks, the Joint Threat Research Intelligence Group (JTRIG), used not only DOS attacks, but also other techniques, the documents obtained by NBC News show. 80% of the individuals who frequented Anonymous IRC rooms are said to have been scared away as a result of the JTRIG’s operations.

However, since non-hacking IRC rooms and other websites could have also been hosted on the same servers, it’s possible that not only hacktivists were impacted by the JTRIG’s activities.

In June 2012, the administrators of the VoxAnon IRC Network informed their users that a “heavy DDOS attack” disrupted their operations.

“#VoxAnon is down due to DDOS. Haters will hate. We won't stop doing what we do best,” they said at the time. It's possible that the “haters” were agents of the British spy agency.

The GCHQ division is also responsible for identifying hacktivists who attacked PayPal and government websites, the documents show. Many Anonymous and LulzSec hackers had no idea that the people they were talking to were actually undercover agents.

For instance, Edward Pearson, known online as GZero, was sentenced to 2.5 years in prison in 2012. GCHQ agents had been provided by Pearson with malicious code designed to infect the devices of a certain website’s visitors and turn them into botnet zombies that could be used for DDOS attacks.

The same spy unit is also said to have contributed to the arrest and conviction of Jake Davis, aka Topiary, and Mustafa al-Bassam, known as Tflow. Authorities targeted another hacktivists known as p0ke, but apparently they didn't indict him.

Update. The article has been corrected to state that the GCHQ launched DOS attacks, not DDOS attacks. Clarifications via Robert David Graham and Sean Sullivan.