NBC News has published new documents from the National Security Agency trove provided by former NSA contractor Edward Snowden. The latest revelation is that British intelligence agency GCHQ conducted a covert campaign against Anonymous in September of 2011, crippling one operation by the hacktivist group and unmasking several of its members. The slides indicate that the GCHQ infiltrated the Internet relay chat (IRC) for Operation Payback, a collective “op” by hackers affiliated with Anonymous that targeted PayPal, MasterCard, and Visa after they stopped electronic donations to WikiLeaks.

The irony of the efforts is that the GCHQ operative used almost precisely the same sort of techniques and methods that hackers who have often aligned themselves with Anonymous employ. The GCHQ employed a covert informant to conduct the campaign, and the informant used social engineering, denial-of-service attacks, and malware against the targets.

It’s not clear if there’s a connection between the GHCQ’s “CHIS” (covert human intelligence source) and the FBI’s turning of Hector “Sabu” Monsegur in June of 2011. But the timing of the GCHQ's operation against the Anonymous IRC corresponds to the time frame during which Sabu became a government informant.

Hacking the hackers

The PowerPoint slides show IRC logs between two individuals: “Gzero,” later identified as a now-25-year-old English hacker named Edward Pearson, and “p0ke,” a hacker who ironically may have been a co-author of Anonymous’ guide for IRC anonymity. Pearson was arrested and is serving a two-year prison sentence; p0ke’s identity (which has been redacted from the slides) was exposed, along with his Facebook and e-mail account data. In both cases, the GCHQ’s covert informant used IRC conversations about the targets’ efforts to gain access to identity data to steer the targets into traps that had been laid for them.

A hacker working with Gzero, whose username has been redacted, came onto the #OperationPayback IRC channel looking for a webpage with high traffic. The hacker's intent was to use the page in order to launch a browser exploit package against visitors that would install a SpyEye botnet and other malware on their PCs.

Enlarge/ A GCHQ slide reveals the details mined by a covert informant chatting with "Gzero."

The GCHQ informant said he had administrative access to a porn site that fit the bill, and Gzero later contacted him in private chat to discuss a deal—pointing the informant at the server running the exploit package. WHOIS data for the server was used to identify Gzero, and he was later convicted for stealing over 200,000 PayPal accounts, 2,700 credit card numbers, and the personally identifying information of over eight million British residents.

The informant also jumped into a conversation with p0ke when the hacker bragged to LulzSec’s Topiary (later identified as Jake Davis), “I has list of email:phonenumber:name of 700 FBI tards.” p0ke claimed the data was from a table called “FBI” in a database from a US Department of Agriculture website. The informant then got p0ke into a private chat and posted a Web link that redirected to a BBC story on hacktivism. This link also captured data about p0ke’s virtual private network provider, and the GCHQ was subsequently able to use that to identify p0ke and share his information with law enforcement.

DDoSing the DDoSers

The GCHQ claimed to take Anonymous IRC offline for over a day using a distributed denial-of-service (DDoS) attack against its network, apparently using a SYN flood—bombarding the network’s servers with bogus partial TCP-IP connections to use up network resources. (A similar attack was used against Ars last year after we reported on the “swatting” of security reporter Brian Krebs.)

In the summer of 2011—around the time of Sabu’s arrest and conversion to informant—the GCHQ was involved in coordinated effort with law enforcement to identify “top targets” within Anonymous, perform “Information ops” using the confidential informant, and go after the collective’s infrastructure. The DDoS attack by the GCHQ, called “ROLLING THUNDER” in the agency’s slide deck, was used in a trial run in early September. The attack took the server irc.anonops.li offline, and it may have affected any “hivemind” denial-of-service attacks launched using Anonymous’ denial-of-service tools.

The details of the “information ops” against Anonymous during the campaign, which was called Operation WEALTH, aren’t clear from the slides. However, the GCHQ apparently used the confidential informant to message individuals active in the IRC with information aimed at ending their involvement with the organization. The GCHQ slide deck reported, “80 percent of those messaged where [sic] not in the IRC channels one month later.”

...In both cases, the GCHQ’s covert informant used IRC conversations about the targets’ efforts to gain access to identity data to steer the targets into traps that had been laid for them.

I do not know that much about British law. In the United States, when law enforcement steers a target into a trap, it is called entrapment.

Entrapment is goading someone into doing something they wouldn't have done otherwise. "Steering" (to me) seems to imply someone was already going to do something, they were just making sure it happened someplace they could catch them.

I took it to mean steering them towards traps that enambled them to be identified, so that they could be linked to other (existing) crimes. Entrapment is where law enforcement is encouraging the person to commit the crime that they then try and prosecute them for.

...In both cases, the GCHQ’s covert informant used IRC conversations about the targets’ efforts to gain access to identity data to steer the targets into traps that had been laid for them.

I do not know that much about British law. In the United States, when law enforcement steers a target into a trap, it is called entrapment.

Entrapment is goading someone into doing something they wouldn't have done otherwise. "Steering" (to me) seems to imply someone was already going to do something, they were just making sure it happened someplace they could catch them.

I think a very significant portion of the DDoS participants could have been talked down from it, maybe a majority. Most of the participants were gullible (and not completely stupid) kids wanting to do it for the lulz; if you explained to them clearly enough the potential consequences of their actions and gave them a taste of the kind of information available, most of them would have realized that it wasn't worth their time.

As usual, governments are more interested in flexing their muscles and kicking in doors than using knowledge and wisdom to prevent undesired outcomes well before they happen.

Governments take the view that it's not illegal if the public don't know about it.

/OT wtf is it with these huge spy buildings and the massive space dedicated to car parking around them? surely with their near unlimited budgets they could build some underground multistory carparks nearby (just above the underground bunkers)

Well, there are many things that are only legal when the government does it, like using guns on people, driving at high speed and the like, etc... It's not really inconceivable to allow them to do it (though I don't know if it is already legal for them, as in if there is already regulation on the subject).

Since when did we in the west decide that spy agencies were part of the police forces? There has always been a rule in most free countries that the military can't engage in police work because policing is a social job, and the military is meant to kill and destroy things.

Since when did we in the west decide that spy agencies were part of the police forces? There has always been a rule in most free countries that the military can't engage in police work because policing is a social job, and the military is meant to kill and destroy things.

Since when did we in the west decide that spy agencies were part of the police forces? There has always been a rule in most free countries that the military can't engage in police work because policing is a social job, and the military is meant to kill and destroy things.

If you look around you'll find the lines aren't as clear as you make it. GCHQ is specifically allowed to help security services. The NSA's technically not allowed to snoop domestic traffic, but if they come across something domestic, nothing's stopping them from handing it to the FBI. Many Western European countries have gendarmes which are military police policing civilians. Not to mention the National Guard being pressed by the states into duty when civilian forces need help.

Well, there are many things that are only legal when the government does it, like using guns on people, driving at high speed and the like, etc... It's not really inconceivable to allow them to do it (though I don't know if it is already legal for them, as in if there is already regulation on the subject).

I can legally shoot someone if my life is in danger and I can go to a racetrack and go as fast as I want.

Law enforcement are treated differently from the general population when it comes to their jobs. Think of it this way: a cop in a car pursuing a guy trying to get away from him will be breaking the speed limits just as much as the cop's target. Federal agents can (and do) lie to people, but it's a felony to lie to them.

A retired cop on Long Island, NY accidentally killed an off-duty federal agent a couple of years ago. The agent interrupted a pharmacy robbery and was struggling with the robber - the retired cop thought the agent was the robber so he placed his gun against the agent's chest and pulled the trigger. If a non-cop had done that it would be murder of a police officer, but this was treated as an accidental death.

In other words, law enforcement gets to play by different rules. They can get away with murder. Literally. Are you surprised they feel they can go after people that they consider bad guys in ways that ordinary citizens cannot without risking prosecution?

The story sounds suspicious to me. It reads more like disinformation or a PR diversionary tactic to hide how the crack into Anon was actually accomplished.

Assuming the SYN attack on the Anon servers was to the URL listed there probably were other websites on the same box a SYN attack to an extreme could have taken down other websites on the same server revealing that an attack was under way. The website/server farm admins should have known an attack was under way.

wtf is it with these huge spy buildings and the massive space dedicated to car parking around them? surely with their near unlimited budgets they could build some underground multistory carparks nearby (just above the underground bunkers)

Since when did we in the west decide that spy agencies were part of the police forces? There has always been a rule in most free countries that the military can't engage in police work because policing is a social job, and the military is meant to kill and destroy things.

Um... change?

As far as I know the UK does not have a 'posse comitatis' law. Police and the army often work together especially in Northern Ireland.

wtf is it with these huge spy buildings and the massive space dedicated to car parking around them? surely with their near unlimited budgets they could build some underground multistory carparks nearby (just above the underground bunkers)

Modulo land cost, surface parking is cheaper to build and maintain?

I am not sure, but I think his point was, the number of cars around the building looked like it was more than the building could support. If you wish to hide the number of workers in your building, covered parking would be a good first step.

This is why the whole NSA business is complicated. I'm glad they got a bunch of punks steeling peoples credit card information. The bad guys use all sorts of technology to get away with crimes. We need people using tech to fight back. The problem is what they do with all of the info they get when they have access to it. We need oversight and transparency in the process after the tech and info has been used.

I really don't mind that the NSA has a lot of info on people as long as there is due process and open court when they try to use that info against people. We need to have fewer laws that convict people of petty crimes and all of this info would be relegated to boring pointless information.

Google has more information on me than any other source. I know for a fact that they sell that information. If the government really wanted to know everything about everyone they would become a marketing firm.

Governments take the view that it's not illegal if the public don't know about it.

/OT wtf is it with these huge spy buildings and the massive space dedicated to car parking around them? surely with their near unlimited budgets they could build some underground multistory carparks nearby (just above the underground bunkers)

How do you know they already don't and the cars in the parking lot aren't just plants or the workers they don't care if people know about?

On another note, this line strikes me as funny, "However, the GCHQ apparently used the confidential informant to message individuals active in the IRC with information aimed at ending their involvement with the organization." Makes me think it went down something like this.

I: Hey there.A: What's up?I: Ever thought this wasn't the life for you?A: What do you mean?I: Let's just say that your not very anonymous Mr. Harvey T. Rabbit of Indiana, PA.A: I see your point.

Since when did we in the west decide that spy agencies were part of the police forces? There has always been a rule in most free countries that the military can't engage in police work because policing is a social job, and the military is meant to kill and destroy things.

We didn't. GCHQ comes under the Foreign and Commonwealth office even though it is not part of the Foreign Office. Regardless of what it is, it's technically not military. And technically is what allows them to get away with all the stuff they've been getting away with.

So, you do understand that there are many things in life that the government is authorized to do that individuals aren't? It's illegal for you to do a great many things that it is legal for the government to do. Not sure why this should surprise anyone. If you doubt this, try demanding that your neighbours pay you 25% of their income under threat of being locked in your basement.

Sean Gallagher / Sean is Ars Technica's IT Editor. A former Navy officer, systems administrator, and network systems integrator with 20 years of IT journalism experience, he lives and works in Baltimore, Maryland.