Behind the Mask: a Computational Study of Anonymous' Presence On
Total Page:16
File Type:pdf, Size:1020Kb
Behind the Mask: A Computational Study of Anonymous’ Presence on Twitter Keenan Jones, Jason R. C. Nurse, Shujun Li School of Computing & Kent Interdisciplinary Research Centre in Cyber Security (KirCCS) University of Kent, UK fksj5, j.r.c.nurse, [email protected] Abstract Interestingly, there are a significant number of Twitter accounts claiming some form of affiliation with Anony- The hacktivist group Anonymous is unusual in its public- mous. From these accounts’ interactions and posts, one can facing nature. Unlike other cybercriminal groups, which rely begin to establish a sense of how the structure and mes- on secrecy and privacy for protection, Anonymous is preva- sage of Anonymous as a group is presented. Accordingly, lent on the social media site, Twitter. In this paper we re- examine some key findings reported in previous small-scale in this research we aim to use the findings of our large- qualitative studies of the group using a large-scale compu- scale study of Anonymous Twitter accounts to examine the tational analysis of Anonymous’ presence on Twitter. We contentions of smaller-scale, often interview-focused stud- specifically refer to reports which reject the group’s claims ies of the group. Such studies reject claims by the group of leaderlessness, and indicate a fracturing of the group af- to its nebulous, leaderless nature (Uitermark 2017; Olson ter the arrests of prominent members in 2011-2013. In our 2013). Furthermore, they suggest that Anonymous fractured research, we present the first attempts to use machine learn- as the result of the arrests of key affiliates (Goode 2015; ing to identify and analyse the presence of a network of over Olson 2013); a factor which again refutes the argument of 20,000 Anonymous accounts spanning from 2008-2019 on a decentralised group structure. the Twitter platform. In turn, this research utilises social net- To achieve this aim, this paper uses computational meth- work analysis (SNA) and centrality measures to examine the distribution of influence within this large network, identifying ods – specifically machine learning classifiers, social net- the presence of a small number of highly influential accounts. work analysis (SNA), and topic modelling – to investigate Moreover, we present the first study of tweets from some of how the findings of qualitative studies of the group, whose the identified key influencer accounts and, through the use of results are largely derived from interviews and the exami- topic modelling, demonstrate a similarity in overarching sub- nation of secondary sources (i.e., newspaper reports) (Ol- jects of discussion between these prominent accounts. These son 2013; Uitermark 2017), compare to a larger-scale study findings provide robust, quantitative evidence to support the of Anonymous’ actual behaviours on Twitter. Specifically, claims of smaller-scale, qualitative studies of the Anonymous through our work, this paper: collective. • Identifies the presence of a sizeable network of Anony- mous Twitter accounts – containing more than 20,000 1 Introduction Anons – using machine learning methods. The hacker/hacktivist collective Anonymous is a group • Uses SNA and centrality measures to map how influence whose nebulous and contradictory ethos provide a source is distributed across the Anonymous network, confirming of both bafflement and fascination to those endeavoring to the findings of smaller-scale studies (e.g., (Olson 2013)) study them. Originating from the /b/ board of the image that influence is generally the purview of a small number arXiv:2006.08273v1 [cs.SI] 15 Jun 2020 sharing site 4Chan, in which the board’s participants in- of members. teract anonymously with each other, this sharing of a sin- • Examines how this network has changed over time rel- gular “Anon” (a member of Anonymous) identity began ative to the arrests of key Anons in the 2011-2013 pe- to resonate with participants on this site, setting the stage riod (Uitermark 2017). This longer-term study reveals a for growth into the group we know today (Goode 2015). network that is seeing a rise in account inactivity, and a A group famed for their campaigns (dubbed ‘Ops’) target- decrease in new members. ing many organisations such as The Church of Scientol- • Compares the overarching tweet content of ‘key’ influ- ogy (Goode 2015), the security firm HBGary (Olson 2013), encer accounts using topic modelling, finding that each as well as ISIS, and the governments of the United States account’s tweets follow similar lines of content. Again and Australia (Goode 2015). strengthening the findings of smaller-scale, qualitative studies. * Published at the 14th International AAAI Conference on Web and Social Media (ICWSM 2020). Please cite the ICWSM version. From this, our research’s large-scale study of Anonymous https://www.aaai.org/ojs/index.php/ICWSM/article/view/7303 on Twitter concludes that, contrary to the group’s claims, Anonymous displays a far less organisationally flat structure Uitermark and Olson described the existence of a ‘#Com- than the group aspires to. Such findings have been suggested mand’ room on IRC, in which these self appointed leaders by past smaller-scale studies, but as far as we know our work – without the knowledge of other Anons – would plan the is the first large-scale study to follow a more systematic and group’s Ops. Moreover, a considerable change was noted in computational approach. the group after the arrest of several members of the #Com- It is expected that the insights provided into this group mand board (also members of the Anonymous splinter group will be of general interest to researchers, cyber security pro- LulzSec (Olson 2013)) in 2012. After this, Uitermark (2017) fessionals, members of the law enforcement community and concluded that the group had fragmented considerably, stat- the public, by increasing our overall understanding of amor- ing that: phous hacktivist groups, and their use of social media. Anonymous lived on ... as a set of symbols and com- munication channels ... appropriated by a range of dif- 2 Background ferent groups for a range of different purposes. Uitermark (2017), in his qualitative analysis of Anonymous’ In turn, the group seemed to have lost the coherence present power dynamics, described the group as follows: in its early days, leading to a drastic fall in notable operations and exploits (Goode 2015). Anonymous lacks a central authority, has no founda- An additional key point of Anonymous, as elucidated by tional ideology, does not represent categorically de- Nurse and Bada (2018), is that it is a group that has a strong fined groups, does not consistently endorse ideologies, “public-facing nature”. Their work noted the presence of and has no fixed objective. several Twitter profiles controlled by Anonymous affiliates, This structure allows for the prevalence of multiple conflict- and the group further confirmed this via its willingness to ing motivations and ideological goals, with the group ad- engage with journalists; be it through IRC or even via in- vocating for nihilism and idealism, libertarianism and so- terviews (Olson 2013). By being public facing, Anonymous cialism, pranks (often referred to as ‘lulz’ a corruption of can easily capture more media attention, and bring new re- LOL (laugh out loud), generally used to describe acts that cruits to whichever Op the group, or a splinter of the group, sought humour at the expense of others) and activism, free- is executing. dom of speech and the suppression of speech (Olson 2013; Goode 2015). As the group matured over time, these targets 3 Related Work and goals began to be referred to as ‘Ops’ by members of Due to the strong influence that high reputation players can Anonymous (Olson 2013). The inception of these Ops gen- wield on a particular network, it is of interest to be able erally followed the nebulous structure that the group sub- to identify who these key players are. In (Nouh and Nurse scribed to, with the success of an Op directly tying in to its 2015), the authors identified a social network of activists ability to attract enough Anonymous members to join it (Ol- operating on Facebook, and then deployed a variety of tech- son 2013). niques to identify the key players within this network. This Instead of describing Anonymous using group-based the- research utilised centrality measures such as betweenness ory, Beraldo used the phrase “contentious brand” – a group and eigenvector centrality to assess the influence of activists defined, and singularly united, by the “Anonymous signi- within the group. These metrics give a sense of how inter- fier” (Beraldo 2017). This notion of signification is central connected the network is, its durability, and which of the to Anonymous, from the Guy Fawkes mask, to the head- nodes in the network wield the most influence. From this, a less businessman, to the grandiose “We are Legion” style of disparity between the activity of a user and their influence on communication (Beraldo 2017; Olson 2013). And it is the the network was identified, as well as the presence of sub- freely available nature of these methods of identification that communities with stronger ties within the wider network. In allow for this movement to be so amorphous. As highlighted doing so, this work lays out a strong method for gaining a by Nurse and Bada (2018), the Anonymous Twitter account good analytical understanding of influence within a given @GroupAnon stated: “No, this is not the official #Anony- social network. mous account. There is no official account. We have no cen- Social network graphs, combined with PageRank central- tral leadership. (Other than the FBI/NSA, joke)”. And the ity measures, have also been utilised by Alfifi et al. (2019) central reason there can be no official Anonymous account in their study of ISIS on Twitter. This was done via the con- is that its membership is entirely reliant on the utilisation struction of a network graph representing the connections of the Anonymous brand, something freely available to all, between ISIS accounts via their retweets, and subsequently rather than something that can be formally accessed by se- utilised PageRank to estimate the overall influence that ISIS curing an approved membership.