Case Study | 2016 | RELEASE 1.0 Cascades: The Anonymous Hack of HBGary (Part A) OPEN TECHNOLOGY INSTITUTE | @NEWAMERICA | CASCADES (A) 1 OPEN TECHNOLOGY INSTITUTE | @NEWAMERICA | CASCADES (A) 2 This case study was created as part of the Open Technology Institute’s (OTI) effort to create a curriculum focused on how digital technology is transforming public policy and governance. It is intended for use in a classroom setting. OPEN TECHNOLOGY INSTITUTE | @NEWAMERICA | CASCADES (A) 3 CASCADES In January 2011, Aaron Barr thought he had research and plans in early February, Anonymous discovered a goldmine. And it could not come unleashed an attack that overwhelmed HBGary, 5 soon enough. Since becoming the CEO of HBGary Inc., Barr’s firm, and Barr himself. More Federal (a company that sold IT security services specifically, Anonymous—which as Coleman 6 to the federal government) in fall 2009, Barr had wrote, was “ready to rumble” after seeing The struggled to generate revenue, occasionally selling Financial Times piece—defaced the company’s “social media training[s]” to private firms but website, released tens of thousands of the failing to secure the large contracts he had company’s e-mails, bragged about deleting a predicted at the start of his tenure.1 Now he terabyte of the firm’s data, and took over Barr’s 7 believed that he had uncovered the key to Twitter account. The hackers posted doctored identifying the leaders of Anonymous, a collection images of Barr, released e-mails detailing his of hacktivists that had gained prominence for marital strife, and went so far as to publish Barr’s (among other things) carrying-out attacks against home address and social security number as well 8 several financial firms that had stopped processing as several tweets with extremely crude content. donations to WikiLeaks.2 Barr planned to share Among them: “Sup mother[redacted]: I’m CEO of his findings in February at B-Sides, a technology a shitty company and I’m a giant media- security conference in San Francisco, and he [redacted]. Lol check out my [redacted] Greg’s believed that the presentation (titled, “Who Needs site: rootkit.com.” And “Okay my fellow the NSA When We Have Social Media”) could Anonymous [redacted] we’re working on bringing 9, 10 jumpstart his career and resolve HBGary Federal’s you the finest Lulz as we speak. Stay tuned!” financial woes.3 As Gabriella Coleman, a cultural For the HBGary brand, the financial fallout anthropologist at McGill University, wrote in her (estimated to be in the millions of dollars) and recent book on Anonymous, “If HBGary was really broader damage was significant.11 “They [the badass enough to identify the movers and shakers hackers] have committed a crime against our behind Anonymous—before even the FBI— company, and, unfortunately, we are legally corporate executives would, with good reason, be bound,” said Penny Leavy, the President of falling all over themselves to employ them.”4 HBGary, Inc. For the IT security community, the The plan backfired. After HBGary leaked the story incident was frightening. “[It] makes me want to to The Financial Times, which reported on Barr’s change all my PWs [passwords] and re-evaluate OPEN TECHNOLOGY INSTITUTE | @NEWAMERICA | CASCADES (A) 4 my processes,” tweeted Jeremiah Grossman, the focused on selling software that helped organizations founder of WhiteHat Security, a firm that in the financial, healthcare, and public sectors specializes in web security, adding, “Do not poke identify and understand IT security threats. the bear.”12 And for the hacktivists, it was a However, in 2009, Hoglund, looking to expand, demonstration of power. “You’ve tried to bite at decided to establish a subsidiary that would focus on the Anonymous hand,” the hacktivists wrote on selling the company’s services to the U.S. federal HBGary Federal’s website, “and now the government.16 The new group was called HBGary Anonymous hand is bitch-slapping you in the Federal, and HBGary, Inc.—which at the time had 30 face.”13 employees and would soon sell for $24 million— would own 10% of the organization.17 As the initial shock of the attacks wore off, Barr, his colleagues, and industry experts found To lead the group, Hoglund hired Barr, a former themselves grappling with a number of difficult military official who had started to build a reputation questions, with important policy implications. in the IT security industry and was eager to run his How did a technology security firm that was own company. Barr had begun his career in the Navy supposed to be demonstrating and selling best where over the course of 12 years and multiple practices get hacked so easily? How did Barr fail to international deployments (including a period in realize that his research—and his public comments Kosovo when he came under fire), he had served as a surrounding it—would provoke such a forceful signals intelligence officer.18, 19 Hoglund felt this response? And what lessons can technology experience would help Barr market the company’s experts, public policy officials, and academics products to the U.S. government; he also believed glean from this crisis as they try to make the that Barr’s more recent experience at Northrop Internet more secure? Grumman, a large aerospace and defense contractor where Barr had helped to lead multi-million dollar projects, reinforced his credibility. As Hoglund wrote Background in an e-mail to colleagues upon Barr’s hiring, “We have known Aaron and Ted [Ted Vera was another Headquartered in Sacramento, CA and with a employee hired alongside Barr] for more than 5 sales office in Washington, D.C., HBGary, Inc. was years. These two are A+ players in the DoD a mid-sized technology security company with a contracting space and are able to ‘walk the halls’ in high-profile CEO and which in 2011 was trying to customer spaces.”20 Hoglund added in an interview gain a foothold in the market for federal in March 2011, shortly after the Anonymous hack of government IT security services. The firm had HBGary, “Aaron has a very high IQ. He’s a very been founded in 2003 by Greg Hoglund, a smart individual. He also has an incredibly good technology-security entrepreneur and researcher reputation, or he did at that time.”21 who had gained recognition for launching another IT security firm, Cenzic, Inc., and for his extensive For his part, Barr felt that the opportunity to run his work on “rootkits,” software that allows malware own company was too good to pass up. “I’d always and viruses to penetrate a computer without had an itch to try the small-business side and work detection.14, 15 HBGary, Inc. had traditionally OPEN TECHNOLOGY INSTITUTE | @NEWAMERICA | CASCADES (A) 5 in a more fluid, less process-oriented Coopers, there had been 42.8 million environment that had a lot of technical information security incidents worldwide over innovation,” he explained, “and so I decided to the previous year, costing victims an average of give it a try.”22 $2.7 million;27 and in the same year, the Center for Strategic and International Studies (CSIS) IT Security released a report estimating that cybercrime cost the world economy more than $445 billion Over the last decade, the IT security field had (nearly 1% of the world’s income) per year.28 become extremely lucrative because of both the What’s more, some of the individual attacks had world’s increasing dependence on the Internet devastating consequences. The “Love Letter” and the difficulty of securing it. Originating virus, for example, cost between $4 and $10 from academic and U.S. government research billion, which according to James Adams, a that began in the 1960s, the Internet was successful entrepreneur and widely published initially used to connect regional academic and author in the cyber-security field, is “the military networks in the United States.23 equivalent of a complete obliteration of a major However, by the first decade of the 21st century, American city.”29, 30 this vast computer network had become foundational to commerce, communication, and Even as experts called for improved cyber- social interaction. According to a 2011 McKinsey security, they disagreed about how best to report, the Internet had been responsible for achieve it. This stemmed in part from a more than one-fifth of GDP growth in mature foundational disagreement about why the economies over the previous five years. During Internet was insecure. Some argued that the the same period, Facebook had exploded to problem was technological. Seen from this point 24 more than 800 million users. “The Internet,” of view, developers—dating to the Internet’s argued Manuel Castells, a professor of genesis—had prioritized ease of use, not communication technology and society at USC, security. “The Internet,” suggested Joseph “is the decisive technology of the information Menn, a technology industry author and age….”25 Reuters reporter, “was basically in beta when it got out of the lab and escaped, but now the Unfortunately, efforts to secure the Internet had world economy depends on it.”31 Others, not kept pace with the platform’s increasing however, felt that people, not technology, were significance; in particular, individuals were the linchpin of IT security. This perspective considered vulnerable to malicious attempts to emphasized that security hinges more on the obtain sensitive information (e.g., credit card people operating at the endpoints of electronic information), and organizations were connections making good decisions and susceptible to attacks that attempted to disable keeping their defenses up-to-date.32 Put their services and unearth their data.26 The differently, networks help computers connect frequency and financial impact of these and communicate with one another, but it is incidents was disturbing.