Harding, Luke - WikiLeaks - Inside Julian Assange's War on Secrecy

The Jester’s attack was the first intriguing skirmish in what turned into a serious cyber-fight. Big US corporations tried to push Assange off the internet. But he was defended by a committed online group of underage libertarians and cyber-freaks. In this warfare, some would discern the beginnings of a decentralised global protest movement. Others would dismiss it as the antics of a handful of sexually frustrated young men. But there was no doubt WikiLeaks was under siege.

To dodge the DDOS attacks, Assange diverted the site’s main WikiLeaks page – though not the one with the diplomatic cables on it – to run on Amazon’s EC2 or “Elastic Cloud Computing” service. The cablegate.wikileaks.org directory and its contents remained outside Amazon, on a server located in France. Amazon’s commercial service was big enough to absorb DDOS attacks. On Tuesday 30 November there were more attacks against Amazon’s main site and WikiLeaks’ France-hosted cables site. Using machines in Russia, eastern Europe and Thailand, the assaults were larger and more sophisticated. Nonetheless, WikiLeaks managed to weather the storm, aided by Amazon’s powerful EC2 servers. Assange publicised that he was hiring them.

Senator Lieberman upped his campaign. He called Amazon and urged them to stop hosting WikiLeaks. Lieberman’s browbeating worked. Amazon removed WikiLeaks from its servers. Instead of admitting it had come under political pressure, the firm claimed in weasel tones that WikiLeaks had breached its “terms of service”. “It’s clear that WikiLeaks doesn’t own or otherwise control all the rights to this classified content,” Amazon said. “Further, it is not credible that the extraordinary volume of 250,000 classified documents that WikiLeaks is publishing could have been carefully redacted in such a way to ensure they weren’t putting innocent people in jeopardy.”

This was a statement Amazon had no factual basis to make. Only a tiny proportion of the 250,000 cables had been published, and each one was, in fact, being carefully redacted. It seemed plain that Amazon executives were regurgitating lines fed to them by politicians.

The senator hailed Amazon’s “right decision” and urged “any other company or organisation that is hosting WikiLeaks to immediately terminate its relationship with them”. He went on: “WikiLeaks’ illegal, outrageous, and reckless acts have compromised our national security and put lives at risk around the world. No responsible company – whether American or foreign – should assist WikiLeaks in its efforts to disseminate these stolen materials.”

The WikiLeaks team had used free software to generate a graphic display showing an overview of the cables’ classification, number and other general data. The small company that licensed it, Tableau Software, removed the graphic from its public site – also feeling the pressure (though there was no direct contact) from Lieberman’s office. The dominoes then started to fall. The company EveryDNS, which provides free routing services (translating human-readable addresses such as wikileaks.org into machine readable internet addresses such as 64.64.12.170) terminated the wikileaks.org domain name. It also deleted all email addresses associated with it. Justifying the move, EveryDNS said the constant hacker attacks on WikiLeaks were inconveniencing other customers.

In effect, WikiLeaks had now vanished from the web for anyone who couldn’t work out how to discover a numeric address for the site. WikiLeaks shifted to an alternative address, www.wikileaks.ch, registered in Switzerland but hosted in a Swedish bunker built to withstand a nuclear war.

Fresh problems surfaced: PostFinance, the Swiss postal system, closed Assange’s bank account, on the basis that he was not living in Geneva, as required by the rules. PayPal, owned by the US auction site eBay, said it would suspend WikiLeaks’ account there, due to “violation of the PayPal acceptable use policy”. A spokesman said the account “cannot be used for any activities that encourage, promote, facilitate or instruct others to engage in illegal activity”. It later emerged that the US state department had written to the company on 27 November – the eve of the cables’ launch – declaring that WikiLeaks was deemed illegal in the US. On Monday 6 December, the credit card giant MasterCard followed suit, saying that WikiLeaks “contravened rules”. On Tuesday, Visa Europe did the same. These were popular and easy methods of donating online; seeing both closed down shut off much of WikiLeaks’ funding. (Critics pointed out that, while WikiLeaks was judged off-limits, the Ku Klux Klan’s website still directed would-be donors to a site that takes both MasterCard and Visa.) It was a wounding blow and left Assange struggling to pay his and WikiLeaks’ growing legal bills.

These salvoes against WikiLeaks did not go unanswered: they triggered a backlash against the backlash. Fury raged online at such a demonstration of political pressure and US corporate self-interest. While polls suggested many Americans backed a shutdown of WikiLeaks, others were angered by the suppression of free speech; and far more outside the US thought the company cave-ins were a bad portent for free expression on the internet.

Into the arena stepped “Anonymous”, a grouping of around 3,000 people. Some were expert hackers in control of small-scale botnets: others were net newbies seeking a cause to rally around. It was a loose collective, mainly of teenagers with time on their hands, and older people (almost all men) with more nous and technical skills. The Anonymous crowd was only a group in the loosest sense, the Guardian ’s technology editor Charles Arthur wrote: “It’s more like a stampeding herd, not sure quite what it wants but certain that it’s not going to put up with any obstacles, until it reaches an obstacle which it can’t hurdle, in which case it moves on to something else.”

Anonymous – which grew out of the equally chaotic “/b/” messageboard on the discussion site 4chan.org – had in the past tormented the Scientologists, reposting videos and leaking secret documents that the cult hoped to suppress. Anonymous’s broad manifesto is to fight against the suppression of information – but its members were not above childish actions simply to annoy and frustrate web users for their own amusement (known as “doing it for the lulz”). Anonymous supporters turned up at demonstrations from time to time – some of them wearing the same spooky Guy Fawkes mask that adorned the group’s Anony_Ops Twitter page. “It’s complex, puerile, bizarre and chaotic,” one of them told Arthur.

Operation Payback had previously been directed against the websites of law firms that pursued online music pirates, as well as against the Recording Industry Association of America (RIAA). Now it was the online payment firms’ turn for “payback”. Despite having no hierarchy or recognisable leader, on Wednesday 8 December Anonymous hackers forced the main website of MasterCard offline for several hours. They temporarily disrupted Sarah Palin’s credit card account. Anonymous also claimed to have knocked out PostFinance’s site and that of the Swedish prosecutor’s office. Some Anonymous supporters posted a “manifesto”. “We support the free flow of information. Anonymous is actively campaigning for this goal everywhere in all forms. This necessitates the freedom of expression for the internet, for journalism and journalists, and citizens of the world. Though we recognise you may disagree, we believe that Anonymous is campaigning for you so that your voice may never be silenced.”

What effect the attack had on MasterCard’s actual financial operations is unclear: the company did not say whether transactions (which would be carried out over secure lines to its main computers) were affected. It largely ignored the attack, hoping not to inflame the attackers. The tactic worked; Anonymous next considered turning its ire on Amazon and PayPal, but the disorganised nature of the group meant they could not muster enough firepower to knock either site offline; Amazon was too big, while PayPal withstood some attacks. The suggestion made privately was that the powerful hackers who had acted against MasterCard did not want to inconvenience themselves by taking out PayPal, which they used themselves all the time.