Spanish Police Arrest Anonymous Operation Hackers

Spanish police have detained three men they believe to be members of the Anonymous Operation hackers collective, according to news reports.

Authorities believe the trio took part in a number of distributed denial-of-service (DDoS) attacks against a Sony PlayStation stoe and government Websites in Algeria, Chile, Colombia, Egypt, Iran, Libya and New Zealand, Spain’s national police said in a statement on June 10. The three men also allegedly attacked Spanish government, law enforcement, banking and media sites.

Not The Sony Breach Hackers

According to the police, they are not suspected of having taken part in the attack on Sony’s PlayStation Network in April that compromised over 101 million user accounts, or in the DDoS attacks that preceded the massive data breach. Anonymous has already denied involvement but has acknowledged that individual members could have taken part independently.

“Police arrested 3 #Anonymous leaders in Barcelona, Alicante & Almería. They attacked governments of Egypt, Algeria, Libya, Colombia,” Spanish authorities posted on Twitter.

Spanish law enforcement launched an investigation in October after the Spanish Ministry of Culture’s Website was hit by a DDoS attack in protest against a Spanish law on illegal downloads. The Technological Investigation Brigade, part of the National Police, analysed more than two million lines of chat logs as well as Web pages to track down the suspects.

Police also posted a screen capture of an online chat room the suspects frequented.

In the Almeria raid, police confiscated a server owned by one of the suspects. Luis Corrons, technical director at Panda Labs, the research arm of Panda Security, speculated the information on the server could lead law enforcement to other Anonymous members. Police uncovered software used to make malware and sophisticated encryption tools as well as the Low Orbit Ion Cannon software Anonymous uses to carry out its DDoS attacks.

Police Claims May Be Premature

The police’s claim of “dismantling” Anonymous in Spain may be premature since it is actually just a loosely knit group of individuals who band together to participate in various online activities. Anonymous is a “highly anarchic” organisation with no strict hierarchy, Corrons wrote in a Panda Labs blog post.

Anonymous members make decisions collectively and figure out their plans through forums and general voting. Not everyone participates, or even supports, all “operations”, so it is difficult to tell who is involved and at what level.

“I am very much afraid that the fact that the ‘main leaders of the Anonymous group’ in Spain are now under arrest does not mean the group will cease its activities,” Corrons wrote.

While it is possible the suspects took part in some of the attacks, there is no evidence they have any kind of leadership role, Corrons said.

All three men were Spanish and in their 30s, Reuters reported. One worked in the merchant navy. They are accused of co-ordinating computer hacking attacks from a server set up in a house in Gijon, a northern port city in Spain. The statement did not specify when the men had been taken into custody.

They are expected to be charged with forming an illegal association to attack public and corporate Websites, a charge that faces a potential sentence of up to three years in prison, The New York Times reported.

Squaring Up To NATO

Anonymous had threatened NATO with potential attacks after it published a report condemning the group. “Do not make the mistake of challenging Anonymous… If you cut down one Anon, 10 more will join us purely out of anger at your trampling of dissent,” the group warned.

“We are very likely to see some kind of retaliation actions from Anonymous over the next few hours, as they are used to getting away with their actions,” Corrons said.

However, shortly after the police made their announcement, it appeared that AnonNews, the site commonly used by Anonymous to issue press releases, was unavailable. AnonNews was “currently experiencing heavy DDoS attacks combined with a spike in legitimate traffic”, read a message on the site.