Meet Anonymous International, the hackers taking on the Kremlin

http://www.theguardian.com/world/2015/apr/07/anonymous-international-hackers-kremlin

Version 0 of 1.

Around 10am on 14 August 2014, an unremarkable man walked into a café near Tishinskaya Square in Moscow. He ordered a coffee, sat down, opened up a cheap laptop and launched a few applications: a text editor, an app for encrypted chat, and a browser.

Then, he opened Twitter and wrote: “I’m resigning. I am ashamed of this government’s actions. Forgive me.”

The tweet immediately appeared on prime minister Dmitri Medvedev’s official Twitter account, visible to his 2.5m followers.

Taking a sip of his coffee, he wrote a few more tweets: “I will become a photographer. I’ve dreamed about it for some time”; “Vova [Putin]! You are wrong!”

The tweeter is a member of Anonymous International, better known as Shaltai Boltai (Humpty Dumpty in Russian), arguably the most famous hacker group in the country after claiming responsibility for a series of high-profile leaks.

In the past two years, they’ve gained access to documents detailing the Russian state’s game plan for a supposedly “grassroots” demonstration in Moscow in support of its actions in Crimea; details about how the Kremlin prepared Crimea’s secessionist referendum; and private emails allegedly belonging to Igor Strelkov, who claims he played a key role in organising the pro-Russian insurgency in Donetsk, Ukraine.

The group also released documents about how Concord, a company owned by Kremlin-connected restaurant owner Evgeny Prigozhin, apparently coordinates an army of pro-Putin internet trolls through an outfit called the Internet Research Agency.

Last week the collective released roughly 40,000 text messages apparently taken from the mobile phone of Timur Prokopenko, manager of the Kremlin’s Internet policy between 2012–2014.

Related: Salutin' Putin: inside a Russian troll house

Speaking about the Medvedev Twitter hack, one of Anonymous International’s members said they had “monitored him for two years, but nothing interesting ever happened, so we decided we’d just troll him instead”.

Thirty minutes after they sent the first tweet, Putin’s press secretary, Dmitri Peskov, announced to reporters, “I can say with high probability that we’re looking at a hacker attack.” The government soon confirmed it: “The prime minister’s Twitter account has been hacked. The last several messages posted are untrue.”

The first leaks

On a dark and humid evening in Bangkok in early January, I met one of the heads of Shaltai Boltai, where he told me the Twitter story. He wouldn’t tell me his name, forbade me from recording our conversation and refuses to let me describe his appearance. For the sake of convenience, I’ll call him Lewis. (After all, Lewis Carroll’s Alice in Wonderland, with its inside-out logic, most accurately captures the world of Russian politics, Shaltai’s members have said.)

It took three months of emailing to arrange a meeting. At first, it was supposed to take place in Istanbul, then in Kiev. I asked the group whether they were changing our meetings because the police were on their trail. “We don’t think so :) :) :),” they wrote. “We’ve got too many trails. Really, we’re not afraid of anything, honestly :) :).”

Really, we’re not afraid of anything, honestly :) :)

Back in December 2013, Anonymous International registered its website on Wordpress and later that month published the full text of Vladimir Putin’s New Year’s national address – several hours before it aired on television.

Over the next 12 months, they released what was mainly correspondence from email accounts and mobile phones belonging to Russian politicians of varying degrees of influence.

Igor Osadchy, named in the leaked emails as the director of a project tasked with placing “trolling” comments in foreign news media later sued Boltai Shaltai for personal data theft. A representative at Roskomnadzor, Russia’s federal agency for media oversight, then announced: “A court has determined that the information [published by Shaltai] must be deleted, but the website’s hosting provider has not responded to our notification. Therefore, our agency has ordered Internet Service Providers to block this blog.”

Acting on orders from Roskomnadzor, in July Russian service providers blocked access to the domain b0ltai.org. The group’s main Twitter account, @b0ltai, was also blocked.

Today, Shaltai’s website is accessible in Russia only via a virtual private network or a mirror site. The group also runs @b0ltai2, a duplicate Twitter account still unblocked in Russia that reproduces all the first account’s posts, down to its retweets.

In August, Anonymous International released the archives from three different email accounts allegedly belonging to Dmitri Medvedev, as well as correspondence from Duma deputy and United Russia member Robert Shlegel about an organised “troll” attack on the websites of major American and British news media (including The New York Times, CNN, BBC, USA Today, and The Huffington Post).

Our mission is to change the world for the better, helping to bring greater freedom and social awareness

In an interview conducted over encrypted chat, Anonymous International’s press secretary claimed that the group publishes leaks because it is “dissatisfied with the restrictions on free speech online and with Russia’s aggressive foreign policy.”

It has complaints about Russian domestic policy, too: “They only let the convenient candidates participate in elections,” and it’s “impossible to work peacefully in a small or medium business”.

Shaltai Boltai’s stated mission is “to change the world for the better, helping to bring greater freedom and social awareness”.

One of the group’s members quotes the 2009 film Watchmen, saying, “We don’t do this thing because it’s permitted. We do it because we have to. We do it because we’re compelled. Once a man has seen society’s black underbelly, he can never turn his back on it.”

‘Changing reality’

With a bang of the exhaust, we come to a halt in the centre of Bangkok, where Lewis suggests another ride, this time on the subway. If Lewis is to be believed, leaking documents in the public interest is Shaltai Boltai’s “side project”. The group’s main work is getting hired to dig up information about private and public individuals.

The whole company consists of a dozen people, he said. Apart from the technical staff, there are Shaltai and Boltai, who manage communications with the outside world, two co-founders (one of whom is Lewis), and a woman called Alice. “She’s a field officer doing extremely important work,” Lewis explains.

Our prices start at around $30,000. I won’t say how high they go. We earn enough to live comfortably and to travel.

The company’s structure, Lewis says, resembles an “online gaming clan”: the staff don’t know each other in person, but they spend hours chatting together every day. No one collects a regular salary, and the size of one’s earnings depends on how much he or she contributes to an operation. Fees are paid in cash, and sometimes in bitcoins.

I ask Lewis if the group has many clients? “We have a small circle of regular ones,” he says. “It’s enough for us. Our prices start at around $30,000. I won’t say how high they go. We earn enough to live comfortably and to travel.”

Buying and selling information, the group “are hired by private individuals and groups within the state, and we never work with anyone tied to the drug trade. But we maintain that we’re an independent team.”

At its core, Lewis says, their job is about “changing the current reality.”

“Generally, we only release information that’s socially useful. We never share personal data.” I ask him whether, if they had access to the data like that Edward Snowden leaked, would they publish it? “Most likely not. Not everything needs to be released.”

I ask Lewis if I can photograph his laptop, or his hat. He agrees and hangs his hat on a nearby fence so that none of the signs in the background are visible. “It would be easy to come here later, pay someone some money, and get the camera footage from this area,” Lewis says, as he buys some orange juice from a street vendor.

He takes a small bottle of gin out of his bag and has a sip. Then he fishes out the mobile he used to phone me from his pocket. Using a handkerchief, he rubs off the fingerprints and removes the sim card and battery, tossing them in different bins.

With that, he runs off to catch a train to the airport.

A longer version of this article originally appeared in Meduza English