Belarus's New Revolutionaries

Russia’s military began sending large numbers of weapons and troops into Belarus in late January. The official purpose of the movement was a joint military exercise, but Belarus, which has a 650-mile border with Ukraine and a government closely aligned with Moscow, was also a logical staging point for Russian President Vladimir Putin to carry out an invasion.

Several days after the troops arrived weird things started happening to the computer systems that ran the Belarus national railway system, which the Russian military was using as part of its mobilization. Passengers gathered on train platforms near Minsk, the capital, watched as information screens flickered and normal messaging was replaced by garbled text and an error message. Malfunctioning ticket systems led to long lines and delays as damaged software systems caused trains to grind to a halt in several cities, according to railway employees and posts that circulated on Belarusian social media.

The cause of the delays was a ransomware attack in which hackers had encrypted crucial files on the railway’s computer systems, rendering them inoperable. The perpetrators of such attacks usually demand money in exchange for unlocking the seized files. But the assailants in this case, a group of hackers identifying themselves as the Cyber Partisans, said they would provide the key to unlock the computers only if Russian troops left Belarus and the Belarusian government freed certain political prisoners.

The authoritarian government of Alexander Lukashenko was well aware of the Cyber Partisans, who’d become a key part of an opposition movement openly trying to overthrow his government. Lukashenko, a former Soviet official who’s been president of Belarus since 1994, is widely known as Europe’s “last dictator.” In 2020 he claimed victory in an election that the US and other countries have declared fraudulent, then ordered a violent response to the subsequent protests. The result has been a grinding conflict between his government and a broad movement of dissidents.

The anti-Lukashenko movement has been notable for the way it’s mixed analog forms of popular protest with online activism. Lukashenko’s opponents started by breaking into the websites of the government and state news agencies, a form of politically motivated hacking with a long history. Since then they’ve begun to branch into cyberattacks that result in physical damage, a tactic traditionally seen as the domain of state-sponsored agents. The result is beginning to look like a new model for revolutionary groups seeking to wage asymmetrical warfare, says Gabriella Coleman, a Harvard professor and an expert on hacking culture. “They are really innovating in a way I have not seen before,” she says of the Cyber Partisans. “It’s like traditional forms of sabotage, but using computer methods. What they are doing has taken hacktivism to the next level.”

In the purest sense, the cyberattack on the train system didn’t succeed. Russian troops didn’t leave the country, and Belarus didn’t free the political prisoners. But the train system remains impaired. The operation also signaled a major escalation in what had been a domestic conflict. The Belarusian dissidents now see a single, broader struggle against both Lukashenko and Putin and have begun to join forces with an informal and chaotic global coalition of pro-Ukraine hackers.

These groups have targeted dozens of Russian government agencies, dumping huge troves of stolen emails and documents online. Andriy Baranovych, a spokesman for the Ukrainian Cyber Alliance, one of the groups working with the Cyber Partisans, says that while information gathering is a goal of his organization, it’s also moving past that: “Political information has little value now. We are trying to cause disorder, disruption, deception—anything that could delay or stop Russia’s actions.”

Aliaksandr Azarau, a former Minsk police chief, arrived at a cafe near Warsaw’s central rail station one day in mid-March to tell the story of how he joined what he considers a war against Lukashenko’s government. Azarau, 45, is a stocky guy in a checked shirt and black jacket, with a piercing stare. He mentioned that he has to be wary of spies as he travels around Poland and regularly glanced at his phone for updates on the fighting in Ukraine.

For more than two decades, Azarau was a police officer in Belarus, working as a detective in a department focused on human trafficking, illegal immigration, and religious extremism. He rose to become a lieutenant colonel, heading a unit of an organized crime and corruption agency. He says he never supported Lukashenko but avoided criticizing the government until August 2020, when he says he personally witnessed fraud in the presidential election and overheard commanders issue what he described as illegal orders to attack and arrest peaceful pro-democracy protesters.

Azarau quit the force and fled to Poland, where he was later joined by his wife and two young daughters. He quickly fell in with the Belarusian exile community in Warsaw and signed up to join ByPol (the name is shorthand for Belarus Police), a group of self-described “honest officers” from Belarus’s law enforcement community who were advocating for free and fair democratic elections.

ByPol’s members weren’t hackers. But they soon linked up with the Cyber Partisans, who showed how their skills could help gather evidence of human-rights violations that could be used to argue for sanctions against government officials.

The hackers broke into government websites. They disclosed mortality statistics indicating that tens of thousands more people in Belarus died from Covid-19 than the government had publicly acknowledged. They also began releasing data including secret police archives, lists of alleged police informants, personal information about top government officials and spies, video footage gathered from police drones and detention centers, and secret recordings of phone calls from a government wiretapping system. ByPol members, with their knowledge of the inner workings of the regime, helped to analyze, authenticate, and distribute the hacked files.

Azarau says that information gathered by the hackers has been vital in documenting police abuses. But the cyberattacks were useful for doing more than simply embarrassing Lukashenko. One database the Cyber Partisans broke into included 10 million passport and driver’s license photos, which ByPol has used to create its own facial recognition system. It’s used it to identify suspected spies, as well as police officers shown attacking protesters in videos. If the group has a picture of a suspected Belarusian spy, it runs a check on the photograph. “People ask us, ‘Who is this person?’ We can say that it is not a problem, if it is just a student,” Azarau says. “Or we can see if it is a spy.”

LulzSec Interview: the full transcript

Last week, hacker collective LulzSec returned with a bang, attacking a series of websites owned by Rupert Murdoch's News International in apparent response to the ongoing phone hacking scandal.

For 50 days between May and June, the tight-knit, six-strong group made headlines across the world, rising to almost instant notoriety after perpetrating a series of audacious cyber attacks on high-profile government and corporate websites, before abruptly announcing that they would disband. Among just a few of LulzSec's targets: Sony, the US Senate, the CIA, the FBI and even the UK's Serious Organised Crime Agency.

The authorities continue to try to track them down, and on Tuesday 20 suspected hackers were arrested in the UK, US and Netherlands as part of an ongoing international investigation. In a joint statement with an affiliated network of hackers known as Anonymous, LulzSec responded to the authorities directly. "We are not scared any more," they wrote. "Your threats to arrest us are meaningless as you cannot arrest an idea."

Earlier this month, two weeks after they had announced their apparent split, I managed to track down "Topiary", a founding member of LulzSec and self described "captain of the Lulz Boat". The interview was long - almost three hours - and covered lots of ground. But a great deal of what Topiary told me never made it in to the final write up, published by the Guardian, due principally to restrictions of space.

It was troublesome, deciding what to include and what to omit; the entirety of the interview was valuable. So rather than let the sections that were not printed disappear into the ether, the most sensible thing to do, I felt, was to have the full transcript published here in its entirety.

In the sections that were until now unpublished, Topiary explains how he first became involved in hacktivism and pays credit to his fellow hackers. He details the basis for extortion claims levelled against LulzSec by one US security company; reveals that he recently engaged in a bout of philanthropy, donating thousands of dollars to organisations including WikiLeaks; and also takes time to talk politics - blasting the US government, who he says are "scared of an uprising"... (click read more below for the full interview.)

Why LulzSec went on the Attack

Its audacity was brazen and apparently fearless. Among its high-profile victims were Sony, the CIA, the FBI, the US Senate and even the UK's Serious Organised Crime Agency. Exposing frailties in government and corporate networks, the group leaked hundreds of thousands of hacked passwords, and in the process garnered more than a quarter of a million followers on Twitter. But after just 50 days, on 25 June, LulzSec suddenly said it was disbanding.

Just hours before this announcement, the Guardian had published leaked internet chat logs revealing the inner workings of the group, which appeared to consist of six to eight members. The logs showed that authorities were often hot on their heels, and that after an attack on an FBI-affiliated website two hackers had quit LulzSec as they were "not up for the heat". As media attention mounted, Ryan Cleary, an Essex-based 19-year-old suspected of affiliation to LulzSec, was arrested in a joint UK-US "e-crime" investigation. Had the pressure simply got too much to handle?

To find out, the Guardian tracked down one of LulzSec's founding members, "Topiary". A key figure in the tight-knit group, he was revealed in the logs to have managed LulzSec's Twitter account and to have written their press releases. After verifying his identity by asking him to send a direct message from the account – "This is the captain of the Lulz Boat," he confirmed – we began a long conversation by Skype.

"I know people won't believe this, but we genuinely ended it [LulzSec] because it was classy," he says. "The leaks we promised happened . . . 50 days were reached, we just about hit 275,000 Twitter followers, things were on a high, so we redirected our fans to [hacker collective] Anonymous and [hacking movement] AntiSec and wrapped it up neatly . . . A high note, a classy ending, a big bang, then a sail into the distance."

LulzSec's jovial public image undoubtedly helped it achieve unusual popularity within a short time. Its stated aim was to provide "high-quality entertainment at your expense," and the word "Lulz" is itself internet slang for laughs. The group's popularity spiked after it planted a fake story on US news outlet PBS.com in protest over what it claimed was a misrepresentative WikiLeaks documentary made by the broadcaster. The story falsely reported that rapper Tupac Shakur, who was killed in a shooting 15 years ago, had been found alive and well in New Zealand.

"What we did was different from other hacking groups," says Topiary. "We had an active Twitter (controlled by me), cute cats in deface messages, and a generally playful, cartoon-like aura to our operations. We knew when to start, we knew when to stop, and most of all we knew how to have fun."

But the group's mission, Topiary explains, was not calculated. Almost everything LulzSec did – from choosing its name to its next target – happened spontaneously. "We made it up as we went along. We were originally @LulzLeaks on twitter, but I forgot the password so we became @LulzSec. My first name was The Lulz Train, then The Lulz Cannon, then The Lulz Boat. I had no idea what The Love Boat was, it was a complete accident . . . I wrote every press release in Notepad without planning. That's what made us unique, we just came out and made stuff up out of nowhere . . . We released when it felt right, we tweeted what felt right, we wrote what we felt needed to be wrote. We weren't burdened by plans or board meetings, we just did it."

The leaked chat logs also revealed the hackers appeared to revel in the international attention they received. However, Topiary says it wasn't that LulzSec was media-hungry, but that the media was LulzSec-hungry.

"We didn't contact a single media outlet for at least the first 40 days, they just kept reporting on our humble tweets," he says, though he admits the attention "gave us more reasons to leak more. It was a thrill, sure, and it did play a role. We enjoyed occasionally confusing and pranking media with weird tweets, or giving exclusives to certain journalists to piss off other certain journalists. It was another aspect of the situation that helped us leverage the entertainment."

Yet although many of LulzSec's attacks were perpetrated "for the lulz", the group was accused of attempted extortion by one US security company, Unveillance – a charge Topiary staunchly denies. It was also criticised after it hacked and dumped thousands of Sony Pictures Europe customers' usernames and passwords online, some of which were reportedly later used in scams by fraudsters. But Topiary is unapologetic.

"It's Sony's fault for not defending – and encrypting – its customers' data," he says. "Similarly, in a perfect world, we'd have dumped said data and nothing would have happened. These scams simply prove that other people (our fans/spectators) are more evil than us."

Towards the end of LulzSec's reign, it seemed to gravitate towards more overtly political causes. It occasionally compared itself to WikiLeaks in tweets, and its penultimate leak was a joint effort with Anonymous to expose Arizona police as "racist and corrupt", and to "sabotage their efforts to terrorise communities fighting an unjust 'war on drugs'."

Anonymous is well known for its acts of political "hacktivism". On Monday it reportedly threatened to attack the Metropolitan police over News International's phone hacking and the possible extradition to Sweden of WikiLeaks founder Julian Assange. Earlier this year the group claimed responsibility for a series of Distributed Denial of Service (DDoS) attacks on government websites in Tunisia, Iran, Egypt and Bahrain, and in 2008 it attacked the Church of Scientology after it allegedly attempted to suppress a leaked video interview with actor and scientologist Tom Cruise. Topiary has been heavily involved with Anonymous in the past, occasionally acting as its spokesman in televised interviews.

"Anonymous has been a great way for the younger generations to get involved through methods they understand, like utilising the internet," he says. "My main goal with Anonymous was to spread the word of revolution to those who might be seeking something new."

How does he define revolution? "Revolution is kicking the Tunisian government in the teeth by rendering their malicious Javascript embedments inert, allowing Tunisian citizens to surf Facebook without fear of password sniffing. Revolution is a horde of activists holding up Anonymous masks and thanking us for assisting their hard work by obliterating their government's ministry, stock and finance websites, replacing them with inspiring words. Revolution, to me, is bringing down the big guy while not forgetting to stand up for the little guy."

Though Topiary will not disclose his age, he describes himself as a teenager and "an internet denizen with a passion for change". He believes he is part of a generational shift in the way technology – specifically the internet – is increasingly being used as a tool to influence the world. The actions of Anonymous in particular, he says, have brought attention to the idea that actions taken online can have a major impact in real life – "linking the two realities". But he also recognises that the actions of Anonymous, LulzSec and other affiliated hackers can be used by governments as justification for greater control of the internet. So how does he balance his actions with that knowledge?

"It only results in greater government control if we remain apathetic and let it happen," he says. "The goal with Anonymous is to brutally cut down the middle of that decision and shout 'NO' to laws we don't agree with. Laws are to be respected when they're fair, not obeyed without question."

For now, however, Topiary is taking a break from law-breaking. He says he will continue operating on the margins of Anonymous, but will not engage in any more hacking. Instead, he intends to create art, video and graphics for the group to help with a new public relations project, to be titled Voice.

"I've been at this non-stop for a while, it's a big time-sink," he says. "Some people can handle it for years on end, and I respect those people. I just needed some air and a new page in the Anonymous/LulzSec era."

After the arrest of Cleary last month, suspected US hackers believed to be affiliated with LulzSec had their homes raided in Ohio and Iowa. In the past, hackers have been offered immunity from prosecution if they cooperate with the authorities. But, if caught, Topiary says he would "never snitch" on other hackers and that he would "pretty much" rather go to jail than work for the government in any capacity.

"Not sure I'd have a place in government security, unless they enjoy bizarre tweets," he says. "But again, no, I wouldn't accept a job that would fight against the things I've fought for. As for the authorities, well, if they have their claws in, they have their claws in, there's not much I can do about it. But I can only hope that they haven't pinned any of us, especially my friends from LulzSec."

This article originally appeared at: http://www.guardian.co.uk/technology/2011/jul/14/why-lulzsec-decided-to-disband