I Can Neither Confirm nor Deny

As website appear to fall to hacks like the rain falls in Seattle, the question du jour doesn’t change from day to day. The same question is always asked… “Did Anonymous perform the attack?”

What do all of these links below have in common? You don’t have to read them, I’ll tell you..

http://sdchamber-members.org/Business%20Online%202009-10/Business%20Action%20Online%20May%202010/Business%20Action%20Online%20May%20ESET.html
http://www.theregister.co.uk/2008/03/17/scientology_anonymous_round_three/
http://mashable.com/2011/02/19/anonymous-westboro/
http://www.bbc.co.uk/news/technology-12535456
http://www.democraticunderground.com/discuss/duboard.php?az=show_mesg&forum=439&topic_id=572223&mesg_id=572590
http://www.theregister.co.uk/2010/12/13/amazon_outage_not_anonymous/
http://www.depravedmindset.com/2010/12/is-wikileaks-controversy-playing.html
http://topstoriesmilwaukee.com/uncategorized/attack-of-the-anonymous/
http://www.wowmaterials.com/2011/05/06/battle-of-the-immortals-turns-one/

In all of these links the group referred to as “Anonymous” denies responsibility. This is an exceptionally odd claim for anonymous to make, and here is why. In an article in the Huffington Post it is stated that “Anyone who claims to be acting under the banner of Anonymous is by virtue of that fact a member of Anonymous“. What this implies is that if you are a member of Anonymous and you carried out the attack, then you can claim responsibility on behalf of Anonymous, however, if you didn’t carry out the attack you don’t know if someone who claims to be a member of Anonymous carried out the attack or didn’t. At best, unless a group that knows that none of its members are also members of Anonymous claims responsibility, the best Anonymous can do is neither confirm nor deny involvement.

In reality, Anonymous can neither confirm nor deny that this blog was written by a member of Anonymous!

Randy Abrams
Director of Technical Education
Cyber Threat Analysis Center
ESET North America