Unmasked - Ars Technica [6]
Coder: I’m not doubting that you’re doing analysis. I’m doubting that statistically that analysis has any mathematical weight to back it. I put it at less than .1% chance that it’s right. You’re still working off of the idea that the data is accurate. mmmm…..taco!
Later, when Barr talks about some “advanced analytical techniques” he’s been pondering for use on the Anonymous data, the coder replies with apparent frustration, “You keep saying things about statistics and analytics but you haven’t given me one algorithm or SQL query statement.”
Privately, the coder then went to another company official with a warning. “He’s on a bad path. He’s talking about his analytics and that he can prove things statistically but he hasn’t proven anything mathematically nor has he had any of his data vetted for accuracy, yet he keeps briefing people and giving interviews. It’s irresponsible to make claims/accusations based off of a guess from his best gut feeling when he has even told me that he believes his gut, but more often than not it’s been proven wrong. I feel his arrogance is catching up to him again and that has never ended well...for any of us.”
Others made similar dark warnings. “I don’t really want to get DDOS’d, so assuming we do get DDOS’d then what? How do we make lemonade from that?” one executive asked Barr. The public relations exec warned Barr not to start dropping real names: “Take the emotion out of it -> focus on the purpose. I don’t see benefit to you or company to tell them you have their real names -- published or not.”
Another internal warning ended: “Danger Will Robinson. You could end up accusing a wrong person. Or you could further enrage the group. Or you could be wrong, and it blows up in your face, and HBGary’s face, publicly.”
“Quite simply, nonsense”
But Barr got his Financial Times story, and with it the publicity he sought. He also made clear that he had the real names, and Anonymous knew he would soon meet with the FBI. Though Barr apparently planned to keep his names and addresses private even at this meeting, it was easy to see why Anonymous would have doubts.
When HBGary President Penny Leavy, who was an investor in separate company HBGary Federal, waded into IRC to reason with Anonymous, she pleaded ignorance of Barr’s activities and said that they were “for security research only; the article was to get more people to the [BSides] event.” To which someone responded, “Penny: if what you are saying is tree [true] then why is Aaron meeting with the FBI tomorrow morning at 11am? PLEASE KEEP IN MIND WE HAVE ALL YOUR EMAILS.” (The answer from the e-mails is that Barr was trying to drum up business with the feds, not necessarily take down Anonymous.)
As for the names in Barr’s BSides presentation, Anonymous insisted that they were wrong. “Penny please note that the names in that file belong to innocent random people on facebook. none of which are related to us at all,” said one admin.
Another user complained to Leavy that “the document that [Barr] had produced actually has my girlfriend in it. She has never done anytihng with anonymous, not once. I had used her computer a couple times to look at a group on facebook or something.”
In the note posted on HBGary Federal’s website when it was taken over, Anonymous blasted Barr’s work. “You think you’ve gathered full names and addresses of the ‘higher-ups’ of Anonymous? You haven’t. You think Anonymous has a founder and various co-founders? False…. We laughed. Most of the information you’ve ‘extracted’ is publicly available via our IRC networks. The personal details of Anonymous ‘members’ you think you’ve acquired are, quite simply, nonsense.”
Oh—and remember the threatening IRC log above, the one “recruiting” Barr to attack a DC security company? Anonymous says that it was all a joke.
“I mean come on, Penny,” wrote Topiary in an IRC chat, “I messaged Aaron in PM [private message] and told him about a ‘secret’ Washington OP, then he emailed the company (including you) being entirely confident that we were directly