UNCLASSIFIED FOR OFFICIAL USE ONLY __________________________________________________ FEDERAL BUREAU OF INVESTIGATION INTELLIGENCE BULLETIN Directorate of Intelligence Cyber Intelligence Section ____________________________________________________ 14 September 2011 U FOUO Anonymous’ Participation in “Day of Rage” Protest May Coincide with Cyber Attack U FOUO The FBI assesses that the hacktivist group Anonymous is likely to participate in the “Day of Rage” protest scheduled for 17 September 2011 in New York City‟s financial district While the extent of group members‟ participation in the event is unknown in late August 2011 Anonymous endorsed the event through propaganda consisting of a video posted on YouTube and a campaign poster as well as references in their Twitter accounts 1 U FOUO In the past Anonymous has been involved in physical protests that coincided with planned cyber attacks This could indicate an intention to conduct a cyber attack in conjunction with the “Day of Rage” protest • U FOUO In August 2011 Anonymous planned multiple protests against San Francisco’s Bay Area Rapid Transit BART These physical protests which became violent and resulted in numerous arrests were combined with cyber intrusions that defaced Web sites and compromised the personal information of BART police officers 2 • U FOUO Anonymous planned to conduct a distributed denial of service DDoS a attack on Quantico facilities on 20 March 2011 to coincide with the physical protests at the base against the incarceration of Private First Class Bradley Manning 3 While a physical protest did occur there was no successful DDoS attack UNCLASSIFIED WHAT ISOUR ON DlMAND U Propaganda poster used by Anonymous to endorse the “Day of Rage” protest U Anonymous plans to release a new DDoS tool to the public called RefRef in September 2011 according to open source reporting Anonymous has tested this tool with successful DDoS attacks on WikiLeaks Pastebinb and 4chan orgc 4 Currently it is unknown if the release date a U A distributed denial of service is a type of attack that floods a network with so many requests for information that regular service is slowed or interrupted b U Pastebin is a Web application that allows users to post portions of text for public viewing UNCLASSIFIED FOR OFFICIAL USE ONLY UNCLASSIFIED FOR OFFICIAL USE ONLY will correspond with the “Day of Rage” protest U “Day of Rage” Protest U The “Day of Rage” is a physical protest against US capitalism that is being organized by several activist groups Open source reporting claims that “non-violent civil disobedience” will occur during this event on 17 September 2011 in New York City’s financial district Similar protests may take place in cities around the world such as Tokyo London Frankfurt Madrid Sydney and Toronto to coincide with the Manhattan protest 5 UNCLASSIFIED U Memo to Volunteers from the “Day of Rage” Organizers On September 17 we want to see 20 000 people flood into lower Manhattan set up tents kitchens peaceful barricades and occupy Wall Street for a few months Once there we shall incessantly repeat our one simple demand until Barack Obama capitulates …there is a very real danger that if we naively put our cards on the table and rally around the “overthrow of capitalism” or some equally outworn utopian slogan then our Tahrir b moment will quickly fizzle into another inconsequential ultra-lefty spectacle soon forgotten But if we have the cunning to come up with a deceptively simple Trojan Horse demand… See you on Wall St Sept 17 Bring Tent b U Tahrir is an Arabic word meaning “liberation” and may refer to the January 2011 Tahrir Square protest in Cairo Egypt U Examiner com “Beware the U S 'day of rage' September 17” - National Conservative Examiner com http www examiner com conservative-in-national beware-the-u-s-day-of-rage-september-17#ixzz1XMeG9Q3G U Outlook and Implications U FOUO The FBI judges—based on the outcomes of other physical protests that Anonymous has been involved in such as BART—the group’s endorsement of the “Day of Rage” protest could increase media attention and attendance for this event The reported release of RefRef on 17 September 2011 may lead to cyber attacks such as DDoS attacks in addition to the physical protests scheduled for this date The potential for cyber attacks could lead to a disruption of service or a release of sensitive information Since these protests are focused on financial services if a cyber attack were to occur financial institutions could be targeted U FOUO This intelligence bulletin addresses the FBI Intelligence Collection Requirements for Cyber Intrusions Hacktivists WW-CYBR-CYD-SR-0057-11 U This product has been prepared by the Domestic Threats Cyber Intelligence Unit of the FBI Comments and queries may be addressed to the Unit Chief at 202-651-3051 c U 4chan org is an online Web site where individuals can hold conversations by posting messages and images UNCLASSIFIED FOR OFFICIAL USE ONLY 2 UNCLASSIFIED FOR OFFICIAL USE ONLY U Endnotes 1 U Online Article Dave Neal 25 August 2011 “Anonymous Sets its Sights on Wall Street” www theinquireer net inquirer news 2104394 anonymous-sets-sights-wall-street last accessed 8 September 2011 2 U Online Article Vivian Ho 22 August 2011 “Anonymous Planning Another BART Protest” http articles sfgate com 2011-08-22 news 29913744_1_sony-s-playstations-network-supporters-civic-centerstation last accessed 12 September 2011 3 U Online Article CBC News 10 March 2011 “Pro-WikiLeaks Activists Target Base Holding Bradley Manning” http www cbc ca news world story 2011 03 10 anonymous-manning-quantico-ddos html last accessed 13 September 2011 4 U Online Article Steve Ragan 1 September 2011 “WikiLeaks Knocked Offline by Anonymous – RefRef due Sept 17” www thetechherald com article php 201135 7560 WikiLeaks-knocked-offline-by-Anonymous last accessed 8 September 2011 5 U Online Article Anthony Martin 21 August 2011 “Beware the U S „Day of Rage‟ September 17” www examiner com conservative-in0national beware-the-u-s-day-of-rage-september-17 last accessed 8 September 2011 UNCLASSIFIED FOR OFFICIAL USE ONLY 3 UNCLASSIFIED FOR OFFICIAL USE ONLY Distribution FBI Intranet DI OCA JWICS SIPRNet LEO LNI UNCLASSIFIED FOR OFFICIAL USE ONLY 4 UNCLASSIFIED FOR OFFICIAL USE ONLY FBI Customer Satisfaction Survey Please take a moment to complete this survey and help evaluate the quality value and relevance of our intelligence product Your response will help us serve you more effectively and efficiently in the future Thank you for your cooperation and assistance Please return to Federal Bureau of Investigation Editorial Review Unit 935 Pennsylvania Ave NW Room 11079C Washington DC 20535 Customer and Product Information Intelligence Product Title U FOUO Anonymous‟ Participation in “Day of Rage” Protest May Coincide with Cyber Attack Dated 14 September 2011 Customer Agency _________________________________________ Relevance to Your Intelligence Needs 1 The product increased my knowledge of an issue or topic Check one ___5 Strongly Agree ___4 Somewhat Agree ___3 Neither Agree or Disagree ___2 Somewhat Disagree ___1 Strongly Disagree Actionable Value 2 The product helped me decide on a course of action Check one ___5 Strongly Agree ___4 Somewhat Agree ___3 Neither Agree or Disagree ___2 Somewhat Disagree ___1 Strongly Disagree Timeliness Value 3 The product was timely to my intelligence needs Check one ___5 Strongly Agree ___4 Somewhat Agree ___3 Neither Agree or Disagree ___2 Somewhat Disagree ___1 Strongly Disagree ERU INTERNAL USE ONLY Product Tracking # __IB 1393_____________ Return To ______________________ Comments please use reverse or attach separate page if needed UNCLASSIFIED FOR OFFICIAL USE ONLY 5