Ars Technica points us to a BBC report that claims botnets are increasingly being deployed by ideological and political activist groups as well as the more traditional spammers ‘n’ scammers. There’s undoubtedly a kernel of truth here, but given that the data that informs this conclusion comes from Prolexic, a company whose profits depend on selling computer security solutions to businesses and governments, I find myself wanting to poke holes in the story. It’s easily done, too.

First of all, Anonymous are described as an “anti-Scientology group”, which is a massive oversimplification. If they can be said to be anything at all, Anonymous is an amorphous and capricious cloud of nihilistic pranksters, but framing them as a single-interest group makes them more understandable to the corporate mind-set, as well as portraying them as “something that could happen to you“.

Next item – look at this excerpt:

In one attack both large and small perfume firms were hit in an apparent attempt, said Mr Sop, by green activists to express their disquiet with the way the companies made and tested their products.

[…]

These techniques are far removed from those favoured by organised criminals. Some targeted databases behind a website in a bid to swamp that with bogus login attempts or lengthy search requests that would knock out the server and take out the website too.

Note the use of “apparent”, and the lack of any defined enemy. They have no idea who did it, in other words; the “green activists” thing is likely a guess, one that plays into current fears about ideological activism by companies whose business practices might put them in line for such. Isn’t it at least equally likely that the botnet was hired by another perfume business in order to throw some caltrops in the path of its competitors? Is it so implausible that “organised criminals” could have upped their technological game in recent months? It’s not an area in which I have great experience (or, indeed, any experience at all), but I’d imagine that staying on top in the world of international gangsterism involves making sure you’re using the best tools available… because if you’re not, your competition surely will be.

Furthermore, how many “green” activist groups with a special interest in perfumery have the spare money to waste on this sort of warfare? A big part of activist psychology is the desire to be seen to be doing something; this sort of clandestine skulduggery doesn’t sound like the work of placard-waving protesters to me, and I doubt they’d have the money or contacts to call down the botnet fist-of-god on their enemies. There’s nothing to say it couldn’t be, of course, but I’d want better proof – especially from a source who stands to benefit from setting up straw-man opponents which it can then offer protection from.

A few more bits from the bottom:

Mr Sop said Prolexic suspected that some of the attacks it had seen in recent months were being mounted by governments or their proxies in the hacking community as a way to demonstrate their cyber capabilities.

*cough* *wink* China *nudge* *cough* The Red Peril! The Other! The monsters under Western capitalism’s bed! They’re coming for you!

The resources being put into the attacks, some of which targeted very expensive pieces of net hardware, ruled out the involvement of organised crime, he said.

Really? Why would organised criminal syndicates not be interested in attacking “expensive net hardware” when political or ideological activists would be? And this hardware – what is so different about it that makes it expensive by comparison to “not-so-expensive” net hardware, exactly? Are the victim servers plated with gold, perhaps?

OK, so I’m going a bit overboard here, but everything about the report from these Prolexic people stinks of under-the-radar button-pushing infomercial. Ideologically-targetted botnets are certainly a real issue, and probably more so than they were a year ago… but I suspect this shift in PR focus by security firms to be born of the realisation that defined threats enable sales better than amorphous ones. Which is the more tangible risk, as perceived by a CEO – “scammers might hijack your server because it’s essentially a box that can do anything if instructed properly” or “people who object to your ideology or business practices could treat your network infrastructure as a weak point”? The former is a statistical long-shot; the latter plays on the fear of competition that is key to any successful business.

Getting back to the core point, though, the rise of ideological deployments of botnets is hardly surprising. The people who run botnets are mercenaries of the old school, renting out their services by the day (or maybe even by the hour) to anyone who can meet the price… and for those groups who can’t meet the price (or don’t like dealing with middle-men), it’s depressingly easy to build one yourself, if you’ve the time and motivation. But that’s the key – time and motivation, and the afore-mentioned visibility. Single-issue activist groups want their protests to be seen and attributed to them, because otherwise they’re wasting their time; the stealthy anonymous attacks are logically far more likely to originate from corporations (legitimate or criminal) and nation-states.

So, yes, ideological cyberwarfare is a real and rising threat… but I’m not convinced it’s as grass-roots a threat as it’s being portrayed. After all, if you want to sell your product to corporations and governments, you can’t go demonising your potential customers in your ad copy.