View source for Operation Payback

{{short description|Series of cyberattacks conducted by Anonymous}}
'''Operation Payback''' was a coordinated,<ref>{{cite news |url=https://www.bbc.co.uk/news/technology-11971259 |title=Anonymous Wikileaks supporters explain web attacks |date=2010-12-10 |access-date=2010-12-10 |work=bbc.co.uk |publisher=BBC}}</ref> decentralized<ref>{{cite web |url=http://gawker.com/5710948/the-top-three-myths-about-anonymous |title=The Top Three Myths About Anonymous |first=Adrian |last=Chen |date=2010-12-09 |access-date=2010-12-11 |work=gawker.com |publisher=Gawker}}</ref> group of attacks on high-profile<ref>Bodmer, Kilger, Carpenter, & Jones, Reverse Deception: Organized Cyber Threat Counter-Exploitation, (2012) McGraw-Hill Osborne Media. {{ISBN|0071772499}}</ref> opponents of Internet piracy by Internet activists using the "[[Organization:Anonymous (group)|Anonymous]]" moniker. Operation Payback started as retaliation to [[Denial-of-service attack|distributed denial of service]] (DDoS) attacks on [[Torrent file|torrent]] sites; piracy proponents then decided to launch DDoS attacks on piracy opponents. The initial reaction snowballed into a wave of attacks on major pro-copyright and anti-piracy organizations, law firms, and individuals. The Motion Picture Association of America, the [[Organization:Pirate Party UK|Pirate Party UK]] and United States Pirate Party criticised the attacks.

Following the United States diplomatic cables leak in December 2010, the organizers commenced DDoS attacks on websites of banks who had withdrawn banking facilities from [[Social:WikiLeaks|WikiLeaks]].
[[File:You call it piracy.jpg|thumb|Early Operation Payback flyer]]

==Background and initial attacks==

In 2010, several Bollywood companies hired Aiplex Software to launch DDoS attacks on websites that did not respond to takedown notices.<ref name="theregister1">{{cite news |title=4chan launches DDoS against entertainment industry |first=John |last=Leyden |newspaper=The Register |date=2010-09-22 |url=https://www.theregister.co.uk/2010/09/20/4chan_ddos_mpaa_riaa/ |access-date=2010-10-22}}</ref><ref name="bbc">{{cite news |url=https://www.bbc.co.uk/news/technology-11371315 |title=Activists target recording industry websites |date=2010-09-20 |access-date=2010-10-27 |work=BBC News}}</ref> Piracy activists then created Operation Payback in September 2010 in retaliation.<ref name="theregister1"/> The original plan was to attack Aiplex Software directly, but upon finding some hours before the planned DDoS that another individual had taken down the firm's website on their own, Operation Payback moved to launching attacks against the websites of copyright stringent organisations Motion Picture Association of America (MPAA) and International Federation of the Phonographic Industry, giving the two websites a combined total downtime of 30 hours.<ref name="torrentfreak">{{cite web |url=http://torrentfreak.com/4chan-ddos-takes-down-mpaa-and-anti-piracy-websites-100918/ |title=4chan DDoS Takes Down MPAA and Anti-Piracy Websites |date=2010-09-18 |publisher=TorrentFreak |access-date=2010-10-27 |author=enigmax}}</ref><ref name="pandalabssecurity">{{cite news |title=4chan Users Organize Surgical Strike Against MPAA |newspaper=Pandalabs Security |first=Luis |last=Corrons |date=2010-09-17 |url=http://pandalabs.pandasecurity.com/4chan-users-organize-ddos-against-mpaa/ |access-date=2010-10-22}}</ref> In the following two days, Operation Payback attacked a multitude of sites affiliated with the MPAA, the Recording Industry Association of America (RIAA),<ref name="torrentfreak-2">{{cite web |url=http://torrentfreak.com/4chan-to-ddos-riaa-next-is-this-the-protest-of-the-future-100919/ |title=4chan to DDoS RIAA Next – Is This the Protest of the Future? |date=2010-09-19 |publisher=TorrentFreak |access-date=2010-10-27 |author=enigmax}}</ref> and British Phonographic Industry.<ref name="theregister1"/> Law firms such as [[Organization:ACS:Law|ACS]], Davenport Lyons and Dunlap, Grubb & Weaver (of the US Copyright Group) were also attacked.<ref name="theregister2">{{cite news |title=Piracy threats lawyer mocks 4chan DDoS attack |first=Chris |last=Williams |newspaper=The Register |date=2010-09-22 |url=https://www.theregister.co.uk/2010/09/22/acs_4chan/ |access-date=2010-10-22}}</ref><ref name="theregister3">{{cite news |title=Second piracy threat lawyers withstand DDoS attack |first=John |last=Leyden |newspaper=The Register |date=2010-09-24 |url=https://www.theregister.co.uk/2010/09/24/piracy_threat_lawyers_withstand_ddos/ |access-date=2010-10-22}}</ref><ref name="ars">{{cite web |url=https://arstechnica.com/tech-policy/news/2010/09/operation-payback-attacks-continue-until-we-stop-being-angry.ars |title="Operation Payback" attacks to go until "we stop being angry" |first=Nate |last=Anderson |publisher=[[Ars Technica]] |date=2010-09-30 |access-date=2010-10-23}}</ref><ref name="slyck">{{cite web |url=http://www.slyck.com/news.php?story=2066 |title=US Copyright Group and Web Sheriff Targeted in DDoS Attack |first=Thomas |last=Mennecke |publisher=Slyck |date=2010-09-29 |access-date=2010-10-23 |archive-date=2010-10-06 |archive-url=https://web.archive.org/web/20101006195725/http://www.slyck.com/news.php?story=2066 |url-status=dead }}</ref>

==Attacks on the recording industry==

===Law firms===

On September 21, 2010, the website of United Kingdom law firm [[Organization:ACS:Law|ACS]] was subjected to a DDoS attack as part of Operation Payback. When asked about the attacks, Andrew Crossley, owner of ACS:Law, said: "It was only down for a few hours. I have far more concern over the fact of my train turning up 10 minutes late or having to queue for a coffee than them wasting my time with this sort of rubbish."<ref name="theregister2" /><ref name="ars" />

When the site came back online a 350[[Megabyte|MB]] file,  which was a backup of the site, was visible to anyone for a short period of time.<ref name="theregister4">{{cite news |title=Anti-piracy lawyers' email database leaked after hack |first=John |last=Leydon |newspaper=The Register |date=2010-09-27 |url=https://www.theregister.co.uk/2010/09/27/anti_piracy_lawyer_email_leak/ |access-date=2010-10-22}}</ref> The backup, which included copies of emails sent by the firm, was downloaded and made available on various [[Peer-to-peer|peer-to-peer]] networks and websites including [[Social:The Pirate Bay|The Pirate Bay]].<ref name="theregister4"/><ref>{{cite web |url=https://www.wired.co.uk/news/archive/2010-09/27/leaked-emails-fuel-anti-piracy-scandal |title=Leaked emails fuel anti-piracy scandal |first=Duncan |last=Geere |publisher=Wired.co.uk |date=2010-09-27 |access-date=2010-09-27 |archive-url=https://web.archive.org/web/20100928164025/http://www.wired.co.uk/news/archive/2010-09/27/leaked-emails-fuel-anti-piracy-scandal |archive-date=2010-09-28 |url-status=dead }}</ref><ref>{{cite web |url=http://torrentfreak.com/acslaw-anti-piracy-law-firm-torn-apart-by-leaked-emails-100925/ |title=ACS:Law Anti Piracy Law Firm Torn Apart by Leaked Emails |author=enigmax |publisher=TorrentFreak |date=2010-09-25 |access-date=2010-12-23}}</ref> Some of the emails contained unencrypted [[Software:Microsoft Excel|Excel]] spreadsheets, listing the names and addresses of people that ACS:Law had accused of illegally sharing media. One contained more than 5,300 Sky broadband customers whom they had accused of illegally sharing pornography,<ref>{{cite news |last=Emery |first=Daniel |url=https://www.bbc.co.uk/news/technology-11418962 |title=Adult video-sharing list leaked from law firm |work=BBC News |date=2010-09-27 |access-date=2010-09-27}}</ref><ref>{{cite web |url=http://www.bbc.co.uk/newsbeat/11430299 |title='My details appeared on 'porn' list' |date=2010-09-28 |publisher=BBC |access-date=2010-12-23}}</ref> while another contained the details of 8,000 Sky customers and 400 Plusnet customers accused of infringing the copyright on music by sharing it on [[Peer-to-peer file sharing|peer-to-peer networks]].<ref>{{cite news|last=Emery |first=Daniel |url=https://www.bbc.co.uk/news/technology-11425789|title=Fresh ACS:Law file-sharing lists expose thousands more|date=2010-09-28 |access-date=2010-09-28 |work=BBC News}}</ref> This alleged breach of the [[Data Protection Act 1998|Data Protection Act]] has become part of the ongoing investigation into ACS:Law by the Information Commissioner's Office.<ref>{{cite news|last=Emery |first=Daniel |url=https://www.bbc.co.uk/news/technology-11434809|title=BT embroiled in ACS:Law porn list breach|date=2010-09-29 |access-date=2010-09-29 |work=BBC News}}</ref><ref>{{cite news|last=Emery |first=Daniel |url=https://www.bbc.co.uk/news/technology-11418970|title=ACS:Law could face £500,000 fine for porn list leak|date=2010-09-28 |access-date=2010-09-28 |work=BBC News}}</ref>

On September 30, the Leesburg, Virginia office of Dunlap, Grubb & Weaver law firm &ndash; also doing business as the "U.S. Copyright Group"<ref>{{cite web |url=http://www.techdirt.com/articles/20100903/11144710895.shtml |title=Hurt Locker Subpoenas Arrive With New Language ... And Higher Demands |first=Mike |last=Masnick |work=Techdirt |date=2010-09-03 |access-date=2010-11-28}}</ref> &ndash; was evacuated by the police after an emailed bomb threat was received.<ref>{{cite web |url=http://www.leesburg2day.com/articles/2010/09/30/news/9513bombthreat093010.txt |title=Investigators Track Leads In Bomb Threat At Leesburg Law Office |date=2010-09-30 |access-date=2010-10-27 |first=Erika Jacobson |last=Moore |publisher=Leesburg Today |work=leesburg2day.com }}{{Dead link|date=January 2024 |bot=InternetArchiveBot |fix-attempted=yes }}</ref><ref>{{cite web |url=http://www.leesburgva.gov/index.aspx?recordid=872&page=29 |title=Leesburg Police Investigating Bomb Threat |work=leesburgva.gov |date=2010-09-30 |access-date=2010-12-23 |archive-date=2011-07-19 |archive-url=https://web.archive.org/web/20110719141728/http://www.leesburgva.gov/index.aspx?recordid=872&page=29 |url-status=dead }}</ref> It's believed the event could be connected to Anonymous.<ref name="torrentfreak-3">{{cite web |url=http://torrentfreak.com/anti-piracy-law-firm-evacuated-after-bomb-threat-101001/ |title=Anti-Piracy Law Firm Evacuated After Bomb Threat |date=2010-10-01 |access-date=2010-10-27 |publisher=TorrentFreak |author=Ernesto}}</ref> Non-related copyright or law firms sites, such as websheriff.com,<ref name="slyck"/> were also attacked. These attacks were originally organized through an [[Internet Relay Chat]] channel.<ref name="theregister1"/> The attacks also became a popular topic on [[Company:Twitter|Twitter]].<ref name="theregister1"/>

===Australian pro-copyright organization===

On September 27, 2010, the DDoS attack on the Australian Federation Against Copyright Theft (AFACT) unintentionally brought down 8,000 other small websites hosted on the same server.<ref>{{cite news |title=Operation Payback directs DDoS attack at AFACT |first=Brett |last=Winterford |url=http://www.itnews.com.au/News/233573,operation-payback-directs-ddos-attack-at-afact.aspx |newspaper=iTnews |date=2010-09-28 |access-date=2010-12-23}}</ref>

===ACAPOR===

In September 2010, in an attempt to ensure that Portuguese citizens could not access ''thepiratebay.org'', Associação do Comércio Audiovisual de Portugal (ACAPOR) filed a complaint against [[Social:The Pirate Bay|The Pirate Bay]].  The complaint was filed with the General Inspection of Cultural Activities, which is part of the Portuguese Ministry of Culture. According to the movie rental association, The Pirate Bay is directly responsible for about 15 million illegal downloads in Portugal every year. By installing a Pirate Bay block on all ISPs, ACAPOR hoped to decrease the financial damage it claims The Pirate Bay causes.<ref>{{cite web |url=http://torrentfreak.com/movie-rental-outfit-calls-for-nationwide-pirate-bay-block-100916/ |title=Movie Rental Outfit Calls For Nationwide Pirate Bay Block |publisher=TorrentFreak |date=2010-09-16 |author=Ernesto |access-date=2010-12-23}}</ref>

On October 18, 2010, the ACAPOR website was [[Website defacement|defaced]], presenting text from Operation Payback and a redirect to The Pirate Bay after a few seconds. In addition to defacing the website, a copy of the email database of ACAPOR was uploaded to The Pirate Bay.<ref>{{cite web |url=http://torrentfreak.com/movie-rental-outfit-hacked-emails-leaked-redirected-to-the-pirate-bay-101018/|title=Movie Rental Outfit Hacked, Emails Leaked, Redirected to The Pirate Bay |author=Ernesto |date=2010-10-18 |publisher=TorrentFreak |access-date=2010-12-23}}</ref><ref>{{cite web |url=http://www.unitethecows.com/content/299-acapor-emails-leaked-pirate-bay.html |title=ACAPOR Emails Leaked to The Pirate Bay |first=Brian |last=Houston |date=2010-10-18 |work=unitethecows.com |access-date=2010-12-23}}</ref> The leaked e-mails so far revealed ACAPOR's methods of denunciation, its dissatisfaction with the Portuguese government and justice system,<ref>{{cite web |url=http://peerauthority.com/acapor1/ |title=A Look Into ACAPOR's Emails: Denunciation, Discontent and Education |first=Pavel |last=Mitov |publisher=Peer Authority |date=2010-10-04 |access-date=2010-12-23}}</ref> its perception of the copyright debate as war, and its antagonism with the ISPs. ACAPOR claimed that "the business of ISPs is illegal downloading."<ref>{{cite web |url=http://peerauthority.com/acapor2/ |title=Back to ACAPOR: The War and the ISP |first=Pavel |last=Mitov |publisher=Peer Authority |date=2010-10-11 |access-date=2010-12-23}}</ref>

===More attacks===

On October 4, 2010, Operation Payback launched an attack on the Ministry of Sound website and the Gallant Macmillan website.<ref name="theregister5">{{cite news |title=Ministry of Sound floored by Anonymous |first=John |last=Leydon |newspaper=The Register |date=2010-10-04 |url=https://www.theregister.co.uk/2010/10/04/ministry_of_sound_ddos/ |access-date=2010-10-22}}</ref>

On October 7, 2010, they attacked the website of the Spanish copyright society, sgae.es.<ref>{{cite web |url=https://www.theregister.co.uk/2010/10/07/anonymous_ent_biz_ddos_hits_spain/ |title=Spanish entertainment industry feels wrath of Anonymous |first=John |last=Leyden |date=2010-10-07 | access-date=2011-01-06 |publisher=The Register}}</ref> As of October 7, 2010, the total downtime for all websites attacked during Operation Payback was 537.55 hours.<ref name="pandalabssecurity"/>

On October 15, 2010, Copyprotected.com was [[SQL injection|SQL injected]] and defaced,<ref name="pandalabssecurity"/><ref name="torrentfreak-4">{{cite web |url=http://torrentfreak.com/mpaa-copy-protected-drmsite-hacked-by-anonymous-101015/|title=MPAA Copy-Protected DRM Site Hacked By Anonymous|date=2010-10-15|access-date=2010-10-27|author=enigmax |publisher=TorrentFreak}}</ref> and three days later Operation Payback launched a DDoS attack against the UK Intellectual Property Office.<ref name="theregister6">{{cite news |title=Notorious Anonymous hacktivists launch fresh attacks |first=John |last=Leydon |newspaper=The Register |date=2010-10-18 |url=https://www.theregister.co.uk/2010/10/18/anon_ipo_ddos/ |access-date=2010-10-22}}</ref>

Production companies SatelFilm.at and Wega-Film.at were hit by "drive-by" DDoSes on October 21, 2010, in response to their efforts to gain a court injunction against an ISP that refused to block a movie-streaming website,<ref name="slycknews">{{cite news |title=Operation: Payback Hits SatelFilm.at with 'Drive By' DoS |first=Thomas |last=Mennecke |newspaper=Slyck News |date=2010-10-21 |url=http://www.slyck.com/story2097_Operation_Payback_Hits_SatelFilmat_with_Drive_By_DoS |access-date=2010-10-26 |archive-date=2010-10-24 |archive-url=https://web.archive.org/web/20101024215544/http://www.slyck.com/story2097_Operation_Payback_Hits_SatelFilmat_with_Drive_By_DoS |url-status=dead }}</ref> Operation Payback then knocked porn website Hustler.com offline the following day.<ref name="slycknews-hustler">{{cite news |title=Hustler Knocked Offline in Operation: Payback |first=Thomas |last=Mennecke |newspaper=Slyck News |date=2010-10-22 |url=http://www.slyck.com/story2099_Hustler_Knocked_Offline_in_Operation_Payback |access-date=2010-12-17 |archive-date=2011-01-01 |archive-url=https://web.archive.org/web/20110101104504/http://www.slyck.com/story2099_Hustler_Knocked_Offline_in_Operation_Payback |url-status=dead }}</ref>

===Musician and copyright advocate===

During the 2010 MIPCOM convention, Gene Simmons of KISS stated:

{{blockquote|text=Make sure your brand is protected {{omission}} Make sure there are no incursions. Be litigious. Sue everybody. Take their homes, their cars. Don't let anybody cross that line.<ref name="Lasar">{{cite web |url=https://arstechnica.com/tech-policy/news/2010/10/kiss-frontman-we-should-have-sued-them-all.ars |title=KISS frontman on P2P: "Sue everybody. Take their homes, their cars." |last=Lasar |first=Matthew |work=[[Ars Technica]] |date=2010-10-05 |access-date=2010-12-20}}</ref>|author=Gene Simmons}}

In response to Simmons' comments,<ref name="theguardian">{{cite news |title=Gene Simmons gets kiss of death from notorious web forum |first=Josh |last=Halliday |newspaper={{wipe|The Guardian}} |date=2010-10-14 |url=https://www.theguardian.com/technology/blog/2010/oct/14/gene-simmons-anonymous-attack-filesharing |access-date=2010-10-22 |location=London}}</ref> members of Operation Payback switched their attentions to his two websites, ''SimmonsRecords.com'' and ''GeneSimmons.com'', taking them both offline for a total of 38 hours.<ref name="pandalabssecurity"/><ref name="Mennecke">{{cite web |url=http://www.slyck.com/story2085_Anonymous_Strikes_at_KISS_Frontman_Gene_Simmons_With_DDoS_Attack |title=Slyck News - Anonymous Strikes at KISS Frontman Gene Simmons With DDoS Attack |last=Mennecke |first=Thomas |date=2010-10-13 |publisher=Slyck News |access-date=2010-10-20 |archive-date=2010-10-17 |archive-url=https://web.archive.org/web/20101017071730/http://www.slyck.com/story2085_Anonymous_Strikes_at_KISS_Frontman_Gene_Simmons_With_DDoS_Attack |url-status=dead }}</ref> At some point during the course of this DDoS, ''GeneSimmons.com'' was hacked and redirected to [[Social:The Pirate Bay|ThePirateBay.org]].<ref name="escapistmagazine">{{cite news |title=Gene Simmons Declares War on Anonymous |first=Andy |last=Chalk |newspaper=Escapist Magazine |date=2010-10-19 |url=http://www.escapistmagazine.com/news/view/104513-Gene-Simmons-Declares-War-on-Anonymous |access-date=2010-10-22 |archive-date=2010-10-22 |archive-url=https://web.archive.org/web/20101022102021/http://www.escapistmagazine.com/news/view/104513-Gene-Simmons-Declares-War-on-Anonymous |url-status=dead }}</ref>  In response to the attack Simmons wrote:

{{blockquote|text=
Some of you may have heard a few popcorn farts re: our sites being threatened by hackers.

Our legal team and the FBI have been on the case and we have found a few, shall we say "adventurous" young people, who feel they are above the law.

And, as stated in my MIPCOM speech, we will sue their pants off.

First, they will be punished.

Second, they might find their little butts in jail, right next to someone who's been there for years and is looking for a new girl friend.

We will soon be printing their names and pictures.

We will find you.

You cannot hide.

Stay tuned<ref name="Mennecke1">{{cite web |url=http://www.slyck.com/story2088_Gene_Simmons_Directly_Threatens_Anonymous_With_Legal_Action_Jail_Time |title=Gene Simmons Directly Threatens Anonymous With Legal Action, Jail Time |last=Mennecke |first=Thomas |date=2010-10-17 |publisher=SLYK |access-date=2010-10-12 |archive-date=2010-10-20 |archive-url=https://web.archive.org/web/20101020081701/http://www.slyck.com/story2088_Gene_Simmons_Directly_Threatens_Anonymous_With_Legal_Action_Jail_Time |url-status=dead }}</ref>}}

This led to additional attacks and subsequently more downtime for his websites.<ref name="Mennecke1"/><ref name="Read">{{cite web |url=http://gawker.com/5666411/gene-simmons-doesnt-understand-the-internet |title=Gene Simmons Doesn't Understand the Internet |last=Read |first=Max |date=2010-10-18<!-- 03:40 AM--> |work=Gawker |access-date=2010-10-20}}</ref><ref name="Anderson">{{cite news |url=https://arstechnica.com/tech-policy/news/2010/10/gene-simmons-vs-anonymous-whos-the-bigger-asshole.ars |title=Gene Simmons vs. Anonymous: Who's the bigger tool? |last=Anderson |first=Nate |work=[[Ars Technica]] |date=2010-10-18 |access-date=2010-10-20}}</ref><ref>{{cite web |url=http://laeknishendr.wordpress.com/2010/10/18/gene-simmons-vs-anonymous/ |title=Gene Simmons vs Anonymous |author=laeknishendr |work=Danger Nazi Zombies Ahead |publisher=WordPress |date=2010-10-18 |access-date=2010-10-20}}</ref> Later, Simmons's message was removed from his website.<ref>{{cite web |url=http://genesimmons.com/102010.html |title=GeneSimmons.com Archive News |access-date=2010-10-30 |publisher=Gene Simmons |archive-url=https://web.archive.org/web/20110115051159/http://www.genesimmons.com/102010.html |url-status=dead |archive-date=2011-01-15}}</ref> More than one year later, in December 2011, a person supposedly known under the nickname "spydr101" was arrested in relation to the attack against GeneSimmons.com. He was charged with conspiracy and unauthorized impairment of a protected computer.<ref>{{cite news |url=http://latimesblogs.latimes.com/lanow/2011/12/man-feds-say-connected-to-anonymous-hackers-man-charged-in-kiss-hacking-case.html |title='Anonymous' hacker charged in breach of KISS' Gene Simmons' website |date=2011-12-13 |access-date=2011-12-13 |author=Andrew Blankstein |work={{wipe|Los Angeles Times}}}}</ref><ref>{{cite news |url=http://edition.cnn.com/2011/12/13/us/california-gene-simmons-anonymous/ |title=Hacker tied to Anonymous charged with targeting GeneSimmons.com |publisher=CNN |author=Michael Martinez |date=2011-12-14 |access-date=2011-12-14}}</ref><ref>{{cite news |url=https://www.reuters.com/article/us-genesimmons-hacker-idUSTRE7BC2MQ20111214 |title=Alleged Gene Simmons website hacker arrested |date=2011-12-13 |access-date=2011-12-13 |publisher=Reuters |first=Jill |last=Serjeant}}</ref>

===RIAA===

On October 26, 2010, [[Software:LimeWire|LimeWire]] was ordered to disable the "searching, downloading, uploading, file trading and/or file distribution functionality" after losing a court battle with the RIAA over claims of copyright infringement. Not satisfied with the injunction, the RIAA announced its intention to continue the ''Arista Records LLC v. Lime Group LLC'' trial to recover damages caused by the program.<ref>{{Cite news|url=https://www.reuters.com/article/idUSN2616212420101026 |title=Court shuts down LimeWire music-sharing service |work={{wipe|Reuters}} |first1=Yinka |last1=Adegoke |first2=Jonathan |last2=Stempel |date=2010-10-26 |access-date=2010-10-26}}</ref><ref>{{Cite news |url=http://news.cnet.com/8301-31001_3-20020786-261.html |title=Judge slaps Lime Wire with permanent injunction |first=Greg |last=Sandoval |work=CNET |date=2010-10-26 |access-date=2010-10-26}}</ref> In retaliation,<ref name="cnbc">{{cite web |url=https://www.cnbc.com/id/39910518 |title=The Shared Enemy of Hollywood, Gene Simmons and Hustler |first=Chris |last=Morris |date=2010-10-29 |publisher={{wipe|CNBC}} |access-date=2010-12-23}}</ref> members of Operation Payback announced that they would attack RIAA's website on October 29, despite the fact that the group typically does not hit the same target twice.<ref>{{cite web |url=http://www.slyck.com/story2109_Anonymous_Planning_DDoS_Attack_Against_the_RIAA |title=Anonymous Planning DDoS Attack Against the RIAA |date=2010-10-28 |publisher=Slyck.com |first=Thomas |last=Mennecke |access-date=2010-12-23 |archive-date=2011-01-01 |archive-url=https://web.archive.org/web/20110101103647/http://www.slyck.com/story2109_Anonymous_Planning_DDoS_Attack_Against_the_RIAA |url-status=dead }}</ref><ref>{{cite news |url=https://www.pcmag.com/article2/0,2817,2371670,00.asp |title='Anonymous' Plans DDoS Attack on RIAA on Friday |date=2010-10-28 |first=Mark |last=Hachman |publisher=PC Magazine |access-date=2010-12-23}}</ref>  On October 29, ''riaa.org'' indeed was taken offline via [[Denial-of-service attack|denial-of-service attack]].<ref>{{cite web |url=http://www.slyck.com/story2110_RIAA_and_LimeWire_Both_Are_Offline |title=RIAA and LimeWire Both are Offline |date=2010-10-29 |first=Thomas |last=Mennecke |publisher=Slyck.com |access-date=2010-12-23 |archive-date=2010-11-02 |archive-url=https://web.archive.org/web/20101102150819/http://www.slyck.com/story2110_RIAA_and_LimeWire_Both_Are_Offline |url-status=dead }}</ref><ref>{{cite news |url=https://www.pcmag.com/article2/0,2817,2371784,00.asp |title='Anonymous' DDoS Attack Takes Down RIAA Site |date=2010-10-29 |first=Mark |last=Hachman |publisher=PC Magazine |access-date=2010-12-23}}</ref> After the attack, ''riaa.com'' and ''riaa.org'' sites were inaccessible in Europe.<ref>{{cite web |url=http://news.softpedia.com/news/Anonymous-Attacks-RIAA-over-LimeWire-Shutdown-164053.shtml |title=Anonymous Attacks RIAA over LimeWire Shutdown |date=2010-11-01 |first=Lucian |last=Constantin |publisher=[[Softpedia]] |access-date=2010-12-23}}</ref> Operation Payback's main site was attacked later that day, and they subsequently moved their website from ''tieve.tk'' to ''anonops.net''.<ref>{{cite web |url=https://www.theregister.co.uk/2010/11/01/riaa_anon_ddos/ |title=RIAA and Anonymous sites both downed by DDoS assaults |date=2010-11-01 |first=John |last=Leyden |publisher=The Register |access-date=2010-12-23}}</ref><ref name="net-security">{{cite web |url=http://www.net-security.org/secworld.php?id=10080 |title=RIAA's sites downed by Anonymous DDoS attack |date=2010-11-01 |work=net-security.org |first=Zeljika |last=Zorz |access-date=2010-12-23}}</ref>

During the damages phase of the LimeWire trial, the RIAA attempted to switch from seeking statutory damages per-work to seeking them per-infringement, but did not quote a total damage amount, nor a method of calculating the number of infringements.<ref name=DamagesRuling>{{cite web|url=http://beckermanlegal.com/Lawyer_Copyright_Internet_Law/arista_limewire_110310DecisionStatutoryDamages.pdf|title=Opinion and order - Case 1:06-cv-05936-KMW -DCF Document 678|date=2011-03-10|access-date=2012-10-16}}</ref> The judge in the case rejected the proposal, holding that case law only supported statutory damages on a per-work basis for large-scale infringement, thus capping the potential award at $1.5 billion.<ref name=DamagesRuling/> On March 15, 2011, four days after the ruling, a report appeared on Law.com highlighting the judge's remark that the per-infringement award sought by the record companies might total in the "trillions"; the report estimated $75 trillion in its attention-grabbing headline (USA's [[Finance:List of countries by GDP (nominal)|nominal GDP]] in 2012-2013 was about $16–17 trillion).<ref>{{cite web|url=https://www.imf.org/external/pubs/ft/weo/2014/02/weodata/weorept.aspx?sy=2012&ey=2019&scsm=1&ssd=1&sort=country&ds=.&br=1&pr1.x=41&pr1.y=3&c=512%2C668%2C914%2C672%2C612%2C946%2C614%2C137%2C311%2C962%2C213%2C674%2C911%2C676%2C193%2C548%2C122%2C556%2C912%2C678%2C313%2C181%2C419%2C867%2C513%2C682%2C316%2C684%2C913%2C273%2C124%2C868%2C339%2C921%2C638%2C948%2C514%2C943%2C218%2C686%2C963%2C688%2C616%2C518%2C223%2C728%2C516%2C558%2C918%2C138%2C748%2C196%2C618%2C278%2C624%2C692%2C522%2C694%2C622%2C142%2C156%2C449%2C626%2C564%2C628%2C565%2C228%2C283%2C924%2C853%2C233%2C288%2C632%2C293%2C636%2C566%2C634%2C964%2C238%2C182%2C662%2C453%2C960%2C968%2C423%2C922%2C935%2C714%2C128%2C862%2C611%2C135%2C321%2C716%2C243%2C456%2C248%2C722%2C469%2C942%2C253%2C718%2C642%2C724%2C643%2C576%2C939%2C936%2C644%2C961%2C819%2C813%2C172%2C199%2C132%2C733%2C646%2C184%2C648%2C524%2C915%2C361%2C134%2C362%2C652%2C364%2C174%2C732%2C328%2C366%2C258%2C734%2C656%2C144%2C654%2C146%2C336%2C463%2C263%2C528%2C268%2C923%2C532%2C738%2C944%2C578%2C176%2C537%2C534%2C742%2C536%2C866%2C429%2C369%2C433%2C744%2C178%2C186%2C436%2C925%2C136%2C869%2C343%2C746%2C158%2C926%2C439%2C466%2C916%2C112%2C664%2C111%2C826%2C298%2C542%2C927%2C967%2C846%2C443%2C299%2C917%2C582%2C544%2C474%2C941%2C754%2C446%2C698%2C666&s=NGDPD&grp=0&a=|title=Report for Selected Countries and Subjects}}</ref> This figure was repeated in ''PC Magazine'' on March 23.<ref>{{cite web|url=https://www.pcmag.com/article2/0,2817,2382494,00.asp|title=P2P Music File Sharing Dropped After Limewire Shutdown, NPD Says|last=Albanesius|first=Chloe|date=2011-03-23|access-date=2012-10-16}}</ref> An Operation Payback call-to-arms followed, citing the $75 trillion figure as if it were still being actively sought by the RIAA, and a DDoS attack on the RIAA website commenced on March 25.<ref>{{cite web|url=http://www.infosecisland.com/blogview/12729-RIAA-Targeted-by-Anonymous-Operation-Payback.html|title=RIAA Targeted by Anonymous' Operation Payback|date=2011-03-28|access-date=2012-10-16|archive-date=2012-10-15|archive-url=https://web.archive.org/web/20121015231300/http://infosecisland.com/blogview/12729-RIAA-Targeted-by-Anonymous-Operation-Payback.html|url-status=dead}}</ref>

===November 5, 2010 attacks===

Around October 28, 2010, the group set up a new website with the intention of coordinating protests around the world to raise awareness of their cause. The date for the protest activities were on November 5, the intended day of the Gunpowder Plot, with which Anonymous heavily affiliates through its use of Guy Fawkes masks.

The protest activity included an attack on the United States Copyright Office, after which the FBI launched an investigation.<ref name="cnet">{{cite web |url=http://news.cnet.com/8301-31001_3-20022264-261.html |title=FBI probes 4chan's 'Anonymous' DDoS attacks |first=Greg |last=Sandoval |publisher=CNET.com |date=2010-11-09 |access-date=2010-12-23}}</ref> They later arrested one person accused of taking part in the attack on [[Company:PayPal|PayPal]].<ref name=nl>{{cite news|last=Sterling|first=Toby|title=Dutch give details on 4 'Anonymous' hacker arrests|url=http://news.smh.com.au/breaking-news-technology/dutch-give-details-on-4-anonymous-hacker-arrests-20110721-1hp9g.html|access-date=21 July 2011|newspaper=The Sydney Morning Herald|date=21 July 2011|agency=Fairfax Media|archive-url=https://www.webcitation.org/60Lj08HZB?url=http://news.smh.com.au/breaking-news-technology/dutch-give-details-on-4-anonymous-hacker-arrests-20110721-1hp9g.html|archive-date=21 July 2011|url-status=live|location=[[Place:Sydney|Sydney]]}}</ref>

===Hiatus and resumption of website attacks===
On November 9, 2010, Operation Payback temporarily ceased attacking websites.<ref>{{cite web |url=http://www.myce.com/news/operation-payback-takes-a-break-but-for-how-long-36311/ |title=Operation Payback takes a break ... but for how long? |author=wconeybeer |date=2010-11-09 |work=myce.com |access-date=2010-12-23}}</ref> The hiatus lasted about four months, ending with an early March 2011 attack that temporarily took down the website of BMI, a prominent collection society operating on behalf of music publishers.<ref>{{cite web|url=https://arstechnica.com/tech-policy/2011/03/anonymous-revives-operation-payback-targets-copywrong/|title=Anonymous revives Operation Payback, wages war on "copywrong"|date=2012-03-08|access-date=2012-10-16|last=Anderson|first=Nate|publisher=ArsTechnica}}</ref> This was followed by the aforementioned second attack on the RIAA website.

==Sarah Palin==
On December 8, 2010, U.S. politician Sarah Palin announced that her website and personal credit card information were compromised.<ref name="sarah-1"/> Palin's team believed the attack was executed by Anonymous, though Anonymous never commented about Palin as a possible target for any attack.<ref name="sarah-1"/><ref name="metro">{{cite web |url=http://www.metro.co.uk/tech/849918-sarah-palin-website-hit-by-wikileaks-operation-payback-ddos-attack |title=Sarah Palin website hit by WikiLeaks Operation Payback DDoS attack |date=2010-12-09 |access-date=2010-12-09 |work=metro.co.uk |publisher=Metro |first=Tom |last=Phillips}}</ref><ref name="sarah-2"/> Palin's technical team posted a screenshot of a server log file showing the wikileaks.org [[URL]].<ref name="sarah-1"/><ref name="sarah-2">{{cite web |url=http://www.theatlanticwire.com/opinions/view/opinion/Is-Palin-Just-Using-Operation-Payback-to-Get-Attention-6125 |title=Is Palin Just Using 'Operation Payback' to Get Attention? |first=John |last=Hudson |work=theatlanticwire.com |publisher=The Atlantic Wire |date=2010-12-09 |access-date=2010-12-09 |archive-date=2010-12-11 |archive-url=https://web.archive.org/web/20101211120803/http://www.theatlanticwire.com/opinions/view/opinion/Is-Palin-Just-Using-Operation-Payback-to-Get-Attention-6125 |url-status=dead }}</ref> Visa attacks had been denial of service attacks, but credit card data was not compromised. It is unknown whether Palin's card was compromised as part of a broad attack on Visa or a specific attack on the Palins.<ref name="sarah-2"/>

==Operation Avenge Assange==

In December 2010, [[Social:WikiLeaks|WikiLeaks]] came under intense pressure to stop publishing secret U.S. diplomatic cables. Corporations such as Amazon, [[Company:PayPal|PayPal]], BankAmerica, Swiss bank PostFinance, MasterCard and [[Company:Visa Inc.|Visa]] either stopped working with or froze their customers' donations to WikiLeaks due to political pressures. In response, those behind Operation Payback directed their activities against these companies.<ref name="panda">{{cite web|url=http://pandalabs.pandasecurity.com/operationpayback-broadens-to-operation-avenge-assange/ |title=Operation:Payback broadens to "Operation Avenge Assange" |work=pandasecurity.com |date=2010-12-06 |access-date=2010-12-09 |first=Sean-Paul |last=Correll |publisher=[[Company:Panda Security|Panda Security]] |url-status=dead |archive-url=https://web.archive.org/web/20101208061947/http://pandalabs.pandasecurity.com/operationpayback-broadens-to-operation-avenge-assange/ |archive-date=December 8, 2010 }}</ref><ref>{{cite news |url=http://thelede.blogs.nytimes.com/2010/12/06/latest-updates-on-leak-of-u-s-cables-day-9/#operation-payback-plans-attacks-on-paypal |title=Latest Updates on Leak of U.S. Cables, Day 9 |work={{wipe|The New York Times}} |first=Robert |last=Mackey |date=2010-12-06 |access-date=2010-12-07}}</ref> Operation Payback launched DDoS attacks against PayPal, PostFinance and the Swedish Prosecution Authority.<ref name="rawstory1">{{cite web |url=http://www.rawstory.com/rs/2010/12/hackers-website-bank-froze-wikileaks-funds/ |title=Hackers take down website of bank that froze WikiLeaks funds |first=Daniel |last=Tencer |work=The Raw Story |date=2010-12-06 |access-date=2010-12-07 |archive-date=2010-12-08 |archive-url=https://web.archive.org/web/20101208235538/http://www.rawstory.com/rs/2010/12/hackers-website-bank-froze-wikileaks-funds/ |url-status=dead }}</ref><ref>{{cite news |url=https://www.theguardian.com/news/blog/2010/dec/07/wikileaks-us-embassy-cables-live-updates |title=WikiLeaks US embassy cables: live updates |first1=Matthew |last1=Weaver |first2=Richard |last2=Adams |work=The Guardian |date=2010-12-07 |access-date=2010-12-07 |location=London}}</ref><ref>{{cite web |url=http://www.eweek.com/c/a/Security/PayPal-PostFinance-Hit-by-DoS-Attacks-CounterAttack-in-Progress-860335/ |archive-url=https://archive.today/20121209011911/http://www.eweek.com/c/a/Security/PayPal-PostFinance-Hit-by-DoS-Attacks-CounterAttack-in-Progress-860335/ |url-status=dead |archive-date=December 9, 2012 |title=PayPal, PostFinance Hit by DoS Attacks, Counter-Attack in Progress |first=Fahmida Y. |last=Rashid |work=eWeek.com |date=2010-12-06 |access-date=2010-12-07 }}</ref> On December 8, 2010, a coordinated DDoS attack by Operation Payback brought down both the MasterCard and Visa websites.<ref>{{cite news |title=Cyberwar: Now Hackers Have Taken Down Mastercard.com As Revenge For Julian Assange |first=Joe |last=Weisenthal |url=http://www.businessinsider.com/cyber-hackers-that-took-down-swiss-bank-site-have-now-taken-down-mastercardcom-2010-12 |newspaper=Business Insider |date=2010-12-08 |access-date=2010-12-23}}</ref><ref>{{cite news |url=https://www.theguardian.com/world/2010/dec/08/wikileaks-visa-mastercard-operation-payback |title=WikiLeaks supporters disrupt Visa and MasterCard sites in 'Operation Payback' |date=2010-12-09 |access-date=2010-12-09 |first1=Esther |last1=Addley |first2=Josh |last2=Halliday |publisher={{wipe|The Guardian}} |work=guardian.co.uk |location=London}}</ref><ref>{{cite news |url=https://www.pcmag.com/article2/0,2817,2374023,00.asp |title='Anonymous' Launches DDoS Attacks Against WikiLeaks Foes |work=pcmag.com |publisher=PC Magazine |first=Leslie |last=Horn |date=2010-12-08 |access-date=2010-12-09}}</ref><ref>{{cite web |url=http://www.boingboing.net/2010/12/08/in-pro-wikileaks-act.html |title=Continuing pro-WikiLeaks DDOS actions, Anonymous takes down PayPal.com |first=Xeni |last=Jardin |date=2010-12-08 |access-date=2010-12-09 |work=boingboing.net |publisher=Boing Boing}}</ref> On December 9, 2010, prior to a sustained DDoS attack on the PayPal website that caused a minor slowdown to its service, PayPal announced on its blog that it would release the frozen funds in the account of the [[Organization:Wau Holland Foundation|Wau Holland Foundation]] that was raising funds for WikiLeaks, but would not reactivate the account.<ref>{{cite web |url=https://www.thepaypalblog.com/2010/12/updated-statement-about-wikileaks-from-paypal-general-counsel-john-muller/ |title=Updated Statement about WikiLeaks from PayPal General Counsel, John Muller |first=John |last=Muller |work=thepaypalblog.com |publisher=[[Company:PayPal|PayPal]] |date=2010-12-08 |access-date=2010-12-09 |archive-url=https://web.archive.org/web/20110108115822/https://www.thepaypalblog.com/2010/12/updated-statement-about-wikileaks-from-paypal-general-counsel-john-muller/ |url-status=dead |archive-date=2011-01-08}}</ref><ref>{{cite web |url=http://erictric.com/2010/12/08/paypal-vows-to-release-wikileaks-funds-account-to-remain-blocked/ |title=PayPal Vows to Release WikiLeaks Funds, Account to Remain Blocked |first=Bertrand |last=Vasquez |date=2010-12-08 |access-date=2010-12-09 |work=erictric.com |archive-date=2011-04-12 |archive-url=https://web.archive.org/web/20110412092610/http://erictric.com/2010/12/08/paypal-vows-to-release-wikileaks-funds-account-to-remain-blocked/ |url-status=dead }}</ref> Regarding the attacks, WikiLeaks spokesman Kristinn Hrafnsson denied any relation to the group and said, "We neither condemn nor applaud these attacks. We believe they are a reflection of public opinion on the actions of the targets."<ref>{{cite web|url=http://wikileaks.ch/articles/2010/Statement-on-DDOS-attacks.html |title=Statement on DDOS attacks |date=2010-12-09 |access-date=2010-12-09 |work=wikileaks.ch |publisher=[[Social:WikiLeaks|WikiLeaks]] |url-status=dead |archive-url=https://web.archive.org/web/20101210081025/http://www.wikileaks.ch/articles/2010/Statement-on-DDOS-attacks.html |archive-date=December 10, 2010 }}</ref> On the same day, a 16-year-old boy was arrested in  [[Place:The Hague|The Hague]], Netherlands, in connection with the distributed denial-of-service attacks against MasterCard and PayPal.<ref>{{cite news |url=http://edition.cnn.com/2010/WORLD/europe/12/09/world.wikileaks/ |title=Pro-WikiLeaks hackers change target to PayPal |access-date=2010-12-09 |date=2010-12-09 |author=The CNN Wire Staff |publisher=CNN |work=edition.cnn.com}}</ref><ref>{{cite web |url=http://nakedsecurity.sophos.com/2010/12/09/dutch-boy-arrested-for-wikileaks-related-ddos-attacks-on-mastercard-and-paypal/ |title=Dutch boy arrested for WikiLeaks-related DDoS attacks on Mastercard and PayPal |date=2010-12-09 |access-date=2010-12-09 |first=Graham |last=Cluley |work=nakedsecurity.sophos.com |publisher=[[Company:Sophos|Sophos]]}}</ref><ref>{{cite web |url=http://www.om.nl/actueel/nieuws-_en/@154591/16-jarige_jongen/ |language=nl |title=16-jarige jongen aangehouden vanwege WikiLeaks-aanvallen |first=Landelijk |last=Parket |work=om.nl |date=2010-12-09 |access-date=2010-12-09 |archive-date=2012-03-31 |archive-url=https://web.archive.org/web/20120331221259/http://www.om.nl/actueel/nieuws-_en/@154591/16-jarige_jongen/ |url-status=dead }}</ref> The boy was an IRC operator under the nickname of Jeroenz0r.<ref>{{cite web |url=http://torrentfreak.com/anonymous-operation-payback-irc-operator-arrested-101210/ |title=Anonymous' Operation Payback IRC Operator Arrested |date=2010-12-10 |access-date=2011-01-07 |publisher=TorrentFreak |author=Ernesto}}</ref>

On December 10, 2010, ''The Daily Telegraph'' reported that Anonymous had threatened to disrupt British government websites if Assange were extradited to Sweden.<ref>{{cite news |url=https://www.telegraph.co.uk/news/worldnews/wikileaks/8193210/WikiLeaks-hackers-threaten-British-Government.html |title=WikiLeaks Hackers Threaten British Government |date=2010-12-10 |access-date=2010-12-10|first=Steven |last=Swinford |work=telegraph.co.uk |publisher=The Daily Telegraph |location=London}}</ref> Anonymous issued a [[Social:Press release|press release]]<ref>{{Cite web |url=http://dump.no/files/467072ba2a42/ANONOPS_The_Press_Release.pdf |title=Dump.no |access-date=2010-12-10 |archive-url=https://web.archive.org/web/20101211014222/http://dump.no/files/467072ba2a42/ANONOPS_The_Press_Release.pdf |archive-date=2010-12-11 |url-status=dead }}</ref> in an attempt to clarify the issue.<ref>{{cite web |url=http://www.thinq.co.uk/2010/12/10/who-are-anonymous-and-what-do-they-want/ |title=Who are Anonymous? And what do they want? |first=James |last=Nixon |date=2010-12-10 |access-date=2010-12-10 |work=thinq.co.uk}}</ref>

[[Organization:Electronic Frontier Foundation|Electronic Frontier Foundation]] co-founder John Perry Barlow described the attacks as "the shot heard round the world—this is Lexington."<ref>{{cite news|last=Cohen|first=Noam|title=Web Attackers Find a Cause in WikiLeaks|url=https://www.nytimes.com/2010/12/10/world/10wiki.html|access-date=11 December 2010|newspaper={{wipe|The New York Times}}|date=December 10, 2010}}</ref> On December 13, 2010 Julian Assange called for supporters to protect WikiLeaks and said that "Visa, Mastercard, PayPal and others are instruments of US foreign policy" in a statement that was seen as likely to add cyber attacks being perpetrated by Anonymous in support of WikiLeaks.<ref>{{Cite news |last=Halliday |first=Josh |date=2010-12-14 |title=Julian Assange urges supporters to protect WikiLeaks |language=en-GB |work=The Guardian |url=https://www.theguardian.com/media/2010/dec/14/wikileaks-julian-assange-protect-from-attack |access-date=2023-10-23 |issn=0261-3077}}</ref>

The following is a list of sites and domains known to have been targeted<!-- (in reliable sources)-->:

{| class="wikitable"
|-
! Target<!-- <ref name="anontargets">{{cite web |url=http://anonops.net/targets.php |title=Operation Payback - Targets |access-date=2010-10-29 |work=anonops.net |author=Anonymous}}</ref>-->
! Site<!-- <ref name="anontargets"/> -->
! Attack time <!-- <ref name="anontargets"/>-->
! Ref.
|-
|PostFinance
|''postfinance.ch''
|align="center"|2010-12-06
|align="center"|<ref name="rawstory1"/>
|-
|Swedish Prosecution Authority
|''aklagare.se''
|align="center"|2010-12-07
|align="center"|<ref>{{cite news |url=https://www.theguardian.com/technology/2010/dec/15/wikileaks-met-police-investigate-anonymous |title=WikiLeaks: Police to investigate Anonymous online attacks |date=2010-12-15 |access-date=2011-01-06 |first=Josh |last=Halliday |work=The Guardian |location=London}}</ref>
|-
|EveryDNS
|''everydns.com''
|align="center"|2010-12-07
|align="center"|<ref name="panda"/>
|-
|Joseph Lieberman
|''lieberman.senate.gov''
|align="center"|2010-12-08
|align="center"|<ref name="panda2">{{cite web |url=http://pandalabs.pandasecurity.com/tis-the-season-of-ddos-wikileaks-editio/ |title='Tis the Season of DDoS – WikiLeaks Edition |date=2010-12-04 |access-date=2011-01-07 | first=Sean-Paul  |last=Correll |publisher=PandaLabs}}</ref>
|-
|MasterCard
|''mastercard.com''
|align="center"|2010-12-08
|align="center"|<ref>{{cite news |url=https://www.theguardian.com/media/2010/dec/08/operation-payback-mastercard-website-wikileaks |title=Operation Payback cripples Mastercard site in revenge for WikiLeaks ban |date=2010-12-08 |access-date=2010-12-31 |author=Esther Addley and Josh Halliday |work=The Guardian |location=London}}</ref>
|-
|Borgstrom and Bodström
|''advbyra.se''
|align="center"|2010-12-08
|align="center"|<ref name="panda2"/>
|-
|[[Company:Visa Inc.|Visa]]
|''visa.com''
|align="center"|2010-12-08
|align="center"|<ref name="visa"/>
|-
|Sarah Palin
|''sarahpac.com''
|align="center"|2010-12-08
|align="center"|<ref name="sarah-1">{{cite web |url=http://blogs.abcnews.com/politicalpunch/2010/12/exclusive-palin-under-cyber-attack-from-wikileaks-supporters-in-operation-payback.html |title=Exclusive: Sarah Palin Under Cyber-Attack from Wikileaks Supporters in 'Operation Payback' |date=2010-12-08 |access-date=2010-12-09 |work=abcnews.com |first=Jake |last=Tapper |publisher=ABC News}}</ref>
|-
|[[Company:PayPal|PayPal]]
|''thepaypalblog.com''
|align="center"|2010-12-09
|align="center"|<ref>{{cite news |url=https://www.reuters.com/article/idUSLDE6BA05O20101211 |title=WikiLeaks supporters' group abandons cyber attacks |date=2010-12-11 |access-date=2011-01-07 |work=Reuters |first=Georgina |last=Prodhan |archive-url=https://web.archive.org/web/20101218174954/http://www.reuters.com/article/idUSLDE6BA05O20101211 |url-status=live |archive-date=2010-12-18}}</ref>
|-
|Amazon
|''amazon.com''
|align="center"|2010-12-09<br/>(Aborted)
|align="center"|<ref name="AmazonAborted">{{cite web |url=http://news.netcraft.com/archives/2010/12/09/operation-payback-aborts-attack-against-amazon-com.html |title=Operation Payback aborts attack against Amazon.com |first=Paul |last=Mutton |date=2010-12-09 |access-date=2010-12-10 |work=netcraft.com |publisher=[[Company:Netcraft|Netcraft]]}}</ref><br/><ref>{{cite web |url=http://www.readwriteweb.com/archives/operation_payback_targets_amazon_wikileaks_in_kindle_store.php |title=Operation Payback Targets Amazon; Wikileaks Cables Found in Kindle Book Store |date=2010-12-09 |access-date=2010-12-09 |first=Sarah |last=Perez |work=readwriteweb.com |publisher=ReadWriteWeb |archive-url=https://web.archive.org/web/20101211150731/http://www.readwriteweb.com/archives/operation_payback_targets_amazon_wikileaks_in_kindle_store.php |archive-date=2010-12-11 |url-status=dead }}</ref>
|-
|PayPal
|''api.paypal.com:443''
|align="center"|2010-12-10
|align="center"|<ref>{{cite web |url=https://www.thepaypalblog.com/2010/12/update-on-paypal-site-status/ |title=Update on PayPal site status |date=2010-12-09 |access-date=2011-01-07 }}</ref>
|-
|MoneyBookers
|''moneybookers.com''
|align="center"|2010-12-10
|align="center"|<ref>{{cite news |url=https://www.reuters.com/article/idUSL3E6N80HH20101210 |title=Activists target Dutch website after boy arrested |date=2010-12-10 |access-date=2011-01-07 |work=Reuters |first=William |last=Maclean |archive-url=https://web.archive.org/web/20110108093508/http://www.reuters.com/article/idUSL3E6N80HH20101210 |url-status=live |archive-date=2011-01-08}}</ref>
|- 
|Conservatives4Palin
|''conservatives4palin.com''
|align="center"|2010-12-10
|align="center"|<ref>{{cite web |url=http://conservatives4palin.com/2010/12/were-temporarily-moving-back-to-blogger-as-were-under-attack.html |title=We're Temporarily Moving Back to Blogger As We're Under Attack |date=2010-12-10 |access-date=2011-01-06 |first=Ian |last=Lazaran |publisher=conservatives4palin.com |archive-url=https://web.archive.org/web/20110728084423/http://conservatives4palin.com/2010/12/were-temporarily-moving-back-to-blogger-as-were-under-attack.html |url-status=live |archive-date=2011-07-28}}</ref>
|-
|}

Operation Payback's attempt to take down Amazon.com was aborted after they failed to recruit enough users to their botnet; CNN noted that the massive Amazon website "is almost impossible to crash."<ref name="AmazonAborted"/><!-- The failed DDoS attack has been attributed to Amazon's massive server capacity, which is normally used to handle the excessive traffic during the December holiday shopping season.<ref>{{cite news |title=Why attackers can't take down Amazon.com |url=http://money.cnn.com/2010/12/09/technology/amazon_wikileaks_attack/ |first=Julianne |last=Pepitone |work=CNNMoney.com |publisher=CNN.com |date=2010-12-09 |access-date=2010-12-14}}</ref>-->

In late December, the FBI began to raid suspected participants in Operation Payback.<ref>{{cite web |title=FBI raids ISP in Anonymous DDoS investigation |url=http://www.computerworld.com/s/article/9202838/FBI_raids_ISP_in_Anonymous_DDoS_investigation?taxonomyId=86 |first=Robert |last=McMillan |work=Computerworld.com |date=2010-12-30 |access-date=2010-12-30}}</ref>

At the beginning of 2011, Operation Payback brought down Zimbabwean government websites after the Zimbabwean President's wife sued a newspaper for $15 million for publishing a WikiLeaks cable that linked her with the alleged trade in [[Social:Blood diamond|illicit diamonds]].<ref>{{cite web|url=http://www.smh.com.au/technology/technology-news/wikileaks-supporters-attack-zimbabwean-sites-20110102-19d1x.html|title=WikiLeaks supporters attack Zimbabwean sites|work=The Sydney Morning Herald|date=2 January 2011 }}</ref> On January 27, 2011, five males aged between 15 and 26 were arrested in early morning raids in the U.K. on suspicion of involvement,<ref>{{cite news |url=https://www.bbc.co.uk/news/technology-12299137|title=Five arrested over 'Anonymous' web attacks|date=27 January 2011|access-date=30 January 2011|work=BBC News}}</ref> and the FBI executed 40 search warrants the same day.<ref>{{cite news |url=https://www.nytimes.com/2011/01/28/us/28wiki.html?_r=1  |title=F.B.I. Warrants Into Service Attacks by WikiLeaks Supporters |date=2011-01-27 |last=Savage |first=Charlie |access-date=2011-01-30 |work=The New York Times}}</ref>

==Criticism==
The United Kingdom Intellectual Property Office said that when its site was attacked, those responsible were depriving its citizens of access to information they have a democratic right to access.<ref name="cmu">{{cite web |url=http://www.thecmuwebsite.com/article/riaa-site-goes-down-following-limewire-win/ |title=RIAA site goes down following LimeWire win |date=2010-11-01 |author=cmumusicnews |work=thecmuwebsite.com |access-date=2010-12-23}}</ref> Other critics claimed the attacks restricted Gene Simmons' right to free speech.<ref name="cmu" />

A spokesman for the MPAA said, "It's troubling that these groups seem more concerned about the rights of those who steal and copy films, music, books, and other creative resources than the rights of American workers who are producing these products."<ref name="cnet" />

There was also some criticism from the [[Organization:Pirate Party UK|Pirate Party UK]] and United States Pirate Party, which in a joint public statement urged the group to "Immediately cease the Distributed Denial-of-Service (DDoS) attacks and to instead seek out a legal method to express your frustration and disquiet with the copyright industry, and their perversions of copyright law for personal gain."<ref>{{cite web |url=http://torrentfreak.com/pirate-parties-use-influence-to-halt-operation-payback-101120/ |title=Pirate Parties Use Influence to Halt Anonymous Operation Payback |date=2010-11-20 |author=enigmax |publisher=TorrentFreak |work=torrentfreak.com |access-date=2010-12-23}}</ref>

While acknowledging that the DDoS attacks on credit card and banking web sites serve as political protests, cyber experts said that Operation Payback has not done any long-term damage: most sites are back online, and people are still continuing to use their credit cards to make payments. "This is more like a noisy political demonstration, like a mob surrounding a bank and refusing to let anyone in or out" said one cyber expert.<ref name="AFP_NoBite">{{cite news |url=http://www.thenews.com.pk/Todays-News-1-20183-WikiLeaks-cyber-backlash-all-bark-no-bite-experts |title=WikiLeaks cyber backlash all bark, no bite: experts |date=2010-12-11 |agency=Agence France-Presse |work=The News International |access-date=2015-01-10}}</ref>

==Tools and communication==
Operation Payback members used a modified version of the [[Software:Low Orbit Ion Cannon|Low Orbit Ion Cannon]] (LOIC) to execute the DDoS attacks.<ref name="softpedia1">{{cite news |title=Anonymous DDoS Tool Gets Botnet Capabilities |first=Lucian |last=Constantin |newspaper=[[Softpedia]] |date=2010-09-27 |url=http://news.softpedia.com/news/Anonymous-DDoS-Tool-Gets-Botnet-Capabilities-158163.shtml |access-date=2010-10-22 |archive-date=2016-03-04 |archive-url=https://web.archive.org/web/20160304051237/http://news.softpedia.com/news/Anonymous-DDoS-Tool-Gets-Botnet-Capabilities-158163.shtml |url-status=dead }}</ref> In September 2010, a "Hive Mind" mode was added to the LOIC.<ref name="softpedia1"/> While in Hive Mind mode, the LOIC connects to [[Internet Relay Chat|IRC]], where it can be controlled remotely. This allows computers with LOIC installed on them to behave as if they were a part of a [[Botnet|botnet]]. Utilising this tool, the coordinators of Operation Payback were able to quickly take down websites belonging to anti-piracy groups.<ref name="softpedia1"/>  Botnets of all sizes have also been used.<ref>{{cite web |url=http://pandalabs.pandasecurity.com/wp-content/uploads/2010/09/ScreenHunter_01-Sep.-17-13.07.jpg |title=Operation Payback flyer from mpaa.org attack |date=2010-09-17 |access-date=2010-10-29}}</ref>

Members of Operation Payback reportedly used an IRC channel to communicate about which targets to select, after which instructions for attacking the targets were produced and posted on various imageboards (4chan/7chan/711chan/420chan/808chan).<ref name="p2pnet">{{cite interview|subject=Anonymous |interviewer=Jon Newton |title=p2pnet talks with Operation Payback |url=http://www.p2pnet.net/story/45762 |type=Interview: Transcript |work=p2pnet.net |date=2010-11-18 |access-date=2010-12-23}}</ref> Media such as [[Company:Twitter|Twitter]] and  [[Company:Facebook|Facebook]] were also utilized for coordination,<ref name="p2pnet"/> but on December 8, 2010, Operation Payback's Facebook page was removed and its official Twitter account was suspended.<ref name="visa">{{cite web |url=http://news.cnet.com/8301-31921_3-20025075-281.html |title=Facebook, Twitter boot WikiLeaks supporters after Visa attack |first=Elinor |last=Mills |date=2010-12-08 |access-date=2010-12-09 |publisher=Cnet |work=news.cnet.com |archive-date=2011-10-08 |archive-url=https://web.archive.org/web/20111008134410/http://news.cnet.com/8301-31921_3-20025075-281.html |url-status=dead }}</ref><ref>{{cite web |url=http://www.heise.de/tp/blogs/6/148908 |title=Facebook und Twitter gegen "Operation Payback" |first=Florian |last=Rötzer |date=2010-12-08 |access-date=2010-12-08 |work=heise.de |language=de}}</ref><ref>{{cite news |url=https://blogs.forbes.com/mikeisaac/2010/12/08/facebook-and-twitter-suspend-operation-payback-accounts/ |title=Facebook and Twitter Suspend Operation Payback Accounts |first=Mike |last=Isaac |date=2010-12-08 |access-date=2010-12-09 |work={{wipe|Forbes}}}}<!-- Do not remove this source, it has the most complete information and its supported by primary sources --></ref> Additionally a federal court order forced [[Social:Encyclopedia Dramatica|Encyclopedia Dramatica]] to delete its Operation Payback article, which featured a detailed history of the operation, including personal information of some individuals associated with the companies attacked .<ref>{{cite web |url=http://gawker.com/5709789/noose-closes-around-pro+wikileaks-vigilantes |title=Noose Closes Around Pro-WikiLeaks Vigilantes |first=Ryan |last=Tate |date=2010-12-09 |access-date=2010-12-09 |work=gawker.com |publisher=Valleywag |archive-url=https://web.archive.org/web/20110812065510/http://gawker.com/5709789/noose-closes-around-pro+wikileaks-vigilantes |archive-date=2011-08-12 |url-status=dead }}</ref><ref>{{cite news |title=Anonymous keeps the cannons firing while pressure mounts |first=Steve |last=Ragan |url=http://www.thetechherald.com/article.php/201049/6530/Anonymous-keeps-the-cannons-firing-while-pressure-mounts?page=1 |newspaper=The Tech Herald |page=1 |date=2010-12-09 |access-date=2010-12-23 |archive-date=2011-11-02 |archive-url=https://web.archive.org/web/20111102204510/http://www.thetechherald.com/article.php/201049/6530/Anonymous-keeps-the-cannons-firing-while-pressure-mounts?page=1 |url-status=dead }}</ref><ref>{{cite news |title=WikiLeaks cables: Shell, Operation Payback and Assange for the Nobel prize - as it happened |first1=Matthew |last1=Weaver |first2=Mark |last2=Tran |url=https://www.theguardian.com/news/blog/2010/dec/09/wikileaks-us-embassy-cables-live-updates |newspaper=The Guardian |date=2010-12-09 |access-date=2010-12-23 |location=London}}</ref>

== Federal indictment ==
In July 2011, 14 members of Operation Avenge Assange were arrested.<ref>{{Cite web |date=2011-07-27 |title=Anonymous, LulzSec Hacking Groups Call for PayPal Boycott |url=https://www.nbcnews.com/id/wbna43913282 |access-date=2023-10-23 |website=NBC News |language=en}}</ref> In October 2013, 13 members of Operation Payback were indicted in Federal court in Alexandria, Virginia as co-conspirators in violation of 18 U.S.C. § 371 and 18 U.S.C. § 1030.<ref>{{Cite web|url=https://www.scribd.com/document/173135553/Collins-Indictment|title=Collins_Indictment {{!}} Denial Of Service Attack {{!}} Wiki Leaks|website=Scribd|language=en|access-date=2018-07-21}}</ref> In 2014, some of the members received a plea deal, reducing their felony charges to a single misdemeanor.<ref>{{Cite news|url=https://www.reuters.com/article/us-anonymous-cybercrime-plea/anonymous-hackers-plead-guilty-to-minor-charge-in-u-s-for-cyberattacks-idUSKBN0GJ25720140819|title='Anonymous' hackers plead guilty to minor charge in U.S. for ...|last=Viswanatha|first=Aruna|work=U.S.|access-date=2018-07-21|language=en-US}}</ref> The defendants were penalized with jail sentences, and one defendant with community service.<ref>{{Cite web|date=2015-01-24|title=ANONYMOUS DDoS Attack Felony DISMISSED, No Jail Time Ordered on Misdemeanor Charge of Conspiracy to Intentionally Cause Damage to a Protected Computer|url=https://medvinlaw.com/anonymous-ddos-attack-conspiracy-to-intentionally-cause-damage-to-a-protected-computer/|access-date=2021-07-07|website=MEDVIN LAW|language=en-US}}</ref>

==See also==
*[[February 2010 Australian cyberattacks]]
*[[Hacktivism]]
*[[Social:Operation Leakspin|Operation Leakspin]]
*[[Social:Project Chanology|Project Chanology]]

==References==
{{Reflist|2}}

==External links==
*[http://anonops.ru AnonOps] &ndash; Main coordination website for Operation Payback (Disfunctioning)
*[http://www.anonops.com AnonOps IRC Network] &ndash; Main IRC network where anonymous resides on
*[http://pandalabs.pandasecurity.com/4chan-users-organize-ddos-against-mpaa/ Pandalabs.pandasecurity.com] &ndash; Chronicle of all Operation Payback events

<!--
*[irc:/irc.anonops.net/OperationPayback irc.anonops.net] or [http://www.anonops.eu/irc.html AnonOps.eu] IRC Server at 91.121.92.84
* {{Twitter|Op_anon|Operation Payback}}
* [http://anonops.socialgo.com/ AnonOps SocialGo]
-->

{{Hacking in the 2010s}}
{{Anonymous and the Internet}}

[[Category:Denial-of-service attacks]]

{{Sourceattribution|Operation Payback}}