How Can You Defend Against Cyber Vigilantes?

Cyber vigilantism—also called Internet vigilantism, hacktivism, or digilantism—occurs when a person or group launches an online attack against individuals or organizations they disagree with philosophically or politically.

Whether you cheer or bemoan cyber vigilantes’ Robin Hood–style attacks depends on your own political and other beliefs. Consider where you stand, for instance, on these attacks against individuals, businesses, and terrorist groups:

• Online vigilantes are actively subverting ISIS by reporting and helping take down thousands of ISIS-related Twitter accounts. (“This is my airstrike,” wrote one vigilante.)
• Anonymous, the world’s most famous hacktivist group, hacked Islamic extremist websites in retaliation for the terror attack on Charlie Hebdo.
• In 2015, hacktivists stole private information on 37 million people who use the Ashley Madison website, a website that encourages users to cheat on their partners.
• Hacktivist supporters of Julian Assange launched DDoS attacks on the websites of anyone taking action against WikiLeaks.
• In 2010, bloggers incensed over the cyber bullying of a 13-year-old girl conducted an online campaign of retaliation against the perpetrator.

What Can Organizations Do?

The Ashley Madison attack is particularly worrisome for organizations that are rightly concerned that a cyber vigilante attack could happen to them. CEO Noel Biderman resigned over the breach, and while the company announced that about 6.5 million new users have signed up since the hack, having members’ personal records exposed to the world is simply not good for business.

To some extent, preventing attacks by hacktivists is not much different than preventing attacks by cyber criminals, nation states, and other threat sources. All require foresight, strategic planning, and deep investments of time and resources in advanced cybersecurity measures.

Organizations that are especially concerned about cybervigilantism do have additional options. For instance, organizations that attract political opponents—from government agencies to oil and gas companies—would be wise to track social media closely to identify hacktivist threats early, before their momentum builds. Many online vigilantes, such as those attacking ISIS, are increasingly crowdsourcing their efforts to attract more supporters. By closely monitoring online conversations about their work, organizations may be able to spot those actions early and prevent hacktivists from gaining traction.

Some organizations are already going a step further and taking the offensive against potential vigilante attacks. NPR reported as early as 2013 that organizations were using a “honeypot” approach to trick hackers, planting documents in internal networks that, if stolen, are “booby-trapped” to identify the hackers.

Additional assistance—wanted or not—in the fight against cybervigilantism is available through Linux. Wifatch, which is white-hat malware that hacks into Internet of Things (IoT) devices with weak defenses. Once inside, Wifatch doesn’t do harm; in fact, it actually enhances protection of the devices. The danger, of course, is that Wifatch could mistakenly introduce vulnerabilities to devices and corporate systems. It’s never ideal for an organization to trust an outside, uninvited guest to identify cybersecurity weaknesses.

In the end, each organization has to make its own decision about how to prepare for and defend against cybervigilante attacks. Some may choose to go on the offensive, while others will focus more simply on being vigilant and continuing to build a strong overall cybersecurity presence.

Most importantly, organizations need to take the critical first step of recognizing and understanding the very real threat posed by the Robin Hoods of the modern world. While we may cheer their efforts to take down terrorists or other bad actors, it’s likely that we will not be cheering when their beliefs collide with our own.