Robert Siciliano of Hotspot Shield discusses Anonymous's campaign against ISIS, including their claim of hacking 5,500 ISIS-linked Twitter accounts. The conversation covers encryption backdoors, ISIS's use of Telegram, and how the group finances operations through Bitcoin. Siciliano argues that while technology matters, defeating ISIS ultimately requires physical, on-the-ground solutions.
Chapters
Ah, that's right, Phil, and as you know, Anonymous has declared war against ISIS. The question is, what can the hacker group actually do? Well, to help us answer that, I'm joined by Robert Siciliano. He is a security analyst with Hotspot Shield. Robert, thanks for joining us.
Thank you.
So it can be argued that one of ISIS's greatest tools is, uh, its recruitment efforts, its posting videos on YouTube, on Facebook, and other social media sites that have been Well, rather effective. Just today, Islamic State posted an image of the explosive device that it claimed it used to bring down the Russian airline over Egypt. People are saying that this is where a group like Anonymous can really have an impact.
Well, certainly. But, you know, maybe stifling them via social media, you know, knocking them down electronically might help. It might curtail some of their exposure. But in the end, you know, it's like mushrooms, they'll pop up somewhere else.
But it may help. The question is, though, should these sites be taking this kind of action independently? Anonymous said it's already hacked about 5,500 ISIS-linked Twitter accounts. Should the likes of Twitter and YouTube and Facebook and other social media be taking action independently?
Certainly whenever the users of the sites see something that's inappropriate, they usually let the site's administrators know. And when the sites find out about that, they generally do something about it. In the case of, um, uh, terrorism, certainly I think it's an appropriate, uh, uh, method to pull down any rhetoric.
Well, U.S. counterterrorism officials are saying that one of the big issues with a group like ISIS is encryption, and, uh, encryption specialists like Apple and Google need to provide backdoor access to government agencies in order to be able to track these things more, more carefully. Now, Apple's Tim Cook has said no way, he is not gonna let governments do this regardless. Is there a way that governments can legally force companies like Apple and Google to do this? And, and what about the moral debate here anyway?
Well, I suppose there is, you know, I suppose they, they may try to force their hand. Now, I work with a company called Hotspot Shield. It's a mobile app that encrypts your wireless connection to Wi-Fi. You know, it masks your data on Wi-Fi. And if that's exposed, if NSA has a backdoor to that, then they have a backdoor to banking information. They have a backdoor to personal information. You can only take that so far. And they're always gonna find other ways to communicate. By providing backdoor access, I don't know if that's gonna solve the problem. This is a boots-on-the-ground issue.
But we've heard from ISIS that they're communicating through the site Telegram, which is an encrypted instant messaging app. So encryption is clearly something that they're using, and one could argue that in the case of national security, bringing back the Patriot Act into the focus, that government agencies should be allowed this kind of access on a need-to-know basis.
It's certainly a conversation worth exploring. You know, but the general public, they don't want their emails spied upon, their phone calls spied upon, their text messages spied upon. So there's— there are privacy issues there.
Why would the general public be exposed to this? Can we not somehow trust that Big Brother, the government at large, would be targeting people who have red flags in their messages? I mean, there's no reason for the government to be looking at my phone, for example, and if they did, I couldn't care because there's nothing on it that's incriminating.
Certainly, that's what you would hope. The unfortunate fact is that whenever you create a backdoor like this, it's gonna be open to hackers, criminal hackers, and it's also gonna be open to other forms of abuse.
All right, another issue here, other than the government is funding. And is ISIS using Bitcoin for funding their operations? Is that something that is relatively easy to infiltrate and hack?
Well, the, the, the fact that they probably are— all chatter that I've seen is that they are— it is a form of currency that is relatively ubiquitous and untouchable by governments. And as long as they're using that form of commerce, it's gonna be hard to, uh, stifle them financially.
But if they're mainly in Syria and Iraq, how do they cash in their bitcoins?
There's a number of brokers all over the world that will take bitcoin and turn it into cash.
So can we expect a group like Anonymous to hit bitcoin accounts and bank accounts? I mean, some are saying that, you know what, it's only fitting that you have a vigilante justice group going after a rogue terrorist organization because it's no longer a state versus state fight. This is not your grandfather's war, and we need to rely on these kind of people for all means.
Yeah, well, Anonymous being a collective that's worldwide, uh, they, um, there are a lot of, uh, computer scientists, many of them both good and bad hackers, that, uh, some of them, or many of them certainly, have the time, uh, to infiltrate these organizations. They have done good in the past, and they've certainly done bad in the past. My guess is that, you know, with this motivation, they always seek a cause. They will, you know, more than likely do some good. But, you know, this is an issue that is handled by governments, by law enforcement, and in the end, that's who's gonna solve this problem.
So regardless if it's Anonymous or governments or non-governmental organizations, from a tech point of view, What is the best way to try and thwart ISIS?
You know, I've been asked this question before, and I'm gonna say it again. I don't see this as being a technology problem. This is a, a literal boots on the ground issue, and it needs to be solved that way.
But technology is one of the fronts in this fight.
Certainly, but you shut down— if you even shut down Twitter, you shut down Facebook, you shut down YouTube, They're still going to have ISIS. They're still going to bomb. Again, it's a boots on the ground issue. They're still going to move in a forward direction.
Well, Robert, question is whose boots are going to be on that ground? All right. Thank you. We're going to have to leave it there. Thank you so much, Robert Siciliano, security analyst with Hotspot Shield.
