Spanish police said on Friday they had arrested three members of the Anonymous hacking group who allegedly directed attacks on banks, government websites and companies including Sony.
According to a statement from the Spanish police, the three individuals were also part of the attack on the New Zealand Parliament website last month, in protest at the passing of the Copyright (Infringing File Sharing) Amendment Bill.
Spain said it was the first police operation in the country dedicated to tracking down Anonymous, a decentralised group of activists who have mounted distributed denial-of-service attacks (DDOS) against businesses and organisations. The arrests were made in Barcelona, Alicante and Valencia.
Targets for Anonymous have included the Scientology website and companies that cut off relations with the whistleblower WikiLeaks website, such as Visa, MasterCard, PayPal, Amazon.com and PostFinance, a Swiss financial institution.
The loose-knit group attracted followers who downloaded a tool called the Low Orbit Ion Cannon (LOIC), a simple DDOS tool to aid in the attacks. Some of the more technically adept Anonymous members used botnets, or networks of hacked computers, to carry out DDOS attacks.
Spanish police said those arrested helped direct the attacks on the websites for the Sony PlayStation Store, the bank BBVA, the Italian utility company ENEL and websites belonging to the governments of Egypt, Algeria, Libya, Iran, Chile, Colombia and New Zealand. Their names were not released.
In Spain, the police said Anonymous has attacked the websites of the Catalan police, and in May, the Central Electoral Board and the UGT trade union.
The country's Technological Investigation Brigade, part of the National Police, analysed more than 2 million lines of chat logs as well as web pages to find those who were arrested.
The investigation started in October 2010 after Spain's Ministry of Culture came under a DDOS attack that was organised through websites and chat networks by Anonymous, police said.
During one of the raids, police found software used to create malware. The group also allegedly used sophisticated techniques to encrypt their communications, which make it difficult for police to intercept and identify. Two of those arrested did not even have their own Internet connection and instead relied on hacking other wi-fi networks for their activities.
In January, UK police arrested three teenagers and two other people for allegedly taking part in a series of denial-of-service attacks against major websites as part of Anonymous. The five males, who range in age from 15 to 26, were charged with offenses under the Computer Misuse Act of 1990.
Turkey has also arrested members of Anonymous operating from that country, with 32 arrests following attacks on government websites, according to the country's state-run news agency.
The Anadolu Agency wrote the alleged Anonymous members were arrested in 12 cities, including Ankara and Istanbul.
Also on Friday, Anonymous said through its website, AnonOps Communications, that its attacks against Turkish government websites were in protest of "plans to implement a filter on internet browsing" in August, the same premise for which the attack against the New Zealand Parliament website was launched. Activists took to the streets in 30 cities in Turkey in May to protest the plans.
"Over the last few years, we have witnessed the censorship taken by the Turkish government, such as blocking YouTube, Rapidshare, Fileserve and thousands of other websites," according to the statement. "Most recently, the government banned access to Google services. These acts of censorship are inexcusable."
Anonymous said the strikes will be executed using the Low Orbit Ion Cannon, an easy-to-use tool for DDOS attacks but one that security experts has said is not difficult for law enforcement to trace who is using it.
Targets included Turkey's telecommunications directorate, which appeared to be offline on Monday morning, and the country's social security institution, Anonymous wrote.
On Saturday, Anonymous wrote that it had retaliated against Spanish police by launching what it said was a successful DDOS against that organisation's website for several hours. The site, however, was functioning on Monday morning.
- Leo King of Computerworld UK contributed to this report. Additional repoting also by David Watson