OpGTMO Campaign Fuses Cyber and Kinetic Protests

We’ve talked previously about the linkages between cyber intelligence and physical warfare. But when we saw the recently executed Operation Guantanamo (#OpGTMO) campaign by Anonymous that culminated this past weekend, it was clear that there are related signals that tie together physical and digital social movements.

The OpGTMO campaign provides an example of how to pick up clues of impending hacker campaigns and intentions as well as evaluate the potential for converging physical and digital demonstrations. Let’s start with the earliest indicator of #OpGTMO:

The image above shows a “parked” Twitter account created on May 4 using variable spelling – “OpGitmo” – to hold the online property as well as redirect errant spellers to Anonymous’ impending campaign: #OpGTMO. Note: solid material for a real-time alert that should be put in place by all of you open source cyber analysts!

The chosen campaign tag  of #OpGTMO matches the name of Guantanamo’s military base operator Joint Task Force Guantanamo (JTF-GTMO) rather than the colloquial “Gitmo”. Although misspellings caused consternation among some supporters, the handle of choice was ultimately successful in dominating the conversation:

Credit to Topsy for data and chart

From Social Media Awareness to Mainstream Attention

For the purposes of further investigation, we’ll consider #OpGTMO and #OpGitmo conflated. This took place early on via positioning by Anon mouthpieces on Twitter, and over the course of the campaign, the intentions behind use of one or the other appear indistinguishable.

So, from the first parking of the “OpGitmo” account on May 4, the first tweet from the Operation Guantanamo account appeared early in the morning Eastern time on May 5. A video posted to YouTube followed on May 6, and Russia Today was the first mainstream source to report on the campaign. Use of the actual terms #OpGTMO or #OpGitmo was, unsurprisingly, largely found on the social web:

The volume of mainstream coverage mentioning the campaign tag #OpGTMO is insignificant compared to the mentions in social media. You can see this clearly in the timeline above that is colored by media category. Non-social channels often referred to the Anonymous campaign by the more formal “Operation Guantanamo”.

But if shutting down the Guantanamo detention center was the stated goal of Anonymous then how did the operation do? Aside from the obvious answer – the facility has not been immediately closed – we should consider the mainstream coverage and public attention to the Guantanamo facility and ongoing hunger strikes that #OpGTMO achieved.

To gauge this attention, we’ll step back from the folksonomy tags of #OpGTMO and #OpGitmo and use Recorded Future to look at mainstream coverage of Guantanamo issues at large.

As you can see in the above timeline spanning two months between March 22 and May 22, the level of mainstream media attention to Guantanamo issues during mid-May is the third highest during the period. The only points in time when Guantanamo drew more media attention than these past few days: detainees being placed in individual cells in mid-April and news that the number of hunger strikers topped 100 on April 27.

The reasons for this recent bump in mainstream attention are even more interesting to evaluate as we consider any achievements of OpGTMO. First of all, a portion of recent media coverage had nothing to do with Anonymous; news of the Pentagon’s request for funding to upgrade the prison hit just after the OpGTMO “twitterstorm” on May 17-19.

However, a share of the bump in coverage can be attributed to physical protests and the specter of cyber attacks leading to the shutdown of Guantanano’s Wi-Fi service.

From Digital to Physical Protests

In the end, it wasn’t just the social media efforts of Anonymous that drove recent conversations related to Guantanamo during the build up and conclusion of #OpGTMO. Responsibility for coordination and amplification of the cause was taken up by activist organizations starting on Day 1, and physical protests representing #OpGTMO took place from Los Angeles to DC to Dublin to Sydney.

You’ll notice protest events in these and other locations as well as reporting on events led by CODEPINK and members of chapters of the Occupy community in the network graph.

The breadth of OpGTMO comes as no surprise to loyal readers of ours already familiar with the distributed and cooperative cyber attacks as part of OpIsrael and OpUSA. This was just the latest in Anonymous’ series of “Op” campaigns, and it’s a near certainty that this won’t be the last time we see such broad coordination for its causes of choice. We’ll watch closely for the reaction to President Obama’s speech on national security planned for tomorrow that is expected to address the future of Guantanamo Bay prison.

Learn more about how Recorded Future’s Web Intelligence products can improve your cyber threat assessment.