AARON BARR▊
- IDENTITY
- Aaron Barr — HBGary Federal CEO. Not Barrett Brown (different person). Living subject. FACT
- OPERATION
- CEO, HBGary Federal — a security firm doing U.S. government contract work
- HABITAT
- Financial Times interviews, the Security B-Sides program, IRC log spreadsheets
- THE MOVE
- Announced he had deanonymized the leadership of Anonymous and would present it — Feb 2011 ATTRIBUTED
- OUTCOME
- HBGary FEDERAL OVERRUN IN A WEEKEND — emails dumped, accounts hijacked; Barr resigned Feb 28, 2011 FACT
They think I have nothing but a heirarchy based on IRC aliases! As 1337 as these guys are suppsed to be they don’t get it. I have pwned them! :)
Aaron Barr, HBGary Federal CEO, in a private email to a colleague days before Anonymous breached HBGary and dumped roughly 70,000 of its emails — his spelling intact. Published by Ars Technica. The boast preceded the annihilation by 72 hours.
The specimen, observed late January through February 2011: an institutional predator that announced its hunt in advance, mistook a swarm for an org chart, and was annihilated by the swarm inside seventy-two hours.
This file carries the
HBGary Federal drama only — the overreach, the buffoonery, the fallout. For the full behavioral profile of Barr as the cautionary anchor of the Anonymous story — archetype, psychometrics, the hacker-history lens — see the companion dossier at
thefire.lol/profiles/aaron-barr.
What you are about to watch is not a troll. It is the thing trolls answer: the institutional actor who decided to hunt them, said so on the record first, and discovered the difference between a target list and a business plan the hard way.
The move was a press claim. The counterattack was a weekend. That is why the archive exists. Every event below carries its receipt. Both sides get the microphone — including the parts of this that were a crime committed against him.
the drama timeline
ACT I — THE DISPLAY (LATE JAN–EARLY FEB 2011)
The display comes first. A security CEO believes he has done what the government could not buy: put names and faces to a ghost. He does not keep it quiet. He calls the press.
-
JAN 2011
The spreadsheet
As CEO of HBGary Federal, Barr pursues a project to identify the "leaders" of Anonymous by correlating usernames across IRC, Facebook, and Twitter — research he intends to present, and, per the reporting, to interest law enforcement in.
Observe the category error before the technical one. The organism builds an org chart for an animal that has no spine.
-
FEB 4, 2011
He tells the Financial Times
The Financial Times runs Barr's account: of a few hundred participants, roughly thirty are steadily active and about ten "co-ordinate and manage most of the decisions"; he says he has collected their real names. He is scheduled to present at Security B-Sides. The claim is now public, dated, and staked to a conference.
The plumage is the vulnerability. This species advertises. It had just told the internet exactly where and when it would perform.
ACT II — THE WEEKEND (FEB 5–6, 2011)
The response is not a debate. It is a demonstration — that the firm selling defense had implemented none. Watch the cascade. Each failure is ordinary; the sum is a company.
-
FEB 5–6, 2011
The cascade
Anonymous breaches HBGary via a SQL injection flaw in the company's own CMS, recovers unsalted MD5 hashes and cracks them with a rainbow table, exploits Barr's reuse of one password across services, and social-engineers SSH access from an administrator. From there: root. Total elapsed time, a weekend.
-
FEB 6–7, 2011
The dump
Tens of thousands of internal emails go up as a public torrent (reported at roughly 70,000). Barr's Twitter account is hijacked and used to broadcast abuse under his name; the company website is defaced; his iPad is remotely wiped. The correspondence was stolen — a crime against him — and then it was read by everyone.
ACT III — WHAT THE EMAILS HELD (FEB 2011)
A dump is only humiliation until someone reads it. Then it becomes a scandal with its own life — one that outran the man whose inbox produced it.
-
FEB 2011
Team Themis surfaces
Inside the dump: Team Themis — a proposal by HBGary Federal with Palantir Technologies and Berico Technologies, solicited through the law firm Hunton & Williams on behalf of Bank of America and the U.S. Chamber of Commerce, to run disinformation against WikiLeaks and to discredit supporting journalists (Glenn Greenwald named) and progressive and labor groups. A proposal, exposed before it was executed.
The hunt for the swarm's leaders had produced no leaders. The hunt for its own emails produced this.
-
FEB 2011
The partners run
Palantir's CEO publicly apologizes to Greenwald and severs ties; Berico distances itself; congressional Democrats call for an investigation into Hunton & Williams and the Team Themis firms. The proposal that was meant to stay in a slide deck becomes a committee inquiry.
ACT IV — THE EXIT AND THE ENCORE (2011 onward)
Most specimens in this file, cornered, reach for a lawyer. This one did something rarer. He resigned — and then walked back into the room.
-
FEB 28, 2011
The resignation
Barr resigns from HBGary Federal, saying he wants to focus on his family and rebuild his reputation. The boilerplate of the genre — but the reputation had already been documented, in his own words, in a torrent anyone could download.
-
AUG 2011
Whoever Fights Monsters
Months after the breach, Barr sits on a DEF CON 19 panel — "Whoever Fights Monsters" — in front of the community that had just destroyed him, and talks about it on the record. The video is on DEF CON's own channel. The rare figure in this file who walked into the room of the people who beat him and answered questions.
Note this. The archive keeps a lot of tape of men who sued rather than speak. This one took the microphone in the enemy's hall. Whatever else the record says, it says that.
-
AFTER
Back in the industry
Barr returns to security contracting, later holding cybersecurity roles at federal contractors — documented by POGO's "The Return of Aaron Barr." The company did not survive in his hands; the man did. HBGary was acquired by ManTech in February 2012.
both sides, on the record
The pre-announced claim: Barr told the Financial Times he had identified Anonymous's leadership and was preparing to present it. The premise assumed a hierarchy to unmask; the identifications were widely disputed [2] [6].
The firm's own posture: a SQL-injectable CMS, unsalted MD5, password reuse, SSH social-engineered from an admin — a security company selling defenses it had not implemented, per Ars Technica's reconstruction [1].
What the dump held: the Team Themis proposal — disinformation-for-hire against WikiLeaks, named journalists, and labor groups, for corporate clients, per the leaked emails as reported by Salon [3].
Barr denied that he was planning to sell personal information on Anonymous to the FBI, and canceled the B-Sides talk once the situation broke, per contemporaneous reporting [6].
Team Themis was a proposal, not an operation — exposed before any execution. Palantir's CEO apologized and cut ties; Berico distanced itself. The proposals were HBGary Federal with partners, solicited through a law firm; they are attributed to the documented proposal, not to Barr's private character [3] [5].
The email dump was a crime committed against him — stolen correspondence, a hijacked account, a wiped device. Provenance is worth stating even where it is not a refutation. And he later answered for the debacle in person, on a DEF CON stage, rather than from behind a filing [8].
YOU DECIDE
Scoped to the claim, never the man. The claim "HBGary Federal deanonymized the leadership of Anonymous" did not survive contact — it assumed a command structure that was not there, and the firm that made it could not keep its own CMS from a SQL injection. That specific move is the file.
Weigh the costly signals: he announced the hunt before he had won it, and paid for the announcement in a weekend. He also took the microphone in the room of the people who beat him — which is more than most of this list ever managed.
The archive does not judge. The archive merely keeps the tape running.
evidence locker
PRIMARY / TECHNICAL RECORD
TEAM THEMIS & THE FALLOUT
Salon — "More facts emerge about the leaked smear campaigns" (Team Themis, Feb 2011) ATTRIBUTED — the Palantir / Berico / Hunton & Williams / Bank of America / Chamber of Commerce proposal, per the leaked emails.
salon.com/2011/02/15/palantir/
PRESS, WATCHDOG & THE SUBJECT ON CAMERA
HBGary — Wikipedia (sourced) FACT — timeline, email-dump scope, Barr's FBI denial and B-Sides cancellation, ManTech acquisition, with inline citations.
en.wikipedia.org/wiki/HBGary POGO — "The Return of Aaron Barr" (Project On Government Oversight) ATTRIBUTED — his return to federal-contractor cybersecurity work. (Host bot-blocks scripted fetches; loads in a browser.)
pogo.org/analyses/return-of-aaron-barr-… DEF CON 19 — "Whoever Fights Monsters: Aaron Barr, Anonymous and Ourselves" (official DEFCONConference channel) SELF-PUBLISHED — the subject on the record, on stage, in his own words.
youtube.com/watch?v=wQxBJ1igMck
The standard. Everything above is sourced to primary technical reporting, named press, watchdog analysis, and the subject's own on-camera account. Facts are stated as facts; the pre-announced claim, the attack chain, and the Team Themis proposal are stated as reporting and as a proposal, and wear their accuser. The defense is presented at full strength — the FBI denial, the not-executed status of Team Themis, the partners' own distancing, and the fact that the email dump was a crime committed against him. The verdict is scoped to the specific claim, never to the man. No motive is asserted, no private character diagnosed. And for the record: Aaron Barr is not Barrett Brown. The burden of proof is on us, not the subject. If it couldn't survive a defamation challenge, it wouldn't be on this page.