It started in September 2010 as revenge: an anti-piracy firm bragged about DDoS'ing The Pirate Bay, and 4chan pointed the same weapon back at the MPAA and RIAA. Then, that December, PayPal, Visa, and Mastercard cut off donations to WikiLeaks — and a leaderless internet mob calling itself Anonymous rebranded the campaign "Operation Avenge Assange" and pointed a free download called the Low Orbit Ion Cannon at the world's payment rails. Thousands clicked "fire." Most of them had no idea the tool broadcast their real IP address in the clear. The FBI kicked in the doors the following summer, and fourteen of them — some barely out of high school — became the test case for whether a distributed denial-of-service attack is a protest or a federal felony. The answer, it turned out, was "both, and it depends who's asking."
Anonymous is not a group of hackers. We are average Internet Citizens ourselves … We do not want to steal your personal information or credit card numbers … Our current goal is to raise awareness about WikiLeaks and the underhanded methods employed by [these] companies to impair WikiLeaks' ability to function.
— "ANON OPS: A Press Release," December 10, 2010, the official Operation Payback communique circulated via AnonNews during the WikiLeaks banking-blockade attacks. Attributed to Anonymous as a collective; the same release describes the DDoS as "a symbolic action … a legitimate expression of dissent."
WHAT
Operation Payback — a 2010–11 wave of distributed denial-of-service (DDoS) attacks run under the Anonymous banner, first against anti-piracy targets, then against the companies that cut off WikiLeaks FACT
SCENE
4chan's /b/ and the AnonOps IRC network; the Low Orbit Ion Cannon (LOIC) "opt-in botnet"; the December 2010 WikiLeaks banking blockade (see the scene timeline and Crew Rivalries)
THE DRAMA
A leaderless mob takes down Mastercard, Visa and PayPal's public sites in the name of free speech — using a tool that quietly logged every volunteer's IP for the FBI to read later
RECORD
Jul 19, 2011: 14 arrested on a San Jose indictment over the PayPal DDoS ("the PayPal 14"); a separate 13-defendant indictment followed in Alexandria, Va. Guilty pleas in Dec 2013; felony counts dismissed at 2014 sentencing with $5,600 restitution each. UK organizers jailed 2013 FACT
STATUS
CONTESTED — the intrusions and the convictions are settled fact; whether a DDoS is a "digital sit-in" or a crime is the argument that never ended
This file is not a verdict on whether flooding a corporate website is legitimate protest — a question that has been litigated in courtrooms and argued to death on message boards. It is a record of the mass-participation Anonymous moment that turned a piracy grudge into a geopolitical banking fight, put a free downloadable weapon in the hands of thousands of amateurs who trusted it to hide them (it didn't), and handed federal prosecutors the raw material for the LulzSec / AntiSec era that followed. The through-line is the gap between the myth — an unstoppable, faceless legion — and the paperwork: a Visual Basic program that leaked your IP, and fourteen people who found out the hard way.
the drama timeline
ACT I — PAYBACK, LITERALLY (SEPTEMBER 2010)
An anti-piracy contractor brags about attacking The Pirate Bay. 4chan decides to return the favor.
SEP 2010
Aiplex lights the fuse
An Indian firm, Aiplex Software, told the press it was hired by film studios to launch DDoS attacks against torrent sites — including The Pirate Bay — that ignored takedown notices. To the 4chan crowd, a company doing DDoS-for-hire on behalf of Hollywood was an irresistible target. Aiplex confirmed the work to the BBC. The counterattack was branded "Operation Payback Is A Bitch."
Coordinated from a 4chan-linked IRC channel, the campaign knocked the MPAA and RIAA websites offline, then rolled on to the British Phonographic Industry and, eventually, the anti-piracy law firm ACS:Law and even the U.S. Copyright Office. The weapon of choice was already the Low Orbit Ion Cannon — a point-and-click flood tool with instructions as simple as "set the target IP and press the button."
WikiLeaks drops the diplomatic cables, the payment processors cut it off, and Operation Payback finds a much bigger enemy.
NOV–DEC 2010
The banking blockade
After WikiLeaks began publishing a trove of classified U.S. State Department cables in late November, PayPal, Visa, Mastercard, Amazon and the Swiss bank PostFinance one by one severed ties, cutting off WikiLeaks' ability to take donations. WikiLeaks said the moves "tried to economically strangle" it. PayPal's own executive later admitted the freeze followed a U.S. State Department letter calling WikiLeaks' activity illegal. The blockade, not the leak, is what turned a piracy feud into a free-speech war.
Under the codename "Operation Avenge Assange," the campaign flooded the payment giants' public websites. www.mastercard.com went down the morning of December 8; Visa's site followed; PayPal's blog and site were repeatedly hammered. A Twitter account, @Anon_Operation, crowed: "Operation: Payback (is a bitch!)." The card networks insisted their payment processing was never breached — only their corporate "public face," exactly as the AnonOps press release claimed it intended.
A synthetic-voice Operation Payback communique from Anonymous (uploaded October 30, 2010), from the campaign's anti-piracy / anti-ACTA opening phase — the mask-and-vocoder template the movement carried into the December banking-blockade attacks on Mastercard, Visa and PayPal.
The scale came from LOIC run in "hive mind" mode: volunteers pointed their copy at a central server and let anonymous operators aim it — a botnet you joined on purpose. The catch, documented at the time by researchers at the University of Twente, was that LOIC "does not protect the IP address of its users" — it took no measures to hide anyone. Every "protester" who fired it left their home address on the target's logs. Coldblood, a self-described participant, told the BBC "thousands" had joined a "war of data." Many of them were signing an evidence log.
The IP addresses LOIC handed over do exactly what you'd expect. The arrests start with a teenager and end with a coordinated multi-country sweep.
DEC 9, 2010
First arrest — a 16-year-old
The very first arrest was a 16-year-old in The Hague, picked up by Dutch police for the pro-WikiLeaks attacks on Mastercard and Visa; reports said he had helped run an Operation Payback chat room. It was the opening sign that "anonymous" was aspirational, not literal — and that some of the people firing LOIC were children.
FBI agents arrested fourteen individuals on an indictment unsealed in the Northern District of California (San Jose), charging conspiracy and intentional damage to a protected computer over the December 2010 PayPal DDoS. DOJ's own release named them and their handles — among them Mercedes Haefer ("No"), Joshua Covelli ("Absolem"), and Christopher Cooper ("Anthrophobic") — and confirmed the operation was executed "using an open source computer program the group makes available for free download." The same day, the FBI executed 35+ search warrants and coordinated with police in the UK and the Netherlands.
In Britain, the people who ran the AnonOps infrastructure faced the harsher end. Christopher Weatherhead ("Nerdo"), an AnonOps administrator, was convicted and jailed for 18 months; prosecutors put PayPal's losses from the campaign at £3.5m. Two men were jailed for the UK attacks — the first time British organizers of the DDoS wave did time. Coordinating the mob, it turned out, carried a very different sentence than joining it.
A separate federal grand jury in Alexandria, Virginia indicted 13 alleged Anonymous members for the broader Operation Payback attacks between September 2010 and January 2011 — targets there included the U.S. Copyright Office, Warner Bros., Bank of America, Mastercard and Visa. This was the "payback for piracy" front, prosecuted alongside the WikiLeaks one.
ACT IV — THE PLEA, THE FINE, THE PRECEDENT (2013–2014)
The test case that was supposed to define hacktivism ended in an anticlimax — a misdemeanor, a modest check, and even a call for mercy from the man who founded eBay.
DEC 5, 2013
Thirteen plead guilty
In San Jose, thirteen defendants pleaded guilty. Eleven pleaded to one felony conspiracy count and one misdemeanor count of intentional damage; two pleaded only to the misdemeanor. The deal's key term: if a defendant stayed out of trouble for a year, the government would dismiss the felony, leaving only the misdemeanor on the record. The "sit-in" would cost most of them a misdemeanor and a check.
In an unusual twist, Pierre Omidyar — founder of eBay, PayPal's parent — publicly argued the defendants should have faced misdemeanors, not felonies, saying he understood their motives and that the government was being too harsh. When the aggrieved company's own founder is pleading for leniency, the "epochal cybercrime" framing gets hard to hold.
At sentencing before Judge D. Lowell Jensen, all 13 had their felony counts dismissed. Each paid $5,600 in restitution to PayPal — roughly $80,000 total, against the millions PayPal had claimed. No one from the PayPal 14 went to federal prison for the DDoS. The mass-participation moment ended not with a martyr but with a fine and a year of good behavior — even as the aggressive prosecution helped set the stage for the harder-edged LulzSec and AntiSec crews (and the informant Sabu) that came next.
It was a crime, and a court said so: a DDoS that deliberately floods a company's servers to deny service is a federal offense under the Computer Fraud and Abuse Act, full stop. The attacks were real, the disruption was real (PayPal put its losses in the millions; a UK court accepted £3.5m), and thirteen defendants pleaded guilty. Calling it a "sit-in" does not change that the participants intentionally damaged computers they had no right to touch.
The tool doesn't care about your politics: LOIC is a weapon, and handing it to thousands of strangers — including minors — to point at critical commercial infrastructure is not civil disobedience, it's a mob with a cannon. Real bystanders (legitimate PayPal and Mastercard users) lost service. The romance of the "faceless legion" evaporates the moment you remember most of them didn't understand what they were joining.
It was protest, and the punishment knew it: the defendants and their counsel called it "a four-day online sit-in" and likened themselves to the freedom riders; the AnonOps press release framed it as "a legitimate expression of dissent" aimed only at corporate "public face" websites, explicitly not at payment infrastructure or customer data [6]. That the felonies were ultimately dismissed and the restitution was a fraction of the claimed damage suggests the system itself blinked [10].
The blockade was the real coercion: PayPal, Visa and Mastercard cut off a publisher after a phone call from the State Department, with no court order — a private banking blockade of speech the U.S. government disliked. Whatever you think of the DDoS, it was a response to censorship-by-payment-processor, and PayPal's own executive admitted the trigger was a government letter [3].
Even the target's founder called it overkill: eBay founder Pierre Omidyar publicly argued for misdemeanors, not felonies. When the wronged company's own founder thinks the prosecution went too far, the "dangerous cybercriminal" story has a hole in it [9].
YOU DECIDE
The attacks happened, the disruption was real, and people pleaded guilty — that part is not in dispute. What is disputed is what it means: a genuine, if legally reckless, mass protest against a private banking blockade of a publisher, or a mob crime dressed in the language of civil rights. The receipts cut both ways. A leaderless internet handed thousands of amateurs a weapon that quietly doxed them; the state answered with felony charges it couldn't ultimately sustain; and the aggrieved company's own founder asked the government to ease off. Strip the mythology off both sides and you are left with a Visual Basic program, a State Department phone call, and fourteen people who learned that "Anonymous" was a brand, not a promise.
The archive does not decide whether a DDoS is speech. It keeps the indictment — and the press release that called it dissent.
evidence locker
PRIMARY / COURT & GOVERNMENT RECORD
DOJ — "Sixteen Individuals Arrested in the United States for Alleged Roles in Cyber Attacks" (Jul 19, 2011)FACT — the San Jose indictment of the fourteen PayPal defendants (named, with handles), the conspiracy and intentional-damage charges, "Operation Avenge Assange," the free download tool, the 35+ search warrants, and the coordinated UK/Dutch arrests.
justice.gov/opa/pr/sixteen-individuals-arrested-united-states-alleged-roles-cyber-attacks
The Guardian — "Operation Payback cripples MasterCard site in revenge for WikiLeaks ban" (Dec 8, 2010)FACT — the Mastercard/Visa/PostFinance attacks, the @Anon_Operation tweets, the 4chan link, and PayPal's admission that a U.S. State Department letter triggered the account freeze.
theguardian.com/media/2010/dec/08/operation-payback-mastercard-website-wikileaks
BBC — "Activists target recording industry websites" (Sep 2010) & "Anonymous hacktivists say Wikileaks war to continue" (Dec 2010)FACT — Aiplex's confirmed DDoS-for-hire, the MPAA/RIAA attacks, and "Coldblood" on the "voluntary botnet tool" and "war of data."
bbc.com/news/technology-11371315
"ANON OPS: A Press Release" (Dec 10, 2010)ATTRIBUTED — the official first-party Operation Payback communique: "Anonymous is not a group of hackers," the "symbolic action / legitimate expression of dissent" framing, and the decision not to attack Amazon during the holidays. Verified via contemporaneous mirror.
simon.rupf.net/…/ANONOPS_The_Press_Release.pdf
The Register — "Dutch police arrest 16-year-old WikiLeaks avenger" (Dec 9, 2010)FACT — the first arrest of the campaign, a minor in The Hague, establishing that participants included children.
theregister.com/2010/12/09/wikileaks_ddos_arrest/
Daily Beast — "Inside the 'PayPal 14' Trial" & Wau Holland Foundation — 2014 sentencingFACT — the "four-day online sit-in" and "freedom riders" framing from defense counsel; the $5,600-each restitution, the felony dismissals, and the probation terms at the October 2014 sentencing.
thedailybeast.com/inside-the-paypal-14-trial/
NBC News & CBS News — the Alexandria, Va. indictment (Oct 2013)FACT — the separate 13-defendant Operation Payback indictment covering Sep 2010–Jan 2011 attacks on the Copyright Office, Warner Bros., Bank of America, Mastercard and Visa.
nbcnews.com — 13 alleged members indicted
BBC — "Anonymous hackers 'cost PayPal £3.5m'" & "Two jailed for cyber attacks" (2012–13)FACT — the UK prosecution of the AnonOps organizers, PayPal's claimed £3.5m loss, and Christopher Weatherhead's 18-month sentence.
bbc.com/news/uk-20449474
The standard. The DDoS attacks, the arrests, the indictments, the guilty pleas, and the sentences are matters of public record, sourced to DOJ press releases, the San Jose and Alexandria indictments as reported, and contemporaneous coverage — stated as fact. The named defendants appear only as they appear in DOJ's own release and the unsealed indictment; no motive is asserted to any individual. Where a participant was a minor, no identity beyond the public record ("a 16-year-old in The Hague") is given. The "digital sit-in vs. crime" question is presented at full strength on both sides and left to the reader; the first-party voice is an official AnonOps communique attributed to Anonymous as a collective, not to any person. If a line here couldn't survive scrutiny, it wouldn't be on the page.