A protracted series of anti-government attacks might be the work of a committed few, or it might be the work of legion
By F.C. | SINGAPORE
THE name James Raj Arokiasamy may or may not trip off the tongue, but it has been everywhere in the city-state’s media in recent days. Mr James Raj, who may or may not be a.k.a. “The Messiah”, stands accused of hacking into at least two government websites as well as that of a scandal-plagued singer and churchman. In all, as many as 19 government websites were taken down simultaneously on the afternoon of November 2nd. (Three hours later a government agency used Twitter to announce that the sites were down due to “planned maintenance”.) And then the story gets complicated. Since Mr James Raj’s arrest in early November, a series of copycat attacks have compromised the websites of high government offices, a government-friendly newspaper and others, using cross-scripting and DDoS attempts. On November 22nd the websites of 13 schools were defaced in less than two hours’ time.
And on December 5th, Standard Chartered, an international bank, said that data belonging to some 647 if its “high net-worth” clients were stolen from a server at Fuji Xerox Singapore. Here the link to Mr James Raj seems clear: the data is said to have been retrieved from his laptop.
The past two months have been a busy time for Singaporean activists of a hackerish persuasion. Many of them have been declaring their resistance to the government’s new “internet-licensing” regime and to plans for a major revision of the Broadcasting Act, due in 2014. Their protests have taken place both on- and offline. The government had anticipated an outdoor demonstration they staged, at a venue designated for dissent. But then it wasn’t prepared for the wave of hacking incidents that followed.
In late October, a town council’s website was broken into a few days after one of its MPs complained about the behaviour of commuters who become enraged on crowded public transport. Someone using the online handle “The Messiah” wrote on the official site in mockery of his original complaint:
I have been to various sites and seen how they take the initiative to secure their systems. You have a brain and you have money. You had a choice. Don’t blame external factors (Anonymous) for this hack. The Messiah ;)
The following day, a video was uploaded to YouTube in which someone, apparently a member of “Anonymous”, wearing one of that diffuse movement’s emblematic Guy Fawkes masks. He or she demanded that the Singapore government stand down from its internet-licensing policy. Otherwise, the speaker threatened, Anonymous would be “forced to go to war” with the government, which had just unveiled a 130m Singapore dollar ($104m) initiative against cyber-attacks. The video quickly went viral.
The same video applauded the work of The Messiah. It encouraged like-minded comrades to don black and red on Guy Fawkes’ Day, November 5th, to help mark a global “Million Mask March” in solidarity with supporters of Anonymous worldwide. (Though Singapore’s Anonymous sympathisers would like to link their cause to the larger movement, it is far from clear that the rest of the world is watching.)
Two days after the video’s debut, The Messiah wrote over a blog post on the website of Singapore’s main newspaper, Straits Times (the ST), which enjoys notably strong relations with the government. The result read “Dear ST: You just got hacked for misleading the people!” The rest of the post claimed that a reporter at the paper had chosen “to conveniently modify the sentence 'war against the Singapore government' into 'war against Singapore'."
But the November 5th movement never really caught on in Singapore. There were 15 protesters who turned up in black and red on that weekday afternoon, most of them carrying Guy Fawkes masks. All were taken into custody; in Singapore it is illegal to take part in any public assembly without a permit. According to a police report, they ended up “assisting” the police in their investigation of the hacking incidents.
At the time, the police believed they had already learned the identity of The Messiah. With the help of their Malaysian counterparts, they had nabbed Mr James Raj in Kuala Lumpur on November 4th, the day before the fizzled protest in Singapore.
But a fresh wave of attacks struck government websites on November 5th, even with the Messiah-suspect languishing in jail. On November 6th the prime minister, Lee Hsien Loong, asserted that Singapore would “spare no effort” in bringing to task everyone responsible for the websites’ defacement. As if emboldened by this threat, the next day hackers set to work on the websites of both the prime minister’s office and the presidential palace. The prime minister’s home-page was made to read “It’s great to be Singaporean today”, dripping with irony.
Two more people were apprehended and charged with hacking, joining Mr James Raj in jail. But then another volley of cyber-attacks defaced 13 school websites. With the supposed Messiah being held without bail, and his colleagues detained too, the attacks’ persistence began to pose new questions. Do the police have their man? Or does The Messiah have a wider network, in Singapore or abroad? Or has Anonymous, as a diffuse, international whole, taken an interest in this case?
The episode has highlighted some lessons for Singapore’s leaders and for its citizens. Often held up as a model for modern states with an authoritarian flair, the government is being taught that top-down policies, announced overnight and without public consultation, no longer go down without resistance. This seems to be especially true when they affect internet freedoms. The government must at least be taking to heart the next lesson: that it needs to build higher and stronger fortifications for its websites.
For the dissidents and their sympathisers, it remains unclear whether this kind of hacking actually helps. Because organisations like Anonymous lack well-defined leadership, they depend on well-defined causes to bring the public onto their side. The Messiah, though he was supposedly only one man, seemed to be busy fighting several battles at once, in the name of different causes. Whoever he was, he succeeded in inspiring at least a few other part-time hackers to break into some of the government’s most visible websites. It may be that in making the new internet-licensing programme their target, activists have found a rallying cry that carries beyond their tiny circle. But since then further, copycat-style hacking seems to have been deterred by the arrest of just five suspects.
