HBGary's high-volume astroturfing technology and the Feds who requested it

The enormous corpus of email leaked from federal security contractor HB Gary following Anonymous's hacking of the company's servers continues to deliver compromising payloads.

This time, it's internal emails detailing the creation of "persona management" software to simplify the process of pretending to be several people at once online, in order simulate widespread support for a point of view -- astroturfing automation software. The software appears to have been developed in response to a federal government solicitation seeking automated tools for astroturfing message boards in foreign countries.

Persona management entails not just the deconfliction of persona artifacts such as names, email addresses, landing pages, and associated content. It also requires providing the human actors technology that takes the decision process out of the loop when using a specific persona. For this purpose we custom developed either virtual machines or thumb drives for each persona. This allowed the human actor to open a virtual machine or thumb drive with an associated persona and have all the appropriate email accounts, associations, web pages, social media accounts, etc. pre-established and configured with visual cues to remind the actor which persona he/she is using so as not to accidentally cross-contaminate personas during use...

To build this capability we will create a set of personas on twitter,‭ ‪blogs,‭ ‪forums,‭ ‪buzz,‭ ‪and myspace under created names that fit the profile‭ (‪satellitejockey,‭ ‪hack3rman,‭ ‪etc‭)‪.‭ ‪These accounts are maintained and updated automatically through RSS feeds,‭ ‪retweets,‭ ‪and linking together social media commenting between platforms.‭ ‪With a pool of these accounts to choose from,‭ ‪once you have a real name persona you create a Facebook and LinkedIn account using the given name,‭ ‪lock those accounts down and link these accounts to a selected‭ ‪#‭ ‪of previously created social media accounts,‭ ‪automatically pre-aging the real accounts...

Using the assigned social media accounts we can automate the posting of content that is relevant to the persona. In this case there are specific social media strategy website RSS feeds we can subscribe to and then repost content on twitter with the appropriate hashtags. In fact using hashtags and gaming some location based check-in services we can make it appear as if a persona was actually at a conference and introduce himself/herself to key individuals as part of the exercise, as one example. There are a variety of social media tricks we can use to add a level of realness to all fictitious personas

UPDATED: The HB Gary Email That Should Concern Us All (via MeFi)

(Image: Shadows and Gold, a Creative Commons Attribution (2.0) image from kevandotorg's photostream)


  1. There is a guy over on FARK who brags about this very thing. Says that it is very widespread in Israel where he is from.

  2. We have computer viruses and we also have Internet diseases.

    Astroturfing is a disease laid upon the Internet that serves to breed distrust and frustration among the community. It serves to stop grassroots organizing that would be the downfall of corporatists like the Koch brothers.

    The more that grassroots people attack and bring down Internet diseases like HBGary, the better it will be for democracy and grassroots organizing.

    People like Aaron Barr get what they deserve. He’s just lucky most (real) grassroots people are non-violent.

  3. Perhaps eventually we’ll start seeing a personal certificate system, kinda like in Vinge’s “Rainbows End”.

    1. We have that technology, it’s called “Public Keys” and “Web of Trust”

      A shame no one uses it. Crypto needs to be EASY to be widely adopted.


  4. lol, if u guys dont think ur being astroturfed ur very very wrong
    but dont worry
    if ur a total d-bag, its pretty hard to out-post the ENTIRE internet
    remember, we outnumber them by quite a bit, just understand (please) not everything u read online is true…. just truer than anything ppl with money or power tell u :)

  5. So what do you we with this knowledge? Make it illegal to create social media accounts if you don’t “mean it”? Engage in a hacking war of attrition with defense contractors/marketing firms/political campaigns to wipe out more personas than they can create?

    Or do we simple invalidate comment threads entirely and restrict unobstructed discussion on the internet to locations that no one cares to try to influence.

    Looks like bad news…

    Here’s an idea. Let create an open-source “Persona Management System” that’s free to use, at least as powerful as HBGary’s and then flood the internet with comments about how the CEO of HBGary is a child pornographer and has meth-fueled orgies with members of congress and your grandmother.

    Seriously though, a boilerplate comment like “this comment thread has been hacked by a fake persona, ask me how” with a link to the open source project’s page explaining the need to bring the danger of persona management to light.

  6. A lack of confidence in community on the internet would alone be harmful to the social cohesion it tries to inspire.

  7. Here’s one of the bidding specification docs for the air force:


    “Online Persona Management Service. 50 User Licenses, 10 Personas per user.

    Software will allow 10 personas per user, replete with background, history, supporting details, and cyber presences that are technically, culturally and geographacilly consistent. Individual applications will enable an operator to exercise a number of different online persons from the same workstation and without fear of being discovered by sophisticated adversaries. Personas must be able to appear to originate in nearly any part of the world and can interact through conventional online services and social media platforms. The service includes a user friendly application environment to maximize the user’s situational awareness by displaying real-time local information.”

  8. Oh wow, whole complete virtual machines? Why? Firefox already allows you to have user profiles, and several can be opened simultaneously. Using the Personas skin engine you can also do that differentiating of colour schemes to make sure you don’t forget who you are.

    Oh wait, they talk about forging origins (I guess through VPN) – different proxy settings for different Firefox profiles? Real time local information, so weather and time? Also offered by Firefox extensions.

    1. I’d guess that the complete virtual machines make it easier for people who are almost completely technically inept to use the system with an absolute minimum of cross-contamination.

      Also, perhaps a sales strategy. You can make more money if you can convince your buyer that they have to buy something big and complex instead of something small and simple, even if it does the same job.

      I’ve noticed that business is more about solving the problem of getting your customers to give you mountains of money than it is about solving the customers problems. It’s occasionally a fundamental mismatch between the way I write software and the way my employer wants software written.

  9. I guess I should have put “geographacilly(sic)”… which reminds me. Is anyone else dumbfounded by the spectacular illiteracy in Barr’s emails? In an age when even texting services provide spell check, how is this still so widespread among ostensibly intelligent professionals at the top of a complex and technical industry?

  10. This is pretty much vanilla alt management. How are they charging for this when stalkers and weirdos (hi Mom!) do it free? I sense another of those “Do Something Internetty – ??? – Profit” plans.

    Betcha they’d still get it wrong by using linguistic and stylistic tics. It is hellaciously hard not to drop those favourite words, be they ‘betcha’ and ‘hellacious’ or just a particular style of smiley. ;) ^_^

    Big budget amateur hour. Which makes me think that HBGary are basically the Uwe Boll of … whatever the hell it is they actually do.

    1. whatever the hell it is they actually do

      They attempt to enable armies of astroturf sockpuppets that disrupt communications for actual and potential grassroots communities. Basically, they attempt to destroy democracy without actually shutting down the internet and they are scum of the earth.

      They infest threads here at boingboing, daily kos, huffington post… everywhere, really… as I said earlier, they are an Internet disease. It’s vermin enabling vermin.

      1. They attempt to enable armies of astroturf sockpuppets that disrupt communications for actual and potential grassroots communities. Basically, they attempt to destroy democracy without actually shutting down the internet and they are scum of the earth.

        Quinton K: This comment sucks.

        Sara A: I can’t believe you’d say something like this. Get out of my country!

        Steve M: Error -9461

        Angie Q: That was insightful Steve M!

        Bob Z: Steve M for president!

    2. Betcha they’d still get it wrong by using linguistic and stylistic ticks

      Indeed. A good system might have you compose the text you intend to post in an application-specific editor that supports profiles for that sort of thing. It could make suggestions about alternate words, punctuation style, etc.

      1. The game Chrono Cross had something like 45 playable characters, three of whom could be in your party at once. They used substitution algorithms for the grammar and vocabulary, and ran them against baseline sentences to make he dialogue more believable.

  11. “…a federal government solicitation seeking automated tools for astroturfing message boards in foreign countries.”

    Foreign countries. Right.

    1. Exactly, every country is foreign to corporatists. They have no allegiance to anything except power and money. Just look at all the ways they cheat taxes and utilize offshore accounts. Look at what they do, not what they say. End of story.

      1. Hey, I’m in a foreign country….

        And unless it’s changed, I believe Boing Boing is hosted in a foreign country. Canuckistan, a country that often elects socialists into government!

  12. Great that this came out, but I’m sure it doesn’t come as too much of a shock to many. After all, the president’s top political advisor, David Axelrod, even runs an astroturfing firm. See: The Secret Side of David Axelrod.

    The only tactic I’ve found to work against astroturfers is to publicly call out the corporations behind the turf, and mock/shame them. Posting parody pics of the executives heading the corporations that employ astroturfing seems to have some effect.

  13. On the plus side, this is pretty much the technology we need to get Cory’s “chaff” internet secrecy thing (from Little Brother) working.

  14. I believe that astroturfing is far more effective than some might believe, as it plays on humanity’s trend toward conformity, by simulating a group that is shown to believe in an idea, there will always be people willing to listen to a voice as long as it speaks loud enough. Astroturfing can thus lead to a wide acceptance of information that is blatantly untrue but as long as people have heard it often enough they won’t question the facts of the matter. Who here can remember all the anti-Obama campaigns that spread through word of mouth stating he was a Muslim and an Islamist despite all easily found evidence towards the contrary.
    I think that astroturfing presents a very real danger to the value of information placed on the internet, while a great majority of the internet is random gibberish, the sites that astroturfing will target are forums for the spread and discussion of information that is critical to our way of life; this introduction of astroturfing may lead to a contamination that devalues the worth of information that can be found online.
    On my position of the different types of government I prefer to keep it to myself, but I can say that I expect astroturfing to be used as just another tool to keep election votes. Whatever the government’s decision may be there will always be those who disagree with their actions and propaganda is a time-tested solution. With the advent of the internet comes propaganda in its newest form, that of astroturfing.

Comments are closed.