First they came for WikiLeaks: ’BlueLeaks’ activists pursued as ‘criminal hacker group’ by DHS despite not hacking

Distributed Denial of Secrets, the group that published the “BlueLeaks” trove of hacked police documents in June, is being persecuted as a “criminal hacker group” by the US Department of Homeland Security – just like WikiLeaks.

The transparency activists “conducted a hack-and-leak operation targeting federal, state, and local law enforcement databases,” according to a document circulated by the DHS’ Office of Intelligence and Analysis among law enforcement fusion centers in late June, recently obtained through a Freedom of Information Act request and published by the Verge on Thursday.

There was just one problem with that narrative, according to DDoS. Despite being labeled a “criminal hacker group” by the agency, which accurately described how the activists leaked “10 years of data from 200 police departments, fusion centers, and other law enforcement… resources,” the group insists it had nothing to do with the actual hack.

DDoS has always claimed the data it published as BlueLeaks, which included information on surveillance tactics and intelligence gathering as well as police and FBI reports, bulletins, and other sensitive information, was provided by a hacker purporting to be part of Anonymous, the long-dormant hacker collective that rose to prominence over a decade ago combining wanton cyber-mischief with political activism.

Emma Best, DDoS’ co-founder, told the Verge the group has never done any hacking itself, merely publishing files hacked by others. She lamented that the language in the DHS document suggested the government was pursuing DDoS in the same manner it had gone after WikiLeaks. However, Best seemed unable or unwilling to grasp any connection between the mischaracterization of DDoS and the slanders commonly leveled against WikiLeaks, which similarly does not hack the documents it publishes. Indeed, DDoS was quick to denounce their fellow leakers, telling the Verge: “Unlike WikiLeaks and [its founder Julian] Assange, we have no involvement in actual hacks and don’t provide material support to hackers” in a statement on Thursday.

DDoS initially surfaced in 2018 purporting to be a “non-partisan” alternative to WikiLeaks, with Best, a journalist, its only publicly named member. While it’s difficult to classify as “partisan” an organization whose founder once referred to the 2016 election as a choice between cholera and gonorrhea, WikiLeaks has nevertheless been dogged by accusations that its publication of leaked emails from the Hillary Clinton campaign and the Democratic National Committee was deliberately done to hand the election to Donald Trump.

The group’s first leak, known as “Dark Side of the Kremlin,” consisted of 175 gigabytes of data – much of it previously released on Russian and Ukrainian websites – from the Russian government, including material about the war in Ukraine. WikiLeaks had declined to publish the material, arguing it was already public. The DHS, in its bulletin, accused DDoS of hacking that material too – though reports at the time suggested Russian hacking group Shaltai Boltai were the culprits, along with other Eastern European hackers.

A February report from the US National Counterintelligence and Security Center declared “hacktivists, leaktivists, and public disclosure organizations” like WikiLeaks and DDoS to be on par with terrorists in terms of the threat they pose to the country.