Anonymous allegedly hacked Romney tax records | Hacker News Reader

Anonymous allegedly hacked Romney tax records

nashvillecitypaper.com

78 pointschoko112 comments

The hacker activist group named Anonymous is not involved in this claim.

But rather the statement comes from an anonymous group claiming to have stolen digital copies of the records.

I don't understand why they made this a public posting. Romney isn't incentivized to pay up once the blackmail is public knowledge -- payment is equivalent to admitting guilt. Might as well keep your money and take the hits.

I don't see any situations where this beats contacting the campaign privately, with a document or two in hand to prove that you have the real stuff.

Unless, of course, if this is just a stunt that someone is running on the off chance that anyone is stupid enough to actually pay the money.

This isn't about getting Romney to pay, it's about getting some suckers to send a little money to the addresses on their own. Here's the balance for the "stop release" account https://blockchain.info/address/1HeF89wMjC48bWNgWvVo7Wu3RaLW... and the "promote release" account https://blockchain.info/address/12AP6iCwRNFQqKLStH3A4b4hw3SL...

Someone was sending "binary" (10101) amounts of bitcoins to the address, to spell out an imgur link as a joke.

What's the link?

This is what I got:

imgur.com/5k37g

You have got the last characters wrong, see my messages below for the correct link. But there is no useful content in the imgur link because the person who made the image messed up and truncated their message.

As for the "promote release" Bitcoin account, somebody posted the ASCII string 'prove it' (I'm repeating what I said below since this thread shows up at the top).

...I don't get it. I mean it's funny that someone is using the BTC chain for communications :) But does that image mean anything?

Maybe there's a message encoded in the image as some sort of double-steganography.

I suppose it's within the realm of possibility that he could make the payment privately, deny that he ever did so, and then take the position that no one was ever in possession of the documents and the whole thing was just a scam and the documents were never released because no one ever had them.

It's plenty likely that the whole thing IS just a scam and they don't actually have the documents.

Romney would never pay directly, that's not an option that is even in the realm of possibility.

Surrogates, though, or better yet supporters...

The ideal outcome for the person who made the post is that Obama and Romney supporters get in a bidding war.

So far they've made $0.30 BTC and the story has hardly broken...

A possible motive is to force Romney's hand to release it himself. It still makes him look bad - but not as bad as a bidding war between his supporters and detractors.

What I find interesting is the future(or current) possibility of political opponents hacking each other and then blaming it on "Anonymous" or entrepreneurial hackers. Or heck, infiltrate companies that do business with the political opponent and then blame "hackers" who don't exist.

So Watergate?

http://en.wikipedia.org/wiki/Watergate_scandal

Or media outlets, given the whole "celebrity cell/email hacking scandal". Or even rival companies that find dirt.

I really hope you didn't just give them the idea.

Some of us developers have been working on the rehabilitation of the term "hack" and "hacker" (Hacker News anyone). The various Anonymous/LulzSec attacks of the last few years have been amusing and most have not been directly attacked individuals or been extortive (however, they've still been illegal, and I have not agreed with them).

Although a politician, Mitt Romney is still a person. No one has rights to his personal information he has not decided to share.

This attack is despicable.

"No one has rights to his personal information he has not decided to share. This attack is despicable."

You realize Mitt Romney is campaigning for the office that is the single worst violator of that philosophy in the world, right? Don't get me wrong, I generally think law enforcement should have privileged access to private data, but you disrespect your philosophical position by pretending to apply it in a manner where the outcome is predetermined through uneven application.

the office that is the single worst violator of that philosophy in the world, right?

The president of the United States takes an oath to defend the constitution. Sure, some do it better than others, but I can think of a dozen worse violators of getting personal information that people have decided not to share.

Sorry, I should have been more precise. The general public does not have rights to personal information an individual has declined to share. Now, this obviously excludes public information which the individual wishes wasn't available (arrest records, political contributions).

I agree with you that the presidential office has made executive orders and signed bills recently (Obama and Bush both) that have substantially increased governmental reach and reduced privacy. But this doesn't give the public to take what they want willy-nilly. It does give the public the right not to vote for someone they feel has a double standard on privacy issues.

The ransom note has pretty specific language:

"Romney's 1040 tax returns were taken from the PWC office 8/25/2012 by gaining access to the third floor via a gentleman working on the 3rd floor of the building. Once on the 3rd floor, the team moved down the stairs to the 2nd floor and setup shop in an empty office room. During the night, suite 260 was entered, and all available 1040 tax forms for Romney were copied."

Anyone at PwC will instantly know if this is true or not. My guess is that the specifics will check out (why else include them?) and give credibility to the claim.

But even if those specifics are true, how will anyone know that they really have the returns? Maybe they just figured out where the returns were stored and are trying to force someone else's hand.

> Anyone at PwC will instantly know if this is true or not. My guess is that the specifics will check out (why else include them?) and give credibility to the claim.

These specifics are either public information or not. If they are public information, they can be checked by a member of the public and confirmed to be wrong or right; but if they are public information, they could have been obtained by such security breaches or by accessing the same public information used to check them. So if they are public information, they do not prove anything.

If they are private information, then perhaps only PwC/PwC-employees can verify; presumably some of them will. But, if there was no security breach then PwC will deny that there was a security breach, and if there was a security breach, PwC will - like most companies - deny that there was a security breach because there is no possible advantage for them to confirm it. So regardless of whether this private information is accurate, the only party in a position to verify the information is also in a position with powerful incentives to claim that it is false.

What is necessary is some sort of trap-door or one-way data: information which is private, but can still somehow be publicly checkable. None of these details seem to be such trap-doors.

I figure these details are either public (building plan listing the existence of suite 260; location of PWC offices and having 3 floors all are trivial bits of info) or are made up for the purpose of seeming plausible.

By taking a line item deduction and making it public to the penny. Unequivocal confirmation.

Good point, that would be the 'proof of life' in this case (at least for Romney and PwC).

One strategy would be to have stolen a bunch of returns from a dozen (well-known?) individuals and then have them confirm that privileged information was taken.

Wouldn't entirely prove it to the public because it could be some kind of clever conspiracy, but taking it to a large enough size would make it fairly plausible.

That's the only way I can think of to get around relying on PWC or the Romney campaign for confirmation.

Damn. Who knows if this is legit, but assassination markets are coming, it's only a matter of time. Obviously it won't start with ACTUAL assassinations-- but hide your data, hide your mistresses.

If abused assistants and underpaid file clerks ever realize they can make 100x their salary by leaking data with a bounty there is going to be a culture changing shit-storm.

Not really. The file clerks and assistants in question would have to do far more than simply "realize" that they can leak data.

They would have to magically acquire the expertise to leak it untraceably, to handle all the financial arrangements untraceably, and not get caught in any other ways. Meanwhile, the most powerful people in the world will be going after them.

This is already an extremely difficult proposition, and will only get more difficult with time.

There is an important piece to this story that is missing from all the current news articles: a different earlier post on pastebin, dated 9/2, did not make mention of any kind of ransom:

http://pastebin.com/zdU1TK40

That earlier post simply said "The group will release all available files to the public on the 28 of September, 2012."

That says to me that a second group saw the original post and decided to try and make some money off it as a scam. Of course it's also possible that they just changed their minds over the weekend.

I'm not sure what either scenario says about the likelihood that this is real, but it definitely makes things more interesting. It's also worth noting that PWC is currently saying they have seen no signs that any data was taken.

What if it's all a scheme to drive up the value of bitcoin via speculation?

Increased attention to the currency will have some bidding up the price, so anyone just holding bitcoin could profit, even if without 1 coin being sent to either address.

Of course, if someone did try to make the payment and purchase a million bucks of bitcoins, that would drive the price sky high.

My first thought is that it would do the opposite: increase political pressure on Bitcoin so that it may become more difficult to use (legally). This would drive down the price since many buyers are speculating on Bitcoin becoming more mainstream one day.

They've provided no real proof that they actually have the tax returns. I'd be surprised if this is genuine.

For me the telling thing is the "1040" bit.

I'm no billionaire but, even my meager tax return is more than a simple 1040 form.

yeah but the critical figures people want, including the sum total of tax paid is on the 1040.

If it is genuine, then the Romney campaign has proof.

Seriously, who else immediately thought of Dr. Evil demanding "one MILLION dollars"? Makes a good story but sounds bogus to me.

If it is genuine, I don't know why they think they'll get away with it.

Also $1M is way too low of an amount to blackmail Romney for. Talk about selling yourself short.

Eh, I'm not sure. It's pretty clear what's in Romney's returns at this point (a lower than average income tax rate, though it's hard to say whether it's closer to 5% or 15%), so I don't see a huge downside risk for him in them being released. If they upped their demands to, say $10 million, we're talking about real money, even for Mitt. Enough to get an extra percent of the vote or so in a moderate sized state. Unless there's something genuinely illegal in the returns, a couple days of renewed interest in them might be preferable to giving up a bit of money at the margin (though, paid media is fairly well saturated now, so it might not be that useful).

From Romney's point of view, too, there'd be no guarantee that paying 10 million would prevent them from being released. There's no accountability for the Anonymous. With 1 million, though, it's just a no brainer.

That said, I doubt they have anything. Reeks of BS to me.

A quick point and a theory:

First, it's not true that the average American pays 15% in income taxes. An typical family in the middle of the income spectrum pays about 5.6%.[1]

As far as Romney's returns go, I have a hunch that the political problems wouldn't be in the numbers, but in something like his charitable giving, of which there's an awful lot. What if one of the church programs he gave to turns out to have had some politically incorrect pamphlets, for example? Suddenly he'd be in a position to have to defend everyone he'd ever given $1 (or more likely, $10,000).

[1] http://www.cbpp.org/cms/index.cfm?fa=view&id=3151

I misspoke: it's not that Romney pays a lower average income tax rate, but pays a lower average federal tax rate, including payroll. For most people, income taxes make up a negligible part of that total tax burden.

I doubt the charitable giving would be a problem, and I'm also skeptical of the "Romney took a tax amnesty in 2009" theory. At this point I think it's mostly bull-headedness: Romney thinks no one has a right to see his private financial information, and he's sticking by that, come hell or high water.

For most people, income taxes make up a negligible part of that total tax burden.

Ignoring the employer "contribution" sleight-of-hand, payroll taxes in 2012 are 4.2% SS + 1.45% Medicare, or 5.65%. Adding in the income tax burden, and you're still looking at a total Federal tax burden of under 12%.

You're missing the point. If you spend most of what you earn, that's an additiona 10% (in my state) on sales tax.

Most very wealthy don't spend nearly what they earn, so the effect of sales tax is negligible.

How am I missing the point? First the claim was that Mitt Romney pays a "lower than average income tax rate", which is demonstrably untrue.

Then the claim was that he pays a "lower than average Federal tax burden" and that the income tax as a burden on the average American was "negligible" relative to their payroll tax burden. I didn't even bring up the fact that Bain pays corporate income taxes on its profits before they're disbursed to owners like Romney. Even discounting that, the average person's Federal tax burden is still lower than Romney's, assuming he's being truthful when he says his income rate was never lower than 13%. And the average American's income tax burden is not "negligible" relative to the payroll tax burden: it's about 50/50.

Now you're trying to bring state taxes into it. Guess what: Romney makes most of his money off of capital gains and is a Massachusetts resident, where long term capital gains are taxed at 5.3%.

Yes, Romney could "afford" a much greater tax burden. He could "afford" a tax burden of 95% and still live comfortably. That's not an argument (or at least a good one) for such a thing. It's also not the point under debate (that somehow the rate of taxes he pays is lower than the average American's).

You're speaking inaccurately. People in the middle 20% paid an effective rate of 15.5 percent. And trying to add in corporate tax rates is a bit-too-clever slight of hand.

The average American is barely getting by. Meanwhile, doctors, engineers, etc, are paying 20-25%. That's just non-sensical.

I have seen it suggested that the problem is not in the taxes themselves -- it may be in the state he declared as his primary residence.

If he declared residence in one state but voted in Federal elections in a different state, he may have committed voting fraud.

Ah -- found a source for speculation: http://www.guardian.co.uk/commentisfree/2012/aug/17/mitt-rom...

I think the downside risk is in the details.

I use a serious accountant for my taxes, and the organizer they send me every year asks for maybe 75 pages of information, and encourages me to add extra sheets as needed. Personally, I leave 98% of it blank, but I can imagine someone at Romney's level being very reluctant to release everything a serious accountant considers necessary to persuade the IRS to cut me a break.

The real problem for them isn't the bottom-line numbers. It's a dozen news cycles as people dig into detail after detail. E.g., the tax deduction for Ann Romney's horse that's larger than the US median annual income. All that detail is a PR nightmare, because each item will highlight to voters how incredibly wealthy he is compared to them.

He has recently insisted that he's never paid less than 13%, so if it comes out as less than that, he might have a huge political problem.

For the record, I don't think he's lying about that, he seems far too smart to set up a trap like that for himself.

I recall it being couched in words about overall tax rate, though, not income tax rate. Which would give him enough wiggle room if push comes to shove.

I think it stands to reason that if the release were no big deal, if it was just something like low-paying taxes, he wouldn't be so resistent. He's taken a lot of egg to the face to keep these things secret, so there has to be a reason why.

paying the ransom is just as bad, since it confirms that there's something worth covering up.

Yes, the low amount is what makes me suspect that it's fake.

If this were real, and the true aim was extortion, we would have never heard about it.

Perhaps the blackmailers assume they are more likely to get money from people who want the records revealed. 1 million people could pay $1 each, Kickstarter-style.

I would gladly pay a dollar (or donate to a charity of Mitt's choice) to have him release the records, just so we could move past them and try to talk about something of substance for a while.

title didn't convey the content of the article, or why it would be of interest to HN. I thought it was political stuff at first vs tech news.

A better title might be:

Anonymous' steals Romney's tax return for blackmail extortion

Actually, I think the thieves are anonymous in that they aren't known yet, not "Anonymous" the hacker group.

If that's the case then "anonymous" shouldn't be used as a noun.

I assumed it was A-nonymous when I read the article, but on re-read I think you are correct.

That probably explains why the story hasn't exploded more like other stories about Anonymous or Lulsec have.

Thanks for the advice.

This kind of stuff has the potential to be so much fun, but always ends up being so boring.

Remember when a 4chan user hacked into Sarah Palin's not-public-record Yahoo! Mail account and managed to post screenshots to /b/? But then the user totally failed to publicly archive the mail? And somehow got caught? Total disappointment.

Pastebin: http://pastebin.com/1j1yzQ9S

I'm not very familiar with the Bitcoin protocol: Can all users view the values of these two bitcoin accounts -- or BTC in transit?

Yes, the transactions to and from these accounts are available here:

Stop release: https://blockchain.info/address/1HeF89wMjC48bWNgWvVo7Wu3RaLW...

Full release: https://blockchain.info/address/12AP6iCwRNFQqKLStH3A4b4hw3SL...

Those amounts that look like 8 bits of binary are interesting, but don't seem to convert to meaningful ascii.

That would have been fun.

It actually is ASCII data (byte == binary_btc_amount * 256), spelling the string 'http://i.imgur.com/5k6Rf.png.

This PNG image is a QR code, which decodes to the string '01101000011101000111010001110000001110100010111100101111011010010010111001101001 01101101011001110111010101110010001011100110001101101111011011010010111101101001' (newline added for layout, not actually present).

This, in turn, is a binary ASCII encoding of the string 'http://i.imgur.com/i. But that's a 404 page, so this whole thing seems a bit futile.

FWIW, the PNG file coincides exactly with the one generated by http://qrcode.kaywa.com/ for the binary string.

And the second Bitcoin account contains the ASCII string 'prove it', in forward chronological order. The imgur string was in backward order.

In the case of the "allow release" bitcoin account, clearly someone is sending a message to the perpetuators saying "prove that you actually have the documents".

In the case of the "stop release", a different person likely sent a message as a joke, but didn't realize that the QR code couldn't handle the number of bits for the full imgur url, and it was truncated as a result to the "/i".

You're absolutely right about the truncation, the text is exactly 160 characters long, and the QR code generator used silently truncates the clipboard contents, so that it's very likely that the person was unaware that some characters were missing.

Any volunteers for sending a Bitcoin message to tell these guys that they messed up? :-)

Apparently it's an imgur URL?

KARL ROVE ALERT! This is a very similar in spirit to past tactics alleged against Karl Rove. This enables Romney to dodge the Tax issue by having it release this way and have all the focus pointed toward an "anonymous" group. Don't fall for this!

I wonder why this one was down voted? Think about the timing, releasing this during DNC.

Think about the nature of the alleged hack, so unprecedented. Think about the random process, this has never happened before.

All these combined and hearing alleged doggy practice of Karl rove in the past can leade you to conclude the shady motivations behind this

Is it safe to accept a ransom via BitCoin? Theoretically how might they be caught?

If the people accepting the Bitcoins for ransom own the Silk Road? Let's face it, all Bitcoins eventually end up on the Silk Road.

It's safe to accept it, but once you have it laundering and spending it is more difficult.

PricewaterhouseCoopers PR managing director Chris Atkins says: “We are aware of the allegations that have been made regarding improper access to our systems. We are working closely with the United States Secret Service, and at this time there is no evidence that our systems have been compromised or that there was any unauthorized access to the data in question.”

See http://news.ycombinator.com/item?id=4481292

It seems likely this is just a scam to get random Romney and Obama supports to send Bitcoins to the scammer.

Now if only they could steal Obama's college transcripts he's paid over a million dollars to keep sealed...

"It would be illegal under federal law (the Family Educational Rights and Privacy Act of 1974) for Occidental, Columbia or Harvard Law School to give any former student’s records to reporters or members of the public without that person’s specific, written permission."

http://www.factcheck.org/2012/07/obamas-sealed-records/

Equally relevant!

Point taken, but I'd be happy if candidates just released both sorts of information and weren't so afraid of being transparent.

In the law of evidence, there is the idea of balancing the relevance of evidence versus it's unfair prejudicial quality. How relevant are Obama's transcripts from college? Meanwhile, given that the media is composed of the stupidet people graduating college each year, can you imagine the shit storm of unfair prejudice that would result if Obama had taken courses in say critical race theory or African studies? Meanwhile, would any prejudice to the Romney campaign from the information in his tax records be "unfair" prejudice? Or legitimate prejudice?

Is it normal to release educational transcripts? I thought taxes were pretty much a given, but not so with college transcripts.

Also the OPs assertion of paying 1 million dollars to hide Obama's transcripts is so ridiculous on its face I'm surprised people willingly post things like that online.

Fun fact, we have Romney's 2010 and 2011 tax returns. McCain only provided two years of returns too when he was running. It's not a hard-precedent to provide "everything you have", either tax records or birth certificates or transcripts or letters of recommendation... But looking at it from a politician's perspective: if it can only help you, fine, release it. Otherwise why bother? Unless the damage from not releasing exceeds the damage from releasing (which I think is becoming the case for Romney), it's just unnecessary information.

I thought we had his 2010 returns and an estimation of his 2011 returns?

I'm calling their bluff, sounds very much like a scam to get money off people who fall for it.

This is quite clever; it seems it is possible that all three groups could possibly pay.

Would they be able to remove that amount of money from the bitcoin system without affecting the conversion rate substantially, or is this loss near negligible?

It is fascinating that none of the major news outlets seems to have reported this as of yet.

Surely if it's true he needs to release his tax records and play "Don't give in to criminals". Might even make him look good / a victim.

The chance of seeing the inside of a jail massively outweighs the chance of these guys getting any money...

They need to release a few random line items as proof, otherwise it's a nice scam.

http://www.freewoodpost.com/2012/07/28/anonymous-hacks-irs-d...

To spare everyone the trouble: unrelated satire from months ago.

I thought there was supposed to be an effort to ensure accuracy in posting titles--Anonymous didn't have a damn thing to do with this.

Kind of a coincidence this comes out right after the FBI Apple hack. Looks like someone wants everyone to look the other way.

"anonymous group" not THE "Anonymous"

Isn't the point of the name supposed to be that anyone can be THE Anonymous?

If you claim to be Anonymous, you get to be Anonymous.

If you act anonymously, you're just being anonymous.

Yes, but AFAICT these people didn't claim to be "Anonymous"

"An anonymous individual or group..."

The original article says nothing about them claiming to be "Anonymous" as the HN title implies, only that they acted anonymously. Adjective, not noun.

1 Million USD = 93,000 BTC at an exchange rate of ~$10.70

Deleted comment

By putting the price at $1,000,000 they might have a chance at actually getting the information. Sure they could have put the price at 10 or 100 million dollars, but the probability that Romney would pay out would be miniscule. I am sure at the ransom price is more money than these guys have ever seen. Why not price the information at a rate which somebody might actually pay?

Since bitcoin is decentralized, I cannot imagine any law passed could successfully outlaw it.

Can this be considered terrorism? Surely, blackmail, but also terrorism? Just curious.

edit: Since I received record fast downvotes, I'll clarify that this is not meant to be a political comment, jesus.

If you want to dilute what the words means to the point it can mean just about any crime, sure. But if you're referring to the strict term, then no.

There's no actual strict definition of terrorism; just a bunch of disparate attempts at one by various government agencies. The reason this is, is because it's so painfully, obviously subjective. If we use the definition provided by drivebyacct2, the use of the term itself is the best example of its definition. Most accounts of terrorism are merely just criminal acts that a certain party wants to paint as extranormative. It's interesting to bring up the question of whether this hack could be considered terrorism, as I'm sure if it's real, some Republicans will have interest in calling it that. That's the nature of the illusive concept of "terrorism". Sorry for the off topic discussion!

>the systematic use of terror, especially as a means of coercion

Which word am I diluting exactly? If Romney is as afraid of releasing his taxes as many imply, would he not be fearful of their release?

edit2: thanks for the replies, I think I understand why y'all disagree and I think that I agree with you. It's not systematic and it's not being used to intimidate others, it's too focused, basically.

Part of the idea of terrorism (and hate crimes, for that matter) is that the victims aren't just the ones immediately impacted, but other people as well. The aim of terrorism is to create a climate of fear in those who live. I will always remember the first time I flew on an airplane after September 11, 2001.

I strongly doubt that this act was designed to strike fear into the hearts of all of the other fabulously wealthy presidential candidates who refuse to disclose their tax returns.

"If Romney is as afraid of releasing his taxes as many imply, would he not be fearful of their release?"

If a kid is afraid of their first day of school that doesn't mean the school is a terrorist, though that child may be full of terror about that day. It's a very broad term - arguably which contributes to problem of ever really "winning" a "war on terror", but the common understanding of the word terrorism today doesn't usually include things like fear of tax records being released.

Two issues with your usage:

- this is not "systematic". Terrorism targets a whole group.

- this is not "violent" (search the wikipedia entry[0]; while the word is left out of the one-liner at the top, it appears throughout).

I would have categorized this under blackmail, or possibly harassment or intimidation. It definitely isn't terrorism.

[0] http://en.wikipedia.org/wiki/Terrorism

Being "fearful" or "worried" about the political consequences of a document being made public isn't the same as "terror." Not wanting to leave your family alone because they may be raped and murdered is terrifying. I think that's the dilution the parent comment was talking about.

In my opinion, the reason this does not classify as terrorism is that 99.999999% of the world is not afraid of being blackmailed for the release of their tax returns.

The entire idea of blackmail is that you fear the thing being held against you.

Not really, per Bruce Hoffman (a Georgetown University professor that's an authority on the subject)

"Terrorism is ... violence - or, equally important, the threat of violence - used and directed in pursuit of, or in service of, a political aim."[1]

Certainly this is political, but I think it's a stretch to call releasing stolen tax returns violence.

[1] Hoffman, Bruce. _Inside Terrorism_. New York: Columbia University Press, 1998. Print.

I don't think so. Since it would bring fear, only if the people were wrong in the first place (not innocent). And that fear is nothing like fear for your life, or the life of the others, or fear of being sexually molested, or offended by any other physical or psychological means.

Only if they stretched a couple of the rules. They can use the wire fraud rules quite a lot easier and put them in jail for a long, long time.

Reply on news.ycombinator.com