Originally published 2020-06-04.
In the days after George Floyd was killed by a Minneapolis police officer on 25 May 2020, a masked figure claiming to speak for Anonymous posted a video threatening the city's police department. Soon afterwards the websites of the Minneapolis Police Department and the City of Minneapolis went down in denial-of-service attacks. What did not hold up was the most dramatic claim that followed: a supposed leak of police emails and passwords turned out to be recycled data from old breaches.
Here is what actually happened, what was exaggerated, and what Anonymous is, for anyone trying to separate the record from the viral posts of that week.
The video and its demands
The video appeared on Facebook on 28 May 2020, three days after Floyd's death. In familiar Anonymous style, the speaker wore a hoodie and a Guy Fawkes mask, the image popularised by the comic and film V for Vendetta, and spoke through a voice distorter.
The message accused the Minneapolis police of a long record of violence and wrongful deaths, said Floyd's death was only the most visible case, and demanded criminal charges for the officers involved, especially Derek Chauvin, who had knelt on Floyd's neck. The speaker said the group did not trust the department to deliver justice and would instead "expose your many crimes to the world", ending with the movement's slogan, "We are Legion. Expect us." It also described police as enforcers for an elite rather than protectors of citizens.
OKAY I FEEL LIKE WE ARE IN A MOVIE BUT HELL MEN ANONYMOUS WILL SHOW NO MERCY JUST LIKE YOU DID. HAVE A TASTE OF YOUR OWN MEDICINE. #Anonymousisback pic.twitter.com/UaxoaSbLgQ
— Marthina (@Monstarvas) May 31, 2020
The clip spread quickly, and the hashtag #Anonymousisback trended as people shared it, often with enthusiasm and very little scepticism.
What was confirmed: the website outages
On the Thursday after the video, the City of Minneapolis website became hard or impossible to reach. City officials described a distributed denial-of-service (DDoS) attack, in which a site is flooded with junk traffic until it stops responding. The city's chief information officer, Fadi Fadhil, said most systems were restored quickly and that protective measures had been in place.
Over the following weekend, further attacks took the Minneapolis Police Department's own website offline. Security reporters linked the outages to people acting under the Anonymous banner, given the timing of the video, but officials did not publicly name who was responsible.
A DDoS attack is disruptive but crude. It does not break into a system or steal anything; it simply makes a public website unavailable for a while. That distinction matters for what came next.
What did not hold up: the "leaked" police database
On 31 May, posts on Pastebin and social media claimed that hackers had breached police systems and released a database of officers' email addresses and passwords. Many accounts presented it as proof that Anonymous had got inside the department.
Security researcher Troy Hunt, who runs the breach-notification service Have I Been Pwned, examined the file. It contained 798 email addresses, 689 of them unique, and 654 of those (95 percent) were already in his database from earlier, unrelated breaches. Most of the passwords had also appeared in previous leaks, some were far too short to pass a modern police password policy, and one was literally "LinkedIn". Hunt concluded that the data almost certainly did not come from a Minneapolis police system and had been assembled from old breach collections to look new.
In other words, the websites really were knocked offline, but the claimed hack of police data was a fake.
The Chicago police radio clips
Around the same time, videos circulated that appeared to show Chicago police radio channels playing N.W.A.'s 1988 protest song "F*** tha Police" and other audio. Some posts credited Anonymous. Whatever the audio was, its origin and authenticity were never confirmed, and police radio interference can come from anyone with a transmitter rather than a sophisticated hack. Treat any claim that Anonymous "hijacked" the radios as unverified.
Hijacked chicago police radio plays NWA's "F*** The Police" pic.twitter.com/I3NWWYZwem
— doomer zoomer (@doomerzoomeer) May 31, 2020
(This post is no longer available on X.)
What happened to the officers
The online threats did not decide the case; the legal process did. All four officers were fired on 26 May 2020. Chauvin was first charged with third-degree murder and manslaughter on 29 May, and on 3 June 2020 prosecutors raised the charge to second-degree murder and charged Thomas Lane, J. Alexander Kueng and Tou Thao with aiding and abetting.
On 20 April 2021 a jury convicted Chauvin of second-degree murder, third-degree murder and manslaughter. He was sentenced to 22.5 years in state court and 21 years on federal civil rights charges, served at the same time. The other three officers received state and federal sentences ranging from about two and a half to nearly five years. In March 2021 the city agreed to pay $27 million to settle a lawsuit brought by Floyd's family.
What Anonymous is, and is not
Anonymous grew out of internet message boards, especially 4chan, in the mid-2000s. It has no membership list, leaders or headquarters. Anyone can put on the mask and post a video in its name, which is why statements "from Anonymous" can contradict each other, and why a claim of responsibility is not proof.
People acting under the name have targeted the Church of Scientology, PayPal and Mastercard (after they cut off donations to WikiLeaks), government sites during the Arab Spring, and the Ku Klux Klan. In August 2014, after police shot Michael Brown in Ferguson, Missouri, Anonymous posted a similar warning video and released personal details of the local police chief. It also published the wrong name for the officer who shot Brown, an example of how vigilante "doxxing" can hit innocent people.
Consequences for participants
Some people linked to the movement have gone to prison. Jeremy Hammond was sentenced in November 2013 to the maximum ten years for his part in hacking the intelligence firm Stratfor, whose emails were passed to WikiLeaks. Deric Lostutter, who was involved in the KnightSec campaign over the Steubenville rape case, was later reportedly sentenced to two years in federal prison. DDoS attacks are crimes in the United States and many other countries, whatever the cause behind them.
How to read hacktivist claims
The Minneapolis episode is a useful lesson for anyone following online activism. A few simple checks go a long way:
- Ask what kind of attack it was. A website going down is not the same as data being stolen.
- Look for independent verification. Security researchers often test leaked data within hours; wait for them.
- Remember that anyone can use the name. "Anonymous says" tells you nothing about who actually acted.
- Be wary of doxxing. Published names and addresses are often wrong, and the people harmed may have nothing to do with the case.
The anger behind the 2020 videos was widely shared, and the protests and unrest that followed changed national debate about policing. The hacks themselves were far smaller than the headlines suggested.
Sources: SecurityWeek: Hackers disrupt Minneapolis systems, no evidence of breach; Troy Hunt: Analysing the alleged Minneapolis Police Department hack; Wikipedia: Timeline of events associated with Anonymous; Wikipedia: Murder of George Floyd; Wikipedia: Jeremy Hammond; Wikipedia: Steubenville High School rape case.
COMMENTS