Preservation Over Cause: Remembering Team Themis

The subversive smear operation was a blueprint for a digital-age, public-private COINTELPRO.

Recently, New York Magazine published my profile of Barrett Brown, who’s seeking asylum in the United Kingdom. It’s a long article, but inevitably some potentially interesting material got cut from the final piece or never made it out of my notes. To that end, here’s a potted history of Team Themis, the private intelligence contractor partnership (with an assist from the DOJ) that worked to discredit Wikileaks supporters and undermine the organization itself. In many ways, Themis prefigured Black Cube-style dirty tricks that were yet to come. I don’t think we have quite reckoned with what Themis wrought, both for some of the people mentioned here and for the larger, ongoing public-private campaign to suppress leftist activism and political agitation. What might be most disturbing about the Themis operation is that it was likely one of many. We know about it thanks in part to the efforts of Barrett Brown.

---

[Team Themis slide presentation via Wikileaks]

In late 2010, a group of intelligence contractors – Palantir, HBGary Federal, Endgame Systems, and Berico Technologies – began working together under the aegis of what they called Team Themis. They were hired by the law firm Hunton & Williams on behalf of Bank of America and the Chamber of Commerce to undermine Wikileaks and labor unions, respectively. Team Themis would investigate critics’ families, compile dossiers, hack online infrastructure, and launch information warfare operations. It was going to be a secretive campaign, potentially illegal, and very expensive: Team Themis asked for an initial $200,000 per month, later to be bumped to $2 million, when the operation was running at full intensity. 

In a December 2010 exchange about attacking Wikileaks, Matthew Steckman, a Palantir employee, sent HBGary Federal CEO Aaron Barr a list of suggestions based on staple counterintelligence tactics, used to undermine radical groups from 1960s Berkeley to the anticolonial struggle in Algeria. Only the technologies had changed.

• Feed the fuel between the feuding groups. Disinformation. Create messages around actions to sabotage or discredit the opposing organization. Submit fake documents and then call out the error. 

• Create concern over the security of the infrastructure. Create exposure stories. If the process is believed to not be secure they are done. 

• Search for leaks. Use social media to profile and identify risky behavior of employees. 

Barr followed up with his own ideas: attack their funding sources, and generate friction among Julian Assange’s followers. Their exchange was later incorporated into a pitch deck trying to sell their strategy.

In a subsequent email, Barr emphasized the “need to highlight people like Glenn Greenwald” and other prominent supporters. “These are established professionals that have a liberal bent,” Barr wrote, “but ultimately most of them if pushed will choose professional preservation over cause.” He didn’t specify how they would be “pushed.”

[The ideas that Barr and Steckman batted around in emails eventually made their way into Team Themis’ official presentation. Team Themis slide via Wikileaks.]

Believing that Anonymous was connected to Wikileaks, Barr began investigating the hacktivist organization. In February 2011, he bragged in a Financial Times interview that his company had infiltrated Anonymous and identified its leadership (despite the hacktivist collective claiming that it had no formal leadership). Barr may have been exaggerating. He had been trying to drum up business for his company, emphasizing analytical capabilities that colleagues didn’t think he had, and touting his FBI connections. Now, he was claiming, without much evidence, that he had secret information on the most significant hacktivist group of the moment. (Barr did not reply to a LinkedIn message sent to him during the course of my reporting.)

In response to his claims, Anonymous trolled Barr, jokingly conceding defeat in a press release that Brown helped write. The next day, members of the collective hacked HBGary Federal, stealing tens of thousands of emails, deleting company data, taking over Barr’s Twitter account, and resetting his iPad. The emails were posted online and within days, journalists and researchers had discovered Team Themis. “We began to discover the full extent of the plans for surveillance and dirty tricks,” Brown, identifying himself as affiliated with Anonymous, wrote in the Guardian. “We were left with an abiding sense of the sickness that plagues institutions that already spend millions on public relations lest they be considered on their merits.”

In the coming months, that institutional sickness would be reported on in newspapers around the world. The programs attacking Wikileaks and Chamber of Commerce opponents were just the beginning. Barrett Brown found evidence of an HBGary Federal-led program called ROMAS/COIN, a mass surveillance and data collection project targeting Middle Eastern social media users. Brown announced his findings in a Guardian op-ed and a lengthier report he distributed to journalists.

Rep. Hank Johnson of Georgia called for an investigation into Team Themis’ actions and its members’ government contracts, but he was rebuffed by Texas Rep. Lamar Smith, the Republican chairman of the House Judiciary Committee. Ultimately there was little political attention paid to the core revelation: the growing union between large corporations, private intelligence contractors, and government intelligence agencies to undermine civil society, boost big business, surveil innocent people, and expand the power of the security state.

Aaron Barr lost his job at HBGary Federal, which eventually was shut down by its parent company. He received some sympathetic press, with Brown cast in the role of a 4chan-inspired troll harassing a patriotic private citizen. Matthew Steckman, the Palantir employee who worked on ways to compromise journalists and activists, was placed on leave, then brought back and promoted. Now he works at the military startup Anduril, which, like Palantir, is backed by Peter Thiel. Pat Ryan, who worked for Team Themis member Berico, became an executive at Dataminr, which sifts social media for law enforcement clients. In 2022, running as a Democrat, Ryan was elected to Congress.

One of the journalists who reported on their potentially illegal activities went to federal prison.