Goatse Security

Goatse Security was a loosely organized hacker group active around 2010 and associated in some reporting with the GNAA. It is best known for the AT&T iPad 3G data exposure incident, in which members enumerated an openly accessible AT&T web application or API that returned customer email addresses when queried with iPad identifiers. The operation resulted in the collection of more than 100,000 AT&T iPad user email addresses, including accounts associated with government, military, media, and major corporate figures, and the group then publicized the issue through Gawker/Valleywag. Known members tied to the incident include Andrew Auernheimer, also known as Weev and Escher, and Daniel Spitler, also known as JacksonBrown. The group presented itself as exposing security weaknesses, but contemporaneous evidence tied members to conduct beyond conventional vulnerability disclosure. Internal discussions referenced possible phishing, spamming, publicity-seeking, and even a contemplated but unexecuted plan to profit from market impact after disclosure. Reporting also indicates that members used scripts to automate identifier enumeration and data harvesting, contacted journalists and some affected individuals using harvested addresses, and debated the legal consequences of their actions. In public accounts surrounding the case, there were conflicting claims about whether AT&T had been notified before disclosure. Goatse Security has also been credited in reporting with identifying flaws affecting Safari, Firefox-related IRC attack vectors, and Amazon’s ratings system, though the AT&T incident remains the defining activity associated with the group. The legal aftermath centered on U.S. federal prosecution of Auernheimer and Spitler under unauthorized-access and fraud-related theories, making the case a prominent point of debate over the boundary between criminal intrusion and controversial vulnerability disclosure.