Question: I'm not security literate, and if I was, I probably wouldn't be asking this question. As a regular tech news follower, I'm really surprised by the [outrage](http://en.wikipedia.org/wiki/Anonymous_%28group%29#Activities) of [Anonymous (hacker group)](http://en.wikipedia.org/wiki/Anonymous_%28group%29), but as a critical thinker, I'm unable to control my curiosity to dig out how exactly they are doing this? Frankly, this group really scares me.

One thing that I don't understand is how they haven't been caught yet. Their IP addresses should be traceable when they DDOS, even if they spoof it or go through a proxy.

* The server with which they are spoofing should have recorded the IPs of these guys in its logs. If the govt. ask the company (which owns the server) don't they give the logs?
* Even if it is a private server owned by these guys, doesn't IANA (or whoever the organization is) have the address & credit card details of the guy who bought & registered the server?
* Even if they don't have that, can't the ISPs trace back to the place these packets originated?

I know, if it was as simple as I said, the government would have caught them already. So how exactly are they able to escape? 

PS: If you feel there are any resources that would enlighten me, I'll be glad to read them.

[Update - this is equally appropriate when referring to the [Lulzsec group](http://en.wikipedia.org/wiki/LulzSec), so have added a quick link to the Wikipedia page on them]

Answer: 
There are NUMEROUS ways for a hacker to cover their tracks..

Here is one very generalized example:

A hacker can compromise a third party machine and use it to do attacks on the hackers behalf. Because the system is compromised, the hacker can delete/modify logs. A hacker can also piggyback machines, such as, log into machine A, from machine A log into machine B, from machine B log into machine C, from machine C attack machine D, then cleanse the logs for machines C, B, then A making tracking the hacker more difficult.

This doesn't even take into account hacked internet accounts (so even if traced back they point to a different person), open proxies, etc etc etc..

I know the above isn't flawless, but like I said this is just a VERY VERY general example. There are many many ways to cover your tracks.

That said, what makes you so sure certain 3 letter agencies don't already know who many of them are, but don't make a move on them so that those individuals can lead them to others?

I'm sure others will chime in who can explain more thoroughly, but I think the ultimate lesson to be learned is to concern yourself less with specific hackers and hacking groups, and more with your own security. The fact that their latest claim to fame originated from something as TRIVIAL to fix as a SQL Injection vulnerability (which is nothing new, very well documented and understood) is a huge discredit to the unnamed "security firm" who was hacked. *rant over*
Several post discuss the technical difficulties in finding the persons behind these groups. It is not at all easy to backtrack their activity when using many machines to create a sense of anonymity.

Another very important aspect is that the police, the intelligence communities around the globe and the different counties legislation is not really constructed to handle these situations. So if you find a server in one country that has been used to hop to a server in another country it takes too long to go through the proper channels to get the local police to get hold of the information. Even if you do the information such as logs are not always kept for longer periods of time.

It's easy to unlawfully hop around the Internet, but much much slower to hop around the Internet in a lawful way. This is a very prohibiting factor when trying to find these groups.