Question: I'm not security literate, and if I was, I probably wouldn't be asking this question. As a regular tech news follower, I'm really surprised by the [outrage](http://en.wikipedia.org/wiki/Anonymous_%28group%29#Activities) of [Anonymous (hacker group)](http://en.wikipedia.org/wiki/Anonymous_%28group%29), but as a critical thinker, I'm unable to control my curiosity to dig out how exactly they are doing this? Frankly, this group really scares me.

One thing that I don't understand is how they haven't been caught yet. Their IP addresses should be traceable when they DDOS, even if they spoof it or go through a proxy.

* The server with which they are spoofing should have recorded the IPs of these guys in its logs. If the govt. ask the company (which owns the server) don't they give the logs?
* Even if it is a private server owned by these guys, doesn't IANA (or whoever the organization is) have the address & credit card details of the guy who bought & registered the server?
* Even if they don't have that, can't the ISPs trace back to the place these packets originated?

I know, if it was as simple as I said, the government would have caught them already. So how exactly are they able to escape? 

PS: If you feel there are any resources that would enlighten me, I'll be glad to read them.

[Update - this is equally appropriate when referring to the [Lulzsec group](http://en.wikipedia.org/wiki/LulzSec), so have added a quick link to the Wikipedia page on them]

Answer: 
One of the most important aspects of an attack like this is covering your tracks. There are lots of different ways to do this, as it depends on the technology. To address your specific questions:

When they DDoS: If the flood was coming from their own machines, then it would be fairly easy to track them. The problem lies in the fact that they aren't using their own machines. They are either a) taking control of someone elses without permission, or b) getting someone to do it on their behalf. The latter is what happened with the Wikileaks attacks. People signed up to to do it.

Things start getting hinky when servers are in countries that don't generally respond to requests for logs. If the company that is being attacked is in the US, it's fairly easy to get a court order if the attack can be proven to originate in the States. What happens if it's a US target, but the attack is originating in Russia or China? The same thing goes for purchase records.

As for being scared... there are quite a few of these sorts of groups out there. Most of them are (I don't want to say harmless, but...) harmless. In this particular case, someone poked the bear and the bear got pissed.

EDIT: Not that I condone their actions, blah blah blah.
[Here is an article](http://www.scientificamerican.com/article.cfm?id=tracking-cyber-hackers) asking (and answering) just that very question from the Scientific American site posted this month. The short answer to the question is spoofing of source addresses and the use of proxies.