Taking to the Digital Streets: A Case Study of Hacktivism on the Early Web

Michael Kurzmeier, DH@NUIM


Hello and welcome to this paper on hacktivism on the early web. It is a great honour for me to be able to speak at this conference, where many of the keynote speakers are academics whose works have shaped my own view and contributed to my own research. My name is Michael Kurzmeier, I am a 2nd year PhD student at Maynooth University in Ireland, based in between the Centre for Digital Humanities and Media Studies.

Introduction: Definition

“hacktivism is the nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends.” [1]


Samuel, Alexandra. 2014. ‘Hacktivism and the Future of Political Participation’. Cambridge, Massachusetts: Harvard University. http://www.alexandrasamuel.com/dissertation/pdfs/Samuel-Hacktivism-entire.pdf.

My own research revolves around hacktivism’s potential to influence public memory. When I go to explain what that means, there are usually two ways. One is to start with the expression “hacktivism” and trace back its academic use, which leads to some defining works in the field. For a definition, I follow Alexandra Samuel who in her 2004 dissertation uses the following definition:

“hacktivism is the nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends.” (2014, 2)

For the context of this talk, the act of altering web sites through hacking (defacements) will be the focus of attention while acknowledging other important scholarly works that use sociological methods to understand the community behind it such as (Coleman 2013, 2014) works on Anonymous.

Introduction: Definition




Photographed by Victor Grigas, originally published by ready.gov, via wikipedia commons


Billboard Liberation, 2005

You can say that is my elevator pitch. If the elevator got stuck and I had more time to explain, I would talk about how I believe hacktivism is best explained by moving away from the conceptual towards the phenomenological. When you do that, the expression hacktivism, so deeply embedded in frameworks and power structures is moved to the back and you can start talking about writing electronic text. By doing so, it becomes more apparent how this writing is regulated by laws, conventions and design. A subset of this writing, in relation to the principles surrounding it, can be described as antagonistic in the sense that one act of writing overrides the other. Further down in this subset, then, are acts of writing that are not only antagonistic, but violations of one or many of the surrounding laws, conventions and designs. This approach also makes it less likely to fall into for a presumed digital exceptionalism. Now we are approaching something that under certain circumstances might be called hacking. As you can see on the slides, I understand this form of writing to be within a history of practices. Motivations for this type of writing are diverse, but what drives all forms of antagonistic engagement with media is narratives of how media should be. Without this utopian vision, or without an actual cause of concern, none of these practices would be able to mobilize its supporters.

Web defacements as a form of hacktivism are rarely archived and thus mostly lost for systematic study. When they find their way into web archives, it is often more as a by-product of a larger web archiving effort than as the result of a targeted effort. Aside from large collections there also exists a small scene of community-maintained cybercrime archives that archive hacked web sites, some of which are hacked in a hacktivist context.

Introduction: Geocities



Based on: Espenschied, Dragan. 2012. ‘Birdseye View on Www.Geocities.Com’. One Terabyte of Kilobyte Age (blog). 10 June 2012. http://blog.geocities.institute/archives/3297.

With that in mind, let us move on to Geocities. For the sake of time keeping, I will explain only as much as is necessary to understand my approach today. Yahoo Geocities started as a service called Beverly Hills Internet and similarly to projects such as the Amsterdam Digital City it owed its name to its organizational structure which was modelled after a city with streets, squares, lots and houses. Although this concept was later abandoned. While the Amsterdam Digital City was originally based in and around the city of Amsterdam, Geocities had a global scale and hosted over 100,000 websites making it the fifth most popular site on the web of 1997. When acquired by Yahoo! for $4.6 Billion in 1999, Geocities had upwards of one million users (Miligan 2017, 139). The service was eventually taken offline in 2009 after the static content was considered not profitable enough for the newly dubbed web 2.0.

But how do the two things – hacktivism and geocities – come together? This leads us back to my own research interest and also leads us back to why we are at this conference. In other words, I am interested in how hacktivism looked on the early web, but I am also interested in how archived web material can be used for research on hacktivism.

This is a visualization of the geocities archive. Each shaded rectangle represents a neighbourhood, containing sub-neighbourhoods, containing pages. The big rectangle on the right are profiles added after Yahoo discontinued the neighbourhood concept. Blue are directories created by, quote

As Ian Milligan says in his latest book "History in the Age of Abundance: "Geocities exemplifies the shifting scope of how we gather, preserve and provide access to our culture's historical record."

This is a fascinating data visualization. There is a revised version without the blue sections and duplicates, but I choose this one because it is great for explaining three points:

There is no such thing as Geocities. What we are seeing is an approximation based on archived material.

This approximation is mediated through yet another layer, as the archiving process has left its traces on what we are able to access.

There are many pages on Geocities. How can we use this archive to find traces of antagonistic writing?

Introduction: Geocities

To be precise, there should be none. The original terms and conditions do not explicitly mention hacking, but forbid:

“Promoting or providing instructional information about illegal activities”

Introduction: Geocities

Two of the main mirror sites, which I have used to collect material for this talk, both forbid/actively remove any such content. So really there should be none. But as we know, people do not always want to follow the rules. I have found articles pointing at geocities pages involved in hacking operations and wanted to find out how much of this has made its way into the archive.

Hacktivism: Surveying the Archive

The methods used were a general keyword search1 to survey the archive and an attempt to cross-reference some well-known hacker groups from the Zone-H archive: full text search for some general keywords reveals the archive holds sites about hacking, hacked sites and even sites about hacktivism. If we put those results into relation to the size of the archive (7 Million pages), the prevalence of potentially relevant content is less than a tenth of a precent. (0.002366%) The comparison of pages and sites distorts this ratio of relevant content but still fits within the ratio bands I observed in my own work. General approaches like this are of course only useful to survey the field and to prove the general existence of potentially relevant content. Not all hacked sites will feature the word “hacked” and very few sites defaced by hacktivists will contain words like “hacktivism” or “defacement”.

Cross-referencing can be a useful method to overcome limitations of general keyword searches. In this case, cross-referencing uses the lack of standardization that complicates the keyword search to achieve more precise results. Cross-referencing requires a reliable source of information and is also reliant on time-dependent vocabulary. The following table shows the selected results of a cross-reference between the top 50 defacers on Zone-H and the respective search results on the Geocities archive.

Hacktivism: Sample Findings

Information on Hacktivism

But what did hacktivism on Geocities look like? I have categorized my findings like this: Pages talking about hacktivism – definitions, history

Hacktivism: Sample Findings

List of hacking tools

Pages instructing users how to hack – depending on user’s motivation

Hacktivism: Sample Findings

Defaced Pages

Pages hacked in the context of hacktivism. From this we can deduct the following: Hacking and hacktivism as forms of antagonistic writing of electronic text have left their marks on the early web. Fragments of this have survived even through a double filter of Geocities and the mirror page’s terms and conditions. The vast majority of this content must be seen as lost. This is due to removals, restoration of the original site and partially due the size of the archive.

Hacktivism: Sample Findings

Defaced Pages

Kevin David Mitnick (born August 6, 1963) is an American computer security consultant, author, and convicted hacker, best known for his high-profile 1995 arrest and five years later in prison for various computer and communications-related crimes.Mitnick's pursuit, arrest, trial, and sentence along with the associated journalism, books, and films were all controversial.He now runs the security firm Mitnick Security Consulting, LLC. He is also the Chief Hacking Officer of the security awareness training company KnowBe4, as well as an active advisory board member at Zimperium, a firm that develops a mobile intrusion prevention system.

Generally, when looking at the possibilities of using archived web content for research on antagonistic writing, which includes hacking or hacktivism, it has to be considered that we are searching for ephemeral content which may not have been included in an archival sweep. Still this brief investigation into hacktivism on the early web has shown that people did take to the digital streets of geocities, that they struggled to overwrite text and replace it with their message. It has also shown a lineage of hacker pseudonyms that can be found outside the archive as well.

Where to?

For my last slide, I want to go back to this birds eye view of the archive. Somewhere in there are histories of antagonistic writing that can be uncovered trough textual scholarship and forensics. This means that cross referencing is only the first step to find content, tools like frequency analysis come to mind for more in-depth study. This is part of what I am doing for my dissertation.

Geocities provides a valuable archive, because it covers a wide range of topics, but within defined temporal limitations. Today, defacing of private web sites is less common, making collections like Geocities the more valuable. Using early web archives in this way can help to reconstruct histories of hacktivism, it can show how users engaged with the platform and it can highlight issues that occur in the transition between the live and the archived web. Thank you.



Espenschied, Dragan. 2012. ‘Birdseye View on Www.Geocities.Com’. One Terabyte of Kilobyte Age (blog). 10 June 2012. http://blog.geocities.institute/archives/3297.

Right, Down, Page DownNext slide
Left, Up, Page UpPrevious slide
GGo to slide number
POpen presenter console
HToggle this help