I saw that the leader connected to IRC without using TOR and they traced their IP address, but the identity of each member was supposed to be unknown to the others. So even if the leader was acting as an informant, how did the other people get caught?
closed as not constructive by Ayrx, Adi, Jeff Ferland♦ May 17 '13 at 6:03
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.
Despite the fact these guys claimed to be 'anonymous', they were not actually anonymous and happily communicated in open environments (even if they were, for the most part, behind proxies etc). They all had handles associated with their identified. As a result, it was possible to slowly build up a profile and identify the suspects. One they correctly identified sabu, they flipped him and convinced him to coerce the others into providing information that would reveal them.
Some key failings as highlighted here as well as a fairly detailed writeup about it all:
reusing "anonymous" usernames and variations on them for many years resulting in "bleeding" of his identity elements (ie. usernames, e-mail addresses, domain registration information) between different, supposedly-unrelated social media and online accounts;
giving out too much personal information about his political/national affiliations/ethnicity;
accidentally logging once or twice into IRC chat channels without first anonymizing through VPN or Tor proxies;
mentioning in a chatroom a domain name he owned, whose whois status—i.e. its domain ownership information—had not always been set to private, and which once listed his real name and address, subsequently preserved on the Internet;
On an Internet that forgets nothing, once a document is made publicly available, even if only briefly, it may be archived in perpetuity. One old clue to even one element of a still-in-use identity can be enough to take down even the most careful hacker.
Another presentation worth viewing which provides evidence used in the trials as excerpts here