Actually they could, assuming that "they" exist as a single coherent entity that sets policy etc. Even without exposing their identities. All they would need to

Actually they could, assuming that "they" exist as a single coherent entity that sets policy etc. Even without exposing their identities. All they would need to do is set up a pgp key which all official anonymous press releases would need to be signed with, end of story. That they don't do this is evidence to me that they're perfectly happy to have random acts of digital crime attributed to them.