Considering that most DDOS attacks come from zombie bots installed on programs when people Torrent, I'm suprised that there were arrest made based on IPs
Did you read the article? Paypal provided evidence that the DDoS was coming from LOIC, a manually-operated non-botnet tool. Also, it sounds like Paypal's evidence was only used to get search warrants, and evidence found in those searches (like LIOC) would then be used to justify arrests.
The issue is not how to translate it but whether an IP address identifies a person beyond reasonable doubt, especially given Anonymous's ability to defeat FBI/CIA and other military grade networks including those the FBI/CIA employ to protect them.
It really raises question as to whether you can trust something as flimsy as an IP header given the technical sophistication of Anonymous. These people could well be innocent and in fact victims of anonymous directing attention away from itself and towards these innocent victims. When Anonymous can gain control of HB Gary and FBI/CIA assets imagine what they could do to an off the shelf system that hasn't been through the rigorous security protocols that HB Gary, the FBI and CIA follow.
Given the mutability of data on a USB stick I'd also be very interested to see the chain of custody on that data and how it might have been modified. Also, the defense should request access to the source code for the IDS system in question so that it can be examined for bugs and problems that may affect its ability to generate reliable evidence.
These people could well be innocent and in fact victims of anonymous directing attention away from itself and towards these innocent victims.
This is wishful thinking, but there is a sense in which it is true. People running LOIC are typically if not exclusively clueless mooks duped into doing so by people who know better.
For all the mythos around Anonymous "having no leaders", I doubt very strongly that you'll find many examples of people who spontaneously downloaded LOIC and started flinging packets at PayPal. Instead what you'll find is people who say they got the idea from an image posted on 4chan (or elsewhere) or from "some guy" on IRC.
All you have to do is convince someone to willingly join a botnet (or anything else) is that 1) this is a way to relieve their angst and 2) other people are doing it. The affidavit even includes examples of the kind of image instructions that accomplish exactly this. The "orders" spread as would memes, and the originators of those orders put themselves at almost no risk to distribute them, while "innocent" members of the herd get caught.
When Anonymous can gain control of HB Gary and FBI/CIA assets
Indeed: "When..." But AFAICR, Anonymous didn't gain control of either FBI or CIA assets. Hacking a self-described FBI "affiliate" and DDOSing cia.gov are hardly the same thing.
Also, holding up HB Gary Federal as an example of an organisation with "rigorous security protocols" is an amusing claim with no real evidence.
