Anonymous Says DDoS Attacks Like Free Speech
By Mathew J. Schwartz
InformationWeek
A petition filed this week with the White House seeks to decriminalize distributed denial-of-service (DDoS) attacks, making them a legal form of protesting. In other words, it would extend the First Amendment's protections to protect people's right to disrupt websites.
"Distributed denial-of-service (DDoS), is not any form of hacking in any way," claims the "We The People" petition request. "It is the equivalent of repeatedly hitting the refresh button on a webpage. It is, in that way, no different than any 'occupy' protest."
According to the petition, "instead of a group of people standing outside a building to occupy the area, they are having their computer occupy a website to slow (or deny) service of that particular website for a short time." The petition also calls for anyone jailed for a DDoS-related crime to be immediately released, and the related charges to be expunged from people's arrest records.
[ For the latest on the ongoing John McAfee saga, see McAfee Strikes Back: Spyware Sting Targets Belize Government. ]
While the identity of the person who created the petition is partially anonymized -- it's ascribed to "Dylan K" of Eagle, Wis. -- members of the Anonymous collective are clearly backing the petition. "We Need Your Signature! Make, distributed denial-of-service (DDoS), a legal form of protesting," read a Friday YourAnonNews Twitter post.
For the White House to respond to the petition, the request needs to garner 25,000 signatures by Feb. 6. By Friday morning, however, the petition had received only about 2,000 signatures.
The First Amendment enshrines both the right to freedom of speech and "the right of the people peaceably to assemble, and to petition the Government for a redress of grievances." The DDoS petition, then, implies that current laws should be updated to protect people's right to disrupt websites. "With the advance in internet techonology (sic), comes new grounds for protesting," reads the petition.
The request highlights the fact that that there are currently different rules governing website shutdowns vs. interrupting businesses in the real world. For example, in many Western countries, protestors can choke the entrance to a business -- or even city streets -- for a few hours, and it's legal. "And the digital equivalent of that, a DDoS attack that takes a website offline for a few hours, is illegal," said Mandiant VP Grady Summers at last year's RSA conference in San Francisco. The prosecutions of numerous people involved in DDoS attacks -- or in some readings, protests -- further makes that clear.
If the petition gathers sufficient signatures, and the White House responds, would DDoS fans have any chance of seeing website disruptions get classified as a form of protest? Most likely Congress would need to pass a law that protects DDoS attacks as a form of free speech. Given that federal legislators can't even agree on a bill to protect people's privacy rights online, good luck scheduling a DDoS discussion.
In the meantime, law enforcement officials will no doubt continue to prosecute DDoS attacks. But FBI officials have said they're not unaware of concerns over people's right to protest online, and emphasized they're required by law to protect people's civil liberties, including online.
"That is a huge concern for us ... and there are a number of challenges associated with this," said Eric Strom, unit chief for the Cyber Initiative and Resource Fusion Unit Cyber Division at the FBI, at last year's RSA conference. One of the chief challenges, he said, is that many people who launch DDoS attacks are minors.
How does the bureau gauge when online speech or protests cross a legal line? "If they're just complaining about something, or an issue, they have every right to do that and certainly we don't have a problem with that," he said. "It's when they take that step across the line, to make a point ... [and] they hack into a system, or go after say someone in law enforcement and their families … obviously we're going to take a big interest."
Hack.me is a free platform to build, host and share simple and complex vulnerable Web applications. Find out more about it in this free Black Hat webcast on Jan. 17, with Armando Romeo, founder of eLearnSecurity.
Federal agencies must eliminate 800 data centers over the next five years. Find how they plan to do it in the new all-digital issue of InformationWeek Government. Download it now (registration required).
| To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy. |
InformationWeek Reports
Cloud Implementer's Checklist
Once your agency has completed the business case for a private cloud, how do you actually move ahead with your data center transformation? Our report provides a practical set of steps to get you there, including a "to do" list that will be helpful to anyone on your IT team who's involved in the project. By the time you're done, your data center should be home to a more flexible, on-demand IT services.
Cloud Compliance in Government
Compute clouds created for government data centers must adhere to a range of specifications designed to support data and system security, privacy, and governance. FISMA, HIPAA, SOX, and SAS 70 are just some of the requirements that have to be taken into account as federal IT pros deploy a shared-services cloud model. In this report, we identify the key specs that need to be factored into any federal cloud architecture.
Government Cloud Platform Strategy
This report analyzes the key IT infrastructure considerations that must be taken into account for implementing cloud services in federal data centers: software/hardware environment, multi-tenancy, security, virtualization, and management tools. We also explain the key important role that APIs play in supporting hybrid scenarios that tap into public cloud services.
The Business Case for Government Clouds
This report assesses usage scenarios, barriers, and other variables that factor into the decision of whether and how to implement cloud computing in federal environments.



Subscribe to RSS