For and against: DDoS attacks as a legitimate form of protest?

By | December 15, 2010, 4:38am PST

Summary: For and against reasons for distributed or non-distributed denial-of-service attacks being a legitimate form of protest.

Many students and I would argue that yes, distributed or non-distributed denial-of-service attacks are a legitimate form of protest.

The British media has been inundated with news of student protests erupting after the government voted to treble tuition fees for new students starting in the 2012 academic year. Though all media from around the world have focused also on the Wikileaks scandal, which continues to put pressure on governments and their efforts around the world.

The two can overlap. The problem is that most students and political activists of my age are unaware of this mechanism of airing our disdain.

A distributed denial-of-service attack is when hundreds or thousands of people at one time use an application to target their own broadband bandwidth to pummel a certain server, often a web server hosting a website, to overload it with information causing it to shut down.

In practice, you download a small application, follow the instructions made available by means of viral marketing spreading and you ping; you ping until your heart’s content.

I am neither condoning nor supporting the use of denial-of-service attacks, but one has to wonder whether the evolution and the speed of the Web has placed certain priorities higher than others when resorting to means of protest.

In a recent poll undertaken by the Between the Lines bloggers, though results are still coming in and polls are yet to change, at the time of publication most do not believe denial-of-service attacks are a legitimate form of protest. I think the readers are wrong.

So let’s just run through some basic pro’s and con’s to see if you can be persuaded otherwise:

Reasons for:

Reasons against:

Whether or not you consider it to be a legitimate form of protest, suited for the twenty-first century, it still makes one hell of a noise.

Do you consider DDoS’ing a legitimate form of protest?

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Zack Whittaker, a criminologist who studied at the University of Kent, Canterbury, is a journalist, writer and broadcaster.

Disclosure

Zack Whittaker

I worked briefly with Microsoft UK in 2006 but no longer have any connection with the company. Regardless, I remain impartial and unbiased in my views.

I don't hold any stock or shares, investments or industrial secrets in any company, but have signed confidentiality agreements with a number of UK and U.S. organisations, whose names I am not at liberty to disclose.

I was involved with Kent Union, the University of Kent's student union, undertaking voluntary, non-salaried, elected positions between early 2009 and mid-2010.

No other company, body, government department, non-governmental organisation or third sector organisation employs me or pays me a salary in any capacity whatsoever.

As a freelance journalist, whenever expenses are given and taken by a company that is not CBS Interactive, these will be disclosed in each relevant post to ensure transparency.

I currently work with a UK law enforcement unit, but this is an entirely separate position which bears no connection to other work.

(Updated: 23rd October 2011)

Biography

Zack Whittaker

Zack Whittaker, criminologist who studied at the University of Kent, UK, is a journalist, writer and broadcaster.

After studying criminology at university, though still in his early-20's, he has already had a series unconventional work and voluntary positions. He has worked with researchers studying neurological illnesses like Tourette's syndrome (which he suffers from), has given lectures on the nature of disabilities in the public community, and occasionally ends up speaking on television and radio discussing the events of the day.

He first had academic work published at the age of 22, then still an undergraduate, and has been cited by a wide range of publications: from the Huffington Post, Business Insider, AllThingsDigital, The Atlantic Wire and CBS News.

203
Comments

Join the conversation!

Just In

RE: For and against: DDoS attacks as a legitimate form of protest?
MDKKnD 8th Jan 2011
The most powerful form of affecting government misconduct is leaks.

If this is a war on freedom then Whistleblowers are the heroic people providing invaluable intel. With DDOS attacks being the equivalent to artillery and physical protests equivalent to ground troops.

Wikileaks has done far more to alter the playing field and expose information about corrupt people in positions of power, than any media organisation (although I still give big ups to the New York Times for the Pentagon Papers).
Wikileaks has altered the game and exposed the previously hushed attack on freedom and basic rights.
Check out http://www.youtube.com/watch?v=oP7Km_waRRI to understand the effects.
0 Votes
+ -
DDoS attacks are criminal.
Stan57 15th Dec 2010
DDoS attacks are criminal. The criminals are stealing other peoples resources for as you say " To Protest". So how can you even play with the idea it might be Legit. The collage kids from the 60s had far more balls then your age group they protested in public,they were even shot and killed for protesting without stealing from other to protest.
0 Votes
+ -
I agree 100%
Ron Bergundy 15th Dec 2010
if DDos attacks can be called a protest then burning cars and buildings can be called "a protest" to. now these students cry "you can't arrest me - i broke that innocent shop owners windows and stole the TVs as a form of protest - its allowed!!"
0 Votes
+ -
Contributr
@cyberspammer2 As a thought - would you agree that a DDoS attack (and its consequences - loss of business, revenue for a short amount of time, negative press coverage etc.) is better than seeing physical violence on the streets with burning cars and police officers being attacked?
0 Votes
+ -
Except nothing is damaged
mdemuth 15th Dec 2010
@cyberspammer2
or stolen. DDoS is more similar to a sit-in. You deny use of a specific space for a limited period of time.

The problem, however, is similar to real world protests; Those who are violent or have criminal intent will travel in the same circles, looking for opportunity.
@cyberspammer2 You are so far off base here, its just sad. A DDOS does not break anything, and it doesn't steal anything. Your metaphor is ridiculously inadequate. A DDOS does in fact block an entrance by using it excessively. Mass dialing a service center would be a clear case of a 1-to-1 comparison. A sit-in or a picketing is closer to a correct metaphor. If you use that (more correct) metaphor, it is easy to find dozens of precedence where such an action is considered legitimate protest. And I will point out as well that every "legitimate protest" had opponent calling it illegal and destructive, so I guess any ddos is in good company.
0 Votes
+ -
RE: For and against: DDoS attacks as a legitimate form of protest?
nickdangerthirdi@... Updated - 15th Dec 2010
@cyberspammer2 once again its us against them, only this time the author is just as bad... "Many students and I would argue that yes, distributed or non-distributed denial-of-service attacks are a legitimate form of protest." THEN he goes on to say "I am neither condoning nor supporting the use of denial-of-service attacks," but you are condoning it, you condoned it in the first sentence of the story. and sure there isnt any "physical damage" But what about those people who need to use those sites to manage their accounts, pay their bills, its not really even the company they are hurting, its the people who use those sites. But I guess making your point is more important than anyone else who might be trying to take care of their business. as for the guy who makes it sound akin to a sit in, why not physically go those places and stage a REAL sit in, that way the rest of us who dont agree with you can still do our business. DDoS attacks are not legitimate form of protest, they are tool for cowardly people who wont even face the people they are attacking, at least in a real protest you know who it is thats protesting you.....
@cyberspammer2 DDoS attacks do not damage their IT infrastructure and the attacks are not directed at "innocent" businesses, so your comparison is misguided at best.
@zwhittaker @mdemuth @TechrepVrijPodium @mrweldo

How can all of you "pro" DDos lamers be so stupid. Here's an example. You (You pro hippies) have a website that I don't agree with. I decide I hate you and DDos it. I "sit in" on it for about a month. Changing IP's and locations that my attack is coming from so as soon as your host knows where the hole is and blocks it. I've already switched IP's and locations and am attacking from somewhere else. After a while your host is fed up with blocking holes for just your website while others on the shared server are also experiencing outages because of "just your website which I am "protesting"". They tell you to take your website and business elsewhere. And many hosting companies won't refund you if termination was due to something like this. So, think about it. It's not like regular protesting. It's not like a sit in. These both don't attack people. Get the facts. DDos attacks are hurtful to both the host and website owner. If you don't think they are maybe you should read up on it. Because I don't think any of you really grasp the concept.

(Oh, and argue all you want with me. I don't come back and read or defend because arguing with people with less common sense then 2 year old's is pointless because you will all never get it.)
  • Flagged
@cyberspammer2 and others -- DDoS is not always without real damage, and always has a real cost. It usually hurts other customers as much as it hurts the business, since they waste time trying to get in. Case in point, how about the small businesses who use paypal to handle their sales.
The real damage can come if the system is truly overloaded and crashes, causing database corruption and loss of real data. How would you feel if you had placed an order online and it was lost due to a 'protest'.
While I can see the parallels to picketing, I also agree that neither is without real consequence, and as in any 'civil disobedience' type of activity, the benefits and costs must be considered.
0 Votes
+ -
@cyberspammer2 Very nicely put!
0 Votes
+ -
@cyberspammer2 Very nicely put!
@cyberspammer2 If you deny me the right to use my Web site to speak and to listen to the speech of others, then you have denied me my First Amendment right to freedom of speech. Your right to protest, i.e, your freedom of speech, ends where it infinges my freedom of speech. DDOS is not defensible as a form of protest, which in its essence is a right conveyed by the Constitution's First Amendment.
legally speaking its criminal. flooding high profile sites gets eyes put directly on u. so it is pretty stupid. keeping it at the kiddy level of attacking each other is fine as that wont get eyes on u.
another screw-up in the article is calling script kiddies students. last I checked 12 year olds werent attending Choate and Dartmouth. the author has a huge disconnect in understanding behind the scenes
@Stan57 It could be considered the same as protesters gathering around a tree, or blocking access to a building. Yes both of those could be classified as illegal.
But now days the whole world could protest at once should they choose to.
It is a delaying action, Like Union workers protesting. Or students taking over a building (Berkley Campus)
It should be considered on the same level as that. A misdemeanor, if enough people do it, then they may have to look at the item being protested as being in question.
45,000,000 Say don't do this... They should listen...
0 Votes
+ -
@agohige
"45,000,000 Say don't do this... They should listen..."

The problem is that, in the case of a DDoS, you can end up getting a misrepresentation of the number who actually care. Many people who take part in a DDoS, might just be doing so for the sake of being part of it. While I do recognize that this can happen with a sit-in, I would also say that it is less of a problem. A sit-in requires a lot of your own time and inconvenience (making random 'I wanna be part of something' people less likely), a script running on a computer while you go about you life does not. The result is that 5,000 people may have taken part in a DDoS, but only 500 or 1,000 actually cared - there would really be no way to tell exactly.

When something is as simple as starting an application and walking away, the dedication that protests are supposed to highlight is lost.
@agohige The tree has no right to property or to the freedom of speech that are denied in attacks on Web sites. If you take away my phone, my Internet site, my Facebook or whatever, you are limiting my ability to speak out.
@Stan57

Yeah if you spam from your computer only, it shouln't be illegal, just like it is not illegal to catch a computer virus. If you operate a network of bots, then yes, it should be illegal.

This should solve the problem of someone innocent being prosecuted because he had a virus on his computer.
0 Votes
+ -
Contributr
@aaaa123354 This is kinda what I meant. I'm not advocating either of them - as I mentioned in the article. I did mean 'to DDoS' as the non-botnet solution, however. Sorry if I didn't make that all that clear.
0 Votes
+ -
@aaaa123354 @Stan57

Stan, if you actually catch a virus that spams other internet users you are actually breaking the law. If you did not take precautions and if you allowed someone to use your IP you are criminally liable. You must and you will be prosecuted if you are caught. The reason is that apart from SPAM ads your "virus" or bot may defraud people or distribute child pornography, breach copyright etc ! It is the same as if you have a lodger at home, he uses the place for drug trafficking. You should know what happens in your home, same way you should know what happens in your computer
0 Votes
+ -
Just figure this one.....
dougogd@... 15th Dec 2010
@Strathclyde-Forensics You just stated if you didn't take precautions....Now I throw this one at you I take precautions but most security companies Ie firewall antivirus spyware programs all use vender list to assign rights to venders regardless of what the program does. It can be a virus or a bot it does not matter the program will let it run because it is signed. So now you have just stated that if you are using these companies programs that are allowing this behavior that they are breaking the law. Now to give you an example I had a virus that was installed on my computer in the past that connected to the computer and turned my computer into a bot for a day. I found out the the signer was microsoft. I also found a signing program on the microsoft download site that signed programs and drivers. I have found a few other viruses signed by verisign and a few others. Now these signing companies are also breaking the law by not stoping the use of their signing programs that are being used by some of the smarter virus creaters..
0 Votes
+ -
Are you kidding?
mrweldo Updated - 15th Dec 2010
@Stan57 I was one of those college students in he 60s (that is college with a E unless you were meaning that we stuck together like a collage). One of the major criteria for choosing the site was so that we could disrupt normal business; that is why they worked. The big difference with DDoS attacks is that we do not give the authorities a clean shot at our heads. [sarcasm]Sorry if that inconveniences you.[sarcasm/]
0 Votes
+ -
@mrweldo OK, so tell me this then, what exactly are you protesting with a DDoS attack? how do you think it changes anything if no one can see you? How are they supposed to know how many people disagree with them? THATS why protests worked in the 60's because people could SEE how many people didnt agree with you, a DDoS attack is what cowards use because they arent truly protesting, also, 1 person with the right resources could start a DDoS, so now we can have 1 person protest and screw up everything for everyone else.... its a cowards tool... not a protesters tool...
0 Votes
+ -
You mean "An E"
mike21b@... 15th Dec 2010
@mrweldo - I think some students were stuck together like a collage in Tiananmen Square back in 1989 - after the tanks rolled through.
@Stan57 I agree with you. I think that DDoS attacks are a form of vandalism. There are normally restrictions in place for street protests (normally), and those restrictions allow the citizen to voice their opinion, show support for their cause, and allow a business to hear those protests without causing injury to the businesses (injury = loss of business or loss of money, or even physical injury). DDoS attacks are intended to cause injury to a network, not necessarily a server because most enterprise networks are running gateway firewalls which block traffic in the case of DDoS attacks. So, depending on the network that the target server is on, you could be bringing down anything from just the company's communication, to a wide variety of critical communications that don't belong to that particular company. (all depending on how the network is set up and where the server is hosted). To deny service to a legitimate company is criminal no matter what they have done to you. (disclaimer: I can only speak to the United States as I do not know the laws of Britain).
As long as its non violent leave them alone. You are right the criminals are stealing other peoples resources and making huge profits while humanity as a whole suffers, oh no I'm sorry you mean the little guy trying to make it in a world designed by criminals who use civil law to make something like protesting illegal unless yo uhave a permit? LOL. A permit to protest, Spare me please. This is the very kind of garbage police states are built on. I said it before and ill say it again, the country is the people not the government. If and when governments represent the people and not a small minority with the money then they are just and deserve respect. When governments decide to disregard the needs of the many for the needs of the few then they do not deserve respect and people have a right without asking permission like a child, to protest these things in a peaceful manner.

The truth is the government is going to do whatever it wants anyway and you want to cut off any and all criticism of their shennanigans too? Even when its non-violent. Thats just too much. YOu want to let them do whatever they want and remove all forms of criticism and protest because they might inconvenience you or you pathetic existence on the plantation. I guess you want your steak huh?
@skoob360
I don't want them to use my computer to do it,i don't care if its non violent. Get your ass out on the street and protest thats non violent.
0 Votes
+ -
as you suggest (In practice, you download a small application, follow the instructions made available by means of viral marketing spreading) but are run from botnets made up of thousands of compromised PCs receiving direction from 1 person. Most people don't even know their PCs are being used for the attack, all they know is their PC seems to be running slow. To say that DDOS is a legitimate form of protest would be like a headline claiming that "THOUSANDS GATHER AT PENN STATION FOR PROTEST" when what actually happened was a small group blocks all exits at rush hour and traps everyone inside as a protest. The "THOUSANDS" were unwilling participants.
@Scubajrr
Good point, it's like someone adding your name to a petition you know nothing about regarding an issue you have no interest in.
@AndyPagin I don't understand this comparison. How do you figure it applies?
@AndyPagin Most of them aren't even about petitioning... Just, "You glined me from this IRC network, I'm gonna DoS one of the client servers" or "This guy said something mean about me on his website" or "I'm going to extort money out of this business"
exactly. this author is pretty lost on this subject and should stop writing about it. and for anyone that downloads the program to allow their pc to be used in a botnet. pretty brain dead as the traffic coming from the program is traceable by your isp. so terminations and arrests will be coming. sucks to be thrown off your cable providers network then off your dsl provider leaving u with dial up. no more facebook for u wah
0 Votes
+ -
I agree, DDoS are not virally organized.
docbillnet 15th Dec 2010
@Scubajrr

I have yet to see a DDoS attack hit the news that was virally organized as described. I would say a virally organized protest should have the same legality as a protest of people lined up in front of a store, or such. The problem is as stated, most DDoS are done with bot programs distributed as trogan horses or viruses. As such those DDoS attacks should be illegal. Just as it would be illegal to hold hostage people on the street to add to a picket line.
@Scubajrr good point!
0 Votes
+ -
No, they are not legitimate.
Hallowed are the Ori 15th Dec 2010
Well, unless you're looking to prove you're a criminal.
..., disconnecting a broadcaster's antenna, uprooting somebody's mailbox, drowning out somebody's face-to-face conversation, etc. Consider that a (naval) blockade has traditionally been considered an act of war. Shutting down a business's web site is not a protest but an act of commercial violence. A legitimate protest would be a boycott of the business. Just because it seems to give the "little guy" (David) a powerful weapon against the "big guy" (Goliath) doesn't make it legitimate.
@kellycarter It isn't "cutting" a phone line. Its calling someone and not hanging up (old PSTN lines only) where you couldn't make any outgoing calls until it timed out or the other person hung up. Annoying? yes... Criminal? no..
This reminds me of an action I was involved in last year. Our (completely legal) advocacy organization was upset about a law that was about to pass in the state legislature. We got in touch with as many of our members and supporters as possible and asked them to call their representative and express their displeasure about this potential law. Well, it turned out many, many people were upset about this law. So many people called in that a few hours later we heard back from several members of the legislature that so many phone calls were being made that it had incapacitated their phone system. There were a limited number of lines at the capital, and our supporters were tying up all of them. Please, they asked, could we please stop so that they could resume normal business? No, we said. Of course not. People have a right to express their opinion to their representatives. By the end of the day we had filled the voicemail of every legislator in the state and had made regular business near impossible. Illegal? Not one bit. Stopped business of the whole state legislature? Absolutely. Legitimate? Well, it worked, and we avoided a truly terrible law passing.

In retrospect, what we did was pretty much a low tech denial of service attack, even if we hadn't exactly planned it that way at the beginning. However, did we tell some people to call in multiple times? When we realized we could shut down 1/3 of the state government for a day, you bet we did.
@TechrepVrijPodium

Crank-calling repeatedly is criminal; next call the business makes is to the telco; i, the switch tech, get told law enforcement is involved and place a trap and trace on the line, then the cops get a print out and you get a visit from the po-po (police). Don't worry though, I'm sure they will find something to charge you with...

Hey Zack, last I heard Ping o death was dead, in fact most big sites, like Microsft won't even answer a ping... fyi. Most firewalls turn off reply to ping when they are enabled... Same goes for syn floods

At any rate DoS still innappropriate; calling you government rep and voicing your opinon with all your supporters would be a good start, the legally protesting could get you some press coverage.
@kellycarter
"A legitimate protest would be a boycott of the business."

A fair number of DoS attacks are the result of not being allowed to use a service to begin with (like being kicked out of a private web forum or similar) , so a boycott might not satisfy the person/people in question.
0 Votes
+ -
Work of cowards
cwallen19803@... 15th Dec 2010
DDoS attacks are the work of anonymous cowards, aka terrorists. "I can f you up and you can't do anything about it" bullies.

This is just another article by Zack revealing that he doesn't have a clue.
he is quite clueless... however calling 12 year olds terrorists is a bit extreme. botnet is controlled by kiddies mostly. luv me some irc son
I can understand (kind of) your viewpoint when it comes to the brick and mortar world where you have the option of showing up and protesting in person. But... where do you protest an online only business to be seen? It's not like you could get everyone organized to go to the local paypal store... So what's the non-cowardly option?
0 Votes
+ -
re: Work of cowards
none none 16th Dec 2010
@cwallen19803@...

DDoS attacks are the work of anonymous cowards...

You can say the same about the Boston Tea Party protesters. They dressed as Indians to disguise their identities. Would you call them anonymous cowards today? I think not.

Was the Boston Tea Party legal? Absolutely not. Do we consider it a legitimate form of protest? Well, look around.






happy
Is this article serious?? I wonder if the writer hosts a website, i'd like to "protest" it
0 Votes
+ -
What happens if a group of individuals decides to protest by marching onto a freeway(US) aka motorway(UK) and stopping traffic? Is that a legitimate form of protest? What if a lifesaving resource like an ambulance gets stuck in the ensuing traffic jam and the transported patient dies? Is that collateral damage? Is collateral damage .....legitimate - whatever legitimate means. Why is this analogy not accurate and appropriate?
@fhskier FYI, the blocking (or slowing down) of traffic is in fact a legitimate form of protest in most democratic countries. Farmers protested EU policy by driving tractors slowly over the Brussels ringway, Taxi drivers blocked Paris entry roads in protest of new legislation deregulating taxi services, and an example closer to home for most posters here can be found here: http://www.kcra.com/r/24678605/detail.html (none of which caused anyone to die I might add). Your analogy is close to appropriate, but your conclusion that it is criminal and unacceptable isn't.
@fhskier haha from what I've seen, a bunch of them will get mowed down before anyone notices and tries to stop. Not that there's anything wrong with that.
@fhskier I have to agree with you, especially the part about "collateral" damage. I notice that those that disagree ignored that issue.
The most powerful form of affecting government misconduct is leaks.

If this is a war on freedom then Whistleblowers are the heroic people providing invaluable intel. With DDOS attacks being the equivalent to artillery and physical protests equivalent to ground troops.

Wikileaks has done far more to alter the playing field and expose information about corrupt people in positions of power, than any media organisation (although I still give big ups to the New York Times for the Pentagon Papers).
Wikileaks has altered the game and exposed the previously hushed attack on freedom and basic rights.
Check out http://www.youtube.com/watch?v=oP7Km_waRRI to understand the effects.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix