A Distributed Denial of Service Attack Isn’t an Act of Civil Disobedience

A demonstrator wearing a Guy Fawkes mask types on his mobile phone as he joins members of the Internet group known as Anonymous in a San Francisco BART station on Aug. 15, 2011. Photograph by David Paul Morris/Bloomberg

Two years ago, I sat in an online chat room with a group of people who claimed to be part of the hacktivist group Anonymous. I left the chat window open after we were done talking and later found a transcript of them taking down, among other sites, then-Senator Joe Lieberman’s (I-Conn.) website in retaliation for the senator’s rhetoric about Julian Assange.

I had wanted first to understand what their methods were, but I returned the next day to ask what they hoped to achieve. They claimed they were protesters, like a crowd in a public square. How could that be, I asked, if I couldn’t see who they were? The answer came from a pseudonym.

Unknowable: Yes. Unsatisfiable? No. Unaccountable? Not in the sense you might think. We aren’t ransoming and demanding satisfaction. We are protesting what we view as illegitimate actions against ideals that are supposed to be protected.

This bothered me at the time. Protest is a moral action precisely because it contains risk—of censure, seizure of assets, physical harm, imprisonment. This was true when Sophocles wrote Antigone, and it’s true today. We are inspired when people risk these things for their ideals, in Egypt or Syria, precisely because the danger they accept gives their presence weight. But Anonymous was unknowable, and therefore unaccountable. If you are both anonymous and not present, what are you risking?

In the meantime, Anonymous members in several countries have been discovered and arrested, and this week a petition showed up on the White House’s website, asking to make distributed denial of service attacks—Anonymous’s signature move—a legal form of protest. It begins:

Distributed denial-of-service (DDoS) is not any form of hacking in any way.

This is correct. And then:

It is the equivalent of repeatedly hitting the refresh button on a webpage.

Also correct. When you opened this article, you sent a request to the computers that host Bloomberg Businessweek’s website. If enough requests came from enough different computers at the same time, this site would either slow or crash, making it unreadable. This is a DDoS attack. Until several years ago, these were performed by “botnets,” chains of infected personal computers directed remotely, usually by someone sitting in Russia. DDoS attacks were used for blackmail (pay up or your site stays crashed) and, in at least two cases, as acts of aggression among states (again, most likely originating in Russia). This is not hacking into a computer system, but merely polluting it from the beyond.

DDoS attacks, then, originated as exactly what the Anonymous member told me they weren’t: blackmail. They were useful to—probably—Russia because it’s hard to pin down, with any internationally useful certainty, where a DDoS attack comes from.

It is, in that way, no different than any “occupy” protest. Instead of a group of people standing outside a building to occupy the area, they are having their computer occupy a website to slow (or deny) service of that particular website for a short time.

Not at all correct. An Occupy protest puts real people in real places in defiance of the law. They can be removed and harassed. They put themselves at risk. An anonymous DDoS attack, if it’s carried out with any skill, risks very little. This is why it’s also such an attractive tool for countries that want plausible deniability for their online aggression. And further, from the petition:

As part of this petition, those who have been jailed for DDoS should be immediately released and have anything regarding a DDoS, that is on their “records,” cleared.

Two years ago, whoever represented Anonymous to me didn’t think you had to be known to protest virtually. Now you don’t, evidently, even have to be at risk. The petition wants a DDoS attack to be both anonymous and unaccountable. But to what end? How is this inspiring? Who can be rallied to this pale flag, which risks nothing?

The White House is not likely to respond. The petition needs 25,000 signatures to merit even one of the administration’s tepid responses; so far it has just over 2,000. For that, however, we have Henry David Thoreau, author of the text now known as Civil Disobedience. Thoreau wrote that “Under a government which imprisons any unjustly, the true place for a just man is also a prison.” Prison is the place you make your statement from. Prison, your willingness to accept punishment for your voice, is the source of your moral authority. If you want change, get on a bridge. Or disclose your names, take your lumps, get arrested, and make your case in court. Martin Luther King did not write a “Letter from a Birmingham Undisclosed Server.” He wrote it from a jail.

    Before it's here, it's on the Bloomberg Terminal.