cyberenviro | eportfolio

gregory donovan's eportfolio (a syndication of cyberenviro.org)

Archive for DDoS

Competing Narratives: Internet Freedom, National Security and Social Reproduction

Evgeny Morozov has an excellent post at Foreign Policy that addresses the competing narratives emerging around WikiLeaks. Namely, WikiLeaks as an internet freedom issue vs WikiLeaks as a national security issue.

Discussing these narratives in the context of the pro-WikiLeaks DDoS attacks “organized” by Anonymous, Morozov touches on the same point I made yesterday:

I don’t think that their attacks are necessarily illegal or immoral . . . I like to think of DDoS as equivalents of sit-ins: both aim at briefly disrupting a service or an institution in order to make a point. As long as we don’t criminalize all sit-ins, I don’t think we should aim at criminalizing all DDoS . . . The danger here is obviously that if the narrative suddenly becomes dominated by national security concerns, we can forget about DDoS as legitimate means of expression dissent — that possibility would be closed, as they would be criminalized. (emphasis added)

Morozov also discusses how the dominance of a national security narrative around this issue could rationalize more state-based surveillance of everyday cyberspatial behavior:

I seriously doubt that U.S. authorities would be able to effectively go after Anonymous, in part because there are too many people involved, they are scattered all over the globe, and attributing cyber-attacks to them would be impossible (and would surely require reading a lot of chat transcripts from IRC). The only other possible policy response at their disposal is to make it easier to trace such attacks in the future — most likely by empowering the likes of NSA/Cyber Command. I would imagine that after the current cyber-attacks on credit card companies — even if they didn’t cause much damage — this would enjoy bipartisan support in the United States. (emphasis added)

Two points worth adding to Morozov’s analysis:

  • It’s not only likely the U.S. will use this event to enact pro-surveillance policies that strengthen the role of the NSA/Cyber Command in everyday internet use, but virtually guaranteed (no pun intended). However, these security initiatives are never achieved through policy alone, social production is always necessary to normalize these policies and socialize a public into compliance (or at least attempt to). Since young people are among the most active internet participants and — let’s face it — will be using the internet much farther into the future than today’s adults, they will be a primary target. “Get ‘em while they’re young” is a common phrase for a reason.
  • While the U.S. government has yet to arrest anyone affiliated with the recent DDoS attacks, the Netherlands’ recent arrest of a 16 year 0ld — for doing little more than encouraging people to ping servers via an IRC chatroom — is a sign of things to come and an example of this social production.  Based on how the U.S. has thus far framed “file-sharing” as “stealing music” and singled out certain youngsters for unjustified and disproportionate punishment, we have a glimpse of what’s around the corner. Watch WikiLeaks/Anonymous (the distinction is almost irrelevant in the public imagination) become the new internet predator, and online civil disobedience the new cyberbullying.

WikiLeaks and InfoYouth

Big government collaborates with big business to deny service to WikiLeaks, everyday people get organized and deny those big businesses the ability to offer services . . . and a 16 year-old Dutch kid gets arrested?

From Bloomberg News:

… a 16- year-old was arrested in the Netherlands in connection with the digital attacks on the MasterCard website and Ebay’s PayPal business. The teenager, whose name wasn’t released, is suspected of being in a larger group of hackers that sympathizes with the work of WikiLeaks, and he will appear before a magistrate in Rotterdam tomorrow …

To recap: a large, loosely affiliated, intentionally disorganized, and geographically dispersed group of people wage distributed denial-of-service (or DDoS) attacks (see Operation Payback) on PayPal, MasterCard, and Visa, because these organizations bowed to government pressure and denied their services to WikiLeaks. A DDoS attack is the informational equivalent of mass non-violent civil resistance and while DDoS may violate terms of use policies or other protocols, it is unclear that participating in them constitutes a crime.

The typical goal of a DDoS attack is to shutdown an internet site or service by coordinating a large and loosely connected group of people to overwhelm the site or service with unusually high web traffic. Thus, at the individual level, people are repeatedly “visiting” and encouraging others to repeatedly “visit” a site until that site becomes overwhelmed and crashes. As Robert Gourley, former cyber-security expert with the Defense Intelligence Agency, states in the same Bloomberg article “At an individual level a person is pushing a button and sending a packet … I don’t know what legal precedents there would be that allows you to take a person to court for doing this.”

Is participating in a DDoS attack wrong? Maybe.

Is participating in a DDoS attack a crime? Unlikely.

Arresting a teen for participating in a DDoS attack? Red Herring.