Tuesday, January 22, 2013

Anonymous Petition to get DDoS Reclassified as Lawful Protest

Recently, the hacker collective/activist group/thing known as Anonymous launched a petition on the White House's We The People website to have distributed denial-of-service (DDoS) reclassified as a lawful form of protest. The petition analogizes between DDoS and the occupy movement, arguing that
Instead of a group of people standing outside a building to occupy the area, they are having their computer occupy a website to slow (or deny) service of that particular website for a short time.
Moreover, the petition calls for anyone who has been jailed for a DDoS to be immediately released and have their "record" cleared.

While interesting and thought-provoking, my gut reaction is that the analogy the petition calls for is fundamentally untenable. There are simply too many differences between the contexts for the comparison to work, and it relies on an unsophisticated understanding of the Internet in order to succeed.

To say that one is "occupying" a website by visiting it and/or refreshing the page from a browser is to ignore the actual ways in which the Internet operates. There was a time when legal/political minds looked at the Internet like a space (as it's often conceived in fiction or theory), but such views have long since been replaced by more literal appreciations of the Internet as a series of connections between users and data. As a result, the notion that one is "occupying" a web page by visiting it is not really accurate since you don't go anywhere on the Internet so much as you request and are sent data from elsewhere.

However, even if such a spatial conception of the Internet succeeded, there are (good) reasons why the comparison is still unjustifiable. Forgive me if I reveal my lack of technological sophistication with this explanation, but as I understand it DDoS attacks/protests/whatever-you-want-to-call-them are regularly orchestrated using various technological multiplication methods whereby targeted servers are hit with more requests than there are participating individuals. This can happen if those involved use rented/owned servers, create botnets, use something called DC++, or whatever, the point is that the usual approach is to create more requests to a server than there are actual people making the requests. This is important because in order for DDoS to succeed it has to overwhelm the receiving server with requests such that it can't fulfill them all and ends up shutting down/failing. In order to overcome the kinds of servers typically employed by the types of sophisticated websites often targeted (i.e. those of VISA, Amazon, or PayPal), DDoS necessarily requires many more requests than there are people involved.

To use the physical occupation metaphor, in order to bring the targeted space (website) to a halt there need to be an unbelievably large number of people (server requests) involved, to the point where access/movement becomes impossible. Imagine Grand Central Terminal in New York: in order for an occupy movement to shut that place down you'd need a huge number of protesters to fill the entire hall so that no one could effectively use the space. In the context of the Internet, the kinds of halls being "occupied" are exponentially larger and so they require many more "people." So many people that it's -- practically speaking -- impossible to succeed without using technology to simulate the existence of many more people than are actually involved. Although you could theoretically go out and hire a huge number of people to occupy a space with you, limiting factors like money, timing, and peoples' availability would necessarily limit your ability to essentially buy an occupy movement.

You'd need a whole lot of people to bring this place to a halt

These differences/reasons why the metaphor isn't realistic aside, the comparison is interesting from an intellectual standpoint. For one thing I like the comparison between visiting a web page and visiting a physical space, as using the Internet does feel like travelling to different (notably privately-owned) places from the comfort of your computer screen. But I just don't see it flying in a legal or political sense since the idea of the Internet as a place is kind of antiquated, and again it ignores the reality of how the Internet works. In terms of redefining DDoS as a form of protest, while I like the notion in terms of how it re-situates power back into the hands of Internet users I can also see how the technological methods described above make it potentially dangerous: DDoS can/must be carried out by a small number of people in such a way that it mimics the existence of a large number of people. This necessarily limits our ability to look at it as a form of politicized speech, and so while I believe that DDoS probably is a form of protest in its most widely publicized instances I don't think we can effectively redefine it as such.

All that said, the idea is interesting in how it reflects back on the actual occupy movement on the theoretical level. When we "visit" a website we don't actually travel to it so much as make a request for it to give us its information, and so how does this exchange compare to physically occupying a privately-owned space? Does going to Grand Central Terminal constitute more than just a physical act but also a request for information from that place? Given the assumptions underlying most advertising and the related fact that we live in a capitalist society, I'm inclined to believe that there is some truth to the comparison: when we go somewhere like Grand Central Terminal we are inundated with information about the services offered there and by its advertisers, which is not unlike what happens when you the place's website. I say this all to draw out the fact that Anonymous' comparison, while perhaps not effective or practical for the aforementioned reasons, may in fact be illustrative in changing our perceptions about how we interact with physical spaces. While "visiting" a website might not be analogous to occupying a physical space, there's more going on when you go to privately owned locations than merely being in that place. DDoS might not be more appropriately conceived of as a form of protest, but maybe the physical occupation of space needs to be reconceptualized in order to realize the kinds of relationships thereby established.

What say you, Internet?


  1. Brilliant points. I concur.

    A couple half-formed thoughts:

    Sort of an extension of what you're saying, but an additional problem with some/many DDoS attacks is that they rely on unlawfully obtained botnets which have been conscripted through the use of various forms of malware - thus recruiting the bandwidth/processors of large numbers of unwilling participants into the attack, which in itself would be prohibited by law. So, even if the DDoS were to be granted retroactive legitimate status, I'm not sure that the people who have been prosecuted would be exempt from criminal sanctions.

    But, there is perhaps something to be said about tools like the the Low Orbit Ion Cannon which was used, inter alia, during Operation Avenge Assange. If I recall correctly, there were large numbers of willing participants who were consciously signing over their bandwidth/processor speed to Anonymous for this purpose. I'd have to look up the numbers, but I have a vague recollection it was well into the tens of thousands. If true, that number of people would be able to cause a significant economic disruption to a company spread out at many physical locations.

    Although I don't think the physical occupation analogy rings true since there are key distinctions between the two forms of protest, I'm not sure that we should necessarily limit the use of DDoS. Perhaps tightly regulating its use would preserve free speech and acknowledge the technological realities of our time.

  2. http://www.youtube.com/watch?v=iDbyYGrswtg