7 ms·

>The FBI yesterday reminded the public that "facilitating or conducting a DDoS attack is illegal, punishable by up to 10 years in prison, as well as exposing pa

>The FBI yesterday reminded the public that "facilitating or conducting a DDoS attack is illegal, punishable by up to 10 years in prison, as well as exposing participants to significant civil liability." What exactly is the relevant statute? As the other Ars article on the subject states, it's the digital equivalent of a sit-in.

skymt 16y ago
Wikipedia suggests 18 U.S.C. § 1030, the Computer Fraud and Abuse Act[0]. Here's the relevant part: > Whoever ... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer ... shall be punished as provided in subsection (c) of this section. > As used in this section ... the term “protected computer” means a computer ... which is used in or affecting interstate or foreign commerce or communication... By my (not a lawyer) reading, the only real question is whether being overwhelmed with traffic can be called "damage". [0]: http://www.law.cornell.edu/uscode/18/1030.html http://www.law.cornell.edu/uscode/18/1030.html
InclinedPlane 16y ago
It's silly to pretend that a DDoS attack is the same as a sit-in, such a contention is intellectually and morally bankrupt. Moreover, sit-ins are not legal either. If you choose to attempt to disrupt a place of business and you refuse to leave private property when asked to do so you can be arrested.
- anonymoushn 16y ago
  What differentiates a DDoS from a sit-in? Of course you can be arrested for a sit-in, but you won't go to gaol for ten years.
- lukeschlather 16y ago
  Well, if we're going to insist on an ironclad analogy, I would say it's something like opening up a fire hydrant and splitting the stream into a bunch of smaller streams, pointing them at a building, and walking away. Except it's more like everyone's garden hoses somehow reach the building with no loss in PSI, and it's a few dozen people each with their own paltry residential water supply. Now, this does have the potential to cause some damage, but not really anything a heavy rain wouldn't cause. Likewise, a DDoS has the potential to overheat some servers and make some sysadmins lose some sleep, but it's nothing a day of heavy traffic couldn't cause. It's clearly illegal. But I don't think anyone there has done anything such that 10 years in prison is an even remotely reasonable punishment. I would say it's a misdemeanor at worst, and it should carry something between community service and six months in jail. And really, the sit-in analogy is probably better than that nonsense I just wrote.
  - tptacek 16y ago
    This is absolutely absurd logic. DDoS attacks can and do cause measurable hundreds of thousands of dollars of damage. You had to have known that. You just choose to overlook the potential damage here because you support the cause.
    - magamiako 16y ago
      What damage does a DDOS cause other than loaded normal traffic any other day?
    - dspeyer 16y ago
      Damage? What are you talking about? The routers don't literally catch fire. It disrupts services while the attack is active. A sit in is the correct metaphor.
      - deleted 16y ago
        [deleted]
      - sukuriant 16y ago
        Damage doesn't have to be physical.
        sesqu 16y ago
        True. But if it isn't, it should be considered emotional harm or sabotage, not straight-up damage.
      - tptacek 16y ago
        Your honor! I object! Sure, I used the man's credit card without asking him! But he didn't literally catch fire! Damages? Why, he looks fine to me!
        Dylan16807 16y ago
        Ridiculous analogies aren't helpful. Try something like.. how about standing in front of someone. All day. They can't walk anywhere without pushing past you. Basically harassment and interfering with their day. The damages lie solely in the fact that they aren't able to be productive.
- steveklabnik 16y ago
  > such a contention is intellectually and morally bankrupt. Could you expand on this a bit? I actually believe that it's very close to the same thing, but I'd like to hear your reasoning. > Moreover, sit-ins are not legal either. You are correct. This is why it's called 'civil disobedience.' Sometimes, the best way to change a law is to break it. And break it publicly. It doesn't mean that you'll be spared a sentence, but the idea is that the sentence is worth it.
  - InclinedPlane 16y ago
    Sit-ins are inherently sacrificial acts. The purpose of a sit-in is to stage a non-violent, disruptive protest which forces a response, typically being arrested, from a business owner or government. If there is no response because, for example, the business owner is too shamed to respond then either the disruption continues until the protesters demands are met or the protesters eventually give up. If there is a response, such as use of law enforcement, then there is the opportunity for the protesters and their cohorts to get the message out, raise awareness, and gain sympathy and support from the public at large. Anonymity changes the equation entirely. Sit-in protesters blatantly flout the law and beg to get arrested, so as to demonstrate their conviction for the rightness of their cause and to gain publicity. Anonymous DDoSers aim only to disrupt, whatever message they have is lost to the public because nobody can know for sure who the people responsible (4chan also apparently DDoS'd minecraft.net for a while, what was the purpose of that? wikileaks itself was DDoS'd for sometime, what was the purpose of that? it's hard to say because these are just anonymous attacks rather than actual, disciplined protests). DDoS participants don't expect to get caught, let alone to be arrested, as witness the reactions of the folks in the main article. An anonymous, or attempted anonymous, denial of service attack is more akin to throwing bricks through a storefront window or arson. It is disruption completely unmoored from personal sacrifice, civil disobedience, or the context of a cause. It is thus properly a more violent form of protest than a sit-in and we have all the more reason to despise such things because of it.
    - JoachimSchipper 16y ago
      If you're smart and know that using your home PC for DDoS attacks is likely to result in trouble for you, a DDoS attack is no less sacrificial than a sit-in (in fact, due to the propaganda against "hackers", you're quite likely to get a harsher sentence). Also, where do you get the idea that non-violent protest doesn't hurt the people being protested against? If someone chains himself to a tree about to be cut down, cutting the chain will disrupt the tree logging operation. Greenpeace isn't violent, but some people/organizations hate them, and with good reason. Gandhi wasn't violent, but he did cost the British a sizable chunk of their empire (which they'd arguably have lost anyway, but still.) Now, DDoS is likely not as effective a protest as a sit-in, and it's entirely possible that most of the anons figured they'd never get caught - but that's not the point.

skymt 16y ago

Wikipedia suggests 18 U.S.C. § 1030, the Computer Fraud and Abuse Act[0]. Here's the relevant part: > Whoever ... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer ... shall be punished as provided in subsection (c) of this section. > As used in this section ... the term “protected computer” means a computer ... which is used in or affecting interstate or foreign commerce or communication... By my (not a lawyer) reading, the only real question is whether being overwhelmed with traffic can be called "damage". [0]: http://www.law.cornell.edu/uscode/18/1030.html http://www.law.cornell.edu/uscode/18/1030.html

InclinedPlane 16y ago

It's silly to pretend that a DDoS attack is the same as a sit-in, such a contention is intellectually and morally bankrupt. Moreover, sit-ins are not legal either. If you choose to attempt to disrupt a place of business and you refuse to leave private property when asked to do so you can be arrested.

anonymoushn 16y ago
What differentiates a DDoS from a sit-in? Of course you can be arrested for a sit-in, but you won't go to gaol for ten years.
lukeschlather 16y ago
Well, if we're going to insist on an ironclad analogy, I would say it's something like opening up a fire hydrant and splitting the stream into a bunch of smaller streams, pointing them at a building, and walking away. Except it's more like everyone's garden hoses somehow reach the building with no loss in PSI, and it's a few dozen people each with their own paltry residential water supply. Now, this does have the potential to cause some damage, but not really anything a heavy rain wouldn't cause. Likewise, a DDoS has the potential to overheat some servers and make some sysadmins lose some sleep, but it's nothing a day of heavy traffic couldn't cause. It's clearly illegal. But I don't think anyone there has done anything such that 10 years in prison is an even remotely reasonable punishment. I would say it's a misdemeanor at worst, and it should carry something between community service and six months in jail. And really, the sit-in analogy is probably better than that nonsense I just wrote.
- tptacek 16y ago
  This is absolutely absurd logic. DDoS attacks can and do cause measurable hundreds of thousands of dollars of damage. You had to have known that. You just choose to overlook the potential damage here because you support the cause.
  - magamiako 16y ago
    What damage does a DDOS cause other than loaded normal traffic any other day?
  - dspeyer 16y ago
    Damage? What are you talking about? The routers don't literally catch fire. It disrupts services while the attack is active. A sit in is the correct metaphor.
    - deleted 16y ago
      [deleted]
    - sukuriant 16y ago
      Damage doesn't have to be physical.
      - sesqu 16y ago
        True. But if it isn't, it should be considered emotional harm or sabotage, not straight-up damage.
    - tptacek 16y ago
      Your honor! I object! Sure, I used the man's credit card without asking him! But he didn't literally catch fire! Damages? Why, he looks fine to me!
      - Dylan16807 16y ago
        Ridiculous analogies aren't helpful. Try something like.. how about standing in front of someone. All day. They can't walk anywhere without pushing past you. Basically harassment and interfering with their day. The damages lie solely in the fact that they aren't able to be productive.
steveklabnik 16y ago
> such a contention is intellectually and morally bankrupt. Could you expand on this a bit? I actually believe that it's very close to the same thing, but I'd like to hear your reasoning. > Moreover, sit-ins are not legal either. You are correct. This is why it's called 'civil disobedience.' Sometimes, the best way to change a law is to break it. And break it publicly. It doesn't mean that you'll be spared a sentence, but the idea is that the sentence is worth it.
- InclinedPlane 16y ago
  Sit-ins are inherently sacrificial acts. The purpose of a sit-in is to stage a non-violent, disruptive protest which forces a response, typically being arrested, from a business owner or government. If there is no response because, for example, the business owner is too shamed to respond then either the disruption continues until the protesters demands are met or the protesters eventually give up. If there is a response, such as use of law enforcement, then there is the opportunity for the protesters and their cohorts to get the message out, raise awareness, and gain sympathy and support from the public at large. Anonymity changes the equation entirely. Sit-in protesters blatantly flout the law and beg to get arrested, so as to demonstrate their conviction for the rightness of their cause and to gain publicity. Anonymous DDoSers aim only to disrupt, whatever message they have is lost to the public because nobody can know for sure who the people responsible (4chan also apparently DDoS'd minecraft.net for a while, what was the purpose of that? wikileaks itself was DDoS'd for sometime, what was the purpose of that? it's hard to say because these are just anonymous attacks rather than actual, disciplined protests). DDoS participants don't expect to get caught, let alone to be arrested, as witness the reactions of the folks in the main article. An anonymous, or attempted anonymous, denial of service attack is more akin to throwing bricks through a storefront window or arson. It is disruption completely unmoored from personal sacrifice, civil disobedience, or the context of a cause. It is thus properly a more violent form of protest than a sit-in and we have all the more reason to despise such things because of it.
  - JoachimSchipper 16y ago
    If you're smart and know that using your home PC for DDoS attacks is likely to result in trouble for you, a DDoS attack is no less sacrificial than a sit-in (in fact, due to the propaganda against "hackers", you're quite likely to get a harsher sentence). Also, where do you get the idea that non-violent protest doesn't hurt the people being protested against? If someone chains himself to a tree about to be cut down, cutting the chain will disrupt the tree logging operation. Greenpeace isn't violent, but some people/organizations hate them, and with good reason. Gandhi wasn't violent, but he did cost the British a sizable chunk of their empire (which they'd arguably have lost anyway, but still.) Now, DDoS is likely not as effective a protest as a sit-in, and it's entirely possible that most of the anons figured they'd never get caught - but that's not the point.