4 ms·

What is the actual law that someone that engages in DDOS'ing violates? I feel like we might need one specifically for the activity. It's effectively the interne

What is the actual law that someone that engages in DDOS'ing violates? I feel like we might need one specifically for the activity. It's effectively the internet version of criminal mischief. It's not hacking and all of that, but it's also not something that we should just let go all the time. I'm getting sick of hearing about script kiddies DDOSing random websites, I'd be happy to see some fines.

greenyoda 12y ago
DDOS attacks are generally launched from botnets consisting of computers that are illegally accessed without their owners' permission. While the DDOS itself may not violate any laws, executing it via hijacked computers certainly does.
- PostOnce 12y ago
  Exactly. Fining them isn't the hard part, finding them is. Spend $200K on an investigation to find a kid to fine him $10K? Maybe not worth the time and money unless it provably worked as a deterrent.
  - jokoon 12y ago
    how can you sped $200k to find a kid ?
    - omegaham 12y ago
      If you employ a certain number of people, it's assumed that they're doing other things. When you have to devote them to a different project, you're doing a few things: 1. Making your staff work overtime. 2. Leaving other work undone. 3. Hiring new staff to make up for this. 4. Keeping redundant personnel on board in case something like this happens again. 5. Hiring temporary contractors and services to help you with this specific task. All of these cost money.
    - PostOnce 12y ago
      the salaries for staffing a coordinated multinational police investigation and possible computer forensics contractors? All of the following need to be paid: Police agency in country where DDoS target resides, police agency in country where criminal resides, police agency in countries where dummy computers reside, etc? 200k was a random number but i doubt it's necessarily cheap to find any random DDoS-starter
- deleted 12y ago
  [deleted]
peteretep 12y ago
Varies by country, but in the UK, where Krebs seems to think one of them is: http://www.legislation.gov.uk/ukpga/2006/48/section/36 http://www.legislation.gov.uk/ukpga/2006/48/section/36
thu 12y ago
It is certainly unlawful: it is trying actively to disrupt someone's service (a website but also possibly its entire business). There are also specific laws for DoS[0]. [0]: http://en.wikipedia.org/wiki/Denial-of-service_attack#Legality http://en.wikipedia.org/wiki/Denial-of-service_attack#Legali...

greenyoda 12y ago

DDOS attacks are generally launched from botnets consisting of computers that are illegally accessed without their owners' permission. While the DDOS itself may not violate any laws, executing it via hijacked computers certainly does.

PostOnce 12y ago
Exactly. Fining them isn't the hard part, finding them is. Spend $200K on an investigation to find a kid to fine him $10K? Maybe not worth the time and money unless it provably worked as a deterrent.
- jokoon 12y ago
  how can you sped $200k to find a kid ?
  - omegaham 12y ago
    If you employ a certain number of people, it's assumed that they're doing other things. When you have to devote them to a different project, you're doing a few things: 1. Making your staff work overtime. 2. Leaving other work undone. 3. Hiring new staff to make up for this. 4. Keeping redundant personnel on board in case something like this happens again. 5. Hiring temporary contractors and services to help you with this specific task. All of these cost money.
  - PostOnce 12y ago
    the salaries for staffing a coordinated multinational police investigation and possible computer forensics contractors? All of the following need to be paid: Police agency in country where DDoS target resides, police agency in country where criminal resides, police agency in countries where dummy computers reside, etc? 200k was a random number but i doubt it's necessarily cheap to find any random DDoS-starter
deleted 12y ago
[deleted]

peteretep 12y ago

Varies by country, but in the UK, where Krebs seems to think one of them is: http://www.legislation.gov.uk/ukpga/2006/48/section/36 http://www.legislation.gov.uk/ukpga/2006/48/section/36

thu 12y ago

It is certainly unlawful: it is trying actively to disrupt someone's service (a website but also possibly its entire business). There are also specific laws for DoS[0]. [0]: http://en.wikipedia.org/wiki/Denial-of-service_attack#Legality http://en.wikipedia.org/wiki/Denial-of-service_attack#Legali...