Risk
1/11/2013
10:26 AM
Connect Directly
RSS
E-Mail
50%
50%

Anonymous Says DDoS Attacks Like Free Speech

Hacktivist collective Anonymous petitions the White House to make DDoS attacks part of First Amendment protections. Shutdown attacks are akin to Occupy protests, group argues.

Can the Anonymous hacktivist collective hack the First Amendment?

A petition filed this week with the White House seeks to decriminalize distributed denial-of-service (DDoS) attacks, making them a legal form of protesting. In other words, it would extend the First Amendment's protections to protect people's right to disrupt websites.

"Distributed denial-of-service (DDoS), is not any form of hacking in any way," claims the "We The People" petition request. "It is the equivalent of repeatedly hitting the refresh button on a webpage. It is, in that way, no different than any 'occupy' protest."

According to the petition, "instead of a group of people standing outside a building to occupy the area, they are having their computer occupy a website to slow (or deny) service of that particular website for a short time." The petition also calls for anyone jailed for a DDoS-related crime to be immediately released, and the related charges to be expunged from people's arrest records.

[ For the latest on the ongoing John McAfee saga, see McAfee Strikes Back: Spyware Sting Targets Belize Government. ]

While the identity of the person who created the petition is partially anonymized -- it's ascribed to "Dylan K" of Eagle, Wis. -- members of the Anonymous collective are clearly backing the petition. "We Need Your Signature! Make, distributed denial-of-service (DDoS), a legal form of protesting," read a Friday YourAnonNews Twitter post.

For the White House to respond to the petition, the request needs to garner 25,000 signatures by Feb. 6. By Friday morning, however, the petition had received only about 2,000 signatures.

The First Amendment enshrines both the right to freedom of speech and "the right of the people peaceably to assemble, and to petition the Government for a redress of grievances." The DDoS petition, then, implies that current laws should be updated to protect people's right to disrupt websites. "With the advance in internet techonology (sic), comes new grounds for protesting," reads the petition.

The request highlights the fact that that there are currently different rules governing website shutdowns vs. interrupting businesses in the real world. For example, in many Western countries, protestors can choke the entrance to a business -- or even city streets -- for a few hours, and it's legal. "And the digital equivalent of that, a DDoS attack that takes a website offline for a few hours, is illegal," said Mandiant VP Grady Summers at last year's RSA conference in San Francisco. The prosecutions of numerous people involved in DDoS attacks -- or in some readings, protests -- further makes that clear.

If the petition gathers sufficient signatures, and the White House responds, would DDoS fans have any chance of seeing website disruptions get classified as a form of protest? Most likely Congress would need to pass a law that protects DDoS attacks as a form of free speech. Given that federal legislators can't even agree on a bill to protect people's privacy rights online, good luck scheduling a DDoS discussion.

In the meantime, law enforcement officials will no doubt continue to prosecute DDoS attacks. But FBI officials have said they're not unaware of concerns over people's right to protest online, and emphasized they're required by law to protect people's civil liberties, including online.

"That is a huge concern for us ... and there are a number of challenges associated with this," said Eric Strom, unit chief for the Cyber Initiative and Resource Fusion Unit Cyber Division at the FBI, at last year's RSA conference. One of the chief challenges, he said, is that many people who launch DDoS attacks are minors.

How does the bureau gauge when online speech or protests cross a legal line? "If they're just complaining about something, or an issue, they have every right to do that and certainly we don't have a problem with that," he said. "It's when they take that step across the line, to make a point ... [and] they hack into a system, or go after say someone in law enforcement and their families … obviously we're going to take a big interest."

Hack.me is a free platform to build, host and share simple and complex vulnerable Web applications. Find out more about it in this free Black Hat webcast on Jan. 17, with Armando Romeo, founder of eLearnSecurity.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
jerrynesmith
50%
50%
jerrynesmith,
User Rank: Apprentice
1/11/2013 | 6:06:59 PM
re: Anonymous Says DDoS Attacks Like Free Speech
I thought this (DDoS as Freedom of Speech) a ridiculous notion. But I thought the same of corporations' having protected freedom of speech as a person and freedom of speech being spending unlimited money on political campaigns and remaining anonymous.
lgaryHB
50%
50%
lgaryHB,
User Rank: Apprentice
1/11/2013 | 6:17:01 PM
re: Anonymous Says DDoS Attacks Like Free Speech
At the risk of being attacked by Anonymous, I would argue that their premise is cute, but flawed. An Occupy protest sits on public property outside of the established business. Were they to enter the business they are protesting, they would be violating laws on the books, not exercising free speech rights. Also, business is still being conducted inside the premises. DDoS attacks are not by definition staying on the public square, but are entering the established online business site. You cannot knock on the door of an online web page without entering. The attacker might also be violating that business or individual's free speech rights by blocking the web page from being presented in the public internet. And if you were to repeatedly knock on a real business's door thousands of times a second, you would be subject to harassment charges if not trespassing. That is not speech nor is it peaceable assembly.
irishutopia
50%
50%
irishutopia,
User Rank: Apprentice
1/11/2013 | 6:21:26 PM
re: Anonymous Says DDoS Attacks Like Free Speech
hmm...an interesting spin on the idea, but wouldn't this lead to everyone throwing down random DDoS attacks in the name of protest?
ikeman
50%
50%
ikeman,
User Rank: Apprentice
1/11/2013 | 6:25:41 PM
re: Anonymous Says DDoS Attacks Like Free Speech
Doesn't DDoS imply that several compromised systems were required to make this so-called protest? By doing so, they are implicitly including other people in the protest who may not agree with the protest, and they've hacked their computers...sorry, they need to rethink that argument, unless all the computers involved to create the DDoS attack are all their own computers. Plus, protesting should be one person to one protest ratio, not one person can make thousands of the same protest ratio.
jries921
50%
50%
jries921,
User Rank: Apprentice
1/11/2013 | 6:32:12 PM
re: Anonymous Says DDoS Attacks Like Free Speech
Right!

...and setting off Molotov cocktails is covered by the right to keep and bear arms!

I agree that corporate political expenditures aren't free speech either (as the late Justice Hugo Black famously said, "Speech is speech"), but dubious Supreme Court precedents are no excuse.

DDoS attacks are harassment, not speech.
jries921
50%
50%
jries921,
User Rank: Apprentice
1/11/2013 | 6:35:33 PM
re: Anonymous Says DDoS Attacks Like Free Speech
Good point. Unless the owners of all the machines used agreed to participate in the DDoS attack, the attackers are engaging in what amounts to burglary and hijacking (regardless of what the law may happen to say).
Nyuk
50%
50%
Nyuk,
User Rank: Apprentice
1/11/2013 | 7:05:27 PM
re: Anonymous Says DDoS Attacks Like Free Speech
After seeing the faces of IT execs hearing that they are being attacked I'd go further to classify them as terrorism.

Release the drones on them! (At risk of having them taken over. ;-)
Laurianne
50%
50%
Laurianne,
User Rank: Apprentice
1/11/2013 | 7:23:21 PM
re: Anonymous Says DDoS Attacks Like Free Speech
My colleague at Dark Reading, Kelly Jackson Higgins, points out that this same issue came up at the most recent DefCon conference. Read more about it: http://www.darkreading.com/dat...

Laurianne McLaughlin
InformationWeek
JerryJ
50%
50%
JerryJ,
User Rank: Apprentice
1/11/2013 | 7:23:51 PM
re: Anonymous Says DDoS Attacks Like Free Speech
lgaryHB is spot on. DDoS is not freedom of speech, it's criminal tresspass. As for jail time, the members of anonymous are civil disobedients (well, some of them are, the others are just bored or in it for kicks). A civil disobedient's duty is to submit to the punishment prescribed by law.
NJ Mike
50%
50%
NJ Mike,
User Rank: Apprentice
1/11/2013 | 7:51:35 PM
re: Anonymous Says DDoS Attacks Like Free Speech
What a load of BS. What these self-righteous jerks are saying that they should be able to exercise their freedom of speech by denying somebody else's their's.
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2595
Published: 2014-08-31
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which all...

CVE-2013-2597
Published: 2014-08-31
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that lever...

CVE-2013-2598
Published: 2014-08-31
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory ...

CVE-2013-2599
Published: 2014-08-31
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption pas...

CVE-2013-6124
Published: 2014-08-31
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary fil...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.