The Right to Hack

-- By NelsonHua - 23 Oct 2014

The First Amendment protects our rights of speech and expression as private citizens of the United States from abridgement by the government. Non-violent protest, especially dear to the national ethos, has been an effective vehicle for social and political change. As our social patterns become increasingly interconnected by technology, it is critically important to recognize and protect valid forms of such expression in this medium. Distributed denial-of-service (DDoS? ) “attacks,” demonized by the media and effectively criminalized by statute, by their nature deserve such protection if a “free, public internet” is anything more than just empty rhetoric.

Servers under “Attack”: What is a DDoS? “Attack?”

A general denial-of-service operation is an attempt to interrupt or suspend the services of a web host, typically through inundating the server with external data requests. Such methods are nothing new, first appearing in 1989 in the form of ping floods.

A DDoS? “attack,” is a DoS? method employing multiple systems in order to flood a server with requests for data. Typically, computers are co-opted into a “botnet,” either through malware or voluntarily, and an operating server instructs the machines to act so as to “attack” a particular server.

Although personal computers may be forcibly conscripted into a botnet through malware, voluntary participation has emerged as a form of cyber-protest. Notable examples include the “hacker collective” Anonymous’s efforts against the Church of Scientology in 2008, their efforts in September 2010 against the RIAA and the MPAA, their efforts in November 2010 against firms such as PayPal? for cutting off service to WikiLeaks? , and their most recent endeavor in 2014, a smaller operation against the city of Ferguson in protest of the events surrounding the Michael Brown shooting.

Non-Violent Protest or Acts of Cyberterrorism?

The U.S. government treats DDoS? “attacks” as no trivial matter. Although most of them eventually agreed to plea bargains, fourteen suspects were arrested in July 2011 over their November 2010 actions against PayPal? . In October 2013, thirteen offenders were indicted in the Eastern District of Virginia in connection with the MPAA and RIAA matter. In both cases, the government alleged either “Intentionally Causing Damage to a Protected Computer” or conspiracy to do so under Section 1030 of the Computer Fraud and Abuse Act, which was passed in 1986. Such offenses amount to a felony and are punishable by a maximum sentence of ten or five years, respectively, and up to a $250,000 fine. The “PayPal 14” prosecution has had a chilling effect on protests of such scale.

DDoS? “attacks” typically face a similar media treatment. Fueled by fear, hacktivists are demonized and depicted as anything from petty vandals to “cyberterrorists” attacking legitimate, established American businesses. Such branding is pervasive to even the most basic terming of DDoS? operations as “attacks.” The actions of a hacktivist “collective” like Anonymous, which is hardly an organized entity at all, are associated with actual instances of efforts to compromise the security of private machines and scandals such as leaking nude celebrity and Snapchat photos, as if the works of a few bad actors on an open, anonymous bulletin board system could discredit possible acts of legitimate protest.

What’s the Difference?

First “hacking” in the sense of “hacktivism” must be distinguished from other, illegitimate cyber-crimes. Richard Stallman, founder of the Free Software Foundation, suggests a distinction between “cracking” and “hacking.” The former involves “breaking computer security,” whereas the latter is essentially the equivalent of protesting in the street in front of a place of business. DDoS? , at least when absent an accompanying crime like extortion, cleanly fits into the latter category. Operators send requests, through a botnet, to a server that is designed precisely to receive requests and handle traffic.

Although the matter has not been meaningfully litigated, DDoS? “attacks” should not be held to violate Section 1030 of the Computer Fraud and Abuse Act. In 2006, a German Court held that such operations lacked the requisite force to constitute coercion. Likewise, DDoS? “attacks” in this sense do not cause actual damage to web servers. Servers may lack the adequate hardware to answer the slew of information requests and slow down or even temporarily shut down, but no permanent damage is done. In its most basic sense, a DDoS? “attack” is no different than times of high traffic.

Even if held to violate Section 1030, DDoS? should nonetheless be protected as a public demonstration under the First Amendment. DDoS? allows for the sort of public demonstration that has no other digital analogue. As more and more of the corporations that influence our politics through lobbying diminish their physical presence in favor of their digital presence, what other answers do we have? Pundits emphasize the harmful economic effects that DDoS? has on business, but that’s precisely the point–so does an effective picket line.

A “Free, Public Internet”

At the heart of the discussion of DDoS? is a more pervasive issue: that of a truly “free, public internet.” Our understanding of what a DDoS? “attack” really is depends on whether the “Internet” is a collection of privately-owned web servers that we have the privilege to “visit,” or a greater social experience that is conceptually open to everyone. This marks the difference between a DDoS? “attack” as trespass and a real “attack” on property, and as a demonstrative in a public space.

Activist Molly Sauter characterizes the “Internet” as a “melded commercial/military space” where users face surveillance from government and corporation alike, a far-cry from a “discursive democracy.” Although Sauter suggests that it may be too late and “that the online space is being or has already been abdicated to a capitalist-commercial governance structure,” there are still fights to be fought in the social and legal arenas, like that over DDoS? , and it would not be right to sleep on our right to hack.