| |
| META TOPICPARENT | name="FirstEssay" |
|---|
| | | -- By NelsonHua - 23 Oct 2014 | |
<
< | The First Amendment protects our rights of speech and expression as private citizens of the United States from abridgement by the government. Non-violent protest, especially dear to the national ethos, has been an effective vehicle for social and political change. As our social patterns become increasingly interconnected by technology, it is critically important to recognize and protect valid forms of such expression in this medium. Distributed denial-of-service (DDoS? ) “attacks,” demonized by the media and effectively criminalized by statute, by their nature deserve such protection if a “free, public internet” is anything more than just empty rhetoric. | >
> | The First Amendment protects our rights of speech and expression as private citizens of the United States from abridgement by the government. Non-violent protest, especially dear to the national ethos, has been an effective vehicle for social and political change. As our social patterns become increasingly interconnected by technology, it is critically important to recognize and protect valid forms of such expression in this medium. Distributed denial-of-service (DDoS? ) “attacks,” deserve such protection as is afforded to other forms of expression if a “free, public internet” is anything more than just empty rhetoric. | | | Servers under “Attack”: What is a DDoS? “Attack?” | |
<
< | A general denial-of-service operation is an attempt to interrupt or suspend the services of a web host, typically through inundating the server with external data requests. Such methods are nothing new, first appearing in 1989 in the form of ping floods.
A DDoS? “attack,” is a DoS? method employing multiple systems in order to flood a server with requests for data. Typically, computers are co-opted into a “botnet,” either through malware or voluntarily, and an operating server instructs the machines to act so as to “attack” a particular server. | >
> | A DDoS? “attack,” is a denial-of-service method employing multiple systems in order to flood a server with requests for data. Typically, computers are co-opted into a “botnet,” either through malware or voluntarily, and an operating server instructs the machines to act so as to “attack” a particular server. | | | Although personal computers may be forcibly conscripted into a botnet through malware, voluntary participation has emerged as a form of cyber-protest. Notable examples include the “hacker collective” Anonymous’s efforts against the Church of Scientology in 2008, their efforts in September 2010 against the RIAA and the MPAA, their efforts in November 2010 against firms such as PayPal? for cutting off service to WikiLeaks? , and their most recent endeavor in 2014, a smaller operation against the city of Ferguson in protest of the events surrounding the Michael Brown shooting.
Non-Violent Protest or Acts of Cyberterrorism? | |
<
< | The U.S. government treats DDoS? “attacks” as no trivial matter. Although most of them eventually agreed to plea bargains, fourteen suspects were arrested in July 2011 over their November 2010 actions against PayPal? . In October 2013, thirteen offenders were indicted in the Eastern District of Virginia in connection with the MPAA and RIAA matter. In both cases, the government alleged either “Intentionally Causing Damage to a Protected Computer” or conspiracy to do so under Section 1030 of the Computer Fraud and Abuse Act, which was passed in 1986. Such offenses amount to a felony and are punishable by a maximum sentence of ten or five years, respectively, and up to a $250,000 fine. The “PayPal 14” prosecution has had a chilling effect on protests of such scale.
DDoS? “attacks” typically face a similar media treatment. Fueled by fear, hacktivists are demonized and depicted as anything from petty vandals to “cyberterrorists” attacking legitimate, established American businesses. Such branding is pervasive to even the most basic terming of DDoS? operations as “attacks.” The actions of a hacktivist “collective” like Anonymous, which is hardly an organized entity at all, are associated with actual instances of efforts to compromise the security of private machines and scandals such as leaking nude celebrity and Snapchat photos, as if the works of a few bad actors on an open, anonymous bulletin board system could discredit possible acts of legitimate protest. | >
> | The U.S. government treats DDoS? “attacks” as no trivial matter. Although most of them eventually agreed to plea bargains, fourteen suspects were arrested in July 2011 over their November 2010 actions against PayPal? . In October 2013, thirteen offenders were indicted in the Eastern District of Virginia in connection with the MPAA and RIAA matter. Under Section 1030 of the Computer Fraud and Abuse Act, such offenses amount to a felony and are punishable by a maximum sentence of ten or five years, respectively, and up to a $250,000 fine. The “PayPal 14” prosecution has had a chilling effect on protests of such scale. | | | What’s the Difference?
First “hacking” in the sense of “hacktivism” must be distinguished from other, illegitimate cyber-crimes. Richard Stallman, founder of the Free Software Foundation, suggests a distinction between “cracking” and “hacking.” The former involves “breaking computer security,” whereas the latter is essentially the equivalent of protesting in the street in front of a place of business. DDoS? , at least when absent an accompanying crime like extortion, cleanly fits into the latter category. Operators send requests, through a botnet, to a server that is designed precisely to receive requests and handle traffic. | |
<
< | Although the matter has not been meaningfully litigated, DDoS? “attacks” should not be held to violate Section 1030 of the Computer Fraud and Abuse Act. In 2006, a German Court held that such operations lacked the requisite force to constitute coercion. Likewise, DDoS? “attacks” in this sense do not cause actual damage to web servers. Servers may lack the adequate hardware to answer the slew of information requests and slow down or even temporarily shut down, but no permanent damage is done. In its most basic sense, a DDoS? “attack” is no different than times of high traffic.
Even if held to violate Section 1030, DDoS? should nonetheless be protected as a public demonstration under the First Amendment. DDoS? allows for the sort of public demonstration that has no other digital analogue. As more and more of the corporations that influence our politics through lobbying diminish their physical presence in favor of their digital presence, what other answers do we have? Pundits emphasize the harmful economic effects that DDoS? has on business, but that’s precisely the point–so does an effective picket line.
A “Free, Public Internet”
At the heart of the discussion of DDoS? is a more pervasive issue: that of a truly “free, public internet.” Our understanding of what a DDoS? “attack” really is depends on whether the “Internet” is a collection of privately-owned web servers that we have the privilege to “visit,” or a greater social experience that is conceptually open to everyone. This marks the difference between a DDoS? “attack” as trespass and a real “attack” on property, and as a demonstrative in a public space.
Activist Molly Sauter characterizes the “Internet” as a “melded commercial/military space” where users face surveillance from government and corporation alike, a far-cry from a “discursive democracy.” Although Sauter suggests that it may be too late and “that the online space is being or has already been abdicated to a capitalist-commercial governance structure,” there are still fights to be fought in the social and legal arenas, like that over DDoS? , and it would not be right to sleep on our right to hack.
| >
> | Although the matter has not been meaningfully litigated, DDoS? “attacks” should not be held to violate Section 1030 of the Computer Fraud and Abuse Act (CFAA). In 2006, a German Court held that such operations lacked the requisite force to constitute coercion. Likewise, DDoS? “attacks” in this sense do not cause the statutorily required damage to web servers. Servers may lack the adequate hardware to answer the slew of information requests and slow down or even temporarily shut down, but no permanent damage is done. | | | | |
<
< | I'll discuss this issue in more detail in the spring offering. For now I would say that I think your analysis of hacktivism is basically sound. (You would benefit from tracking down the work of Roberto Dominguez, who took your positions as a matter of social practice with the Pentagon and others at the beginning of the century.) | >
> | Clearly, the CFAA is a defective statute that is especially ill-suited to addressing hacktivism. Setting the statute aside, DDoS? should be protected as a public demonstration under the First Amendment. DDoS? allows for the sort of public demonstration that has no other digital analogue. As more and more of the corporations that influence our politics through lobbying diminish their physical presence in favor of their digital presence, what other answers do we have? Nonetheless, even without the CFAA, DDoS? may be regulated. However, as with other forms of protected expression, a careful analysis of time, place, and manner is critical in determining the appropriate regulation or lack thereof that should be extended to DDoS? . | | | | |
<
< | The essay would be stronger, in my view, if it went beyond the usual
criticism of the CFAA, which everyone can see is a completely
defective statute, to consider the more serious issues with your
basic argument. Picketing and demonstrating are regulated
activities everywhere. The contours of the First Amendment in
relation to the general police power of government in this area are
complex, and there's lots of law (about parades, street blockages,
permits, injunctions, labor picketing, general facilities like
shopping centers as opposed to business premises of the employer,
etc.) to consider in many directions. Suggesting that the
constitutional condition is straightforward because CFAA is a bad
law is grossly oversimplifying. | >
> | Time, Place, and Manner | | | | |
<
< | Nor can this be a matter of metaphors. It can't be resolved by
saying that a traffic-snarl deliberately created at a business's or
government's website is "like" a demonstration, requiring something
"like" a parade permit. Time, place and manner restrictions are
about the specifics of times, places, and manners. If a DDoS
attack is "like" the use of many bullhorns on the street at 3am,
what's the point of claiming First Amendment privilege to undertake
it? | >
> | As an exercise of the Police Power, a "State may .... enforce regulations of the time, place, and manner of expression which are content-neutral, are narrowly tailored to serve a significant government interest, and leave open ample alternative channels of communication." | | | | |
<
< | So in my view, the route to the improvement of the draft is to
shorten the exposition (which it can well stand), minimizing the
CFAA, and addressing directly the central issues as they relate to
the broad patterns of existing constitutional law. | >
> | There is not a significant government interest in heavily regulating the time and manner of DDoS? “attacks”. Although there are times of typically high and low traffic, servers are not sensitive to the timing of an “attack” in the same way that 4:00AM blow-horns in a residential would be disruptive. Also, as previously noted, the manner of a voluntary DDoS? attack is not problematic - in its most basic sense, a DDoS? “attack” is no different than times of high traffic. It might be argued that the intent and effect of DDoS? is to disrupt and that it is typically in the Police Power to regulate activities that more directly disrupt private businesses. That being said, the absence of any, let alone ample, "alternative channels of communication" to DDoS? in an increasingly digitized reality implies only very thin regulation. Perhaps, similarly to the practice of parade permitting, parties may be required to submit notice of when a denial is to occur, giving businesses a chance to prepare accordingly. | | | | |
<
< | | >
> | At the heart of the discussion of DDoS? is a more pervasive issue: that of place and a truly “free, public internet.” Our understanding of what a DDoS? “attack” really is depends on whether the “Internet” is a collection of privately-owned web servers that we have the privilege to “visit,” or a greater social experience that is conceptually open to everyone. This marks the difference between a DDoS? “attack” as trespass and a real “attack” on property, and as a demonstration in a public space. | | |
\ No newline at end of file | |
>
> | Activist Molly Sauter characterizes the “Internet” as a “melded commercial/military space” where users face surveillance from government and corporation alike, a far-cry from a “discursive democracy.” Although Sauter suggests that it may be too late and “that the online space is being or has already been abdicated to a capitalist-commercial governance structure,” there are still fights to be fought in the social and legal arenas, like that over DDoS? , and it would not be imprudent to sleep on our right to hack. |
|