On October 29, 2014, The Berkman Center hosted Civic Media alum Molly Sauter in a “fireside chat” with Nieman Fellow Laurie Penny about Molly’s new book The Coming Swarm: DDOS, Hactivism, and Civil Disobedience on the Internet. This is a liveblog of that conversation (not a transcript), co-written with Dalia Othman and Kendra Albert.
Laurie: Can you tell us please what is a DDOS?
Molly: How many people have younger siblings, and you may have gone to Disneyland? I have a little brother, and when we were going to Disney wherever, he would be like “Hey Molly! Hey Molly! Hey Molly!” repeatedly. Now, imagine your younger sibling is a server saying that to you over and over and over again. That’s a DDOS. Pinging a targeted server a bunch of times until it falls done. An activist DDOS is doing this with whitehouse.gov as the target. And there was a time when that was a reasonable action: on 4pm on a Wednesday, you would coordinate and start refreshing the page on whitehouse.gov and crashing it with your friends.
Laurie: I didn’t realize that this is something that has a long history, it spans long before wikileaks and Anonymous’s DDOS attacks then, it goes back to the WTO Battle for Seattle.
Molly: DDOS has been around at least since the early 1990s. For example, Quebec redphoning: calling the same political switchboard. Flood your congressman with more mail than they can read. Those are types of DDOS.
The Strano Network Net Strike was the first example back in 1995(?) that Molly found. Italian group attacking a French nuclear company. Electronic Disturbance Theater (that were involved with the zapatistas) and Electrohippies were both American groups who did activist DDOS in the 1990s
Laurie: Can you break that down a little bit, can you talk more about attention getting versus direct action?
Molly: Attention getting activism is a good way of describing the paradigm of activist intervention that we see contemporarily. Through press coverage of the intervention, you gain the attention you need to put it on the political agenda. Direct action is instead about working on the issue you want to make change on. Spiking trees to stop logging, or sending out your own ships to drive off whales from whaling ships in environmental activism and Electrohippies stopping the WTO from emailing itself.
Laurie: Protest is when I say I don’t like a thing, resistance is when I stop that thing from happening. So where does DDOS fall?
Molly: It really can be on either side of the spectrum. It depends on what your goals are. It’s so easy with DDOS, where activists will direct the press toward an issue or target by DDOSing them. It’s easier to do an attention-getting DDOS now than ever before – but much more difficult for you and your friends to take down servers on your own, because of advances in web infrastructure.
Laurie: Can we talk about Operation Payback linked to Anonymous? Especially for journalists in the room, that was a big deal, I remember that I did trying to learn the background.
Molly: Operation Payback was in the late fall / early winter of 2010. Everyone remembers Cablegate and Wikileaks in this room, right? The US government got upset over the cables publication and asked financial institutions to stop enabling funding of Wikileaks.
Anonymous was already, confusingly enough, involved in an action called “Operation Payback” targeting the MPAA and RIAA. They expanded their target pool to VISA, MasterCard, a Swedish banking site, and several congress member’s sites. This lasted for a about a week, also under the name “Operation Avenge Assange.”
Laurie: Can we talk about the PayPal 14?
Molly: When Anonymous targeted Paypal,they targetted the PayPal blog (and not their credit card processing servers). Did you know PayPal had a blog? I didn’t know they had a blog. Most people participating in that action used the Low-Orbit Ion Cannon (LOIC) to DDOS PayPal. There were some problems with the design of LOIC in the security of the end user. When you used LOIC you sent series of bits as well as a return address. Most of the participants didn’t realize it. Some people did know about this and tried to alert others that the bug existed.
What happened next was either that Anonymous members kicked them from the IRC channel because they thought they were Feds, or that the flaw in the tool had been purposefully introduced and undercover Feds kicked the people pointing out out from the IRC channel. Think whichever makes you happy that day. PayPal collected the addresses and handed them to the FBI. Fourteen of the accusations stuck: and these fourteen participants were charged, and they all pled out. Most had to pay some restitution to PayPal.
Laurie: More importantly, who will play the PayPal 14 in the movie?
Molly: Benedict Cumberbatch’s cheekbones will each get to play one of the PayPal 14.
Laurie: It’ll be like that scene in the Fifth Estate. Can you explain a little bit about the legal status of these actions and the CFAA?
Molly: CFAA is the Computer Fraud and Abuse Act and it is the main relevant legislation for these actions in the US. It is terrible. That is my opinion. It’s a fraud statute. It’s modeled on fraud statutes.
The sentencing recommendations get more intense the more people involved and the higher the estimated damage.
If I was Snidely Whiplash and I defrauded 200 little old ladies out of their life savings, I would be very good at what I do. That would be all I do. If I am an Anonymous participant, I can affect 200 customers by helping take down a credit card website for 5 minutes,. The CFAA does not scale to these two scenarios. It sees them similarly.
I’m not saying that companies don’t make up damages out of whole cloth. [wink wink nod nod]
For example, the Koch Brothers website went down for 15 minutes. One guy was arrested for this. He was a truck driver. He had to pay $200,000 to Koch based on their cost to pay a consultant to rewrite the security infrastructure for the site. And because of joint and several liability, he was responsible for the whole amount.
Laurie: What you get at in the book is the power differential in this situation. Is it always as clear as the truck driver versus series fraud?
Molly: It is never that clear.
DDOS can be used for many different actions for many different purposes. It can be a used for extortion and harassment. It can be used as a tool for censorship. The Berkman Center wrote a great report on DDOS to censor activist media outlets.
Anyone can use them for a variety of aims: criminal or not.
Laurie: DDOS are not just attacks on speech but can be speech-acts themselves. Are there times when they are straight up censorship?
Molly: I think when governments DDOS media outlets it is straight up censorship. There are other situations where you have more tricky definitions. There was an ISP that was hosting a Basque Separatist website in Spain. There was a demand from a nameless group of people to take down that content. Eventually the ISP did take it down because it made it impossible for them to carry out their business.
There’s a difference between that and the Anonymous action saying we don’t like how PayPal is handling funding to Wikileaks. You are objecting to the actions of a corporation and doing so by attack their public presence online. You aren’t stopping them from conducting business by taking down the PayPal blog. It doesn’t disrupt their communications / PR infrastructure to tell their story. If anything, it brings the press to them to comment on being DDOS’ed.
Molly: It’s really hard for John Q. Public to make a change at a corporation. If you are trying to silence something, that is a free speech and ethical issue.
Audience member: Who gets to decide what is disruption and what is not?
[point made]Laurie: This would be a good time to discuss democracy on the internet.
Molly: EDT wanted to draw a straight line between street activism and online activism. Digitally-enable activists versus Hacktivists that were primarily involved in computer networks and then moved to political use of those tools. EDT was interested in talking about these actions in street action terms: DDOS is a sit-in. While this metaphor served it’s purpose at the time, it’s problematic. Sit-ins draw out a romanticized reference to the civil rights movement, which does not accurately represent how activism unfolds.
The second problem with using the term sit-in is that it’s not a sit-in. The denial of that service is the illustrative part of that example. DDOS is more akin to a blockade.
Laurie: Say I have a problem with the internet. Why would I choose to use a tactic like this rather than send a letter to my MP?
Molly: The value comes from the fact that you don’t have to rely on a faith in the system responding to you. If you believe that sending a letter to a Senator will give you a good faith response. If you don’t believe the system with respond in good faith than those traditional avenues are closed off to you: maybe you don’t use the right language, you won’t get a response in time, or many other reasons.
So moving to a disruptive action like DDOS, a strike, or monkeywrenching means you are attempting to get someone to pay attention on your issue now.
There’s this really interesting article going around that talks about tactics suffragettes used before they got the vote. They did things like interrupting the Kentucky Derby to pin flags on the horses and starve themselves. When people saw the women starving themselves or chaining themselves to the gates of the White House they didn’t understand that. People responded by saying why don’t they write a letter: But they did these actions because they did not have equal voice.
Laurie: Back in the day, suffragettes were seen as terrorists.
Molly: It is the interruption of the use of property and the flow of capitalism. People use disruptive tactics for a reason because often it’s the only way to get on the public agenda.
Laurie: You say in the book: There is no public space on the internet. So how we do create a notion of publics and civics on the internet? You don’t seem to have answers here, but
Molly: People have tried to make space on the internet through municipal wi-fi. There a government and corporate attempts to block the ability to create these public spaces. It’s actually illegal to make municipal networks in some states.
It’s shocking that we are unable to create these spaces.
Laurie: Why did you choose to position this a more popular book than a purely academic book?
Molly: I wanted this to be more than academic for a couple reasons. First, I think this is important. People aren’t asking these questions or asking them the right ways. This is important for people writing about the internet and using the internet for political purposes. Primarily it was about appealing to a wider audience.
Laurie: What’s the end game? DDOS are time-delimited as a tactic because of the arms race in online security.
Molly: This will stay a fringe tactic because it’s legally risky. And people that are in the activist mainstream will not go there because it’s so risky.Even though I think DDOS will stay fringe and decline in popularity as a political tactic, I still think it’s valuable as a really low bar for participation in political action online and civic disobedience.
In activism you talk about the ladder of engagement, which starts with signing a petition and then move toward a attending a lecture or march, and then volunteering and then traveling to participate. DDOS opens that door to online civil disobedience action with a low level of commitment and technical knowledge. And in that way it’s very useful.
Laurie: Some of the penalties make this very risky as you said, do you see this trend continuing? I see people in the UK getting locked away for just participating in a sit-in. What scares the gov about DDOS activism?
Molly: The government is scared of DDOS because they want to define the space as one of war and protect their abilities to carry out intelligence in this space.
QUESTION & ANSWER
Schuyler Towne: You say that people act because they lose faith in the system…
Molly: In the great variety in the Iraq war protests there was one in San Francisco that created a major disruption where they sat in the road in a group with handcuffs, covered in PVC pipe connecting them and it was impossible to move them. But there were questions about what happens when an ambulance needed to drive through. What about a school bus. What a woman about to give birth? I’m not saying that Anonymous did this…and I’m not saying they didn’t, I don’t know.There are a certain number of activist populations that have lost faith in the system.
ACT UP was a very disruptive organization who engaged in a fight for a very long time. Disruption is appealing in the case when you reach the scale of thousands of people dying and the sense that society is doing nothing.
The extreme environmental movement is another good example. When you think that some things are going to irreparably harm the environment, you spike trees and blow up parts of the Tar Sands Pipeline.
Sara Marie Watson: How did you do the research for the book?
Molly: I don’t have any interviews with activists in the book because I wasn’t interested in having my notes subpoenaed by the government or courts and harm the activists.
I’m fortunate to have Biella Coleman as my advisor, and so there are parts of my book that do a press analysis. I did a lot of news analysis of how they covered the actions. I am a media theorist at heart and so using media theory and analysis to understand what was happening.
Ivan Sigal: Did you look at international comparisons at all?
Molly: I primarily focused on the US and Western Europe. I tried to learn Mandarin to look at China, but that only lasted a year. and so I was limited by the languages I could speak EDT was a primary mover in a lot of the 90s and they had their own archive. German activists also had their own archive, much of it was translated to English.I tried to study Syria context but most of it is not in English.
Audience member: Is this like a naive white middle class strategy?
Molly: This is an excellent point. To a certain extent, you are limiting your activist pool by requiring that you have an always on computer and internet connection and ability to install the software to DDOS. This is a very esoteric set of requirements to participate in a action.
Floodnet was all scheduled actions because it was during the time of dial-up. The Zapatistas created disruption by scheduling it through a web-based platform with a drop down menu that said choose the Mexican neo-liberal institution and the people knew what that meant.
Do I hope that one day everyone will be able to participate in the types of actions that are applicable to their needs and times? Yes. But there is a lot that needs to happen between now and then.
Chris Peterson: The definition of a disruptive act is that it plays outside the rules of this game. I’m happy with how you responded to the disruption in this event earlier. How do you make the case that these types of disruptive actions are acceptable?
Molly: I’m a big fan of Tressie mcmillan Cottom. She has written, “In a democracy everyone should be equally uncomfortable.” Democracy is about distributing discomfort so that everyone takes some on. When someone needs to have their voice heard. Why is your opinion more important than my need to get to work? Well you might have that same need to have your opinion heard a year or more from now. And so we trade off on that responsibility. It’s like everyone is keeping the speaker’s corner warm for each other.
My case for disruption is that one day we each will need that. Plus, if no one keeps democracy on its toes, then it never.
Audience member: On a nonviolent spectrum, where do you categorize DDOS actions?
Molly: That is depends on our definition of violence. And your own opinion. I think an action that silence someone is an act of violence.
Audience member: I liked that you distinguish between DDOS action and DDOS attack. You mentioned that there was a bug in LOIC…
Molly: Saying it was a bug in the program is a misnomer. Rather it was a bug in the process. People didn’t know their identities were being shared and couldn’t take steps to be anonymous.
Same audience member: The lack of anonymity is actually a core feature of civil disobedience.
Molly: The modern conception of civil disobedience is not anonymous. This was influenced by MLK Jr’s theory of change that if you put your own body on the line for abuse, you strengthen the point. DDOS actions come from a longer tradition where that is not an option. James Scott has a book called “Weapons of the Weak,” and those are largely anonymous or covert routes. I find it annoying that the message we hear from politicians is that if you are not named in your struggle than your struggle is illegitimate. Because that basically says that I am already in charge and you need to let me be more in charge by abusing your body and life.
Audience member: My question is predicated on the premise that DDOS won’t keep working. A botnet might work. But it’s also a hierarchy. If you are interested in ethical protest online, what are the avenues available in the future?
Molly: Botnets have tried to deal with the ethical problem of not being able to be online all the time to hit the button and participate. Tools like LOIC allow you to say that I am dedicating my computer to this cause. Now there are many cases of illegal botnets being used for these issues, which has major problems.
Ethics is hard. There is like a Kinsey scale of ethics: nobody is perfectly ethical or unethical. Information exfiltration is less ethical but it is also considered to be okay depending on what the information is and the purpose you have for it.
Audience member: Where is this ethical line in the question of censorship? YOu mentioned in PayPal, Anonymous just took down the blog. But if they had the ability to take down the whole site, would that be censorship?
Molly: No that would not be censorship. Preventing a business from doing business is not censorship. A definition of censorship depends on the power differential of the players, how robust the target is to this influx, and what the actual impact is: whether you are actually stopping speech or not.
Follow-up question about efficacy…
There are many reasons to do an action. It’s really hard to take down a corporate website. There are other ways that activists measure success of an action. You don’t have to take down a site to get press coverage.