Since DDoS is simply a group of subjects coming together to send requests to a particular server, is it true to say that a voluntary DDoS is perfectly valid and legal in US?

By that, I mean that a program (e.g. Low Orbit Ion Cannon) is running openly on the user's computer and not trying to hide it's tracks using unscrupulous methods.

For example, a coordination program can be distributed to all the students in a school, all of them willingly and knowingly running the program in the background. And then once a month a random site would be selected as "test target" receiving requests from all computers in the group in a short time frame.

In fact, how about we achieve coordination without using any programs at all? We can employ means like simple word-of-mouth e.g. telephones or face-to-face chat etc. Now, there are no programs, and we simply visit x 100 the website at the appointed time. All of us.

Now is that still illegal (in USA)?

  • 2
    Participating in one is illegal in some jurisdictions. – CodesInChaos Aug 16 '13 at 10:11
  • 4
    If you're taking legal advice from the internet, then (a) you're not asking an IT Security question and (b) you deserve whatever fate the court assigns you. – Mark C. Wallace Aug 16 '13 at 10:28
  • 4
    What's a DDoS ? Distributed Denial of Service. The goal ? To take down a server/website. Logic: if you're voluntary participating in it, it means you want to take down a website. Common sense: Would you think you would get away with that intention ? You should know the answer. – HamZa Aug 16 '13 at 11:26
  • 2
    @HamZa - the question doesn't say, but this would be perfectly legal if the DDoS was being run inside a test environment within an organisation – Callum Wilson Aug 16 '13 at 11:29
  • 1
    @CallumWilson That's unrealistic, unless you have 10.000 VM's set to do that ? Let's call it a DoS instead :) – HamZa Aug 16 '13 at 11:31

If you voluntary contribute to a Distributed Denial of Service attack you are being an accessory if someone uses the botnet (you are voluntary part of) to perform an illegal action such as taking down a website. If this take down results in financial damages you may be hold accountable for those damages.

Here's a small excerpt of an interesting article on LOIC:

Getting back to DDoS arrests, there are many, many precedents of the law catching up with anons who turn out to be not so anonymous. In late 2010, a 16 year old Dutch teenager was arrested for using LOIC as part of Operation Payback against companies that had begun refusing to process payments to WikiLeaks. This lead to retaliation against the national prosecutor’s website which quickly results in the arrest of another Dutch teenager, this time a 19 year old. Apparently the guy just fired LOIC up from his own PC connected directly to the internet without taking any identity obfuscation measures. As the article in the link says “That's a pretty silly mistake to make if you're going to attack the website of your country's national prosecutor”. Indeed. Then there was Giordani Jordan in the US a couple of years back, Dmitry Olegovich Zubakha in Cyrpress and a two unnamed teenagers in Norway last year plus of course Christopher Weatherhead in the UK who we now know is in jail. It’s a rapidly growing list of global arrests.

Also installing a program which makes you part of a botnet is a bit retarded. You are voluntary building a potential backdoor into your system which will likely be used for malicious intent.

Note that all of the above is when you intentionally install custom versions of LOIC or additional programs which allow remote users to use your machine.

That said, if want to test a company's network (on their request with complete legal paperwork which state that they are aware what a DDoS actually does and that they are aware that this can take down their systems) then it should be OK to proceed. LOIC can be used to do this, or you can use Apache Benchmark as an alternative if you want to test a website. There is nothing wrong in using the tool, it is what you are using the tool for. It's similar to using a knife to kill someone or make turkey sandwiches.

Intent is key here. If you visited the website with the intent to view information, then this might be regarded as normal usage. If your intent is to take down a website in an orchestrated attack then yes it is illegal.

  • So what if there are no programs? What if we used email to inform everyone of the time and IP and when the time hits, we manually visit x 100 the website at the appointed time? Is it now legal? – Pacerier Aug 16 '13 at 11:47
  • 4
    If your intent is to take down the website, then yes it is illegal. Note that the law mostly does not care what you do, but why you do it. Intent is key here, if you have to face a judge or a jury they will have to see if you are guilty of a crime. If you visited the website with the intent to view information, then this might be regarded as normal usage. If your intent is to take down a website in an orchestrated attack then yes it is illegal. – Lucas Kauffman Aug 16 '13 at 11:50
  • so who is going to be punished? All 10 thousand of them? That's just not feasible right? – Pacerier Aug 16 '13 at 11:51
  • 2
    I know tons of people have the reaction "but hey they will never be able to tell or proof we did it to take down the website". This is where things get tricky if you have to face a judge and jury, if there are indicators which show that your intent was to take down the website, then you can be found guilty. In theory, all 10.000 can be tried and convicted. – Lucas Kauffman Aug 16 '13 at 11:51
  • 1
    @Pacerier In theory, yes, or law enforcement will pick out the top 10 or 20 people in the attack and arrest them. It's more likely they will hand-select a few people and make them examples. It seems silly that you think you could somehow circumvent the law by having people DoS by, say, manually submitting something into a form on a site repeatedly. Your intent is identical; you're just not using a tool to do it. – Anorov Aug 19 '13 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.