Subject: [hrpc] Case three: DDoS

From: Corinne Cath <[email-masked]>
Date: Tue, 19 Jan 2016 21:08:42 +0000

And last but not least, Case three DDoS.

*DDOS attacks *

Are Distributed Denial of Service (DDoS) attacks a legitimate form of
online protest protected by the right to freedom of speech and association?
Can they be seen as the equivalent to ‘million-(wo)men marches’, or
sit-ins? Or are they a threat to freedom of expression and access to
information, by limiting access to websites and in certain cases the
freedom of speech of others? These questions are crucial in our day and
age, where political debates, civil disobedience and other forms of
activism are increasingly moving online.

Many individuals, not excluding IETF engineers, have argued that DDoS
attacks are fundamentally against freedom of speech. Technically DDoS
attacks are when multiple computers overload the bandwidth or resources of
a website (or other system) by flooding it with traffic, causing it to
temporarily stop being available to users. In their 2010 report Zuckerman
et al argue that DDoS attacks are a bad thing because they are increasingly
used by governments to attack and silence critics. Their research
demonstrates that in many countries independent media outlets and human
rights organizations are the victim of DDoS attacks, which are directly or
indirectly linked to their governments. These types of attacks are
particularly complicated because attribution is difficult, creating a
situation in which governments can effectively censor content, while being
able to deny involvement in the attacks (Zuckerman et al 2010). DDoS
attacks can thus stifle freedom of expression, complicate independent media
and human rights organizations to exercise their right to online freedom of
association, while facilitating the ability of governments to censor
dissent.

In addition, DDoS attacks are increasingly used as an extortion tactic,
with criminals flooding a website – rendering it inaccessible – until the
owner pays them a certain amount of money to stop the attack. The costs of
mitigating such attacks, either by improving security to prevent them or
paying off the attackers, ends up being paid by the consumer. All of these
issues seem to suggest that the IETF should try to ensure that their
protocols cannot be used for DDoS attacks. Decreasing the number of
vulnerabilities in the network stacks of routers or computers, reducing
flaws in HTTPS implementations, and depreciating non-secure HTTP protocols
could address this issue. The IETF can clearly play a role in bringing
about some of these changes, and has indicated in RFC 7258 its commitment
to mitigating ‘pervasive monitoring (…) in the design of IETF protocols,
where possible.’ This means the use of encryption should become standard.
Effectively, for the web this means standard use of HTTPS. The IETF could
redirect its work such that HTPPS becomes part-and-parcel of its standards.
However, next to the various technical trade-offs that this might lead to
it is important to consider that DDoS attacks are also fundamentally a
method for exercising freedom of speech.

DDoS although disruptive, and silencing at times, can also enable as
protest and speech. Or as Sauter (2014) argues: ‘though DDoS as a tactic is
still relatively novel, it fits within a centuries- long tradition of
breaking laws and disrupting business as usual to make a political point.
These actions aren’t simply disruption for disruption’s sake. Rather they
serve to help the activist or dissenter to direct the attention of the
public through the interpolation of difference into routine.’ (30-31). An
often heard argument against DDoS attacks is that you cannot construe it as
a means to exercise your right to freedom of speech, when the means used
effectively impede the right of the party on the receiving end of the
attack to exercise that same right.

The problem with this line of argumentation is that it conveniently ignores
the fact that online DDoS attacks are often the only effective way for
activists to gain the attention of the media, the government or other
parties of interest. Simply putting up a website for a cause won’t garner
the same amount of attention as directly confronting the issue via the
website of the individual or organization at the heart of the issue. The
ability of activists to do so should be protected, especially considering
the fact that as Sauter (2014:4) explains: ‘Collectively, we have allowed
the construction of an entire public sphere, the Internet, which by
accidents of evolution and design, has none of the inherent free speech
guarantees we have come to expect. Dissenting voices are pushed out of the
paths of potential audiences, effectively removing them from the public
discourse. There is nowhere online for an activist to stand with her
friends and her sign. She might set up a dedicated blog—which may or may
not ever be read—but it is much harder for her to stand collectively with
others against a corporate giant in the online space.’ Although the
Internet is often compared to public space, it is not. Rather the opposite.
The Internet is almost entirely owned by private entities. Or as Sauter
(2014:35) states: ‘It is the nature of the online environment itself that
has made disruptive tactics such as activist DDoS actions increasingly
necessary.’ If there is no true public space online, the individuals
managing the Internet architecture should allow for DDoS attacks to happen,
when they are part of a legitimate freedom of speech campaigns.

The question of how the IETF should respond to this is two-fold: first, it
would require developing a method to establish when a DDoS attack is a
legitimate expression of the right to freedom of speech, or whether it
impedes on it. Second, it asks the IETF to reflect upon its role in
creating a commercialized Internet that has no defacto public space of
inherent protections for freedom of speech. One of the founding fathers of
the Internet, David Clark, recently published a paper warning that the
future of the Internet is in danger. He argues that the private sector
control over the Internet is too strong, limiting the myriad of ways in
which it can be used (Daedalus 2016), including for freedom of speech. As
such, it is important for the IETF to consider the fact that DDoS attacks
are inherently dual-use and not take immediate sides on this discussion.

*Literature referenced:*

Bray, T., 2012. ID 2616 A New HTTP Status Code for Legally-restricted
Resources draft-tbray-http-legally-restricted-status-00. Retrieved on May
1, 2015, from
https://tools.ietf.org/html/draft-tbray-http-legally-restricted-status-00.

Clark, D., 2015. The Contingent Internet. Daedalus Winter 2016, Vol. 145,
No. 1: 9–17. Retrieved on January 1, 2016 from
http://www.mitpressjournals.org/toc/daed/current.

Sauter, M., 2014. The Coming Swarm. London: Bloomsbury.

Walfish, M., Stribling, J., Krohn, M., Balakrishnan, H., Morris, R., &
Shenker, S. 2004. Middleboxes No Longer Considered Harmful. Retrieved on
May 24, 2015, from http://nms.csail.mit.edu/doa

Zuckerman, E., et al. 2010. Report on Distributed Denial of Service (DDoS)
Attacks. Retrieved on January 1, 2016 from
https://cyber.law.harvard.edu/sites/cyber.law.harvard.edu/files/2010_DDoS_Attacks_Human_Rights_and_Media.pdf
.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 19 Jan 2016 21:26:21 +0000

Hmm. Can you give some examples of when a DDoS has only
involved willing participants/"protesters" and a target?
AFAIK, for almost all (as in 99.9ish%) cases of DDoS, the
clients are likely hacked computers belonging to unrelated
parties and nothing to do with those who want to protest
nor with those who are the target of the protest.

Doesn't that mean that the million-person march analogy
is busted? For a march to be a good analogy for a DDoS,
the million people would be being press-ganged into marching
and would not be choosing to march.

Seems to me that DDoS as a method of protest is just a
not a useful concept. (I can imagine methods of protest
that use the Internet, but I can't see it being useful
to call any of those a DDoS.)

S.

On 19/01/16 21:08, Corinne Cath wrote:
> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc
>

---

From: Joss Wright <[email-masked]>
Date: Tue, 19 Jan 2016 21:34:49 +0000

The use of LOIC by 4chan and Anonymous are probably the most well-known examples
that spring to mind.

The Wikipedia page (
https://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon#Notable_uses ) notes "Project
Chanology", "Operation Payback", and "Operation Megaupload" as occasions in
which LOIC was used for protest.

Having said that, I do agree that DDoS will not, in the vast majority of cases,
have relied on what the page linked above calls 'voluntary botnets'.

J

On Tue, Jan 19, 2016 at 09:26:21PM +0000, Stephen Farrell wrote:
> 
> Hmm. Can you give some examples of when a DDoS has only involved willing
> participants/"protesters" and a target?  AFAIK, for almost all (as in
> 99.9ish%) cases of DDoS, the clients are likely hacked computers belonging to
> unrelated parties and nothing to do with those who want to protest nor with
> those who are the target of the protest.
> 
> Doesn't that mean that the million-person march analogy is busted? For a march
> to be a good analogy for a DDoS, the million people would be being
> press-ganged into marching and would not be choosing to march.
> 
> Seems to me that DDoS as a method of protest is just a not a useful concept.
> (I can imagine methods of protest that use the Internet, but I can't see it
> being useful to call any of those a DDoS.)
> 
> S.
> 
> > Are Distributed Denial of Service (DDoS) attacks a legitimate form of online
> > protest protected by the right to freedom of speech and association?  Can
> > they be seen as the equivalent to ‘million-(wo)men marches’, or sit-ins? Or
> > are they a threat to freedom of expression and access to information, by
> > limiting access to websites and in certain cases the freedom of speech of
> > others? These questions are crucial in our day and age, where political
> > debates, civil disobedience and other forms of activism are increasingly
> > moving online.
> > 
> > attacks are when multiple computers overload the bandwidth or resources of a
> > website (or other system) by flooding it with traffic, causing it to
> > temporarily stop being available to users. In their 2010 report Zuckerman et
> > al argue that DDoS attacks are a bad thing because they are increasingly
> > able to deny involvement in the attacks (Zuckerman et al 2010). DDoS attacks
> > can thus stifle freedom of expression, complicate independent media and
> > human rights organizations to exercise their right to online freedom of
> > In addition, DDoS attacks are increasingly used as an extortion tactic, with
> > criminals flooding a website – rendering it inaccessible – until the owner
> > pays them a certain amount of money to stop the attack. The costs of
> > could address this issue. The IETF can clearly play a role in bringing about
> > some of these changes, and has indicated in RFC 7258 its commitment to
> > mitigating ‘pervasive monitoring (…) in the design of IETF protocols, where
> > possible.’ This means the use of encryption should become standard.
> > However, next to the various technical trade-offs that this might lead to it
> > is important to consider that DDoS attacks are also fundamentally a method
> > for exercising freedom of speech.
> > 
> > DDoS although disruptive, and silencing at times, can also enable as protest
> > and speech. Or as Sauter (2014) argues: ‘though DDoS as a tactic is still
> > relatively novel, it fits within a centuries- long tradition of breaking
> > laws and disrupting business as usual to make a political point.  These
> > actions aren’t simply disruption for disruption’s sake. Rather they serve to
> > help the activist or dissenter to direct the attention of the public through
> > the interpolation of difference into routine.’ (30-31). An often heard
> > argument against DDoS attacks is that you cannot construe it as a means to
> > exercise your right to freedom of speech, when the means used effectively
> > impede the right of the party on the receiving end of the attack to exercise
> > that same right.
> > 
> > discourse. There is nowhere online for an activist to stand with her friends
> > and her sign. She might set up a dedicated blog—which may or may not ever be
> > read—but it is much harder for her to stand collectively with others against
> > a corporate giant in the online space.’ Although the Internet is often
> > compared to public space, it is not. Rather the opposite.  The Internet is
> > almost entirely owned by private entities. Or as Sauter (2014:35) states:
> > ‘It is the nature of the online environment itself that has made disruptive
> > tactics such as activist DDoS actions increasingly necessary.’ If there is
> > no true public space online, the individuals managing the Internet
> > architecture should allow for DDoS attacks to happen, when they are part of
> > a legitimate freedom of speech campaigns.
> > 
> > impedes on it. Second, it asks the IETF to reflect upon its role in creating
> > a commercialized Internet that has no defacto public space of inherent
> > protections for freedom of speech. One of the founding fathers of the
> > Internet, David Clark, recently published a paper warning that the future of
> > the Internet is in danger. He argues that the private sector control over
> > the Internet is too strong, limiting the myriad of ways in which it can be
> > used (Daedalus 2016), including for freedom of speech. As such, it is
> > important for the IETF to consider the fact that DDoS attacks are inherently
> > dual-use and not take immediate sides on this discussion.
> > 
> > 
> > 
> > *Literature referenced:*
> > 
> > Resources draft-tbray-http-legally-restricted-status-00. Retrieved on May 1,
> > 2015, from
> > Shenker, S. 2004. Middleboxes No Longer Considered Harmful. Retrieved on May
> > 24, 2015, from http://nms.csail.mit.edu/doa
> > 
> > 
> > _______________________________________________ hrpc mailing list
> > [email-masked] https://www.irtf.org/mailman/listinfo/hrpc
> > 
> 
> _______________________________________________ hrpc mailing list
> [email-masked] https://www.irtf.org/mailman/listinfo/hrpc

-- 
Dr. Joss Wright | Research Fellow 
Oxford Internet Institute, University of Oxford
http://www.oii.ox.ac.uk/people/?id=176

---

From: Collin Anderson <[email-masked]>
Date: Tue, 19 Jan 2016 21:48:55 +0000

Operation Ababil: http://ddanchev.blogspot.com/2012/09/dissecting-operation-ababil-osint.html
Green Movement DDoS: https://www.nartv.org/2009/06/16/iran-ddos/

________________________________________
From: hrpc [[email-masked]] on behalf of Joss Wright [[email-masked]]
Sent: Tuesday, January 19, 2016 4:34 PM
To: Stephen Farrell
Cc: Corinne Cath; [email-masked]
Subject: Re: [hrpc] Case three: DDoS

The Wikipedia page (

J

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 19 Jan 2016 21:55:17 +0000

> have relied on what the page linked above calls 'voluntary botnets'.

Right. And in my little head at least forms of protest that
involve involuntary participation by O(10^5) unrelated
parties are far more dubious than forms of protest that are
voluntary. Especially when the involuntary participant's
networks need to be compromised as part of the "protest" in
ways that are very likely to be abused by others.

But in any case, I think if the IETF wants to be consistent
in considering pervasive monitoring an attack regardless of
motivation, then we need to treat DDoS in the same way - as
an attack and nothing else, regardless of motivation.

S.

PS: That there are a handful of cases where "voluntary botnets"
were used does not IMO counter the above. If one is interested
in those then one would be far better off not using the term
DDoS I reckon.

---

From: Joss Wright <[email-masked]>
Date: Tue, 19 Jan 2016 22:15:43 +0000

On Tue, Jan 19, 2016 at 09:55:17PM +0000, Stephen Farrell wrote:
> > Having said that, I do agree that DDoS will not, in the vast majority of
> > cases, have relied on what the page linked above calls 'voluntary botnets'.
> 
> Right. And in my little head at least forms of protest that involve
> involuntary participation by O(10^5) unrelated parties are far more dubious
> than forms of protest that are voluntary. Especially when the involuntary
> participant's networks need to be compromised as part of the "protest" in ways
> that are very likely to be abused by others.

No disagreement here.

> But in any case, I think if the IETF wants to be consistent in considering
> pervasive monitoring an attack regardless of motivation, then we need to treat
> DDoS in the same way - as an attack and nothing else, regardless of
> motivation.

Voluntary pervasive monitoring? Isn't that called Facebook? :)

In any case, I don't see what complications there could be to the IETF's
position here -- I certainly wouldn't expect anything other than attempts to
prevent the possibility of DDoS and view it as an attack. (Although I admit I'd
genuinely love to see some proposals for "methods to facilitatejustified DDoS of
nasty resources".)
 
> PS: That there are a handful of cases where "voluntary botnets" were used does
> not IMO counter the above. If one is interested in those then one would be far
> better off not using the term DDoS I reckon.

Well, I don't think you could reasonably call it anything other than a DDoS --
every one of those letters is just as applicable to organised, voluntary DDoS as
to the more evil kind. If you specifically wanted to refer to them then I'd
expect a clear qualification ("collective action DDoS"), but I hardly think it's
likely to cause confusion. In fact, the other term that's floated up is probably
more a source of confusion. "Botnet" has clear implications of compromised
machines, so I'd say that 'voluntary botnet' is tending towards the oxymoronic.

J

---

From: Paul Ferguson <[email-masked]>
Date: Tue, 19 Jan 2016 14:22:24 -0800

On 1/19/2016 2:15 PM, Joss Wright wrote:

>>> Having said that, I do agree that DDoS will not, in the vast
>>> majority of cases, have relied on what the page linked above
>>> calls 'voluntary botnets'.
>> 
>> involve involuntary participation by O(10^5) unrelated parties
>> are far more dubious than forms of protest that are voluntary.
>> Especially when the involuntary participant's networks need to be
>> compromised as part of the "protest" in ways that are very likely
>> to be abused by others.
> 
> No disagreement here.
> 
>> But in any case, I think if the IETF wants to be consistent in
>> considering pervasive monitoring an attack regardless of
>> motivation, then we need to treat DDoS in the same way - as an
>> attack and nothing else, regardless of motivation.
> 
> In any case, I don't see what complications there could be to the
> IETF's position here -- I certainly wouldn't expect anything other
> than attempts to prevent the possibility of DDoS and view it as an
> attack. (Although I admit I'd genuinely love to see some proposals
> for "methods to facilitatejustified DDoS of nasty resources".)
> 
>> were used does not IMO counter the above. If one is interested in
>> those then one would be far better off not using the term DDoS I
>> reckon.
> 
> Well, I don't think you could reasonably call it anything other
> than a DDoS -- every one of those letters is just as applicable to
> organised, voluntary DDoS as to the more evil kind. If you
> specifically wanted to refer to them then I'd expect a clear
> qualification ("collective action DDoS"), but I hardly think it's 
> likely to cause confusion. In fact, the other term that's floated
> up is probably more a source of confusion. "Botnet" has clear
> implications of compromised machines, so I'd say that 'voluntary
> botnet' is tending towards the oxymoronic.
> 

One of the things that most people who try to rationalize a DoS attack
as a "justified method of protest" forget that a lot of innocent
bystanders are negatively affected by the "collateral damage" that DoS
attacks create, which is directly related to the proximity of the
bystander to the target relative to shared bandwidth or other resources.

An attack is an attack is an attack...

There is no such thing as "justifiable" attack when it essentially
harms innocent bystanders, regardless of one's politics.

"The freedom to swing your fist stops when it hits my face." Period.

$.02,

- - ferg

- -- 
Paul Ferguson
PGP Public Key ID: 0x54DC85B2
Key fingerprint: 19EC 2945 FEE8 D6C8 58A1 CE53 2896 AC75 54DC 85B2

---

From: Joss Wright <[email-masked]>
Date: Tue, 19 Jan 2016 22:31:27 +0000

> bystander to the target relative to shared bandwidth or other resources.

A point that's equally applicable to real-world sit-ins, strikes, graffiti,
protests, and various other forms of direct action. I'm not disagreeing at all,
but this strikes me as exactly the point of these discussions: this is tying
into a much wider set of issues.

Joss

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 19 Jan 2016 17:32:50 -0500

> bystander to the target relative to shared bandwidth or other resources.

In general, I agree with the doubts being cast on DDoS as legitimate
protest.  But the "collateral damage" argument is, I think, a bad one
against it.

When in the physical world workers hold a strike and picket an
employer and so on, there is no question that many people are
negatively affected.  But that isn't "collateral damage".  That's in
fact the point.  Having a strike such that a business is negatively
affected does not mean it is negatively affected in terms of being
able to make its stuff.  It's instead negatively affected in terms of
being able to deliver to its customers, proceed with its ordinary
business with orhers, and so on.  Negatively affecting those others is
a significant part of the point of a work stoppage.

So it is with a DDoS (whether for supposedly-legitimate or
-illegitimate purposes).  It is not enough to take the target off the
Internet, because that will last only a short while at best and is
unlikely to result in permanent changes.  But driving away customers,
driving up costs of hosting or transit (because of the risk), making
it harder to find hosting locations (same reason), and negatively
affecting others on the same network (thereby driving up risk, so the
previous two items) are all long-term effects that the DDoS might
have.  If the DDoS has any aim at all (apart from simple destruction,
that is), then that "collateral damage" is in fact part of the
intended damage.  It needs to be, or the attack wouldn't have the
desired effect.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Paul Ferguson <[email-masked]>
Date: Tue, 19 Jan 2016 14:45:47 -0800

On 1/19/2016 2:32 PM, Andrew Sullivan wrote:

>> One of the things that most people who try to rationalize a DoS
>> attack as a "justified method of protest" forget that a lot of
>> innocent bystanders are negatively affected by the "collateral
>> damage" that DoS attacks create, which is directly related to the
>> proximity of the bystander to the target relative to shared
>> bandwidth or other resources.
> 
> In general, I agree with the doubts being cast on DDoS as
> legitimate protest.  But the "collateral damage" argument is, I
> think, a bad one against it.
> 
> negatively affected.  But that isn't "collateral damage".  That's
> in fact the point.  Having a strike such that a business is
> negatively affected does not mean it is negatively affected in
> terms of being able to make its stuff.  It's instead negatively
> affected in terms of being able to deliver to its customers,
> proceed with its ordinary business with orhers, and so on.
> Negatively affecting those others is a significant part of the
> point of a work stoppage.
> 
> -illegitimate purposes).  It is not enough to take the target off
> the Internet, because that will last only a short while at best and
> is unlikely to result in permanent changes.  But driving away
> customers, driving up costs of hosting or transit (because of the
> risk), making it harder to find hosting locations (same reason),
> and negatively affecting others on the same network (thereby
> driving up risk, so the previous two items) are all long-term
> effects that the DDoS might have.  If the DDoS has any aim at all
> (apart from simple destruction, that is), then that "collateral
> damage" is in fact part of the intended damage.  It needs to be, or
> the attack wouldn't have the desired effect.
> 

I would disagree that these are analogous (protests in the "real
world" vs. DoS attacks as a form of protest).

In the "real world", protesters get arrested if they don't play by the
rules, e.g. don't block traffic, cause risks to bystanders, carry
firearms, etc., and if they violate those rules, they are subject to
being arrested and charged by law enforcement.

Of course, things don't always follow the script in the "real world",
and there are frequently "collateral damages" as you describe above.

The difference here is that there are guidelines -- usually
municipality-by-municipality -- in the case of protests in the "real
world", and protests are allowed if certain guidelines are followed.

There are no guidelines that I am aware of for conducting a DDoS that
proscribes how not to harm others instead of the target of said attack.

- - ferg

- -- 
Paul Ferguson

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 19 Jan 2016 18:45:14 -0500

> being arrested and charged by law enforcement.

[…]

> proscribes how not to harm others instead of the target of said attack.

The way all those meat-world rules got adopted, as a matter of
history, was through the working out of whether or not there was a
right to strike.  Over time, as some jurisdictions determined that
there was such a right, they codified the way that you were allowed to
exercise the right.

If you believe in natural rights (I'm with Bentham on them, but let's
set that aside), and if you believe that online protest through this
mechanism is such a right, then the analogy is quite strong: here is a
natural right that you have and that is not recognized, and so there
are no accepted ways yet for how you exercise the right.  But as the
right gets recognized, so do acceptable ways of exercising it.  A DDoS
that includes unwilling participant computers is presumably not
allowed for the same reason that a strike cannot force non-unionized
employees to support the strike.  A DDoS that causes unfortunate
consequences for the hosting business, however, might still conform to
the analogy.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 20 Jan 2016 00:00:57 +0000

> consequences for the hosting business, however, might still conform to

I really think this is a bad analogy stretched way beyond
breaking point.

In a strike the strikers also suffer and the side effects on
uninvolved parties are mostly minimal. Yes, one could try find
a really exceptional case that's significantly different.

I think we've agreed that 99.9% of DDoS involves botnets and
deliberate and lasting damage to tens or hundreds of thousands
of uninvolved parties' networks or computers. Yes, there might
have been a handful of DoS-like attacks that were different.

But strikes and DDoS are just not similar things at all as
can be seen from the above.

And Andrew, even if your analogy was not so utterly broken
(as it in fact is:-) what explanatory benefit do we gain from
it? I think the answer is none, so it's both a broken and a
useless analogy, no matter that it might superficially sound
less broken and as if it might maybe possibly explain something
even if we can't say what.

It could be useful for hrpc to discuss forms of protest on the
Internet (in support of freedom of expression say) but this
particular discussion isn't IMO useful and seems to rest on
a misunderstanding of the very different nature of protests
like strikes and DDoS.

S.

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 19 Jan 2016 19:17:15 -0500

On Wed, Jan 20, 2016 at 12:00:57AM +0000, Stephen Farrell wrote:
> it?

I seem to recall starting by saying that I think that there is no
right to DDoSing anyway, but that the argument from "innocent
bystanders" was a bad argument against DDoS rights.  If you're going
to make the "collateral damage" argument, you are stuck dealing with
these kinds of analogies.  I agree they can be attacked (all analogies
can be), but it's a losing game.  Arguments from precedent are all
analogies and, by definition, analogies involve cases that have
differences (otherwise, it's not an analogy).  

I prefer to deny the premise that we can even contemplate a right
here.  I think the reason DDoS isn't an acceptable political act or a
protected right is precisely because it is an attack on the
Internetworking infrastructure itself.  It is therefore an attack on
the very means of expression of any possible online right, and
consequently it is absurd.  If any argument about rights is to be
coherent, it cannot rely on the absurdity of those rights.  So there
cannot be this right.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 20 Jan 2016 00:23:24 +0000

> coherent, it cannot rely on the absurdity of those rights.  So there

I agree that there is no such "right to DDoS" and that DDoS
is unacceptable and ought always be treated as an attack
regardless of anyone's real or claimed motivation.

Cheers,
S.

---

From: Mallory Knodel <[email-masked]>
Date: Tue, 19 Jan 2016 21:11:07 -0500

> regardless of anyone's real or claimed motivation.

I agree; expressing this as a right is literally nonsense. What is civil
disobedience without the "disobedience" part? As a supporter of
activists who use DDoS, I think it's fine, if not great, that most
people hate it. It's that discomfort that makes it work.

But more to the original point:

> first, it would require developing a method to establish when a DDoS
> attack is a legitimate expression of the right to freedom of speech,
> or whether it impedes on it.

Is there a way to completely eradicate DoS? Probably not. I mean, for
the purposes of making the internet work better perhaps we should try. I
don't think this will get in the way of activists using the internet in
creative ways to make a point.

> Second, it asks the IETF to reflect upon its role in creating a
> commercialized Internet that has no defacto public space of inherent
> Internet, David Clark, recently published a paper warning that the
> control over the Internet is too strong, limiting the myriad of ways
> in which it can be used (Daedalus 2016), including for freedom of speech.

This is very important. I want to think more about how to make all
conversations this conversation.

> As such, it is important for the IETF to consider the fact that DDoS
> attacks are inherently dual-use and not take immediate sides on this
> discussion. 

Yes, DDoS is dual use. But again, even *if* we could get everyone to
agree that DDoS is not a denial of free expression, not to mention an
act that is widely condoned, then the action simply loses its teeth. The
last thing we want is the online equivalent of "free speech zones"[0]
sanctioned by IETF or anyone for that matter.

-Mallory

[0] https://en.wikipedia.org/wiki/Free_speech_zone
-- 
Mallory Knodel
Association for Progressive Communications :: apc.org <https://apc.org>
gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9 B071 0C32 A271 BD3C C780

---

From: Jeroen van der Ham <[email-masked]>
Date: Wed, 20 Jan 2016 09:23:29 +0100

> On 20 Jan 2016, at 03:11, Mallory Knodel <[email-masked]> wrote:
> 
>> first, it would require developing a method to establish when a DDoS attack is a legitimate expression of the right to freedom of speech, or whether it impedes on it.
> 
> Is there a way to completely eradicate DoS? Probably not. I mean, for the purposes of making the internet work better perhaps we should try. I don't think this will get in the way of activists using the internet in creative ways to make a point.

One way to at least make it harder is universal adoption of BCP38 and 84.
This way you make performing DDoSes harder, and certainly more attributable.

Making it harder for DDoS attackers to hide, may make it more acceptable as a form of legitimate protest. Although I completely agree that most DDoS attacks currently are not in this category. Most attacks currently are either extortion or disrupting technical services in schools.

Another form of protest on the Internet currently seem to be defacements. However, these are currently more akin to graffiti and less to blocking access to services.

Jeroen.

---

From: Seun Ojedeji <[email-masked]>
Date: Wed, 20 Jan 2016 10:46:05 +0100

Well, DDoS is not a protocol but a procedure/process that relies on/use
existing protocols. Those protocols have their own benefits/advantages that
cannot be underestimated. I know network admin colleagues(oh yes probably
guilty as well) who for one reason or the other have utilised those
targeted DDoS (ideas) towards an intruder (whether it's legitimate or a
right is a different thing)

So while I am not supporting that DDoS is a good thing, my point is that as
one looks to review existing RFCs(if required) or adopt best practice(as
you indicated), it has to be that creativity and innovation opportunities
is not lost as that is one of the reasons the internet has naturally grown
and flourished.  I personally like BCPs referenced and appreciate using BCP
approach to address these issues as much as possible.

Lastly, I use a modified version of Stephen's statement, "Is there a way to
completely eradicate DoS...for the purposes of making the internet work
better AND REMAIN OPEN perhaps we should NOT try..."

Regards
On 20 Jan 2016 09:23, "Jeroen van der Ham" <[email-masked]> wrote:

> attack is a legitimate expression of the right to freedom of speech, or
> whether it impedes on it.
> >
> Making it harder for DDoS attackers to hide, may make it more acceptable
> as a form of legitimate protest. Although I completely agree that most DDoS
> attacks currently are not in this category. Most attacks currently are
> either extortion or disrupting technical services in schools.
>
> Another form of protest on the Internet currently seem to be defacements.
> However, these are currently more akin to graffiti and less to blocking
> access to services.
>
> Jeroen.

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 20 Jan 2016 10:27:07 +0000

The quoting below has gotten messed up and attributes text to me
that I didn't write.

I do not consider that that rights language is even appropriate
when discussing DDoS, which is always and only an attack.

And FWIW, IMO anyone who claims that any DDoS can ever be somthing
other than an attack is as a side-effect damaging the work that we
have been doing over the last few years to counter pervasive
monitoring (PM). (And yes, that's why I'm so loud in this thread:-)

Effectively countering PM (to the extent we can) requires us to
not consider the motives of the attacker. In the case of DDoS we
should follow the same logic, and conclude DDoS is always an
attack. The only alternative I see is to (stupidly) start to
consider some attacks and attackers as "ok" and therefore lose
the ability to make a cogent argument against PM. Let's not do
the latter.

I'd argue that the right thing to do here for us all to agree
that there's no utility in ever talking about DDoS other than as
an attack, and to declare victory for this topic with that result.

S

On 20/01/16 08:23, Jeroen van der Ham wrote:
>>> first, it would require developing a method to establish when a
>>> DDoS attack is a legitimate expression of the right to freedom of
>>> speech, or whether it impedes on it.
>> 
>> Is there a way to completely eradicate DoS? Probably not. I mean,
>> for the purposes of making the internet work better perhaps we
>> should try. I don't think this will get in the way of activists
>> using the internet in creative ways to make a point.
> 
> One way to at least make it harder is universal adoption of BCP38 and
> 84. This way you make performing DDoSes harder, and certainly more
> attributable.
> 
> Making it harder for DDoS attackers to hide, may make it more
> acceptable as a form of legitimate protest. Although I completely
> agree that most DDoS attacks currently are not in this category. Most
> attacks currently are either extortion or disrupting technical
> services in schools.
> 
> Another form of protest on the Internet currently seem to be
> defacements. However, these are currently more akin to graffiti and
> less to blocking access to services.
> 
> Jeroen. _______________________________________________ hrpc mailing
> list [email-masked] https://www.irtf.org/mailman/listinfo/hrpc
>

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 21 Jan 2016 11:01:04 +0100

Hi all,

Am enjoying this thread. Some replies inline:

> when discussing DDoS, which is always and only an attack.

I think we're getting to the core of the matter here.

> monitoring (PM). (And yes, that's why I'm so loud in this

If I can try to translate what Stephen is saying in rights langauge:
IETF is working on freedom of expression and access to information (=
connectivity), everything that hinders that, even if that falls under
the Right to Association / Protest (some particular uses of DDoS),
that is a inherent violation.

If this is a correct representation, I'm not sure if it is in line
with human rights law where human right should be balanced.

Perhaps we could also consider 'proportionality' (of DDoS) here?

> Effectively countering PM (to the extent we can) requires us to not
> consider the motives of the attacker. In the case of DDoS we should
> follow the same logic, and conclude DDoS is always an attack. The
> only alternative I see is to (stupidly) start to consider some
> attacks and attackers as "ok" and therefore lose the ability to
> make a cogent argument against PM. Let's not do the latter.
> 

I don't think the IETF should consider the motive of the attacker, and
I think one can still consider DDoS (in some cases) as legitimate
while still trying to make it much harder (as Jeroen said for instance
by implementing BCP38 and 84).

> I'd argue that the right thing to do here for us all to agree that
> there's no utility in ever talking about DDoS other than as an
> attack, and to declare victory for this topic with that result.
> 

Am afraid we're not yet at this conclusion yet, but happy to continue
to discuss.

Cheers,

Niels

>>>> first, it would require developing a method to establish when
>>>> a DDoS attack is a legitimate expression of the right to
>>>> freedom of speech, or whether it impedes on it.
>>> 
>>> Is there a way to completely eradicate DoS? Probably not. I
>>> mean, for the purposes of making the internet work better
>>> perhaps we should try. I don't think this will get in the way
>>> of activists using the internet in creative ways to make a
>>> point.
>> 
>> One way to at least make it harder is universal adoption of BCP38
>> and 84. This way you make performing DDoSes harder, and certainly
>> more attributable.
>> 
>> acceptable as a form of legitimate protest. Although I
>> completely agree that most DDoS attacks currently are not in this
>> category. Most attacks currently are either extortion or
>> disrupting technical services in schools.
>> 
>> defacements. However, these are currently more akin to graffiti
>> and less to blocking access to services.
>> 
>> Jeroen. _______________________________________________ hrpc
>> mailing list [email-masked]

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 21 Jan 2016 11:07:44 +0100

Hi Mallory,

On 01/20/2016 03:11 AM, Mallory Knodel wrote:
>>> I prefer to deny the premise that we can even contemplate a
>>> right here.  I think the reason DDoS isn't an acceptable
>>> political act or a protected right is precisely because it is
>>> an attack on the Internetworking infrastructure itself.  It is
>>> therefore an attack on the very means of expression of any
>>> possible online right, and consequently it is absurd.  If any
>>> argument about rights is to be coherent, it cannot rely on the
>>> absurdity of those rights.  So there cannot be this right.
>> I agree that there is no such "right to DDoS" and that DDoS is
>> unacceptable and ought always be treated as an attack regardless
>> of anyone's real or claimed motivation.
> 
> I agree; expressing this as a right is literally nonsense. What is
> civil disobedience without the "disobedience" part? As a supporter
> of activists who use DDoS, I think it's fine, if not great, that
> most people hate it. It's that discomfort that makes it work.
> 

I have a hard time understanding your argument here Mallory. Do you
think everyone who used DDoS should be exposed to legal cases because
else it would not be an effective tool and it is the risk of the game?

>> commercialized Internet that has no defacto public space of
>> inherent protections for freedom of speech. One of the founding
>> fathers of the Internet, David Clark, recently published a paper
>> warning that the future of the Internet is in danger. He argues
>> that the private sector control over the Internet is too strong,
>> limiting the myriad of ways in which it can be used (Daedalus
>> 2016), including for freedom of speech.
> 
>> As such, it is important for the IETF to consider the fact that
>> DDoS attacks are inherently dual-use and not take immediate sides
>> on this discussion.
> 
> Yes, DDoS is dual use. But again, even *if* we could get everyone
> to agree that DDoS is not a denial of free expression, not to
> mention an act that is widely condoned, then the action simply
> loses its teeth. The last thing we want is the online equivalent of
> "free speech zones"[0] sanctioned by IETF or anyone for that
> matter.
> 

Here you seem to say that legal / accepted protest is ineffective. Am
I right? #confused.

Best,

Niels

> -Mallory
> 
> [0] https://en.wikipedia.org/wiki/Free_speech_zone -- Mallory
> Knodel Association for Progressive Communications :: apc.org
> <https://apc.org> gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9 B071
> 0C32 A271 BD3C C780
> 
>

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 21 Jan 2016 11:57:14 +0000

Hi Niels,

> I think we're getting to the core of the matter here.

Yes, DDoS is only an attack.

> that is a inherent violation.

FWIW, I think I disagree with every possible way in which I
can read the above paragraph, while still being entirely
unclear what it's meant to mean:-)

It is certainly not something I can imagine as a translation
of what I said. And what I said was that I don't think rights
language is useful or appropriate when discussing DDoS, so
"translating" my actual statement into rights language should
I think result in a NULL statement and not the above.

S.

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 21 Jan 2016 13:16:07 +0100

Hi Stephen,

On 01/21/2016 12:57 PM, Stephen Farrell wrote:
>>> The quoting below has gotten messed up and attributes text to
>>> me that I didn't write.
>> 

Something in never only one thing imho.

>> 
>>> And FWIW, IMO anyone who claims that any DDoS can ever be
>>> somthing other than an attack is as a side-effect damaging the
>>> work that we have been doing over the last few years to counter
>>> pervasive monitoring (PM). (And yes, that's why I'm so loud in
>>> this thread:-)
>> 
>> 
>> If I can try to translate what Stephen is saying in rights
>> langauge: IETF is working on freedom of expression and access to
>> information (= connectivity), everything that hinders that, even
>> if that falls under the Right to Association / Protest (some
>> particular uses of DDoS), that is a inherent violation.
> 
> FWIW, I think I disagree with every possible way in which I can
> read the above paragraph, while still being entirely unclear what
> it's meant to mean:-)

We seem to have this problem more often ;)

> 
> It is certainly not something I can imagine as a translation of
> what I said. And what I said was that I don't think rights language
> is useful or appropriate when discussing DDoS,

That is another argument, right? Saying DDoS should not be a right, or
DDoS is not a form of digital protest or association is something else
than saying rights language is not useful or appropriate. Let me know
which of the above (or other) you deem correct.

> so "translating" my actual statement into rights language should I
> think result in a NULL statement and not the above.

OK, maybe it was indeed a summary of earlier point. Let me try to
summarize that para again:

DDoS is strengthening the case for pervasive monitoring and therefore
DDoS is indirectly undermining the rights to privacy.

My problem with this point would be: PM is the only way to react to
DDoS, right?

Best,

Niels

> 
> S.
> 
>> 
>> If this is a correct representation, I'm not sure if it is in
>> line with human rights law where human right should be balanced.
>> 
>>> not consider the motives of the attacker. In the case of DDoS
>>> we should follow the same logic, and conclude DDoS is always an
>> I don't think the IETF should consider the motive of the
>> attacker, and I think one can still consider DDoS (in some cases)
>> as legitimate while still trying to make it much harder (as
>> Jeroen said for instance by implementing BCP38 and 84).
>> 
>>> that there's no utility in ever talking about DDoS other than
>>> as an attack, and to declare victory for this topic with that
>>> result.
>> 
>> 
>> Am afraid we're not yet at this conclusion yet, but happy to
>> continue to discuss.
>> 
>> Cheers,
>> 
>> Niels
>> 
>>> S
>> 
>>>>>> first, it would require developing a method to establish
>>>>>> when a DDoS attack is a legitimate expression of the
>>>>>> right to freedom of speech, or whether it impedes on it.
>>>>> 
>>>>> Is there a way to completely eradicate DoS? Probably not.
>>>>> I mean, for the purposes of making the internet work
>>>>> better perhaps we should try. I don't think this will get
>>>>> in the way of activists using the internet in creative ways
>>>>> to make a point.
>>>> 
>>>> One way to at least make it harder is universal adoption of
>>>> BCP38 and 84. This way you make performing DDoSes harder, and
>>>> certainly more attributable.
>>>> 
>>>> completely agree that most DDoS attacks currently are not in
>>>> this category. Most attacks currently are either extortion
>>>> or disrupting technical services in schools.
>>>> 
>>>>  defacements. However, these are currently more akin to
>>>> graffiti and less to blocking access to services.
>>>> 
>>> _______________________________________________ hrpc mailing
>> _______________________________________________ hrpc mailing

---

From: Roland Bless <[email-masked]>
Date: Thu, 21 Jan 2016 13:30:29 +0100

Hi,

> an attack and nothing else, regardless of motivation.

+1

Regards,
 Roland

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 21 Jan 2016 13:32:54 +0100

>> attack and nothing else, regardless of motivation.

What would be the argument for this though? That DDoS harms more
rights (directly and indirectly) than it enables?

Best,

Niels

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 21 Jan 2016 12:32:57 +0000

Hiya,

> Something in never only one thing imho.

Disagree. DDoS is a pretty clearly defined technical term.

It has nothing whatsoever to do with a million-person march
as the origin of this thread wondered. That was IMO a simple
misunderstanding that has lead to this pointless analogising.

> We seem to have this problem more often ;)

And that's fine for this group I reckon, given that (for me
at least) a big part of the work here is figuring out useful
translations. (Unlike the above:-)

> That is another argument, right? 

That's the main argument. (And was at the top of the mail to
which you responded I think.)

> Saying DDoS should not be a right, or

No, that's not at all an accurate paraphrasing of the secondary
argument I made. Let me try state it again:

- Statement X: 'A claim that DDoS is sometimes "ok" depending on
  the attacker's motives'

- Part of the argument against PM is that we don't consider the
  attacker's motives (see 7258 for why)

- Defending statement X calls into question that part of the
  argument against PM and hence undermines that work

S.

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 21 Jan 2016 13:49:35 +0100

Heya,

On 01/21/2016 01:32 PM, Stephen Farrell wrote:
>>>>> The quoting below has gotten messed up and attributes text
>>>>> to me that I didn't write.
>>>> 
>>>>> I do not consider that that rights language is even
>>>>> appropriate when discussing DDoS, which is always and only
>>>>> an attack.
>>>> 
>>>> 

Yes, but a technical definition might not capture all dimensions of a
concept/phenomena/object.

> 
> It has nothing whatsoever to do with a million-person march as the
> origin of this thread wondered. That was IMO a simple 

So you disregard these examples provided by Colin and Josh?:

Operation Ababil:
http://ddanchev.blogspot.com/2012/09/dissecting-operation-ababil-osint.h
tml
Green Movement DDoS: https://www.nartv.org/2009/06/16/iran-ddos/

The use of LOIC by 4chan and Anonymous are probably the most
well-known examples that spring to mind.

The Wikipedia page (
https://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon#Notable_uses )
notes "Project Chanology", "Operation Payback", and "Operation
Megaupload" as occasions in which LOIC was used for protest.

>>>>> somthing other than an attack is as a side-effect damaging
>>>>> the work that we have been doing over the last few years to
>>>>> counter pervasive monitoring (PM). (And yes, that's why I'm
>>>>> so loud in this thread:-)
>>>> 
>>>> 
>>>> langauge: IETF is working on freedom of expression and access
>>>> to information (= connectivity), everything that hinders
>>>> that, even if that falls under the Right to Association /
>>>> Protest (some particular uses of DDoS), that is a inherent
>>>> violation.
>> 
> And that's fine for this group I reckon, given that (for me at
> least) a big part of the work here is figuring out useful 
>>> language is useful or appropriate when discussing DDoS,
>> 
> That's the main argument. (And was at the top of the mail to which
> you responded I think.)
> 
>> Saying DDoS should not be a right, or DDoS is not a form of
>> digital protest or association is something else than saying
>> rights language is not useful or appropriate. Let me know which
>> of the above (or other) you deem correct.
>> 
>>> so "translating" my actual statement into rights language
>>> should I think result in a NULL statement and not the above.
>> 
>> OK, maybe it was indeed a summary of earlier point. Let me try
>> to summarize that para again:
>> 
>> DDoS is strengthening the case for pervasive monitoring and
>> therefore DDoS is indirectly undermining the rights to privacy.
> 

Yes, but it also says:

	PM is distinguished by being indiscriminate and very
	large scale

That is not neccesarry the case with DDoS, right? Aren't we comparing
apples and oranges?

~n.,

>> My problem with this point would be: PM is the only way to react
>> to DDoS, right?
>> 
>> Best,
>> 
>> Niels
>> 
>> 
>> 
>> 
>> 
>> 
>>> S.
>> 
>>>> 
>>>> If this is a correct representation, I'm not sure if it is
>>>> in line with human rights law where human right should be
>>>> balanced.
>>>> 
>>>>> Effectively countering PM (to the extent we can) requires
>>>>> us to not consider the motives of the attacker. In the case
>>>>> of DDoS we should follow the same logic, and conclude DDoS
>>>>> is always an attack. The only alternative I see is to
>>>>> (stupidly) start to consider some attacks and attackers as
>>>>> "ok" and therefore lose the ability to make a cogent
>>>>> argument against PM. Let's not do the latter.
>>>> 
>>>> 
>>>> attacker, and I think one can still consider DDoS (in some
>>>> cases) as legitimate while still trying to make it much
>>>> harder (as Jeroen said for instance by implementing BCP38 and
>>>> 84).
>>>> 
>>>>> I'd argue that the right thing to do here for us all to
>>>>> agree that there's no utility in ever talking about DDoS
>>>>> other than as an attack, and to declare victory for this
>>>>> topic with that result.
>>>> 
>>>> 
>>>>>>>> first, it would require developing a method to
>>>>>>>> establish when a DDoS attack is a legitimate
>>>>>>>> expression of the right to freedom of speech, or
>>>>>>> Is there a way to completely eradicate DoS? Probably
>>>>>>> not. I mean, for the purposes of making the internet
>>>>>>> work better perhaps we should try. I don't think this
>>>>>>> will get in the way of activists using the internet in
>>>>>> One way to at least make it harder is universal adoption
>>>>>> of BCP38 and 84. This way you make performing DDoSes
>>>>>> harder, and certainly more attributable.
>>>>>> 
>>>>>> Making it harder for DDoS attackers to hide, may make it
>>>>>> more acceptable as a form of legitimate protest. Although
>>>>>> I completely agree that most DDoS attacks currently are
>>>>>> not in this category. Most attacks currently are either
>>>>>> extortion or disrupting technical services in schools.
>>>>>> 
>>>>>> Another form of protest on the Internet currently seem to
>>>>>> be defacements. However, these are currently more akin
>>>>>> to graffiti and less to blocking access to services.
>>>>>> 
>>>>>> Jeroen. _______________________________________________
>>>>>> hrpc mailing list [email-masked] 
>>>>> _______________________________________________ hrpc
>>>> list [email-masked]

---

From: Joss Wright <[email-masked]>
Date: Thu, 21 Jan 2016 12:49:35 +0000

On Thu, Jan 21, 2016 at 12:32:57PM +0000, Stephen Farrell wrote:
 
> No, that's not at all an accurate paraphrasing of the secondary argument I
> made. Let me try state it again:
> 
> - Statement X: 'A claim that DDoS is sometimes "ok" depending on the
> attacker's motives'

This depends on scope. If you are only taking a pure 'attack or not' viewpoint
then of course an attack is an attack is an attack, as you've stated. The
purpose of these discussions, as I understand them, is explicitly to include a
wider scope of human rights concerns. It's perfectly possible for it to be 'just
an attack' from a security perspective, and much more than 'just' an attack in a
broader context. Just as it would be feasible to say 'it's just packets being
sent, why are you adding all this language about attacks'?

Half of the problem here seems to be a complete lack of agreement on the
appropriate level of abstraction for the problem, or even an acceptance that
there are multiple possibly levels at which to view this. 

> - Part of the argument against PM is that we don't consider the attacker's
> motives (see 7258 for why)

You do, however, consider the 'intent' of the communicating parties in your
definition of an attack.

> - Defending statement X calls into question that part of the argument against
> PM and hence undermines that work

Which is by no means a reason to stop the discussion.

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 21 Jan 2016 12:58:00 +0000

> concept/phenomena/object.

Yes, as humans, we are capable of endless chatter:-)

> Megaupload" as occasions in which LOIC was used for protest.

Basically, yes. There are too few of those and they don't work
as well as the 99.9ish% of DDoS attacks that do abuse botnets.
That was all stated upthread I think.

> That is not neccesarry the case with DDoS, right? Aren't we comparing

No. DDoS usually is large scale and indiscriminate but that's
not relevant.

What is relevant is that the bogus argument here "for" DDoS as
a supposed valid form of protest depends on contradicting one
important part of the argument against PM.

We do need to be consistent as to whether we consider attacker's
motives or not, and "not" is the only good answer.

S.

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 21 Jan 2016 13:03:04 +0000

On 21/01/16 12:49, Joss Wright wrote:
> then of course an attack is an attack is an attack, as you've stated.

Correct.

> The
> wider scope of human rights concerns. 

A wider scope is fine. Bad argument is not. Arguing that DDoS is
sometimes "ok" depends on the bad argument that one does consider
the attacker's motives.

> It's perfectly possible for it to be 'just

No. My disagreement with this discussion is that it is based
on faulty logic, if one accepts that PM is an attack on the
basis set out in 7258.

> You do, however, consider the 'intent' of the communicating parties in your

No, we recognise that there is some intent of the communicating
parties, but don't depend on what that is, or whether it is good
or bad or just between those or shared more widely. That isn't
the same at all.

> Which is by no means a reason to stop the discussion.

Apparently not, but that's a pity. Note that recognising
that this particular thread is just worthless does not
mean stopping discussion - there are many other things
to discuss that are much more worthwhile I'm sure. And
it's also important sometimes to recognise that yes, we
went down a blind alley and that supposed analogy between
DDos and million-person marches was just bogus and
misleading and is just not worth following up on any more.

S.

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 21 Jan 2016 14:12:41 +0100

On 01/21/2016 01:58 PM, Stephen Farrell wrote:
>>>>>>> The quoting below has gotten messed up and attributes
>>>>>>> text to me that I didn't write.
>>>>>> 
>>>>>>> appropriate when discussing DDoS, which is always and
>>>>>>> only an attack.
>>>>>> 
>>>>>> 
>> Yes, but a technical definition might not capture all dimensions
>> of a concept/phenomena/object.
> 

Apparently we are :)

>> 
>> 
>>> It has nothing whatsoever to do with a million-person march as
>>> the origin of this thread wondered. That was IMO a simple 
tml
>> https://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon#Notable_uses
>> ) notes "Project Chanology", "Operation Payback", and "Operation 
> Basically, yes. There are too few of those and they don't work as
> well as the 99.9ish% of DDoS attacks that do abuse botnets. That
> was all stated upthread I think.
> 

Could it perhaps the discussion if we would differentiate between:
voluntary vs involuntary botnets? Because if we follow your argument,
the voluntary botnets aren't as harmful as well. One could also make a
strong argument about sovereignty and security here.

Or if you're gonna reply that intent of the host doesn't matter, that
also kind of defeats your argument about disregarding these examples,
right?

>> 
>>>> 
>>>>>> 
>>>>>>> And FWIW, IMO anyone who claims that any DDoS can ever
>>>>>>> be somthing other than an attack is as a side-effect
>>>>>>> damaging the work that we have been doing over the last
>>>>>>> few years to counter pervasive monitoring (PM). (And
>>>>>>> yes, that's why I'm so loud in this thread:-)
>>>>>> 
>>>>>> 
>>>>>> If I can try to translate what Stephen is saying in
>>>>>> rights langauge: IETF is working on freedom of expression
>>>>>> and access to information (= connectivity), everything
>>>>>> that hinders that, even if that falls under the Right to
>>>>>> Association / Protest (some particular uses of DDoS),
>>>>> FWIW, I think I disagree with every possible way in which
>>>>> I can read the above paragraph, while still being entirely 
>>>>> It is certainly not something I can imagine as a
>>>>> translation of what I said. And what I said was that I
>>>>> don't think rights language is useful or appropriate when
>>>>> discussing DDoS,
>>>> 
>>>> rights language is not useful or appropriate. Let me know
>>>> OK, maybe it was indeed a summary of earlier point. Let me
>>>> try to summarize that para again:
>>>> 
>>> - Statement X: 'A claim that DDoS is sometimes "ok" depending
>>> on the attacker's motives'
>> 
>> PM is distinguished by being indiscriminate and very large scale
>> 
>> That is not neccesarry the case with DDoS, right? Aren't we
>> comparing apples and oranges?
> 
> No. DDoS usually is large scale and indiscriminate but that's not
> relevant.
> 
> What is relevant is that the bogus argument here "for" DDoS as a
> supposed valid form of protest depends on contradicting one 
>>>> My problem with this point would be: PM is the only way to
>>>> react to DDoS, right?
>>>> 
>>>> Best,
>>>> 
>>>> Niels
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>>> S.
>>>> 
>>>>>> 
>>>>>> If this is a correct representation, I'm not sure if it
>>>>>> is in line with human rights law where human right should
>>>>>> be balanced.
>>>>>> 
>>>>>>> Effectively countering PM (to the extent we can)
>>>>>>> requires us to not consider the motives of the
>>>>>>> attacker. In the case of DDoS we should follow the same
>>>>>>> logic, and conclude DDoS is always an attack. The only
>>>>>>> alternative I see is to (stupidly) start to consider
>>>>>>> some attacks and attackers as "ok" and therefore lose
>>>>>>> the ability to make a cogent argument against PM. Let's
>>>>>>> not do the latter.
>>>>>> 
>>>>>> 
>>>>>>  attacker, and I think one can still consider DDoS (in
>>>>>> some cases) as legitimate while still trying to make it
>>>>>> much harder (as Jeroen said for instance by implementing
>>>>>> BCP38 and 84).
>>>>>> 
>>>>>>> I'd argue that the right thing to do here for us all
>>>>>>> to agree that there's no utility in ever talking about
>>>>>>> DDoS other than as an attack, and to declare victory
>>>>>>> for this topic with that result.
>>>>>> 
>>>>>> 
>>>>>> Am afraid we're not yet at this conclusion yet, but happy
>>>>>> to continue to discuss.
>>>>>> 
>>>>>> Cheers,
>>>>>> 
>>>>>> Niels
>>>>>> 
>>>>>>> S
>>>>>> 
>>>>>>>>> Is there a way to completely eradicate DoS?
>>>>>>>>> Probably not. I mean, for the purposes of making
>>>>>>>>> the internet work better perhaps we should try. I
>>>>>>>>> don't think this will get in the way of activists
>>>>>>>> One way to at least make it harder is universal
>>>>>>>> adoption of BCP38 and 84. This way you make
>>>>>>>> performing DDoSes harder, and certainly more
>>>>>>>> attributable.
>>>>>>>> 
>>>>>>>> Making it harder for DDoS attackers to hide, may make
>>>>>>>> it more acceptable as a form of legitimate protest.
>>>>>>>> Although I completely agree that most DDoS attacks
>>>>>>>> currently are not in this category. Most attacks
>>>>>>>> currently are either extortion or disrupting
>>>>>>>> technical services in schools.
>>>>>>>> 
>>>>>>>> Another form of protest on the Internet currently
>>>>>>>> seem to be defacements. However, these are currently
>>>>>>>> more akin to graffiti and less to blocking access to
>>>>>>>> services.
>>>>>>>> 
>>>>>>>> Jeroen.

---

From: Joss Wright <[email-masked]>
Date: Thu, 21 Jan 2016 13:37:29 +0000

On Thu, Jan 21, 2016 at 01:03:04PM +0000, Stephen Farrell wrote:
> > This depends on scope. If you are only taking a pure 'attack or not'
> > viewpoint then of course an attack is an attack is an attack, as you've
> > stated.
> 
> Correct.
> 
> > The purpose of these discussions, as I understand them, is explicitly to
> > include a wider scope of human rights concerns. 
> 
> A wider scope is fine. Bad argument is not. Arguing that DDoS is sometimes
> "ok" depends on the bad argument that one does consider the attacker's
> motives.

Why is it inherently a bad argument? I've read 7258, but my understanding is
that the argument against considering motivation is this:

"The same techniques to achieve PM can be used regardless of motivation.  Thus,
we cannot defend against the most nefarious actors while allowing monitoring by
other actors no matter how benevolent some might consider them to be, since the
actions required of the attacker are indistinguishable from other attacks.  The
motivation for PM is, therefore, not relevant for how PM is mitigated in IETF
protocols."

Which isn't an argument that considering motivation is inherently wrong in all
contexts, it's an argument that we can't build technical systems to prevent
"bad" PM that don't also prevent "good" PM. So it's perfectly reasonable, when
designing systems, to take the view that preventing all PM is the only feasible
goal. Extending that argument to some kind of universal truth would be silly.

Even in its simplest form, you have to make an argument that the definition as
you apply it to PM is necessarily equivalent to its application in DDoS. I
haven't seen that argument made either.

Again, and as I've argued before here, I see no problem with taking the same
view in DDoS from a design perspective -- that it's an attack and that
mitigation against it is broadly correct. That still doesn't address the wider
scope, though, and I completely reject that it ties into some kind of universal
'attacker motivations never matter, regardless of context' statement.

> > It's perfectly possible for it to be 'just an attack' from a security
> > perspective, and much more than 'just' an attack in a broader context. Just
> > as it would be feasible to say 'it's just packets being sent, why are you
> > adding all this language about attacks'?
> > 
> No. My disagreement with this discussion is that it is based on faulty logic,
> if one accepts that PM is an attack on the basis set out in 7258.

Which, it is clear from the discussion, that some people don't. 7258 is still
open to debate, and as I've pointed out above I disagree that the argument made
there holds in this discussion.

> No, we recognise that there is some intent of the communicating parties, but
> don't depend on what that is, or whether it is good or bad or just between
> those or shared more widely. That isn't the same at all.

No, it's not. There is clearly intent in a DDoS, though, when a person actively
participates. I would still want it defined as an attack, though, even though
your definition in 7258 leaves room for interpretation there.

> >> - Defending statement X calls into question that part of the argument
> >> against PM and hence undermines that work
> > 
> Apparently not, but that's a pity. 

Questioning a (potentially) flawed argument being applied in a new context is a
way to improve it. Arguing that you shouldn't do that because it might undermine
some other arguments is a pity.

> Note that recognising that this particular thread is just worthless does not
> mean stopping discussion - there are many other things to discuss that are
> much more worthwhile I'm sure. And it's also important sometimes to recognise
> that yes, we went down a blind alley and that supposed analogy between DDos
> and million-person marches was just bogus and misleading and is just not worth
> following up on any more.

It's also worth working out what aspects, if any, of an analogy are meaningful,
rather than taking it to its logical extreme and then discarding the entire
thing.

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 21 Jan 2016 08:59:57 -0500

> with human rights law where human right should be balanced.

A postulated right which is in its nature an attack on the foundation
of other rights is no right at all.  You cannot balance such a right
against any other, because it attacks its own claims to a right.

A DDoS attacks, by its nature, the open protocols of the Internet and
works by undermining the Internet infrastructure itself.  If every
Internet participant engaged in DDoS, then the supposed right here
(which I guess is claimed as a right by analogy with speech-acts)
would in fact be impossible, because the infrastructure to support the
right would no longer function.  By reductio, then, there can be no
right to perform a DDoS.

> Perhaps we could also consider 'proportionality' (of DDoS) here?

There is no possible proportion without absurdity.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 21 Jan 2016 09:04:57 -0500

> goal. Extending that argument to some kind of universal truth would be silly.

But it would not be silly to extend it to DDoS, which suffers from the
very same problem, since there is no technical difference.  There is
only difference of motivation, and there's no way to detect that
reliably.  (We could use the evil bit, of course, but I think we all
understand why that won't work.)

If the work of this RG is to be meaningful, it must be about HR
considerations _for protocols_.  So even if there is a right to
perform DDoS (which I reject, see upthread), there can be no relevant
considerations for protocols.  DDoS must be treated as an attack in
all cases, and dealt with the same way.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 21 Jan 2016 15:11:35 +0100

On 01/21/2016 03:04 PM, Andrew Sullivan wrote:

> perform DDoS (which I reject, see upthread), there can be no
> relevant considerations for protocols.

I agree with this, but this discussion will help us to understand the
relation between human rights and protocols and help us with coming up
with (a framework for) protocol transcending considerations.

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 21 Jan 2016 15:23:25 +0100

On 01/21/2016 02:59 PM, Andrew Sullivan wrote:
> A postulated right which is in its nature an attack on the
> foundation of other rights is no right at all.  You cannot balance
> such a right against any other, because it attacks its own claims
> to a right.
> 

Do you mean that rights cannot be on conflict with each other? It
happens all the time. We'll need to think of a framework for how to
balance them.

> A DDoS attacks, by its nature, the open protocols of the Internet
> and works by undermining the Internet infrastructure itself.  If
> every Internet participant engaged in DDoS, then the supposed right
> here (which I guess is claimed as a right by analogy with
> speech-acts) would in fact be impossible, because the
> infrastructure to support the right would no longer function.

That everyone has a specific right doesn't necessarily mean everyone
should be able to exercise that right at the same time.

> By reductio, then, there can be no right to perform a DDoS.
> 

Disagree.

> There is no possible proportion without absurdity.

In general or this specific case?

Cheers,

Niels

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 21 Jan 2016 09:30:46 -0500

> happens all the time. We'll need to think of a framework for how to

No, I mean that a right cannot attack itself.  DDoS is an attack on
the network infrastructure required to express anything on the
network, including the DDoS itself.  A right to do something that
defeats the doing of it is absurd.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 21 Jan 2016 15:34:59 +0100

On 01/21/2016 03:30 PM, Andrew Sullivan wrote:
>> Do you mean that rights cannot be on conflict with each other?
>> It happens all the time. We'll need to think of a framework for
>> how to balance them.
> 
> No, I mean that a right cannot attack itself.  DDoS is an attack
> on the network infrastructure required to express anything on the 

It's not an attack on the whole network. It is targeted, even though on
can indeed argue that there can be collateral damage, but hardly the
whole network.

Best,

Niels

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 21 Jan 2016 09:53:46 -0500

> can indeed argue that there can be collateral damage, but hardly the

Any particular DDoS is aimed at some part of the network, yes, but the
very activity contains a mechanism to foil the mechanism being able to
be used, in case someone else engaged in the same behaviour at the
same time.  I can think of no right worthy of the name my exercise of
which _by nature_ deprives another of the ability to exercise the same
right.

For instance, to take an uncontroversial one, if I exercise a right to
live that does not by its nature deprive another of that right (except
in perverse pholosophy class cases where there is a trolley and so
on). 

Perhaps I'm missing a case (though I confess I think such a right
would need rather a better defence than "someone considers it a right
now").

In any case, as I argued elsewhere in the thread, even if there is a
right to DDoS (which I do not concede, but set that aside), there can
be no protocol considerations for that anyway.  So the purported right
is not a useful topic of discussion here regardless, unless it is to
say that it is logically possible that there be rights for which there
can be no protocol considerations.  I'm willing to concede that claim
_a priori_, though.

A

-- 
Andrew Sullivan
[email-masked]

---

From: Mallory Knodel <[email-masked]>
Date: Thu, 21 Jan 2016 10:04:49 -0500

Hi Niels,

> else it would not be an effective tool and it is the risk of the game?

It's not the realm of the IETF to determine if people using DDoS for
political reasons be exposes to legal action. But yes, I recognise that
activists break the law for political reasons, meaning that they
sometimes get arrested. And then released once it's determined that
theirs were crimes of conscience.

Of course I don't hope to see people arrested for DDoS, no. I don't
think Anonymous or other groups who perform DDoS as a kind of online
civil disobedience are really counting on us in the IETF to officially
sanction their actions as legitimate. They will do them regardless of
whether or not someone tells them it's okay.

-Mallory

> > _______________________________________________ > hrpc mailing list >
[email-masked] > https://www.irtf.org/mailman/listinfo/hrpc > >

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 21 Jan 2016 16:25:32 +0100

On 01/21/2016 04:04 PM, Mallory Knodel wrote:
>>>>> I prefer to deny the premise that we can even contemplate
>>>>> a right here.  I think the reason DDoS isn't an acceptable 
>>>>> political act or a protected right is precisely because it
>>>>> is an attack on the Internetworking infrastructure itself.
>>>>> It is therefore an attack on the very means of expression
>>>>> of any possible online right, and consequently it is
>>>>> absurd.  If any argument about rights is to be coherent, it
>>>>> cannot rely on the absurdity of those rights.  So there
>>>>> cannot be this right.
>>> I agree; expressing this as a right is literally nonsense. What
>>> is civil disobedience without the "disobedience" part? As a
>>> supporter of activists who use DDoS, I think it's fine, if not
>>> great, that most people hate it. It's that discomfort that
>>> makes it work.
>> 
>> 
>> I have a hard time understanding your argument here Mallory. Do
>> you think everyone who used DDoS should be exposed to legal cases
>> because else it would not be an effective tool and it is the risk
>> of the game?
>> 
> 
> It's not the realm of the IETF to determine if people using DDoS
> for political reasons be exposes to legal action.

Agree. But we are discussing the issue whether DDoS can be part of the
right to association & protest, which could have impact on human
rights considerations for protocols.

> But yes, I recognise that activists break the law for political
> reasons, meaning that they sometimes get arrested.

For something to be a protest or political action it doesn't need to
be illegal, right? Not sure if I understand your argument.

> And then released once it's determined that theirs were crimes of
> conscience.

That is very dependent on the legal framework of the country where the
individual is arrested.

> 
> Of course I don't hope to see people arrested for DDoS, no. I
> don't think Anonymous or other groups who perform DDoS as a kind of
> online civil disobedience are really counting on us in the IETF to
> officially sanction their actions as legitimate.

That was also not the intention of the thread. It's trying to
understand the relations between human rights and protocols.

~n.,

> They will do them regardless of whether or not someone tells them
> it's okay.
> 
> -Mallory
> 
>>>> Second, it asks the IETF to reflect upon its role in creating
>>>> a commercialized Internet that has no defacto public space
>>>> of inherent protections for freedom of speech. One of the
>>>> founding fathers of the Internet, David Clark, recently
>>>> published a paper warning that the future of the Internet is
>>>> in danger. He argues that the private sector control over the
>>>> Internet is too strong, limiting the myriad of ways in which
>>>> it can be used (Daedalus 2016), including for freedom of
>>>> speech.
>> 
>>> This is very important. I want to think more about how to make
>>> all conversations this conversation.
>> 
>>>> As such, it is important for the IETF to consider the fact
>>>> that DDoS attacks are inherently dual-use and not take
>>>> immediate sides on this discussion.
>> 
>>> Yes, DDoS is dual use. But again, even *if* we could get
>>> everyone to agree that DDoS is not a denial of free expression,
>>> not to mention an act that is widely condoned, then the action
>>> simply loses its teeth. The last thing we want is the online
>>> equivalent of "free speech zones"[0] sanctioned by IETF or
>>> anyone for that matter.
>> 
>> 
>> Here you seem to say that legal / accepted protest is
>> ineffective. Am I right? #confused.
>> 
>> 
>> Best,
>> 
>> Niels
>> 
>>> -Mallory
>> 
>>> <https://apc.org> gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9
>>> B071 0C32 A271 BD3C C780
>> 
>> 
> -- Mallory Knodel Association for Progressive Communications ::
> apc.org <https://apc.org> gpg fingerprint :: E3EB 63E0 65A3 B240
> BCD9 B071 0C32 A271 BD3C C780
> 
> 
>

---

From: Mallory Knodel <[email-masked]>
Date: Thu, 21 Jan 2016 10:42:11 -0500

Hi again,

As per the below, I should have moved forward the discussion as it
relates to hrpc. I think it is important to acknowledge DDoS as a tool
for direct action online that exploits weaknesses in internet protocols.
We can elaborate a lot on this because it's interesting, but ultimately
I do not think that political DDoS should be expressed as a right, or
included in the rights formulation of the work, because this really
bends rights language beyond its usefulness.

-Mallory

On 21/01/16 10:04 AM, Mallory Knodel wrote:
> political reasons be exposes to legal action. But yes, I recognise
> that activists break the law for political reasons, meaning that they
> > > _______________________________________________ > hrpc mailing list

---

From: Christine Runnegar <[email-masked]>
Date: Thu, 21 Jan 2016 18:09:08 +0000

Joining the email thread …

I strongly support the view of others that the IETF community should regard DDoS as an attack on Internet infrastructure regardless of the motivation for the attack. But, for those who may not be very familiar with IETF threat analysis, it is helpful to understand that the terminology “attack” has a particularly technical meaning, which may be different from the common understanding of attack. Specifically, the notion of an “attack” in IETF parlance does not consider the attacker’s motivation.

If individuals or groups assert that they are exercising their right to freedom of expression through a DDoS attack, this is “their motivation”. In my view, whether or not their motivation is justified, in any given case, is not a matter for the IETF, but rather a policy or legal question. Perhaps the solution for the HRPC’s work is simply to note the claims that some entities engaging in DDoS attacks do so for the purpose of civil activism without going into whether or not such motivations are legitimate, or whether such action is appropriate and/or justified.

Christine Runnegar

> On 21 Jan 2016, at 4:42 PM, Mallory Knodel <[email-masked]> wrote:
> 
> Hi again,
> 
> As per the below, I should have moved forward the discussion as it relates to hrpc. I think it is important to acknowledge DDoS as a tool for direct action online that exploits weaknesses in internet protocols. We can elaborate a lot on this because it's interesting, but ultimately I do not think that political DDoS should be expressed as a right, or included in the rights formulation of the work, because this really bends rights language beyond its usefulness.
> 
> -Mallory
> 
>> It's not the realm of the IETF to determine if people using DDoS for political reasons be exposes to legal action. But yes, I recognise that activists break the law for political reasons, meaning that they sometimes get arrested. And then released once it's determined that theirs were crimes of conscience.
>> 
>> Of course I don't hope to see people arrested for DDoS, no. I don't think Anonymous or other groups who perform DDoS as a kind of online civil disobedience are really counting on us in the IETF to officially sanction their actions as legitimate. They will do them regardless of whether or not someone tells them it's okay.
>> 
>> -Mallory
>> 
> Association for Progressive Communications :: apc.org

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 21 Jan 2016 18:23:55 +0000

Hi Christine,

On 21/01/16 18:09, Christine Runnegar wrote:
> note the claims that some entities engaging in DDoS attacks do so for
> the purpose of civil activism

Personally, I think that would be misleading unless one really
emphasises that there are only a handful of known cases of that
kind of thing versus perhaps O(10^6) cases of DDoS attacks for
purely nefarious purposes. (*)

It'd not be a good plan to ignore many orders of magnitude of
difference like that.

Cheers,
S.

(*) I've no idea what the overall total number DDoS attacks
ever seen might be. I picked O(10^6) conservatively based on
a quick search that turned up the a claim that there were
143,410 attacks observed in Q4 2014 [1]

[1]
http://betanews.com/2015/03/24/ddos-attacks-reduce-in-frequency-but-grow-in-volume/

---

From: Christine Runnegar <[email-masked]>
Date: Thu, 21 Jan 2016 18:32:05 +0000

> On 21 Jan 2016, at 7:23 PM, Stephen Farrell <[email-masked]> wrote:
> 
> 
> Hi Christine,
> 

Totally agree. And, just to be clear, the use of “claims” was deliberate.

---

From: Mallory Knodel <[email-masked]>
Date: Thu, 21 Jan 2016 13:57:52 -0500

Hi

I like where this thread is going. I agree.

This is something I posted to Niels off-list, which he then asked me to
share here:

> I get that the right to peaceful protest is clear, and I also
> understand and support the argument that DDoS is a form of political
> action, if not also very much like protest. I do also recognize that
> it rubs up against freedom of expression, which is not a problem
> because sometimes rights conflict, as you've mentioned.
>
> Why I don't think hrpc needs to worry about it so much is that Article
> 11 focuses on freedom of association, which I think is perhaps more
> important of a focus in terms of the way activists use the internet to
> organise. I feel like this discussion on DDoS is a bit of a
> distraction from that larger issue.
>
> If we say that DDoS is protected under the right to peaceful protest,
> then we would have to say that the IETF acts against this right simply
> because they are trying to solve a very easy-to-fix and obvious
> weakness of the internet. But it is obviously not a direct or even
> indirect threat to civil disobedience online. *I think even Anonymous
> would rather have a better internet than the ability to DDoS*. So it
> just seems counter productive to make a claim that certain IETF
> initiatives are falling on the pro- or anti- side of rights.
>
> BUT I do definitely think it merits treatment in our work, just not in
> the same way that we direct attention towards anonymity for privacy,
> for example.

-Mallory

---

From: "Eric (Maule) Brunner-Williams" <[email-masked]>
Date: Thu, 21 Jan 2016 10:57:48 -0800

Corinne,

A few years ago I took part in an activity intended to deny service. The
activity was undertaken by many more people, using their access to general
purpose network attached programmable devices, and so "distributed", and
as I mentioned, intended to deny service, and so a distributed denial of
service attack.

The system under attack utilized rendezvous points for reconstitution, and
our work was to discover the algorithm(s) for the selection of rendezvous
points, and prevent the system from using these.
 
The rendezvous point were domain names in several namespaces, and the system
under attack the .C variant of the Conficker worm, which had obtained access
to a low multiple of 10^^7 (MS Windows) edge devices at the time of our work
to "DDos" that application.

I suggest that the framing you've provided is non-exhaustive of the fact
patterns likely in distributed responses stimuli originating from distributed
systems.

Cheers,
Eric Brunner-Williams
Eugene, Oregon

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Thu, 21 Jan 2016 14:27:05 -0500

> that is a inherent violation.

[ i understand that this was not what Stephen was trying to say, but i
  want to clarify why i think this framing is troubling anyway ]

>From what i've seen, the most DDoS are not violations of freedom of
expression, whether they're caused by activists or not.  They are also
violations of any sort of right to association and even rights to
protest.

Consider a small group that is effectively harrassed by DDoS out of
having any online community forums -- their freedom of association is
violated as much as their freedom of expression.  They cannot associate
with each other because of the DDoS.  If the group is itself attempting
to coordinate protests or petitions, their ability to do so is also
harmed.

Similarly, consider an organization that is forced by DDoS (or even
threat of DDoS) to move their infrastructure behind a DDoS mitigation
service, effectively inviting the DDoS mitigation service into their
circle of association.  There are very few effective and affordable DDoS
mitigation services in existence, and it's entirely conceivable that
none exist who are politically aligned with any given target of a DDoS.
Here, the freedom to *not* associate with parties that you wish to avoid
is abrogated due to DDoS.

The overwhelming majority of DDoS situations i've read about or seen
fall into a few categories:

 * extortion attempts
 * retribution against minority viewpoints or populations
 * DDoS for competitive advantage

The fact that there may be some instances where DDoS is used by "people
we like" and against "people we don't like" doesn't change that as a
mechanism (whose intent the network cannot determine, as others in this
thread have pointed out), it is an unambiguous attack on many different
human rights, including the rights of free association and the right to
protest.

Arguing in favor of DDoS as an acceptable mechanism on the basis of a
small handful of successful politically-justified DDoS actions seems no
different than arguing in favor of pervasive surveillance as an
acceptable mechanism on the basis of a small handful of law-enforcement
victories where pervasive surveillance resolves clear-cut rapes and
murders.

Both mechanisms can certainly made to achieve both narrowly-stated ends,
but not without broader consequences that come along for the ride.  And
the broader consequences to society (or to "the network" if you like) of
adopting or accepting either of these mechanisms are unambiguously
terrible.

        --dkg

---

From: [email-masked]
Date: Thu, 21 Jan 2016 15:45:35 -0500

Interesting thread, good cases.

My view is that even in warfare of the worst sort there are human
rights issues.

The premise being put forth is unnecessarily binary: That either DDoS
is right, or it's wrong, and if we can agree on which then the issue
is settled.

That's overly judgemental and tries to predict, as this thread is
trying to do, every possible way DDoS can arise.

What about in the course of cyber-warfare? If one country were
cyber-attacking another one could imagine the target's first response,
assuming just blocking the source was not an option, to DDoS the
source if possible. Or it could be on their list of engagements.

Or maybe not?

Maybe that's a cyber-war crime? Who is to say if no one writes this
all down with definitions etc?

Something very similar just went on on NANOG recently.

Someone suggested de-peering ASNs entirely which did not respond to
complaints of DDoS and other misbehavior.

I asked if there were any contracts, any agreements, anything written
down which they have agreed to or can be generally cited to identify
this behavior?

Was there any process in place for this de-peering?

Any way for a misidentified or misunderstood or even just disagreeing
("that's not our responsibility, who says it is?") accused to be
heard?

I suggested that right now it's "Justice By Router Commands" which
seems primitive and error-prone at best, vigilantism basically.

We can lay out hypothetical scenarios ad infinitum and try to use them
to adduce the worthiness of the topic but I'll assert that's an error.

All one really should be discussing are the boundaries of DDoS and the
implications for human rights issues.

To adjudicate DDoS per se is misguided just as adjudicating whether
kinetic warfare is right or wrong as a pre-requisite to any discussion
of human rights in that warfare context.

Some things are bad, some very bad, but human rights issues remain
even within very, very distasteful contexts.

Even the worst criminals have human rights.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]             | http://www.TheWorld.com
Purveyors to the Trade | Voice: +1 617-STD-WRLD       | 800-THE-WRLD
The World: Since 1989  | A Public Information Utility | *oo*

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 21 Jan 2016 17:38:19 -0500

> Was there any process in place for this de-peering?

I think this is a terrible mischaracterisation of the way the Internet
works.  Unfortunately it's of a piece with similar lines of thought
that I see all over the place lately, so I think I must respond to it.

By definition, the Internet is a network of networks [of networks
&c.].  Each participating network makes its own rules, including the
rules about how to interconnect.

This means that there is no duty whatsoever to route someone else's
packets.  There is no duty at all to peer, and therefore there needn't
be any contract or any "process in place for … de-peering".  This
non-contractual basis for collaborative growth is in fact what makes
the Internet grow the way it does.

As a consequence, if all the other networks decide you play badly, and
de-peer you, then your traffic won't flow.  That is not a violation of
your rights, any more than the fact that nobody is listening to
someone's views is a violation of that person's right to speak.

It does mean, however, that for us all to get the benefits of the
Internet, we each need to be conservative in what we send and liberal
in what we accept.  The complaints of misbehaviour are, in effect,
complaints that the sender is failing in the social contract to be
conservative in what it sends.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: [email-masked]
Date: Thu, 21 Jan 2016 20:56:07 -0500

This was not an individual (person or company) deciding to not route
certain networks.

This was a broad call for a boycott, a call for everyone sympathetic
on the huge NANOG list (thousands of network administrators) to refuse
to route all of Russia and/or China or whatever networks they had in
mind specifically due to some aggrieved misbehavior which was never
even clearly characterized.

IANAL but I dare say that in the US that rises to the level of an
illegal business boycott. See for example:

  https://www.ftc.gov/tips-advice/competition-guidance/guide-antitrust-laws/dealings-competitors/group-boycotts

or

  http://tinyurl.com/hl2lznf

Which starts:

  "Any company may, on its own, refuse to do business with another
  firm, but an agreement among competitors not to do business with
  targeted individuals or businesses may be an illegal boycott,
  especially if the group of competitors working together has market
  power..."

I daresay the NANOG list addresses almost exclusively competitors.

Tho some might be recused on a case by case basis it would seem to be
prima facie evidence of being in the same business as those targeted,
it's the North American Network Operators Group.

And working together I think it's safe to say they have market power.

Which of course is the only reason any believe such a boycott might be
effective and the only reason such a list would be addressed for this
purpose.

Their defense might be that the target was doing them harm but that
brings me back to my original point:

Where is this harm written down? What agreement has been violated?
What process was taken to cure? Where is any of that documented?

It isn't, or only in the most casual manner.

But that wasn't even my point here.

I never said a word about legalities but since you seemed to express
the situation as if there were an unassailable right involved I
thought I would point this legality out.

My point was that whatever it is that is motivating this boycott
should be clearly defined and characterized, written down, and agreed
upon, and a process and cure established.

Mob rule and vigilantism is ugly. Even when one imagines they are the
harmed party and in their rights.

I would hope that one high purpose of this list is to rise above that
sort of mob rule.

Which was my point to this list:

That whatever one's feelings about the four letters "DDoS" in the
context of human rights etc this needs to be documented and agreed
upon in clear language with transparent process and cure.

And further, that I believe any attempt to do so responsibly would
raise issues of doubt about its simplicity or self-evidentiary nature
as some are presenting here.

Finally, as I said in the previous note, even if a clear violation
were shown, that doesn't by itself preclude concerns for human rights.

Even of the accused, even of those found fully culpable.

Again, criminals also have human rights.

And there would also remain issues of collateral damage to the
innocent, and proportionality.

-- 
        -Barry Shein

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 21 Jan 2016 23:43:06 -0500

> even clearly characterized.

Sure.  And the manifest fact that neither "Russia" nor "China"
(whatever that means on the Internet) has disappeared from the
Internet suggests that such a broad call has so far resulted in no
failure.  We don't need de-peering rules for that.  We already have
the relevant pressure: internetworking increases the value at both
ends of the internetworked networks.

In my opinion (and, to be clear, speaking only as an individual), this
is why various statements by the government of a particularly populous
and influential country about "national priorities" and so on are
self-defeating.  On the real Internet, you don't get to plan where the
network grows, because if you try you will strangle it at the wrong
time or (network-topological) place.  And by "strangle it", I mean,
"you won't get the benefits".  The benefits won't disappear.  They'll
just flow elsewhere.

> And working together I think it's safe to say they have market power.

But this isn't "working together".  This is working independently, and
using judgement.  And so far, no such effort -- the one of which you
speak isn't the first, I know you know -- has been effective.
Internetworking is just too valuable.

> upon, and a process and cure established.

Yes, I know.  And that is precisely the claim I think it wrong.  For
it would involve a treaty of all with all.  

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: [email-masked]
Date: Fri, 22 Jan 2016 02:01:17 -0500

I don't know if this is a good use of this list, I tend to doubt it.

I brought up this de-peering example to illustrate that it's
worthwhile having agreed upon definitions of terms and some study of
how they might interact with human rights without rejecting the idea
out of hand.

THAT SAID...

 > ends of the internetworked networks.

This particular event only happened this month more or less, I don't
know that it's fair to claim "see! and nothing happened!"

I don't know where it's going and I suspect neither do you.

Maybe it was my interjection into that discussion that they needed to
define DDoS and develop some documentation, process, and cures which
gave some pause. At least I'd like to think so.

I was the one who suggested that "Russia" and "China" were ill-defined
in the message you're responding to tho I suspect those suggesting
de-peering could work up a list of ASNs if asked. If not then what are
they planning to de-peer?

If they are complaining that these ASNs are unresponsive to complaints
of DDoS etc they probably have some idea who those ignored complaints
were sent to.

They meant Russian and Chinese (and probably other) ASN's from which
bad behavior was chronically arising and were chronically
non-responsive where all that is of course poorly documented as far as
I could see.

I also suggested there might be language difficulties vis a vis
unresponsiveness and asked if they had made any effort to send their
complaints in Russian or Chinese as appropriate?

What do I do with complaints sent to me in Russian or Chinese? I don't
know, I don't think I've ever recognized one.

 > "you won't get the benefits".  The benefits won't disappear.  They'll

ok

 > Internetworking is just too valuable.

I quoted a legal statement from the US Federal Trade Commission
suggesting that one test for an illegal boycott was that those
involved had "market power".

And that -- my comment above -- taken as a group the subscribers of
NANOG would probably be identified as collectively having market power
if they should act on the proposal put forth to the group, to
collectively de-peer some set (by some definition) of misbehaving (by
some definition) of ASNs.

And if they behaved in concert, blocked a common set of ASNs, as a
result of publicly accessible discussion it would be a damned fool of
a court which would accept that they each did so purely as individual
acts.

But yes, I wasn't ordering the tide not to come in.

I was offering commentary on the idea being put forth that these ASN's
be de-peered as a reaction to their (claimed) bad behavior and
suggesting a possibly more productive path, formalize the complaints,
process, etc in writing.

 > it would involve a treaty of all with all.  

So why do we write RFCs? Or BCPs? Why are we here if not to produce
some sort of written document with some sort of standing?

I never suggested a "treaty", multilateral, polylateral, forward
lateral, or otherwise.

I did suggest that a set of documents defining disruptive behavior and
minimal expectations of responsiveness etc could be written up and
even signed by parties as pre-requisite to obtaining resources such as
ASNs etc. as an alternative to instituting wildcat business boycotts
or as a few suggested in that discussion: lawsuits (w/in what
jurisidiction?)

And that might be preferable and actually have some effect since
people have been spouting this sort of "Governance by Router Commands"
for about 20 years now, at least, with little success judging from the
continued complaints.

I think their complaints are real and substantial, and I'm suggesting
they need to better focus their response.

But for the purpose of this list terms need to be defined, researched,
and more, and not just dismissed out hand as "DDoS is always evil so
end of discussion".

-- 
        -Barry Shein

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 22 Jan 2016 12:56:19 -0500

Hi,

> I don't know if this is a good use of this list, I tend to doubt it.

The reason I think this belongs on this list is because it is a
foundational error in the discussion of any rights and the Internet.

> some sort of written document with some sort of standing?

We write them _not_ because they have some sort of "standing", but
because we need conventions.  Getting the benefit of the Internet
relies on interoperation without explicit agreements among the various
parties.  RFCs are, basically, advice for interoperation.  "If you do
it this way, then you'll interoperate.  If you don't, you might not."
The IETF is notable for its total lack of a protocol police force, and
that's because we're not writing law.  We're writing guides for how to
interoperate.  It's still your network; you can make your own rules if
you want.  You just won't get the benefits of interoperation.

So, the only part of rights claims that can be relevant for this RG
are those where there are choices in protcol design that could have an
effect on whether a right can be expressed.  Routing is designed in
such a way that people are free to choose not to route some ASN's
traffic.  In principle, a routing system could have been designed that
didn't give internetworkers that freedom.  In my view, the designers
made the right choice here in respect of human rights considerations,
for they maximised the freedom of a router operator to make choices.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: [email-masked]
Date: Fri, 22 Jan 2016 14:59:10 -0500

On January 22, 2016 at 12:56 [email-masked] (Andrew Sullivan) wrote:
 > because we need conventions.

I think you're mincing words, "standing" includes being blessed
(labelled and published) by the IETF as an official RFC.

I chose that word carefully.

At any rate sometimes these various written policies have some force,
sometimes they don't.

For example if one applies for resources from an RIR they will be
required to present the requisite need for those resources or they
will not get them. ICANN has a rather developed mechanism for judging
domain disputes (UDRP, URS) which can include ordering the registrar
to change or cancel ownership.

So your characterization has increasingly become a bit of a fiction,
or at least in its full generalization.

I suppose one could call all that a free individual choice to
participate...whether I take my next breath is a free choice.

At any rate resolving damaging behavior (DDoS) to others is a bit
outside of voluntarily adhering to protocol standards alone.

And human rights has a similar aspect.

How else to characterize denial or impedence of human rights?

It's certainly different than choosing not to implement the QoS field
in IP packets, etc. except where it has such implications (I suppose
any example could be beaten to death, but not ordinarily.)

As to this list all that still leaves the interesting area of where do
protocol standards perhaps inadvertantly intersect with human rights
issues. Or advertantly, I think the adoption of the 451 status code
would be an advertant case though is mostly mechanism rather than
policy, a way to annotate a result.

Onwards.

-- 
        -Barry Shein