Boing Boing has published an excerpt from Molly Sauter’s new book, The Coming Swarm, on Distributed Denial of Service attacks and the way the U.S. government has used the Computer Fraud and Abuse Act to portray the attacks as much more dangerous than merely virtual sit-ins. Sauter details the wide disparity in sentences between CFAA or online fraud convictions and physical sit-in trespassing misdemeanors.
As Sauter writes, the German case of Andreas-Thomas Vogel provides a model for how to recognise the political nature of these acts of civil disobedience online. She explains the case:
Andreas-Thomas Vogel … ran the libertad.de website during the 2001 Deportation Class action against Lufthansa Airlines. Vogel had posted a call to action on libertad.de and was arrested on charges on coercion. Initially in 2005, a lower court in Frankfurt found Vogel guilty of using force against Lufthansa, based predominantly on the economic losses the airline had suffered during the campaign, both in terms of lost sales and the costs of acquiring additional bandwidth to soak the protesters’ traffic. Vogel was sentenced to either pay a fine or serve 90 days in jail.
This is essentially the logic that U.S. courts have adopted, though under the CFAA, the penalties are much more severe. The PayPal 14, activists who allegedly launched DDoS attacks against PayPal and other online banking companies in response to those companies freezing WikiLeaks’ assets and incoming donations, were charged under the CFAA, which carries a 10-year prison sentence.
Pierre Omidyar, eBay founder who sat on PayPal’s board at the time of the financial blockade on WikiLeaks, muddied the logical waters further, writing,
If we want to make parallels between real-world protests and online protests, that means that one thousand people can have the effect of six million people demonstrating in front of your office. That seems like an excessive impact in the hands of each person. It’s like each protester can bring along 6,000 phantom friends without going to the trouble of convincing each of them to take an afternoon off and join the protest in the street.
But if financial institutions are allowed to block funds to a legitimate news organisation simply because the U.S. government doesn’t like them, and that action takes place online, protests against those institutions will take place online if they’re to have any impact.
German courts recognised this in the Vogel case, and their reasoning is exemplary:
a higher court overturned the verdict, finding, “. . . the online demonstration did not constitute a show of force but was intended to influence public opinion.” [1] Libertad responded to the ruling with a statement: “Although it is virtual in nature, the Internet is still a real public space. Wherever dirty deals go down, protests also have to be possible.”
As Sauter writes,
The Vogel case was the first international precedent to recognize the legal and philosophical arguments put forth by supporters of DDoS activist actions. The court decision pivots on the point that these actions were oriented to influence the public, and through that avenue, influence the actions of the Lufthansa corporation, rather than badgering the airline into conceding to a set of demands. Specifically, the judge ruled that the protest was not an action of force intended to compel an action from Lufthansa; the action’s intention was to impact public opinion first.
Sauter says, “There has been no such precedent-setting case thus far in the US courts.” In fact, U.S. courts have reversed the German reasoning: not only is this not protected speech, it’s something the U.S. wants to stamp down on harder than it would if it were a physical sit-in, to set an example. The government has sided with Omidyar’s argument, giving corporations the gift of the CFAA to punish virtual activists, having a far greater impact than those activists could ever hope for. “When used to prosecute activist DDoS actions,” Sauter writes, “the CFAA directly gives the targets of protest the ability to extort payments from activists for their dissent and disruption. When coupled with the innovative reality of online activism, the CFAA literally renders the internet a space where you can be charged hundreds of thousands of dollars for participating in a collective protest.”
