Interconnected Contests
137
particular, this in-depth review of the DDoS phenomenon builds on the observation
that the types of control mechanisms that states and others may employ have evolved
from the fi rst-generation Internet control process of technical fi ltering to the secondand third-generation controls that we have observed emerging since the middle part
of the 2000s.
9 As Ronald Deibert and Rafal Rohozinski say of these next-generation
controls in the opening chapter of Access Controlled :
Although there are several tactics that can be employed within this rubric — deliberate tampering
with domain name servers, virus and Trojan horse insertion, and even brute physical attacks
— the most common is the use of DDoS attacks. These attacks fl ood a server with illegitimate
requests for information from multiple sources — usually from so-called ‘ ‘ zombie ’ ’ computers that
are infected and employed as part of a ‘ ‘ botnet. ’ ’ The ONI has monitored an increasing number
of just-in-time blocking incidences using DDoS attacks, going back to our fi rst acquaintance
during the Kyrgyzstan parliamentary elections of 2005.
10
A group of ONI researchers have also tracked other early instances of DDoS attacks
in the Belarus elections of 2005, the Russia-Estonia dispute in 2007, and the RussiaGeorgia confl ict of 2008.
11 In this chapter, we build upon these previous fi ndings of
our ONI partners in this broad-based review of DDoS attacks that were independent
of particular sensitive political moments, as well as the detailed research on the 2008
Web defacement attacks in Burma in chapter 8.
Our research method in studying DDoS was multifaceted. We conducted an indepth analysis of media reports on human-rights and independent media-connected
DDoS attacks, surveyed independent media and human rights sites, conducted confi -
dential interviews, and hosted a working meeting with participants from multiple
related sectors in Cambridge, Massachusetts, in 2010. We shared our results with
knowledgeable peers before disseminating them and discussed possible responses to
the rising DDoS threat. Although our research was meant to cover DDoS broadly
around the world, Asia proved to be one of two regions we focused on, along with
the Commonwealth of Independent States (CIS). Our respondents in Asia came in
particular from Burma, China, and Vietnam, and we focus on cases from those countries here.
We sent a survey on DDoS attacks to a sample of 317 independent media and
human rights sites. We generated the sample by asking at least three local experts in
each of the nine target countries for the most prominent independent media in their
countries. We translated the survey into the primary Internet language of each surveyed country and also translated the recruitment e-mail to the primary language of
each site. We received full responses from 45 sites, for a response rate of 14 percent.
These survey methods limited our fi ndings in several ways. The sample involved
was not large. Despite this limitation, we perceive that the 45 responses amount to a
decent response rate for such a survey, given a series of special factors involved. These
factors included the diffi culty of reaching a key actor at each site, the inherent
137
particular, this in-depth review of the DDoS phenomenon builds on the observation
that the types of control mechanisms that states and others may employ have evolved
from the fi rst-generation Internet control process of technical fi ltering to the secondand third-generation controls that we have observed emerging since the middle part
of the 2000s.
9 As Ronald Deibert and Rafal Rohozinski say of these next-generation
controls in the opening chapter of Access Controlled :
Although there are several tactics that can be employed within this rubric — deliberate tampering
with domain name servers, virus and Trojan horse insertion, and even brute physical attacks
— the most common is the use of DDoS attacks. These attacks fl ood a server with illegitimate
requests for information from multiple sources — usually from so-called ‘ ‘ zombie ’ ’ computers that
are infected and employed as part of a ‘ ‘ botnet. ’ ’ The ONI has monitored an increasing number
of just-in-time blocking incidences using DDoS attacks, going back to our fi rst acquaintance
during the Kyrgyzstan parliamentary elections of 2005.
10
A group of ONI researchers have also tracked other early instances of DDoS attacks
in the Belarus elections of 2005, the Russia-Estonia dispute in 2007, and the RussiaGeorgia confl ict of 2008.
11 In this chapter, we build upon these previous fi ndings of
our ONI partners in this broad-based review of DDoS attacks that were independent
of particular sensitive political moments, as well as the detailed research on the 2008
Web defacement attacks in Burma in chapter 8.
Our research method in studying DDoS was multifaceted. We conducted an indepth analysis of media reports on human-rights and independent media-connected
DDoS attacks, surveyed independent media and human rights sites, conducted confi -
dential interviews, and hosted a working meeting with participants from multiple
related sectors in Cambridge, Massachusetts, in 2010. We shared our results with
knowledgeable peers before disseminating them and discussed possible responses to
the rising DDoS threat. Although our research was meant to cover DDoS broadly
around the world, Asia proved to be one of two regions we focused on, along with
the Commonwealth of Independent States (CIS). Our respondents in Asia came in
particular from Burma, China, and Vietnam, and we focus on cases from those countries here.
We sent a survey on DDoS attacks to a sample of 317 independent media and
human rights sites. We generated the sample by asking at least three local experts in
each of the nine target countries for the most prominent independent media in their
countries. We translated the survey into the primary Internet language of each surveyed country and also translated the recruitment e-mail to the primary language of
each site. We received full responses from 45 sites, for a response rate of 14 percent.
These survey methods limited our fi ndings in several ways. The sample involved
was not large. Despite this limitation, we perceive that the 45 responses amount to a
decent response rate for such a survey, given a series of special factors involved. These
factors included the diffi culty of reaching a key actor at each site, the inherent