138
Hal Roberts, Ethan Zuckerman, and John Palfrey
sensitivity of the survey subject, and the early stage of research in this fi eld. We used
neutral language that did not explicitly refer to DDoS attacks when querying the
experts for the list of sites, but some of the experts were familiar with our work and
therefore likely to bias their lists of independent media toward sites known to suffer
DDoS attacks. It is likely that the 14 percent of responding sites overrepresents sites
that have suffered a DDoS attack, since a survey on DDoS attacks may seem more
interesting — and worth responding to — to DDoS attack victims. These two factors
make the results of the survey less useful for answering questions about overall prevalence of DDoS attacks. We cannot, for these reasons, answer questions about what
percent of all independent media sites in our surveyed countries have suffered DDoS
attacks. But we believe that the responses are useful for investigating the nature of
attacks reported by the surveyed sites and the defenses used by those sites.
We conducted interviews in person, over Skype, and by e-mail with administrators
of 12 sites that experienced DDoS attacks. We contacted every survey respondent who
reported having been subject to a DDoS attack and requested a more in-depth interview. Six of the interview participants were recruited through this method. We found
the rest of the interview participants through media analysis or through referrals from
researchers and other contacts in the fi eld. We interviewed administrators of sites
based in Australia, Burma, China, Iran, Russia, and Vietnam. The interviews involved
a series of questions and answers tailored to each interviewee exploring the technical
details of attacks and the experiences of the administrators dealing with them. In a
few cases, we obtained and analyzed logs of attacks. We cannot publish the interviews
themselves for security reasons, but we include a number of fi ndings, in aggregate
form, from the interviews.
Additionally, we studied as many published reports of DDoS attacks as we could
fi nd by tracking accounts posted to the Web over the course of six months. Our sample
set includes 329 reports of attacks against more than 800 sites going back to 1998. We
also had the unexpected opportunity to study a DDoS attack that happened to occur
during the course of our research. Our research home, the Berkman Center for Internet
and Society at Harvard University, hosts the site of a sister research project, the Citizen
Media Law Project, which happened to be attacked by a sustained denial of service
attack. We were able to study that attack in progress, as it happened, for which we are
grateful to the unknown attackers.
Interconnected Methods of Contesting Information Online
A core fi nding from our survey and related methods is that DDoS attacks exist within
a portfolio of different attacks suffered by these sites. We also found that the same site
usually suffers from multiple types of attacks. During the past year, of the surveyed
sites,
Hal Roberts, Ethan Zuckerman, and John Palfrey
sensitivity of the survey subject, and the early stage of research in this fi eld. We used
neutral language that did not explicitly refer to DDoS attacks when querying the
experts for the list of sites, but some of the experts were familiar with our work and
therefore likely to bias their lists of independent media toward sites known to suffer
DDoS attacks. It is likely that the 14 percent of responding sites overrepresents sites
that have suffered a DDoS attack, since a survey on DDoS attacks may seem more
interesting — and worth responding to — to DDoS attack victims. These two factors
make the results of the survey less useful for answering questions about overall prevalence of DDoS attacks. We cannot, for these reasons, answer questions about what
percent of all independent media sites in our surveyed countries have suffered DDoS
attacks. But we believe that the responses are useful for investigating the nature of
attacks reported by the surveyed sites and the defenses used by those sites.
We conducted interviews in person, over Skype, and by e-mail with administrators
of 12 sites that experienced DDoS attacks. We contacted every survey respondent who
reported having been subject to a DDoS attack and requested a more in-depth interview. Six of the interview participants were recruited through this method. We found
the rest of the interview participants through media analysis or through referrals from
researchers and other contacts in the fi eld. We interviewed administrators of sites
based in Australia, Burma, China, Iran, Russia, and Vietnam. The interviews involved
a series of questions and answers tailored to each interviewee exploring the technical
details of attacks and the experiences of the administrators dealing with them. In a
few cases, we obtained and analyzed logs of attacks. We cannot publish the interviews
themselves for security reasons, but we include a number of fi ndings, in aggregate
form, from the interviews.
Additionally, we studied as many published reports of DDoS attacks as we could
fi nd by tracking accounts posted to the Web over the course of six months. Our sample
set includes 329 reports of attacks against more than 800 sites going back to 1998. We
also had the unexpected opportunity to study a DDoS attack that happened to occur
during the course of our research. Our research home, the Berkman Center for Internet
and Society at Harvard University, hosts the site of a sister research project, the Citizen
Media Law Project, which happened to be attacked by a sustained denial of service
attack. We were able to study that attack in progress, as it happened, for which we are
grateful to the unknown attackers.
Interconnected Methods of Contesting Information Online
A core fi nding from our survey and related methods is that DDoS attacks exist within
a portfolio of different attacks suffered by these sites. We also found that the same site
usually suffers from multiple types of attacks. During the past year, of the surveyed
sites,