Interconnected Contests
139
• 72 percent experienced national network fi ltering of their sites.
• 62 percent experienced DDoS attacks.
• 39 percent experienced an intrusion.
• 32 percent experienced a defacement.
• Of those experiencing a DDoS attack, 81 percent also experienced at least one of
the following other content controls: Internet fi ltering, intrusion, or defacement.
These numbers provide strong evidence that DDoS attacks are not an isolated problem
for independent media sites. Instead, DDoS attacks exist within a larger range of different kinds of attacks against the sites. In addition to the specifi c range of attacks
reported, the surveyed sites reported a high level of unexplained downtime during the
past year:
• 61 percent experienced unexplained downtime.
• Of those respondents who experienced unexplained downtime, 48 percent experienced seven or more days of unexplained downtime.
Unexplained downtime can be the result of factors other than attacks. Independent
media sites often suffer from a lack of experienced system administrators, leading both
to downtime and to the inability to diagnose the reasons for downtime. Still, the very
high amount of unexplained downtime experienced by these sites suggests more, and
possibly more complex, attacks than described by the answers to the preceding DDoS
question.
Our fi nding that a signifi cant number of sites have experienced 21 days or more of
downtime suggests that there is a serious shortage of technical capacity available to
respond to threats to independent media and human rights Web sites. Arbor Networks,
a leading DDoS mitigation fi rm, surveys large ISPs annually about their experience
with DDoS. Their survey of tier-one and -two ISPs suggests that most administrators
of large ISPs respond to a typical DDoS attack within an hour.
12 The administrators
we interviewed were unable to bring their sites back online in such a timely fashion.
Our in-depth interviews provided further support for the fi ndings, in both our
survey and media research, that DDoS attacks are often accompanied by intrusions,
defacements, fi ltering, and offl ine attacks. One administrator of more than a dozen
independent media sites reported DDoS attacks followed by offl ine extortion intended
to force him to retract a story. (He refused.) That same administrator reported being
subject not only to DDoS attacks but also to daily virus-laden e-mails targeting him
personally and about topics of confi dential interest to him; to weekly intrusion attacks
based on guessed passwords; and weekly defacement and complete deletion of at least
one of the sites under his control.
Another administrator had been subject to weeks-long, multigigabit DDoS attacks
but reported that a greater problem was the harassment of participants in the publication ’ s discussion forums: attackers broke into the discussion forum to steal and publish
139
• 72 percent experienced national network fi ltering of their sites.
• 62 percent experienced DDoS attacks.
• 39 percent experienced an intrusion.
• 32 percent experienced a defacement.
• Of those experiencing a DDoS attack, 81 percent also experienced at least one of
the following other content controls: Internet fi ltering, intrusion, or defacement.
These numbers provide strong evidence that DDoS attacks are not an isolated problem
for independent media sites. Instead, DDoS attacks exist within a larger range of different kinds of attacks against the sites. In addition to the specifi c range of attacks
reported, the surveyed sites reported a high level of unexplained downtime during the
past year:
• 61 percent experienced unexplained downtime.
• Of those respondents who experienced unexplained downtime, 48 percent experienced seven or more days of unexplained downtime.
Unexplained downtime can be the result of factors other than attacks. Independent
media sites often suffer from a lack of experienced system administrators, leading both
to downtime and to the inability to diagnose the reasons for downtime. Still, the very
high amount of unexplained downtime experienced by these sites suggests more, and
possibly more complex, attacks than described by the answers to the preceding DDoS
question.
Our fi nding that a signifi cant number of sites have experienced 21 days or more of
downtime suggests that there is a serious shortage of technical capacity available to
respond to threats to independent media and human rights Web sites. Arbor Networks,
a leading DDoS mitigation fi rm, surveys large ISPs annually about their experience
with DDoS. Their survey of tier-one and -two ISPs suggests that most administrators
of large ISPs respond to a typical DDoS attack within an hour.
12 The administrators
we interviewed were unable to bring their sites back online in such a timely fashion.
Our in-depth interviews provided further support for the fi ndings, in both our
survey and media research, that DDoS attacks are often accompanied by intrusions,
defacements, fi ltering, and offl ine attacks. One administrator of more than a dozen
independent media sites reported DDoS attacks followed by offl ine extortion intended
to force him to retract a story. (He refused.) That same administrator reported being
subject not only to DDoS attacks but also to daily virus-laden e-mails targeting him
personally and about topics of confi dential interest to him; to weekly intrusion attacks
based on guessed passwords; and weekly defacement and complete deletion of at least
one of the sites under his control.
Another administrator had been subject to weeks-long, multigigabit DDoS attacks
but reported that a greater problem was the harassment of participants in the publication ’ s discussion forums: attackers broke into the discussion forum to steal and publish