142
Hal Roberts, Ethan Zuckerman, and John Palfrey
For example, one participant — an administrator of a well-funded and prominent
Asia-based nonprofi t organization — reported that his organization shared two desktop
computers among its staff of several dozen people. Many of these staff members had
never touched a computer before working for the publication. Defending client computers that are so widely shared and used by such novice users, and that are specifi cally
and aggressively targeted, is an enormously diffi cult problem to solve for even one
organization, let alone for the fi eld as a whole. We know of at least one organization
focused on political rights in Asia that has a policy of reformatting the hard drive of
laptop computers that have been removed from the offi ce and used on other networks.
Most organizations do not have nearly this level of concern or technical competence,
even though most targeted organizations likely need to operate at this level of caution.
Two of the independent media site administrators we interviewed reported multiple
types of attacks coming from multiple sources, as well as confusion about the source
of the attacks. One participant was subject to a DDoS attack when he published a story
about a prominent government actor, and then was approached separately both by
the government actor with demands to take down the offending story and by the
group of cybercriminals who were carrying out the attacks with demands for money.
Another participant claimed that his site is sometimes attacked by the government
when it is unhappy with a particular story and sometimes attacked by activists in
opposition to the government when they are unhappy with a story (and sometimes
the activists have taken credit for attacks that the participant thought were certainly
coming from the government). Others we surveyed suggest that, in many cases, the
effectiveness of DDoS attacks was a matter of gaining press coverage rather than
success in taking and keeping a site down. In other words, even when DDoS is the
only attack a site faces, the actors and their motivations may be complex and
multilayered.
Site Administrators Worry about DDoS, among Other Attacks
Despite their prevalence, DDoS, intrusion, and defacement attacks are not the primary
concern for most independent media sites. Asked to rank the impact of various issues,
participants placed DDoS, intrusion, and defacement attacks squarely in the middle
of the pack among other Internet content-control issues. The issues were ranked in
the following order, with the most important issue listed fi rst and with the average
rank out of fi ve noted (a higher number implies a lower priority):
• Blocking access to the publication ’ s site by the government (2.47)
• Persecution of authors, publishers, or sources by the government (2.53)
• Intrusions, defacements, and denial of service attacks (2.89)
• Financial support for the publication (3.00)
• Technical issues other than defending against attacks (3.89)
Hal Roberts, Ethan Zuckerman, and John Palfrey
For example, one participant — an administrator of a well-funded and prominent
Asia-based nonprofi t organization — reported that his organization shared two desktop
computers among its staff of several dozen people. Many of these staff members had
never touched a computer before working for the publication. Defending client computers that are so widely shared and used by such novice users, and that are specifi cally
and aggressively targeted, is an enormously diffi cult problem to solve for even one
organization, let alone for the fi eld as a whole. We know of at least one organization
focused on political rights in Asia that has a policy of reformatting the hard drive of
laptop computers that have been removed from the offi ce and used on other networks.
Most organizations do not have nearly this level of concern or technical competence,
even though most targeted organizations likely need to operate at this level of caution.
Two of the independent media site administrators we interviewed reported multiple
types of attacks coming from multiple sources, as well as confusion about the source
of the attacks. One participant was subject to a DDoS attack when he published a story
about a prominent government actor, and then was approached separately both by
the government actor with demands to take down the offending story and by the
group of cybercriminals who were carrying out the attacks with demands for money.
Another participant claimed that his site is sometimes attacked by the government
when it is unhappy with a particular story and sometimes attacked by activists in
opposition to the government when they are unhappy with a story (and sometimes
the activists have taken credit for attacks that the participant thought were certainly
coming from the government). Others we surveyed suggest that, in many cases, the
effectiveness of DDoS attacks was a matter of gaining press coverage rather than
success in taking and keeping a site down. In other words, even when DDoS is the
only attack a site faces, the actors and their motivations may be complex and
multilayered.
Site Administrators Worry about DDoS, among Other Attacks
Despite their prevalence, DDoS, intrusion, and defacement attacks are not the primary
concern for most independent media sites. Asked to rank the impact of various issues,
participants placed DDoS, intrusion, and defacement attacks squarely in the middle
of the pack among other Internet content-control issues. The issues were ranked in
the following order, with the most important issue listed fi rst and with the average
rank out of fi ve noted (a higher number implies a lower priority):
• Blocking access to the publication ’ s site by the government (2.47)
• Persecution of authors, publishers, or sources by the government (2.53)
• Intrusions, defacements, and denial of service attacks (2.89)
• Financial support for the publication (3.00)
• Technical issues other than defending against attacks (3.89)