Interconnected Contests
143
While DDoS attacks are an increasingly prevalent form of Internet control, our
respondents listed conventional government fi ltering as the most serious problem
they face. Only 11 percent of respondents chose DDoS, intrusion, and defacement
attacks as the most pressing issue, and only 32 percent chose these attacks as one of
the two most pressing issues. These are particularly interesting fi ndings given the bias
of the study toward respondents facing such attacks. By comparison, 68 percent of
respondents chose persecution of authors, publishers, or sources by the government
as one of the two most pressing issues. Issues directly related to censorship and control
(fi ltering, persecution, and DDoS and other attacks) all ranked higher than the two
issues not directly related to censorship and control (fi nance and nonattack technical
issues).
Effective Responses to DDoS Attacks Are Elusive
A common response to a DDoS attack is to turn to the hosting ISP during the time of
the attack. The survey respondents had mixed luck getting their ISPs to defend them
against attacks. Of those who experienced a DDoS attack in the past year,
• 55 percent had their site shut down by their ISPs in response to the attack.
• 36 percent report that their ISP successfully defended them against a DDoS attack.
The number shut down by their ISPs is surprisingly high, considering that an ISP
will usually shut down an attacked site only when subject to a traffi c-based attack
(since other type of attacks generally do not directly affect the ISP ’ s network or other
customers). The fact that 55 percent of respondents suffering a DDoS attack had been
shut down by their ISPs at least once indicates that at least 55 percent, and almost
certainly more, of the sites had been subject to a traffi c-based attack. This fact, along
with the fact that only 36 percent of the respondents subject to DDoS attack had an
ISP that defended them against attack, indicates that for many independent media,
the local ISP is a weak point rather than a strong ally. We do not know whether the
reason for this poor defense of sites by their ISPs is that independent media sites are
customers of sites outside the core of ISPs able to respond to an attack in under an
hour or whether the reason is that the independent media sites are customers of the
core ISPs but are not able to pay for the DDoS protection that those ISPs generally sell
as an add-on service.
In our survey, we also asked site administrators about the defenses they had
tried when hit by a DDoS attack and how effective those defenses had been. Their
responses can be read as a map of how independent media escalate defenses against
DDoS attacks:
• 83 percent had fi xed problems with their existing Web application software, with
80 percent reporting that this measure was “ somewhat effective ” or “ effective. ”
143
While DDoS attacks are an increasingly prevalent form of Internet control, our
respondents listed conventional government fi ltering as the most serious problem
they face. Only 11 percent of respondents chose DDoS, intrusion, and defacement
attacks as the most pressing issue, and only 32 percent chose these attacks as one of
the two most pressing issues. These are particularly interesting fi ndings given the bias
of the study toward respondents facing such attacks. By comparison, 68 percent of
respondents chose persecution of authors, publishers, or sources by the government
as one of the two most pressing issues. Issues directly related to censorship and control
(fi ltering, persecution, and DDoS and other attacks) all ranked higher than the two
issues not directly related to censorship and control (fi nance and nonattack technical
issues).
Effective Responses to DDoS Attacks Are Elusive
A common response to a DDoS attack is to turn to the hosting ISP during the time of
the attack. The survey respondents had mixed luck getting their ISPs to defend them
against attacks. Of those who experienced a DDoS attack in the past year,
• 55 percent had their site shut down by their ISPs in response to the attack.
• 36 percent report that their ISP successfully defended them against a DDoS attack.
The number shut down by their ISPs is surprisingly high, considering that an ISP
will usually shut down an attacked site only when subject to a traffi c-based attack
(since other type of attacks generally do not directly affect the ISP ’ s network or other
customers). The fact that 55 percent of respondents suffering a DDoS attack had been
shut down by their ISPs at least once indicates that at least 55 percent, and almost
certainly more, of the sites had been subject to a traffi c-based attack. This fact, along
with the fact that only 36 percent of the respondents subject to DDoS attack had an
ISP that defended them against attack, indicates that for many independent media,
the local ISP is a weak point rather than a strong ally. We do not know whether the
reason for this poor defense of sites by their ISPs is that independent media sites are
customers of sites outside the core of ISPs able to respond to an attack in under an
hour or whether the reason is that the independent media sites are customers of the
core ISPs but are not able to pay for the DDoS protection that those ISPs generally sell
as an add-on service.
In our survey, we also asked site administrators about the defenses they had
tried when hit by a DDoS attack and how effective those defenses had been. Their
responses can be read as a map of how independent media escalate defenses against
DDoS attacks:
• 83 percent had fi xed problems with their existing Web application software, with
80 percent reporting that this measure was “ somewhat effective ” or “ effective. ”