Debate rages over online forms of protest, as cyber-activists go on the attack

It's getting more and more difficult to mobilize large amounts of people to take part in a protest. These days few are prepared to take to the streets, especially when the weather turns chilly. What's more, many question the actual impact that demonstrations and marches have on policymakers. But it's quite a different matter when it comes to a virtual protest, as proved by a recent orchestrated "denial-of-service"; attack, which brought down the websites of the SGAE, Spain's performing-rights society, the Culture Ministry, and Promusicae, the body that represents the country's record companies.

The organizers, a group of cyberactivists called Anonymous based mainly in the United States, staged Operation Payback to protest government-backed plans to crack down on illegal file sharing, as well as a tax on all digital-related products, the proceeds of which go to the SGAE and Promusicae. And unlike a street protest, the organized action hit headlines around the world.

The organizers staged the attack to protest plans to crack down on file sharing

"It is a criminal act, whichever way you look at it," says the SGAE chairman

Anonymous' attack was organized through chat rooms such as 4chan and social-networking sites. The assaults are part of an international campaign against those organizations it claims are "restricting creativity," and "the copyright lobbyists." Other targets in recent months have been the British and US record industries, as well as the law firms that represent them. Anonymous generally works through "distributed denial of service" (DDoS) attacks, in which a multitude of compromised systems attack a single objective, thus causing the denial of service for users of that website. The flood of incoming messages to the target system is on such a huge scale, that it essentially forces it to shut down, rendering it inaccessible for users.

The attacks have sparked a debate between those who consider such methods little more than criminal vandalism, and those who simply see it as a new form of non-violent protest - as legitimate in its approach as a strike or a demonstration. In short, the question is not only whether such means are justified by the ends, but also, who it is that should decide the targets.

The question of illegal copying of music dates back decades; what is new this time is that the policy of attacking websites has split the internet community.

Take the case of Julio Alonso, the man behind Weblogs, a blog-hosting service that relies on advertising for its income. Two years ago, a DDoS targeted his Genbeta blog, which had published an article about the methods used by some websites to take over people's computers, usually using them for illegal activities. In response, the owners of some of the websites mentioned, or indeed alluded to, saw to it that Genbeta was down for a week. Nevertheless, he says that he supports the methods employed by Anonymous.

In his blog Merodeando (or, Musings), Alonso poses the following question: "Are DDoS attacks necessarily wrong? The copyright lobbyists are using the legal system for their own ends to defend their position. What's more, they are winning the battle, which they are fighting on their own turf. Sadly, that's the way it is. Here and everywhere. And in the face of such a situation, what options are left open? We should remember for a moment that just about every form of non-violent protest started off as illegal. Strikes were banned for a long time."

But pressed further on the issue, Alonso says that he doesn't agree with Anonymous' methods. "I didn't say that I think what they are doing is necessarily right. What I am saying is that I understand why such attacks take place, which isn't the same thing." The difference, says Alonso, is that the attack against his own website was motivated by money, while Anonymous' activities are political.

Unsurprisingly, the SGAE sees things differently. "It is a criminal act, whichever way you look at it," says its chairman, José Neri. He is angry at what he calls the "arch cynicism of those who expect the law to pursue those who attack websites, except in the case of so-called freedom of expression." Neri points out that the attacks on the SGAE's website "incurred serious financial costs, not just for us because of the expense of security measures that we had to deal with in getting the site back up, but also for the many thousands of members who were unable to access the site."

The SGAE has been locked in a legal battle with Alonso due to defamatory comments that were posted on his blogs. He has been ordered to pay ¤9,000, but has appealed against the ruling.

As far as the law is concerned, neither the attacks launched against Alonso's Weblogs company, nor those against the SGAE are illegal. The first case has already been closed, and there is little chance that legal action can be brought against the individuals who closed down the SGAE's website en masse. But the law is soon to be changed, and from December, the penal code will make DDoS attacks a criminal offense, punishable by up to three years in prison.

"Anybody who, by whatever means, and without authorization, blocks or interrupts the functioning of a computer system by introducing, transmitting, damaging, erasing, deteriorating, altering, suppressing, or by making data inaccessible - and when the results of said actions are serious - will be punished by a prison sentence of between six months and three years," reads the new amendment to the penal code, which comes into effect on December 23.

Carlos Sánchez Almeida, the lawyer who represented Weblogs in the case brought by Julio Alonso against the companies that had attacked his site, says in his own blog that even though bringing down a website may not be a crime at present, "that doesn't mean that it isn't against the civil code, and above all, is a serious ethical, political and strategic mistake. Bringing down websites such as those of the SGAE or the Ministry of Culture is no great feat: it is cowardly and stupid. For a long time, a slow and complicated legal struggle has been underway in the courts, in parliament, and in the media, that has managed to portray the SGAE in a negative light. Then, just at the moment when parliament is debating the government's plans to impose censorship on websites, they are given a huge boost by being able to portray themselves to society and our politicians as victims."

David Bravo, another lawyer who has defended file-sharing sites in cases brought by the record industry, agrees that Anonymous' tactics are making matters worse. "The SGAE, which is generally seen as a predatory organization, will consider this attack manna from heaven, making it the victim for once," he said via a recent Twitter message.

That said, there is no denying that Anonymous is making its voice heard. And the media unwittingly found itself contributing to the campaign by providing a link to its website, where the public could follow simple instructions to take part in the DDoS offensive.

Luis Corrons, the technical director of Panda Labs, a computer security company, says that Anonymous' attack was brought forward by several hours ahead of midnight on October 7, given the widespread knowledge of the plan. By 1pm on October 6, the SGAE was experiencing problems, and by 6pm, its website had gone down. The first wave of attacks came from within Spain. Seven million requests to log on to the site were received from one server alone, located in the outskirts of Madrid. By giving coverage to Anonymous's activities, to what extent was the media responsible for what happened? And how would a major newspaper or television channel react if they were the target of such an attack?

"The popularization of this group's activities has led many users without much technical know-how to join in," said Luis Corrons, Panda Labs' director of research. "In fact, there are numerous tutorials and tools available for launching DDoS attacks across the web. This also means that not everyone is taking the steps necessary to cover their tracks, such as hiding IPs [Internet Protocol addresses]. If there is an investigation, it would be possible to follow the trail and locate some of the protestors."

For the moment, Anonymous' methods are legal. And the organization says that it will continue with its activities.

"I hope that the future of protest is direct action. There is no point in walking around with useless placards that nobody takes any notice of," says an appropriately anonymous protestor interviewed by Corrons on his website. The interviewee justifies Operation Payback, blaming copyright lobby groups for launching similar DDoS attacks on file-sharing sites through computer security firms such as Aiplex, which is based in India.

"To be clear, we do not condone any sort of profit from botnets or malware for that matter, but the vast majority of what is considered cyber crime can be something as simple as downloading your favorite song, instead of paying ridiculous fees for that song (which the artist will only see a fraction of)... We will keep going until we stop being angry," he said. "Harnessing the power of the web to communicate with each other through Facebook, Twitter, blogs and forums, Operation Payback is going to continue to launch this type of attack against current and new targets in the coming days," he added.

Enrique Dans, a lecturer at the Madrid-based IE Business School, supports the cyber-attacks. "These are not mischief makers, nor are they criminals, and there are no victims here. This is simply a legitimate form of protest: they are a bunch of ordinary people who are fed up and angry, and are responding to abuse by staging a protest on the internet. If you want to see the power of the internet, then here you have it: a ministry and two large organizations silenced on the net, and we'll have to see if the next thing isn't silencing the government on the net as well," says Dans, in reference to the government's measures to introduce legislation that would allow file-sharing sites to be closed down.

The proposals have sparked widespread protest among many internet users, who say that the new measures mean that what can and cannot be downloaded or shared is no longer decided by judges, but through mechanisms and procedures that are controlled by the entertainment industry.

Ricardo Galli, who runs the Menéame portal, and whose website was attacked for defending Julio Alonso, condemns Anonymous' methods. "I thought that we were trying to build a grass-roots alternative, and not simply destroy what we don't agree with by using their methods. And we should not be celebrating what a bunch of kids abroad have done in our name. I'm out of here."