Highlighted Selections from:

'LOIC Will Tear Us Apart': the Impact of Tool Design and Media Portrayals in the Success of Activist DDOS Attacks


DOI: 10.1177/0002764213479370

Sauter, M. “‘LOIC Will Tear Us Apart’: the Impact of Tool Design and Media Portrayals in the Success of Activist DDOS Attacks.” American Behavioral Scientist 57.7 (2013): 983–1007. Web.

p.984: This article explores the role of tool design and media coverage in the relative success of Operation Payback and earlier activist distributed denial-of-service (DDOS) actions. Through a close reading of changes in the tool’s interface and functionality across several iterations, the article considers the evolution of the Low Orbit Ion Cannon (LOIC) DDOS tool, from one that appealed to a small, inwardly focused community to one that engaged with a larger population. The article further considers Anonymous’s contribution to the reframing of DDOS actions from a tool of direct action to a tool of media manipulation and identity construction as well as the news media’s role in encouraging individuals to participate in the Operation Payback actions. -- Highlighted apr 19, 2014

p.985: The actions taken by Anonymous should be understood not as unique events but as an evolution in digital activist tactics, particularly in the realms of media manipulation, recruitment, and participant impact. In this article, I argue that Anonymous, in Operation Payback, has expanded on the DDOS tactics used by earlier groups in the 1990s. -- Highlighted apr 19, 2014

p.985: Whereas earlier actions by groups such as the Electronic Disturbance Theater (EDT) typically consisted of an activist core organizing a relatively small population of other media activists, artists, and special interest groups, Anonymous pushed a horizontal structure that opened the tools and mechanisms of protest organizing and action to the population of the Internet at large. -- Highlighted apr 19, 2014

p.985: In looking at how the design of DDOS tools can affect the participant population and the levels of diversity within that population, I consider how the design and development cycle of these tools reflect changes in protest strategy and in the activist space at the time they were created. -- Highlighted apr 19, 2014

p.986: to a tool of media manipulation and identity construction—from an action-oriented tactic to an attention-oriented tactic. -- Highlighted apr 19, 2014

p.989: In particular, the Anonymous innovations serve as a bridge between two previous conceptions of online activism: those ideas held by net-native hacktivist organizations that privileged skill and the freedom of information versus mass participation and those espoused by activist organizations that saw the Internet as a tool for information dissemination and borderless recruitment and action. -- Highlighted apr 19, 2014

p.989: Political action online did not begin with the DDOS. It is important to distinguish between hacktivist groups, such as Cult of the Dead Cow and Hacktivismo, made up of hackers who became politically active through writing and distributing code and tools beginning in the 1990s (Ruffin, 2004), and digitally empowered activists, who were more often than not experienced activists using Internet tools and capabilities to supplement more traditional, physical-world actions (Dominguez, 2009). -- Highlighted apr 19, 2014

p.989: Oxblood Ruffin, a prominent member of the Cult of the Dead Cow, wrote in response to an activist DDOS action in 1999, “No rationale, even in the service of the highest ideals, makes [DDOS attacks] anything other than what they are—illegal, unethical, and uncivil. One does not make a better point in an public forum by shouting down one’s opponent” (Ruffin, as quoted in Koerner, 2000). -- Highlighted apr 19, 2014

p.989: As activists who were experienced in traditional forms of civil disobedience in the physical world began to move their actions into the digital realm, they attempted to bring those practices with them. Seeing a parallel, some early practitioners of digital activism adapted the established concept of the sit-in and dubbed their DDOS actions “digital” or “virtual sit-ins” (Rolfe, 2005). -- Highlighted apr 19, 2014

p.989: The DDOS was viewed as an auxiliary political act, a way to “leave one’s computer protesting at home and then hit the streets to do the same” (Dominguez, 2009, p. 1810). -- Highlighted apr 19, 2014

p.989: The EDT was particularly conscious of media attention paid to its actions, taking care to distribute press releases to major media outlets and to announce all actions publically beforehand (Dominguez, 2009). -- Highlighted apr 19, 2014

p.990: The Critical Art Ensemble envisioned practitioners of what they termed “electronic civil disobedience” to operate as small, semiautonomous cells of specialized practitioners, each performing a specific action or role within a larger organization while simultaneously maintaining individual identities within the larger group (Critical Art Ensemble, 1996). -- Highlighted apr 19, 2014

p.990: Anonymous’s media-heavy strategy, including the use of videos and graphical manifestos and announcements released online, aligns it with groups such as the EDT, and its digitalnative culture and net-freedom ideology places it on the same ground as hacktivist groups such as the Cult of the Dead Cow. -- Highlighted apr 19, 2014

p.992: Much of the functionality present in LOIC, the DDOS tool used by Anonymous during Operation Chanology and Operation Payback, was present in earlier DDOS tools, such as FloodNet, a tool developed by the EDT in the late 1990s. In this section, I will be tracing the development of the FloodNet and LOIC DDOS tools, highlighting where their functionalities overlap and diverge. The language and memes used in the tool interfaces are of particular interest here, as they can be analyzed to show the lineage and intended audience for the tool. -- Highlighted apr 19, 2014

p.993: On the 1st of January 1999, the source code for the FloodNet tool was released, allowing other groups to use the tool in their own actions. Its design was simple and for the most part undifferentiated version to version. The language used in the interface clearly marked the tool as belonging to a particular population of activists and artists who were familiar with the language and practices of street and media activism -- Highlighted apr 19, 2014

p.993: The version used in the pro-Zapatista actions of 1998 invited users to “send your own message to the error log of the institution/symbol of Mexican Neo-Liberalism of your choice,” specialized language that creates a gulf between those who already understand it and those who do not. The tool does not appear to have been designed to appeal to users who were not already interested in and informed about the issue at hand. This impression is underscored by the methods by which the EDT publicized its actions: through mailing lists and message boards frequented by media activists and special interest lists devoted to South America, the Zapatistas, and other related topics. Similarly, in its attempt to translate the physical world sit-in to the online space, FloodNet clings to a one-person/one-computer operations model, refusing to augment the resulting flow of traffic with tools such as botnets (volunteer or otherwise) or other traffic amplification exploits (Jordan & Taylor, 2004). This tied the ethical validity of their actions, and eventually of DDOS itself as a tactic, to how closely they could be compared to physical-world actions. -- Highlighted apr 19, 2014

p.995: Use of those development community websites meant that more people participated in the development of LOIC, making it possible for them to more accurately reflect the needs, whims, and tastes of the target audience. By December of 2010, versions of LOIC could be run on Windows, Mac, and Linux PCs as well as Android phones and jail-broken iPhones. A version called JS LOIC, or JavaScript LOIC, ran, like the EDT’s FloodNet application, from within a web browser; the user was not required to download or install anything (Warren, 2010). -- Highlighted apr 19, 2014

p.996: Although NewEraCracker’s and abatishchev’s tools share virtually identical GUIs and core functionalities, there are differences in the design and functionality of each tool that would be recognized by and appeal to different participant groups. Both employ the same color scheme, dark blue on black with white text, and use the same image of a futuristic laser weapon firing at a planet, although different fonts are used for the Low Orbit Ion Cannon moniker. -- Highlighted apr 19, 2014

p.996-997: Both GUIs are peppered with references to memes and video games that would be instantly recognizable to individuals associated with Anonymous or familiar with Internet meme culture, although the references differ between the two versions in ways that make the tools temporally and politically distinct.9 .9 These differences can be used to position the different versions of the tool in time and how DDOS was being used by Anonymous in terms of its activist strategy. For instance, the phrase “A cat is fine, too,” which appears as the default message in the transmission-control protocol/user datagram protocol (TCP/UDP) message field in the abatishchev version, began appearing on 4chan and /b/ in 2006 (“A Cat is Fine Too,” 2009). “Desudesudesu,” also included in the TCP/UDP message field, references a separate meme, also popular on 4chan in 2006 (“Desu,” 2009). NewEraCracker replaces that message with “U dun goofed,” a reference to the Jessi Slaughter meme, which became widespread during the summer of 2010 (“Jessi Slaughter,” 2010). The abatishchev version also includes the subtitle “When harpoons, air strikes and nukes fail,” a reference to the video game series Command and Conquer, from which the name Low OrbitIon Cannonistaken. Onereferencethe abatishchev and NewEraCracker versions share in common is the “IMMA CHARGIN MAH LAZER” phrase, splashed across the button one presses to launch the attack. This references the Shoop Da Whoop meme, which also originated on the 4chan /b/ board in 2006 (“Shoop da Whoop,” 2009). Whereas “IMMA CHARGIN MAH LAZER” and “U dun goofed” enjoyed widespread popularity beyond 4chan, “A cat is fine, too” references an obscure bestiality meme derived from Japanese manga. It did not achieve recognition or popularity beyond 4chan and similar image boards, such as SomethingAwful and YTMND. Given the proliferation of 2006 Internet memes in the older versions of LOIC, and given that 2006 predates any significant media coverage of Anonymous or 4chan, it is reasonable to assume that the original developer of LOIC was most likely active on /b/ and with Anonymous and developed the tool sometime during 2006. -- Highlighted apr 19, 2014

p.997: So marked, NewEraCracker’s version of LOIC can be seen as appealing more to individuals who had relatively little interest in the more recreationally offensive aspects of /b/’s culture but were drawn to Anonymous for other, perhaps predominantly political, reasons. -- Highlighted apr 19, 2014

p.997: The changes made by NewEraCracker also heighten the explicit and overt political value of the tool. Whereas “A cat is fine, too” and “Desudesudesu” are relatively nonsensical in the context of an adversarial DDOS attack, “U dun goofed” is explicitly confrontational. It accuses the target of making a grave error and implies that he or she is now, or shortly will be, suffering the consequences of his or her actions. -- Highlighted apr 19, 2014

p.998: The design of the interface makes the operation of the tool relatively simple, even for someone with little experience waging DDOS attacks, but it also contains features for more advanced users to “personalize” their actions. The required steps (target, attack mode, and some customizable options) are numbered 1 to 3. A website can be targeted by entering either its URL or its IP address. A more advanced user can also set the port destination, the number of simultaneously open threads, request timeout, and the relative speed with which packets are hurled at the target. Most of these options have a default setting, so all an inexperienced user has to do is enter a target URL, click “IMMA CHARGIN MAH LAZER,” and sit back. However, if a user were still confused, there are a myriad of tutorials and FAQs available online, posted on webpages and as video tutorials on YouTube. Information on how to operate LOIC is, and in December of 2010 was, extremely easy to find. In fact, much of the news coverage of Operation Payback and Operation Avenge Assange contained enough information to constitute a tutorial on the use of LOIC in and of itself. -- Highlighted apr 19, 2014

p.998-999: The Hive Mind feature represents a significant break with the one-person/onecomputer protocol practice exemplified by FloodNet. Although an original goal of the FloodNet project might have been to “leave one’s computer protesting at home and then hit the streets to do the same” (Dominguez, 2009, p. 1810), it was Anonymous that actually took advantage of the protocol’s physics-defying potential. Hive Mind mode enabled Anonymous to engage with participants who did not, for whatever reason, follow the targeting and scheduling information that Anonymous was constantly releasing and updating. A lower level of commitment was required. Although Anons may not have “hit the streets” as EDT envisioned, Hive Mind mode did enable them to go to school, work, sleep, or anywhere while still participating in DDOS actions as they arose. -- Highlighted apr 19, 2014

p.999: Even those whose favored mode of participation is turning on Hive Mind and walking away are just as important to the success of the action as those who man their terminals for the duration. This subsumption of personal agency has the potential for a strong biographical impact on the participants, particularly, those who had not previously considered themselves political actors. It allowed those who had considered themselves to be an audience in the world of politics and industry to become actors, strengthened by the invisible yet palpable presence of thousands of their new comrades-in-arms. -- Highlighted apr 19, 2014

p.1001: The EDT primarily spread word of its actions via activism, performance art, and issuecentered e-mail lists and message boards (Dominguez, 2009). As a result, their participants were, more often than not, well versed in the practices and risks of on-the-streets activism. Although they may have had an incomplete understanding of the online space they were moving to, it is safe to assume that they had an understanding of the legal risks often associated with acts of civil disobedience. As the EDT was primarily engaged in drawing an explicit linkage between traditional forms of civil disobedience and digital actions, such as DDOS attacks, they were also aware of the illegal nature of the acts they were undertaking and the risks they were exposed to. -- Highlighted apr 19, 2014

p.1001: The culture and population of Anonymous underwent a major shift, beginning with Operation Chanology (Coleman, 2011a). Activism-minded individuals came onto the scene with little to no real awareness of the traditional tactics and motivations of Anonymous, and Anons themselves typically lacked any real activism experience. Their tactics were often innovative and interesting, but they lacked a core awareness of the basic risks of activism. Given time to evolve, Anonymous may have acquired a knowledge base of activist practices organically by attracting individuals with that particular profile. However, the storm of media attentionin December 2010 sped upthe cycle of change, essentially forcing Anonymous into the risky world of high-profile civil disobedience, perhaps before its members were ready. Anonymous’s sudden high profile also raised the stakes for those forces arrayed against it, namely, law enforcement and the targeted corporations, making it more likely that those participating in Anonymous DDOS actions would be pursued by law enforcement. -- Highlighted apr 19, 2014

p.1002: Many journalists have adopted practices of deep-linking to primary sources in their news coverage: If your sources are available online, say as a PDF of a scientific report or a video of a press conference, why not link to it? In this case, however, deep-linking within coverage of Anonymous often meant linking to pages where one could download LOIC, join an IRC channel, or find information on scheduled raids, as happened with Time magazine (Aamoth, 2010) and the popular blog BoingBoing (Frauenfelder, 2010). The practice provided a sheen of endorsement to the linked materials, for why would a news organization or blog make it so easy to access these materials if it did not believe them worthy of the resultant attention and influence? -- Highlighted apr 19, 2014

p.1002: it is apparent that direct linking is a powerful and not yet fully understood tool of news coverage that affects public actions in ways that must be taken into consideration. Although disputes about the press coverage of protest actions and civil unrest are common, in this case, I want to highlight the impact of both the practice of direct linking to activist tools and materials and the erroneous coverage that made the DDOS actions seem less legally risky than they in fact were. -- Highlighted apr 19, 2014

p.1003: In this article, I have considered how the design and development of the tools used in those actions reflect changes in technology and strategy and how they reflect the activist space as it existed at the time they were created. -- Highlighted apr 19, 2014

p.1004: The skill-heavy, closed, mastery-focused world of the hacktivist need not be read as in conflict with the horizontal, open, attention-oriented world of the EDT and Anonymous. Anonymous did not create DDOS as an activist tactic but rather innovated on the history of experience, skills, and code of activists and hackers who came before. What is being dismissed as script kiddieness should rather be recognized as resourcefulness. -- Highlighted apr 19, 2014