Although it’s far from always possible to determine the perpetrators of a denial-of-service attack and bring them to justice, there are plenty of people who have been put behind bars because of this modern-day crime.
He isn’t the first and he certainly won’t be the last.
A British man has been given an eight month prison sentence after being found guilty of knocking more than 300 websites offline with denial-of-service attacks.
51-year-old Ian Sullivan from Merseyside attacked a wide range of websites in 2013, including ones belonging to British Airways, the Conservative Party, multinational banks and Merseyside Police.
In addition, Sullivan’s denial-of-service attacks targeted adoption, children’s social services, and social housing websites – leaving thousands of people unable to access vital information and support, after rendering the sites completely inaccessible by flooding them with traffic.
Jobless Sullivan, a father of six, was apprehended in July 2013 after a joint operation between the National Crime Agency’s Cyber Crime Unit and the North West Regional Organised Crime Unit. Police had linked a Twitter handle (@anonian01) referencing the DDoS attacks to the attacks themselves.
Subsequent forensic investigations of seized computer equipment found software designed to clobber websites, and evidence of links to other online campaigns and activity by Anonymous hacktivists.
According to a BBC News report, Sullivan’s Twitter account would often alert targeted websites that they were under attack with phrases such as:
“This is just the start! Tango down. It’s not just you.”
Subsequent forensic analysis found software designed to take websites offline and documentation linking him to other campaigns and activity carried out by Anonymous.
Of course, it’s important to note that none of the sites targeted by Sullivan suffered a data breach as the result of his attacks. Although DDoS attacks often acting as a smokescreen to other online criminal behaviour such as hacking, they don’t in themselves steal sensitive data.
That’s why it’s a mistake to describe a denial-of-service attack as a form of hacking.
Nonetheless, denial-of-service attacks are a serious crime – they disrupt legitimate businesses, and can cause inconvenience and even distress to a website’s users.
At the time of Sullivan’s guilty plea earlier this year, Steven Pye of the NCA’s National Cyber Crime Unit spoke of the impact that DDoS attacks can have:
“Many DDoS attacks are little more than a temporary inconvenience but in this case Sullivan’s actions are likely to have deprived vulnerable people of access to important information, ranging from where to get support on family breakup, to reporting crime anonymously.”“This multi-agency operation illustrates the commitment of the NCA and its partners to pursuing people who think they can criminally disrupt important public services or legitimate businesses.”
It’s extraordinary how many people believe that participating in or indeed actually co-ordinating a denial-of-service attack can be done across the internet with no risk of the authorities determining your identity.
Although it’s far from always possible to determine the perpetrators of an attack and bring them to justice, there are plenty of people who have been put behind bars because of this modern-day crime.
Obviously you shouldn’t knowingly participate in an illegal denial-of-service attack, unless you want to have your collar felt and find yourself eating bread and water at Her Majesty’s pleasure.
But, more than that, regular innocent internet users should take measures to prevent their computers from being hijacked in ways which allow them to be commandeered into a botnet that can be exploited to launch attacks.
In short, if you have a home computer or other internet-connected device, keep it patched, updated and defended with the latest security software.
