9.2. Social, Moral, and Legal Issues

DDoS is a problem that is unlikely to be solved by any single person or entity. It is a problem for society as a whole. As we have seen, it is difficult for any single computer or network to fully defend itself from all feasible attacks. Help is required to handle huge flooding attacks, at least. There must be a social aspect to DDoS defense.

Social problems are most commonly dealt with using either shared morality or legal authority. Given the many different attitudes people have toward the proper moral behavior of computer and network users, and the international scope of the Internet (and, hence, the DDoS problem), engaging shared morality to make inroads against DDoS attacks seems like an uphill struggle. Perhaps each of us can do our part, taking a bit of extra care to secure our own machine so that it does not become part of someone else's DDoS problem, but we cannot hope to solve the DDoS problem quickly this way.

Legal actions are somewhat more promising. As described in Chapter 8, many countries, including the United States, have existing laws that are relevant to DDoS attacks, and also have law enforcement agencies that are interested in DDoS attacks and might be able to help. However, the difficulty in tracking down the culprit limits the degree to which law enforcement approaches can be used, at least today. Also, the large numbers of attacks and the limited resources of law enforcement make it impossible for police and federal agents to investigate all DDoS attacks.

However, if you have suffered large damages and are well prepared to work with law enforcement authorities, legal avenues may prove helpful. If you think you might need to resort to legal action against DDoS attacks in the future, you should make preparations now. You should know whom to contact, understand how to gather evidence they can use, and be prepared to help law enforcement in their investigations.

Currently, few DDoS attackers have been caught, prosecuted, and convicted, which limits the desired deterrent effect of laws against performing these attacks. In the future, more successful prosecutions of DDoS perpetrators and better national and international mechanisms for dealing with the legal aspects of DDoS attacks may discourage all but the most motivated attackers.