This week, fourteen people charged by the Department of Justice in connection with a coordinated denial of service attack on PayPal's services in 2010 will appear in Federal Court. The "PayPal 14," as they have been dubbed, are charged with participating in an attack orchestrated by Anonymous to retaliate against PayPal's suspension of its relationship with WikiLeaks. Their case as well as PayPal's actions in 2010 raise important questions about press freedoms and the nature of online protests.
As Chairman of eBay Inc., PayPal's parent company, and as a philanthropist and soon-to-be publisher deeply committed to government transparency, press freedoms and free expression, these issues hit close to home. (Since eBay is a public company, it's important for me to stress that the views in this article are my own and don't represent the views of the company.)
The story started in December, 2010, when PayPal suspended its relationship with WikiLeaks and the foundation accepting donations on their behalf for a period of several months. Today, PayPal can be found as one of several payment options available to support WikiLeaks' work.
When I learned of PayPal's decision, I immediately expressed my concerns to company management. A few days later, I contributed to an editorial by the Honolulu Civil Beat Editorial Board drawing attention to the important press freedom concerns raised by the actions of PayPal and other companies as a result of government pressure.
In the editorial, we affirmed that Julian Assange is a publisher and that the U.S. government used its power to attempt to silence him:
It used to be that a publisher owned his own presses and while even the angriest of politicians might want to stop him from running them, there was essentially nothing they could do.
With the Internet, many of us believed that the power of the publisher had spread to everyone, that we lived in a time of press freedom that would have been unimaginable just a few decades ago.
But the WikiLeaks case exposes the vulnerability of any publisher on the Internet. What's happened to Assange and his website has deeply troubling implications for our society. And, no, we're not talking about the damage some believe he's doing to our national security by publishing classified records.
We're talking about how democracy can be diminished when government uses its power to silence a voice it disagrees with. Even more worrisome is how this case has exposed how foreign governments may be able to use their own criminal investigations to hurt and potentially silence journalists beyond their own borders.
We also noted that the commercial nature of the Internet posed new threats to press freedoms by virtue of the fact that these companies generally don't have the First Amendment rights of its customers in mind when the government starts howling about one of them.
Today, it appears, notification of a criminal investigation is enough to force businesses whose cause is not the First Amendment to cut off a publisher the way Amazon, PayPal, Visa and MasterCard each have done WikiLeaks...
Unlike the press barons of old, the executives of these businesses cannot tell their shareholders that it will hurt their company more to cave on a matter of principle than to drop a customer.
In contrast, our new media organization will have the First Amendment at its core, and will make very different decisions if faced with government pressure not to publish or retaliation after the fact.
Three years later, the vulnerability of Internet publishers is not much different, though according to recent reports the Justice Department has realized it has a "New York Times problem" if it wants to criminalize WikiLeaks' publication. It may have taken nearly three years for the Justice Department to realize something that seems evident to press freedom advocates, but it's still progress.
There is, however, still skepticism and uncertainty about whether or not WikiLeaks or Assange will be charged. While it's impossible to know what specific acts law enforcement officials are investigating, it's a sad state of affairs that the legality of what from the outside appears to be legitimate news-gathering operations are being questioned.
Today it's not just the process of news-gathering that's being questioned, but the nature of online protest. Is a distributed denial of service attack a legitimate form of protest?
Back in 2010, members of Anonymous retaliated against PayPal by launching exactly this type of attack. We don't know how many people participated in the attack but just fourteen were arrested and charged by the government.
A denial of service attack is damaging and costly. Many of PayPal's customers rely on PayPal for their livelihood. An interruption in service can have serious consequences: those customers may lose income that may cause them to become late on rent payments, medical expenses, etc. These are serious impacts that must not be ignored. An attack on PayPal's servers hurts these vulnerable people far more than it hurts a multinational company.
People at PayPal -- as in most companies -- take their responsibility to protect their customers very seriously. They sleep with pagers next to them so they can be woken in the middle of the night when something goes wrong. They put in extra hours on short notice at the expense of spending time with their families. They put their customers ahead of their own interests time and time again.
But on the other side, I can understand that the protesters were upset by PayPal's actions and felt that they were simply participating in an online demonstration of their frustration. That is their right, and I support freedom of expression, even when it's my own company that is the target.
The problem in this case however is that the tools being distributed by Anonymous are extremely powerful. They turn over control of a protester's computer to a central controller which can order it to make many hundreds of web page requests per second to a target website. The combined impact of just a few (say, one thousand) of these computers can overwhelm most websites. One thousand computers each initiating just 100 requests per second means that every minute, six million page requests are being made.
If we want to make parallels between real-world protests and online protests, that means that one thousand people can have the effect of six million people demonstrating in front of your office. That seems like an excessive impact in the hands of each person. It's like each protester can bring along 6,000 phantom friends without going to the trouble of convincing each of them to take an afternoon off and join the protest in the street.
That's why I've concluded that the use of these attack tools is vastly different than other forms of protest.
That said, from a justice point of view, I think prosecutors need to look at the actual damage caused by each defendant. First, it would be unjust to hold fourteen people accountable for the actions of a thousand (or however many other people were part of the same attack). Each person should be accountable for the damage they personally caused.
Second, the law allows prosecutors to calculate damage in a way that seems overstated. An appropriate damage estimate includes the pay and overtime pay required for employees to respond to the attack. But the damage estimate apparently being used by prosecutors in this case includes the cost of upgrading equipment to better defend against similar future attacks.
To me, that doesn't make sense. It's akin to charging a protester who illegally and ill-advisedly throws a rock through a window with the cost of replacing the window with much more expensive rock-proof glass. Yes, it's true the business wouldn't have thought to protect itself against rocks if it hadn't been for the protester's actions, but to me it's not fair to compel the protester to pay for the upgrade.
Prosecutors should also look at the circumstances of each defendant, and examine whether or not they were aware of the excessive impact their actions might have. They may have believed they were participating in a legitimate online protest and not aware of the multiplicative effect of the tools they were installing. Many people are not technically aware of the power of these tools and may have felt they were lending a single voice to the chorus of protest, rather than simulating thousands of voices. In those cases, I believe justice requires leniency. In my view, they should be facing misdemeanor charges and the possibility of a fine, rather than felony charges and jail time.
As a society, our notions of free speech and protest must evolve since much of the public sphere is now online. Online protest is a new form of expression and probably feels natural to people who have grown up participating in online communities. The principles of the First Amendment require that we create space for free speech and association, unencumbered by government intrusion, and that those spaces exist online as well as offline. But in creating those spaces, we must also be cognizant that a much smaller number of protesters can now significantly disrupt the activities of millions of their fellow citizens who have an equal right to go about their lives without undue disruption.
If the great civil rights March on Washington can now be simulated online by a few dozen people using purpose-built tools, simple parallels with offline protests aren't sufficient to give us guidance on the role of free expression online.
The government's actions against WikiLeaks in 2010 and companies' reactions to that pressure, as well as the prosecution of the PayPal 14 raise critical questions about the nature of the First Amendment in the digital age. The First Amendment is primarily a restraint on government intrusion and a bedrock principle of our society. How do commercial interests interact with those protections? How does government ensure space for free expression online when there are no public sidewalks or street corners? How can unpopular dissent resist government pressure when that dissent depends on commercial Internet providers to reach its audience?
These are vital questions in today's society. The First Amendment is one of the most important rights we have. How will our understanding of the First Amendment adapt as society and technology changes? Time will tell, but our freedoms depend on a vigorous engagement on these questions by all of us.