Port 80

Lycos "spokesperson" Malte Pollmann is a strong contender for the 2004 Mohammed Saeed al-Sahaf awards with this comment on the "Make Love, Not Spam" screensaver:

Contrary to some reports, the service never launched a ‘distributed denial of service attack’. Rather, a centralized database ensured all known spammers’ sites were left with at least 5% of bandwidth. The idea was simply to slow spammers’ sites and this was achieved by the campaign.

With all due respect, Malte, the use of the screensavers was distributed, and the stated goal was to deny the spammers the ability to effectively offer their services on the web. If this isn’t a Distributed Denial of Service Attack, then what on Earth is?

The possibility of electronic counterstrike systems deserves serious consideration - it may very well be an idea whose time has come. However, it is becoming clear that Lycos failed to give the possible consequences of their DDoS campaign even the most cursory evalation.

Consider Symbiot, a company that made headlines by launching a counterstrike security system. Symbiot’s page discussing the possible counterstrike options available to customers is filled with cautions on the legal ramifications of deploying such systems. Other links on their website will take you to extensive white papers discussing the subject. The legal and ethical questions accompanying counterstrike systems are unresolved, and Symbiot recognizes this fact. (Although, as a vendor of such systems, they do have a well-established viewpoint.)

Lycos, on the other hand, doesn’t even appear to have prepared a coherent argument to defend their decision to launch a massive, multinational DDoS. Instead, we get this:

The aim of the campaign was to ignite a debate about anti-spam measures. We feel that we have achieved this through our activity and will now continue that debate with others in the email industry. We hope that this will lead to further new and innovative solutions to the problem of spam.

Igniting the debate on solving the problem of spam would involve writing a provocative whitepaper on the possibilties of an anti-spammer DDoS attack. What Lycos actually did is akin to "igniting a debate" on gun control by handing out free revolvers on a city sidewalk.

I previously wondered what case law might emerge from this Lycos campaign, and I hoped that this case law might help better define the legal liabilities of counterstrike systems. At this point, I’m mostly wondering what heads will roll at Lycos for this fiasco.

I now inform you that you are too far from reality. — Mohammed Saeed al-Sahaf, Iraqi Information Minister (Retired)