Participating in a distributed denial of service attack is not necessarily illegal. There has to be some intent on the part of the visitor to cause damage. You could get involved in one just by innocently visiting a malicious web page which makes your browser download large files from the victim. Or suppose I set up an under-sized server with a very popular web application, the server might collapse under the load, but my visitors would not automatically become criminals when my server went down.