Hacker News Reader

Comment by HPsquared | Hacker News Reader

It does raise questions about how industrial disputes may unfold online.

If picketing IRL factories is allowed, what would the law be on DDOS of an online business by union members?

Historically, law enforcement, courts and at time even military force have been used to put down labour action when it goes outside the box the NRLA drew. So I have no doubt they would throw the book at this kind of action if they can get away with it.

Even regular picketing sometimes gets sanctioned by the police. Just this October John Deere picketers were sanctioned for blocking a gate. [1]

[1] https://nptelegraph.com/business/deere-wins-injunction-again...

>Historically, law enforcement, courts and at time even military force have been used to put down labour action when it goes outside the box the NRLA drew.

>Even regular picketing sometimes gets sanctioned by the police. Just this October John Deere picketers were sanctioned for blocking a gate. [1]

Did those actions get put down because it was labor action, or was it because those actions were not acceptable? ie. if I said [unpopular thing] online, and a bunch of protesters showed up to my house and blocked my driveway, preventing me from going to work, would it be reasonable for the police to disperse those protesters? would it be reasonable for me to get an injunction against those protesters to prevent them from doing it again?

All "labor actions" have only become "acceptable" through sacrifices of people fighting for it. Its a hard thing to get companies to agree to make less profit, as making profit is how they justify their existence, and profit tends to fall, so they are incentived to fight even the smallest demands from workers. "Acceptability" is a dynamic thing, decided by those who write laws.

Not sure how to respond to your example because its a different situation? Do you think workers are just angry in the same way the mob outside of your house is? Or do you maybe think they are just trying to survive in this world?

> "Acceptability" is a dynamic thing, decided by those who write laws.

To me, this almost sounds like "it's easier to ask for forgiveness than permission, ie. what uber does, and runs counter to principle of rule of law.

>Do you think workers are just angry in the same way the mob outside of your house is?

so culture war protests = not fine, economic protests = fine?

To the first point, I think I agree, and in general, I personally would like workers to run "against the rule of law" more than they do now, where it is in their interest. I think it's plain to see that the rule of law is generally not in their interest, so I think they should do what they can, but I get that is probably an unpopular opinion here.

To the second point, I don't think we need to decide on the fineness of either, in order to understand their qualitative difference.

I trust this is about size of subject. usually, protests are fight to some things bigger than one person.

What culture war?

I can't remember the details exactly but there was a case in Germany in which a coordinated online and offline protest against Lufthansa was carried out, the online component being a denial of service attack on the airline's website. Lufthansa attempted to charge those response and the court dropped all charges - seeing it as a legitimate form of protest.

Regardless, I can't see how anyone could fathom prosecuting thousands (if not millions?) of participants in a DDOS attack and actually being successful.

You probably don’t need to prosecute each and every one of them, just the biggest offenders.

It would be much more effective to go after the facilitator who made it possible, in this case the developer. Both efficient and punative messaging-wise

The German (and generally, almost all European) legal system is a very different beast to the American one. What might be dropped by the court there may very well be seen as legitimate and prosecutable on the other side of the Atlantic, and vice versa. For something happening in the USA, you'd be best served by precedents from the USA itself, then from other common law countries, before considering anywhere in mainland Europe.

I'm not an American, but from what I know of the US judicial system and the power corporations have, I would think the courts would come down very heavily on anyone doing this - they'd rot in jail.

>If picketing IRL factories is allowed, what would the law be on DDOS of an online business by union members?

I'm pretty sure union/striking isn't a valid excuse to violate laws, and that "picketing IRL factories" doesn't violate any laws (ie. they do in on the sidewalk/public roads).

Perhaps surprisingly, whether picket lines are lawful is often a matter of legal contention when there's a strike. Company owners argue that they are obstructive (which is at least partially the point), and courts often grant injunctions or restraining orders placing limits on the size, location, or even existence of picket lines.

A coal company in Alabama recently won a restraining order that fully prohibited a picket line at their mine: https://www.msn.com/en-us/news/us/judge-issues-restraining-o...

Have any of these restrictions been on people operating entirely on public property? The only ones I've ever seen typically entail trying to block access entirely, something that by definition almost requires access to private property unless you have a ton of people, which most picket lines don't.

Submitting a job application with false information does not violate any law that I am aware of (perhaps if it's a government position there is? I'm not sure).

Manually submitting 50 job applications with false information also does not violate any laws that I am aware of.

The focus then becomes on automation. But if I automate the job application process at 1 application/day, that's not illegal. So it becomes a balancing act between how fast I am automating, and how shoddily designed the application system is.

I don't think it's as cut and dry as "this is illegal" or not.

Sending a single request to a website is not illegal. Hammering a website with thousands of requests per second with the intent of taking it down or making it inaccessible is. I agree it's not cut and dry but intent matters to some extent.

In the context of this specific scenario, I can agree to that.

But in the context of the parent comment ("what would the law be on DDOS of an online business by union members"), there's a valid discussion to be had.

If my code submits 1 fake application to each open position, once per hour or once per day (which is well within what I can do manually), and that code is shared between thousands of striking workers (and their supporters), and that results in downtime or inaccessibility, should that be illegal? If so, why? Would it be different if there wasn't code, but just thousands of strikers submitting applications as fast as they manually can and as fast as the website allows?

At what point does the responsibility lie with the company who isn't rate-limiting or captcha-ing?

With the CFAA, it's actual entirely possible that the person who wrote the code is entirely at fault if their intent was that multiple people run malicious code. Courts aren't black and white and take intent and amount of damage into account. There's no hard and fast "number" on how many people makes a DDOS. In fact, the service (site) doesn't even need to be hampered to be considered a DOS. Just having HR have to filter through tens of thousands of bogus applications can be considered a DOS.

In the context of the CFAA, I think you can make just about any activity on a computer be deemed illegal. Which is why I think these cases are worth discussing, and we should have the discussions with the intent of improving what the CFAA is and does, because it's grossly outdated.

Personally, I believe that if a few thousand striking workers decided to manually fill out job applications as fast as they could, as opposed to walking a picket line, that should potentially considered a valid form of protest. If the job-application-taking website fails or slows down or HR gets a headache, so be it. That's sort of the point of union workers protesting - cause headaches so their voices will hopefully be heard.

And at that point, what is the difference between a few thousand people manually submitting applications or using code to submit them at a pace which they manually could anyways?

Again: intent. If your intent is to harm/sabotage the company, it's beyond a protest.

What do you think the intent of a strike is?

Is holding up every car that enters or leaves the work premise not considered an intent to harm the operations of the company?

Is resfuing to do your job, slowing the overall production of the company, not considered harmful to the company?

What is the intent of the striking worker who airs their grievences on signs and media?

Striking, by nature, has the intent of causing grief/headache/slowed business/etc., in order to make demands heard.

I'm protesting Kellogg brands by boycotting them.

My intent here is 100% to harm the company by hurting their bottom line.

>If my code submits 1 fake application to each open position, once per hour or once per day (which is well within what I can do manually), and that code is shared between thousands of striking workers (and their supporters), and that results in downtime or inaccessibility, should that be illegal? If so, why?

A lot of it hinges on intent. If the people striking are attempting to overwhelm the service, I could see that being illegal, regardless of whether or not a program was used to assist in the denial of service.

Put another way, if I and a group of friends coordinate to call your office and tie up all of your phone lines, should there be legal consequences for my group?

I agree intent matters. But if the intent is to strike, which is what my posts are in the context of, the intent is obviously to cause headaches. That's what strikes do - cause inconvenience (less production, picket lines slowing traffic into/out of the workplace, etc.) so that demands can be heard.

>Put another way, if I and a group of friends coordinate to call your office and tie up all of your phone lines, should there be legal consequences for my group?

I think this is somewhat detached - your friends aren't striking workers trying to make a point - but I think it somewhat depends on what easily available mitigations I could employ. Can I simply block the numbers? Then I should do that. Can I rate-limit the number of times a certain number can call me? Then I should do that as well.

More illustratively, if my phone system is poorly designed and only accepts 1 phone call every 5 minutes or it crashes, should there be legal consequences for someone who calls twice in that 5 minute period? I say this, because if a website has no rate-limiting, no captcha, and can easily fall over -- is it really solely the fault of the striking workers who manually submit applications?

What if your phone system is poorly designed and only accepts 500 phone calls a minute or it crashes, should there be legal consequences for getting 600 people to call during the minute? What if your web site is poorly designed so that more than five million requests make it crash, and a DDOS sends ten million requests? Is it okay for the NSA to hack your computer to spy on you because computer software is poorly designed and includes exploits that allow hackers in? What if your automobile is poorly designed in that it can't handle having caltrops thrown in front of it to puncture the tires and cause a crash?

All systems are "poorly designed" if by that you mean they'll fail under pressure but this could have been prevented. It would, after all, be possible to design a car that is more resilient to running over a row of caltrops, it would just be expensive and unrewarding most of the time.

Of course, the person disrupting the system is a biased party. He shouldn't get to decide what counts as poorly designed in order to excuse his disruption; if you allow that, he's always going to claim that whatever vulnerability he found is just poor design. We don't think this is a good excuse for the NSA; it shouldn't be a good excuse for anyone trying to overwhelm a phone system.

Your whole comment is based on an analogy which I already said is detached from the issue at hand. None of your examples relate, at all, to a striking worker.

Was my phone analogy poorly constructed? Yes. Does your extension all the way to NSA hacking innocent citizens make sense? No.

Nobody is talking about "hammering a website with thousands of requests per second with the intent of taking it down." They're flooding an application process so that Kellogg HR can't find any real people in the giant pile of fake applications. Taking the website down is not a goal.

Both are attacks on availability in an IT context which is what makes it illegal. The goal is to cost the company money by reducing their ability to use recruiting systems, which is rather analogous to taking down a website in the eyes of the law.

What do you mean by "in an IT context?" The limit of the "IT" part of this is submitting the application online. There is no further technical piece, and I can't help drawing a parallel between you saying this is illegal because it's "in an IT context" and similarly ridiculous things like patenting already-patented processes but "on a computer."

If this stuff is illegal then posting a job when you already have an internal candidate in mind, or you are just collecting resumes or the actual job does not match the listing should also be illegal. After all aren't they sabotaging my application process with their spammy adds?

The intent to access systems in an unauthorized way in order to disrupt those systems-- the clear intent of this script-- would fall afoul of the rather broad CFAA.

Laws written by the corporations to protect the corporations?

I don't think repeatedly hitting F5 on a webpage is illegal.

Intent and specifics matter; hitting F5 is legal, hitting F5 10 times a second intending to disrupt the site probably isn't.

(IANAL, working from American perspective)

This isn't technically a DDOS though, is it? My understanding is that they're overwhelming humans' capacity to process the applications, rather than machines' capacity to process them.

I don't see how the thing being overwhelmed matters for determining if a DDOS took place. For instance, I think many people would characterize the Church of Scientology's attack on the IRS [0] as a denial of service of sorts.

[0]: https://en.wikipedia.org/wiki/Operation_Snow_White

I don't think they'd characterize it that way in court. The Church of Scientology's dudes appear to have done a bunch of other illegal stuff in setting up for the requests.

OTOH, if we're going to consider "sharing too much information to an individual for them to process it" to be a DDOS, there are a whole bunch of Terms of Service that will need to be rewritten. So maybe this is a good idea...

This isn't equivalent to picketing. It's more like sabotage.

Flooding your public website form isn't a crime in the same way prank calling a customer service line isn't a crime.

To be clear, are you saying you believe DDoS attacks are legal?

Filling in a form a few times is not a DDoS attack, even if it's automated.

Intent matters, and the intent is clearly to deny services.

That and denial of service doesn't even need to be something that "clogs up" technical systems. Just making it impossible for the HR people to work by overwhelming them is still a DOS attack.

This isn't the case, though, the intent is to disrupt their ability to hire non-union workers by submitting bad data, not by taking down their ability to ingest data in general.

Isn’t ability to hire people a “service” in this context?

Not OP, but I believe they should be legal in the case of a protest/strike lead by union members.

The constant underhanded tactics are the exact reason joining a union is immoral.

> The constant underhanded tactics

They are also the reason many corporations are immoral.

Or: most unions are legitimately just trying to improve the situation for their workers, and many business owners have a conscience and weigh more than profits in their business decisions. It’s mostly the mega-wealthy who have become disconnected from normal humans and give us these Snidely Whiplash characterizations that ultimately paint both sides with a bad brush.

Enterprise businesses are a majority of the workforce and drive trends that are followed by small businesses.

IMO a union's primary purpose is to provide counterbalance against disparity in a greater game of power.

What are they doing? I was under impression that american unions are kinda toothless.

Is it worse than what kelloggs is doing, spending money to replace striking workers rather than giving them a raise?

Reminder that this attack comes from users on reddit's r/antiwork sub, not union workers.

A DDoS is a pandemic friendly remote way to join a union lead strike.

Fighting fire with fire. By the actor in the weaker position.

Maybe it's the Scots Borderer in me, but it warms my heart.

Employer underhanded tactics are so common it's an SOP.

Legal lawbreaking is such a stupid concept. Have people forgotten that civil disobedience is purposely breaking the law for good reason? God it's like an entire generation forgot how to be rebels when they grew up -- "Oh I'm sorry could you pretty please let me protest you."

Isn't part of civil disobedience that you understand there will be negative legal consequences for your actions, but you do them anyway? What I see a bunch of today is people saying "yeah I broke the law but I should be immune from the consequences because blah blah blah".

Actually it is a crime (even though prank calling isn't a crime) because of the CFAA.

Pretty much anything done on a computer could be a crime because of the CFAA. It is extremely broad.

A recent case at the Supreme Court has limited this, and it seems applicable here, on the face of it.

https://www.eff.org/deeplinks/2021/06/supreme-court-overturn...

> the Court adopted a “gates-up-or-down” approach: either you are entitled to access the information or you are not.

To me, it sounds like you are entitled to submit a job application or you are not. I don't see how a charge under the CFAA for submitting an application would stick, when they are inviting the public to submit applications.

Submitting a single application would probably be OK, but the coordinated flood might not be

Nonsense. Using a public form, which is clearly intended to be a public form, is not using a computer without authorization or in excess of authorization.

You can't make someone using your computer a crime just by retroactively deciding that you don't like they way someone used it.

Low orbit ion canon was a n activist tool to ddos something by basically refreshing webpages

Was just thinking this - and I also think quite a few people have been arrested for using it over the years, including some jail terms. While I'm not on Kellogg's side on this, I'm nervous for a lot of US residents who might be jumping on this bandwagon for lolz without understanding the potential consequences...

(edit ... link: https://www.wired.com/2010/01/guilty-plea-in-scientology-ddo...)

picketing explicitly CAN NOT prevent people from crossing the line. Though in practice it does just that, they have plausible deniability. A DOS attack is harder to use this defense, plus typically you attest that the information is correct so unless you're actually automating this will real information you could potentially be opening up that concern as well.

There is a difference between picketing-- which is refusing to work-- and actually sabotaging company systems.

The DDOS would fall under (among, I'm sure, other laws) the CFAA and could be a felony if someone wanted to pursue it.

Reply on news.ycombinator.com