Automated DDOS-for-hire services are not legal either. They're tools/machines/etc, possibly running more or less autonomously.

https://www.justice.gov/usao-ak/pr/federal-prosecutors-alask...