2.1 Why launch DoS attacks?

Previous literature on information control in the digital age describes how governments censor online (Deibert et al., Reference Deibert, Palfrey, Rohozinski, Zittrain and Gross2008), finds macro-level evidence that countries censor political and news websites (Pearce et al., Reference Pearce, Jones, Li, Ensafi, Feamster, Weaver and Paxson2017), and shows that domestic and regional unrest increase online censorship efforts in autocracies (Hellmeier, Reference Hellmeier2016). King et al. (Reference King, Pan and Roberts2013) found that social media posts in China are deleted when they contain collective action potential, while recent studies suggest that posts that are critical of the government may also be censored (Gueorguiev and Malesky, Reference Gueorguiev and Malesky2019). Other research has emphasized that modern-day authoritarian governments do not only rely on deletion to control information, but use the Internet and social media to distract from sensitive content (King et al., Reference King, Pan and Roberts2017; Spaiser et al., Reference Spaiser, Chadefaux, Donnay, Russmann and Helbing2017; Munger et al., Reference Munger, Bonneau, Nagler and Tucker2018) or to identify and harass opposition actors (Pan and Siegel, Reference Pan and Siegel2020; Xu, Reference Xu2020; Pearce and Kendzior, Reference Pearce and Kendzior2012).

Roberts (Reference Roberts2018) combines these different insights on information control and proposes that censorship works through three non-exclusive mechanisms: fear, flooding, and friction. Fear can deter media institutions from distributing, and individuals from consuming, certain content. For instance, governments can pass censorship laws that forbid individuals or media institutions to write about particular topics; opposition activists are often intimidated and media outlets publicly sanctioned for reporting on specific subject matter. Flooding, in contrast, increases the relative costs to consumers who wish to retrieve information and can be achieved by distributing pro-regime messages and/or literally flooding social media channels with content. Finally, friction increases the costs to individuals and organizations seeking to gain access to and distribute sensitive information—often covertly—blocking specific websites or restricting access to information in other ways. Whereas the permanent censorship of specific websites is a good example of this mechanism, even a slightly slower loading website increases friction costs.

Previous qualitative and quantitative evidence suggests that DoS attacks frequently target news websites in autocracies in an attempt to disrupt information flows (Deibert et al., Reference Deibert, Palfrey, Rohozinski, Zittrain and Gross2008; Global Voices, 2011; Freedom House, 2016; Lutscher et al., Reference Lutscher, Weidmann, Roberts, Jonker, King and Dainotti2020; Nazario, Reference Nazario2009). Compared to more sophisticated (e.g., firewalls or filters) or brute-force (e.g., network shutdowns) forms of online censorship, DoS attacks have some useful properties as a censoring tool. First, DoS attacks can target websites worldwide, enabling governments to temporarily disable sites in cases where authoritarian administrations cannot employ pressure on providers to block them. Second, DoS attacks often go unnoticed and are hard to trace back. Users are unaware that a particular website has been hit by a DoS attack and even if such attacks should become public, governments will often deny any involvement (Lutscher et al., Reference Lutscher, Weidmann, Roberts, Jonker, King and Dainotti2020).

In this paper, I argue that the main mechanism through which politically-motivated DoS attacks on news websites work is through information friction: they increase the costs for individuals and outlets to gain access to and distribute information. Table 1 summarizes how DoS attacks can increase friction costs distinguishing between news consumers versus providers and between temporary versus long-term costs.

1. (a) If successful, the temporary cost of a DoS attack for consumers is that a complete news website is unavailable for a specific, potentially critical, point in time. DoS attacks make it harder and more costly for domestic citizens and the global audience to access information. The average Internet user will see only that the website is not accessible or is loading very slowly and will not spend extra effort to search for the reasons for the outage. Several studies show that when it comes to information consumption in the digital age, the average consumer is extremely impatient and will opt to visit other websites if they have to wait longer than usual (Brutlag, Reference Brutlag2009; Athey and Mobius, Reference Athey and Mobius2012). Evidently, politically engaged individuals may be less impatient and notice that the website has been purposely taken offline. As stated by Roberts (Reference Roberts2018), the goal of information friction is, however, not to completely restrict access to information but rather increase the average costs involved in retrieving undesirable content.

2. (b) Beyond temporary costs, DoS attacks may also increase fees borne by consumers to access specific information in the long-term. When Internet users observe frequent outages or high latencies in a website, they are likely to switch permanently to other more stable websites due to the simple reason that it requires too much patience to access the specific site (see above). Beyond these increased costs to website access, it may also be that readers find the website to no longer be reliable and credible because it is frequently offline (cf. Klyueva, Reference Klyueva2016).

3. (c) For news outlets, DoS attacks likewise increase costs in the short-term if they still want to provide content. News providers are forced to employ IT experts, hire DoS mitigation services, or look for alternative ways to provide information. Moreover, money is lost if they are unreachable because no users see their advertising, which constitutes the primary income for news websites (Mitchelstein and Boczkowski, Reference Mitchelstein and Boczkowski2009).

4. (d) A long-term consequence of, in particular, frequent DoS attacks may be that outlets will alter their content. News websites may do so to avoid future DoS attacks that accumulate the temporary costs outlined in (c). Moreover, outlets may potentially decide to self-censor because fewer users are visiting due to the long-term cost to the consumer described in (b). Finally, DoS attacks may also be understood as a signal to outlets that more drastic means such as permanent censorship will follow if they do not alter their content. Obviously, this potential consequence of DoS attack works only if editors or website owners are aware that such attacks are somehow related to their published content, and when attacks can generate enough pressure on the outlet.

Table 1. DoS attacks and friction costs

2.2 When to launch DoS attacks?

When authoritarian regimes are indeed relying on DoS attacks to increase friction costs, the question remains—when should we expect the use of these attacks? Given that DoS attacks are quick and easy to employ in addition to being rather inexpensive, it could be expected that critical news websites are constantly hit. As previously noted, however, steps can be taken to protect news websites by switching the IP address or hiring DoS mitigation services, making it more difficult and expensive to constantly attack. More importantly, the advantage of DoS attacks as a concealed friction tool likely diminishes instances when they are launched for a longer period. The public may discover that there is a reason for the outage and potentially gain more interest in the attacked site (cf. Martin, Reference Martin2007). If the perpetrators use these attacks to increase friction costs, it is likely that they are launched against news outlets as a response to the reporting of specific news. In particular, if the main goal of DoS attacks is to temporarily censor, regimes are likely to use DoS attacks relatively soon after news outlets have published undesirable information. But what topics are deemed censor-worthy by authoritarian regimes?

First, one main threat to the survival of an autocrat remains popular contention (Svolik, Reference Svolik2012). Theoretical models expect the use of censorship and other means of information control during contentious periods (Edmond, Reference Edmond2013; Gehlbach and Sonin, Reference Gehlbach and Sonin2014). Empirical studies from China show that social media posts reporting on protests or events that have direct collective action potential, e.g., repressive events, are likely to be censored (King et al., Reference King, Pan and Roberts2013). Beyond China, already Rasler (Reference Rasler1996) detailed how the Shah regime used means of press censorship in a response to mass protests during the Iranian revolution in 1979. Concerning the use of DoS attacks, anecdotal evidence suggests that authoritarian regimes employ these in a similar fashion. For instance, in May 2012, Russian newspapers were targeted when they reported about a large-scale protest against the inauguration of President Putin (Jagannathan, Reference Jagannathan2012). In 2016, Ecuadorian news websites suffered DoS attacks when they reported on protest events (Freedom House, 2016).

Second, recent work on autocratic politics contends that the main legitimacy strategy of modern-day autocracies centers around economic performance (Guriev and Treisman, Reference Guriev and Treisman2019). In fact, economic downturns may also spur citizens to engage in opposition activities as they open a window of opportunity and increase grievances (Dorsch et al., Reference Dorsch, Dunz and Maarek2015). While Rozenas and Stukal (Reference Rozenas and Stukal2019) do not find that Russian state media is actively censoring bad news on the economy but instead shifts the blame to external actors, it may still be that opposition or independent outlets encounter censorship when reporting about social and economic grievances. In particular, the potential long-term costs of DoS attacks may be helpful in this regard as users could become less likely to visit targeted websites and news outlets may even alter the content to avoid such an outcome. In the Venezuelan case, there is indeed evidence that the regime wishes to censor such information. For example, state-owned Venezuelan Internet service providers have attempted to block the outlet DolarToday since 2014. This website writes predominantly about the country's worsening economic condition (Rueda, Reference Rueda2015).

Third, news that questions the overall political legitimacy of a regime may be deemed censor-worthy. In the context of an electoral autocracy, this especially includes reports on opposition actors and electoral malpractices. As noted by Tucker (Reference Tucker2007), accusations of electoral fraud may serve as a focal point for political protest and are thus perceived as threatening by the regime. Furthermore, reports on the opposition in electoral autocracies may further make citizens aware of a credible alternative and reduce the political support for the authoritarian government. More generally, however, it can be various topics that question the political legitimacy of an authoritarian regime. To name just a few, authoritarian regimes may want to avoid reports on corruption accusations, resignation demands, or other governments or simply the outlet itself questioning the regime's political legitimacy. Publicly questioning the regime's legitimacy could again ultimately increase the likelihood of contention against the regime (cf. Walker et al., Reference Walker, Rogers and Zelditch1988).

Concerning the use of DoS attacks, there is indeed widespread evidence that news outlets were hit by DoS attacks when they have reported on such topics. The Russian website Vedomist was attacked following a series of articles that were critical of the authorities (BBC, 2009). El Pitazo, a Venezuelan news website, suffered from DoS attacks in March 2017 after publishing several articles about vice-president Tareck El Aissami links to drug-trafficking (Cardenas, 2017). Similarly, DoS attacks occurred against Belorussian media outlets after stories were run about students being forced to attend a public pro-government prayer in 2015 (Freedom House, 2016). Related to electoral and opposition topics, outlets in Russia were hit by large-scale and prolonged DoS attacks before the 2011 Durma election when an electoral fraud map was published (Global Voices, 2011), and several Venezuelan news websites were attacked in 2019 when they reported on the return of Venezuelan's self-declared interim president, Juan Guaidó, to Caracas (Rosas, Reference Rosas2019).

To summarize, I expect the following:

Finally, I expect that more widespread coverage of a topic will lead to a greater likelihood of DoS attacks since the topic is more salient and encountered by more readers.

3.1 The case of Venezuela

In the second half of the 20th century, Venezuela was one of the few democratic countries in South America. During the incumbency of Hugo Chávez which began in 1999, the country began to follow an authoritarian path. After the death of Hugo Chávez in 2013, the former vice-president Nicolás Maduro took over power. Since then, the country has faced an escalating socioeconomic crisis (Munger et al., Reference Munger, Bonneau, Nagler and Tucker2018). In December 2015, the incumbent government lost its majority in the Asamblea Nacional de Venezuela. The government response was with harsh repression, the creation of the pro-government filled Constituent National Assembly, and increasing levels of press censorship. Concerning the latter, the regime has managed to almost gain entire control over traditional media, making it hard to retrieve critical views from print and broadcast media (Hawkins, Reference Hawkins2016; Freedom House, 2017a).

As a response, most media outlets have migrated to the Internet, making news websites of particular importance for Venezuelan citizens to retrieve independent news (Cardenas, 2017). The regime has reacted to this by setting up pro-government websites, uses social media as a distraction (Munger et al., Reference Munger, Bonneau, Nagler and Tucker2018), and has its own pro-government online agitators (Morales, Reference Morales2019). Moreover, government-owned Internet Service Providers (ISPs) have begun to filter some websites in recent years and news and other websites are increasingly hit with DoS and other technical attacks (Freedom House, 2017b; OONI, 2018; La Patilla, 2018b; Franceschi-Bicchierai, Reference Franceschi-Bicchierai2019). Official documents indeed confirm that the Venezuelan armed forces have dedicated cyber units and investigative reports link DoS attacks against Venezuelan news outlets back to these units (Galicia Lugo, Reference Galicia Lugo2019).

Apart from the frequent use of DoS attacks in Venezuela and the important focus on news outlets as information gatekeepers, the case of Venezuela enhances our knowledge as to how modern technologies are employed as a censoring tool in electoral autocracies beyond the well-studied case of China (King et al., Reference King, Pan and Roberts2013; Roberts, Reference Roberts2018). More precisely, this study focuses on the period from November 2017 to June 2018, which includes the municipal elections held on 10 December 2017, and the presidential election on 20 May 2018. This period was chosen as previous studies have reported an increase in DoS attacks during election periods (Lutscher et al., Reference Lutscher, Weidmann, Roberts, Jonker, King and Dainotti2020).

Although Nicolás Maduro was able to win the presidential election with almost 70 percent of the votes, the election was characterized by a ban on opposition candidates, a boycott by most of the opposition, the lowest turnout in Venezuelan history, and (plausible) accusations of electoral fraud (Sen, Reference Sen2018). More precisely, Mesa de la Unidad Democrática (MUD), the largest opposition alliance decided to boycott the election after the national election council, the Consejo Nacional Electoral (CNE), disqualified the most threatening opposition candidates. These candidates included Henrique Capriles, who almost won the 2013 presidential election, and Leopold Lopez and Antonio Ledezma, who are former political prisoners and popular conservative opposition actors (Herrero and Semple, Reference Herrero and Semple2018).

3.2 Sample and measurement of DoS attacks

Previous studies emphasize that DoS attacks on civil society and news websites in autocracies are often underreported (Hardy et al., Reference Hardy, Crete-Nishihata, Kleemola, Senft, Sonne, Wiseman, Gill and Deibert2014; Maschmeyer et al., Reference Maschmeyer, Deibert and Lindsay2020). To improve upon previous work, my approach aims to actively measure DoS attacks on news websites.

The list of websites comes from www.abyznewslinks.com, a website that collates news outlets worldwide. I restricted the sample to websites that are not clearly associated with the state as the goal of this paper is to explore the use of DoS attacks as a censorship tool against private, independent, or opposition outlets. I added this restriction as activists may also use DoS attacks against government websites (Lutscher et al., Reference Lutscher, Weidmann, Roberts, Jonker, King and Dainotti2020).Footnote ¹ I did not consider inactive news websites (with no updated content), those from which content could not be downloaded, sites that purely aggregate news from other websites, or English language websites. As described in Appendix A in more detail, this left 19 websites.

Next, I set up a server with a university IP address outside Venezuela that monitored the online status of the news website sample every 30 minutes. I relied on an external server as DoS attacks restrict worldwide access to the targeted website, not only within the country. Moreover, by using a university server and running the measurement every 30 minute, I aimed (1) to avoid being classified as a bot, which would lead to the constant blocking of my machine, and (2) to save the computational resources on the news websites. While a greater description of the measurement approach is provided in Online Appendix A, I exploited the fact that web devices communicate according to standardized protocols. When a contacted server responds with a “503” code this indicates that the server is temporarily unavailable, most likely caused by an overload in traffic. While this is the main observable consequence of a successful DoS attack, there may also be other reasons for server overload, most prominently, maintenance work or just random errors due to the server configurations being used or legitimate latency testing, etc.Footnote ²

To minimize the number of false positives, I impose two restrictions on my measurement. First, I do not consider measurements for the period from 12.00 to 6 a.m., when major service providers schedule maintenance work (Richter et al., Reference Richter, Padmanabhan, Spring, Berger and Clark2018). Second, I only consider a website as having been attacked if two subsequent measurements return a 503-error code. Although I may miss potential attacks by enforcing the second restriction, previous research shows that DoS attacks last on average between 18 and 48 minute (Jonker et al., Reference Jonker, King, Krupp, Rossow, Sperotto and Dainotti2017). In later sensitivity tests, I relax on this restriction.

Somehow complicating the measurement task, a domain lookup shows that many of the websites in my sample are protected by Cloudflare—a popular DoS mitigation service. Protection by DoS mitigation services does not necessarily mean that such attacks cannot be successful, they still can when they extend the “protected” bandwidth or exploit other server weaknesses. Moreover, Cloudflare-protected servers also return a 503-error code when the server is placed in “under attack” mode, enabling me to also capture attack attempts for these cases (Cloudflare, 2020).Footnote ³

Nevertheless, it is still possible that my measurement suffers from measurement error and that I wrongly infer from a 503-error code that the server is under attack. However, as long as these errors occur randomly, they “only” worsen the precision of the later statistical analysis, but not its inference. When these errors correlate systematically to news content this could lead to biases. The latter may occur when specific news attracts a large readership, causing a server overload. To control for this scenario, I include a variable measuring legitimate traffic in later robustness tests.

Figure 1 details the status of the 19 newspapers for the period from 13 November 2017, until 3 June 2018. The figure highlights that six websites likely suffered from DoS attacks at least once and that there were in total 19 attack days. The most frequently affected website is Aporrea, which is a leftist opposition outlet that had been loyal to the Chávez regime and which has a known history of DoS attacks (IPYS, 2017). Others that were attacked were critical opposition outlets La Patilla and El Nacional, as well as the private news websites Confirmando, Informe21 and Noticierodigital. In fact, after the period of study, the Maduro government began to (temporarily) censor La Patilla and El Nacional at the ISP level (La Patilla, 2018a). More recently, state-owened ISPs also placed Aporrea on a block list (Aporrea, 2021). Finally, the figure shows that attacks against multiple websites seem to cluster around the municipal and presidential elections.

Fig. 1. Incidents of measured DoS attacks in Venezuela November 2017–June 2018. Note: The two vertical lines show the municipal election (10 December 2017) and presidential election (20 May 2018). Blank periods indicate time periods where the measurement did not work.

In sum, the descriptive results suggest that DoS attacks are a rather rare phenomenon but that they more frequently target critical news websites and that political events increase the likelihood of DoS attacks (cf. Lutscher et al., Reference Lutscher, Weidmann, Roberts, Jonker, King and Dainotti2020). Concerning the attack duration, Figure A.2 in Online Appendix A illustrates that many attacks lead to short outages, while the maximum is sixteen 503-errors per day.

3.3 News retrieval and topic modeling

To retrieve the content from the websites, I downloaded the first page every day at 01:00 p.m. Venezuelan time. Next, the extraction of headlines was custom-tailored, including the first paragraph if available. In this process, uninformative headlines with less than three words were ignored along with websites structured according to broader categories, providing entertainment news, sport, culture, and technology. Finally, the headlines were parsed following standard text pre-processing procedures. Infrequent terms were not, however, removed as the content that might trigger DoS attacks could be rare. Online Appendix E presents a more detailed discussion of these steps.

To investigate whether specific news topics are related to DoS attacks, I first reduce the high dimensionality of the textual data, using topic model approaches to link the headlines to broader topics. Since Latent Dirichlet Allocation (LDA) models perform poorly with short texts, I employ the so-called Biterm Topic Model (BTM) that learns topics by modeling word-word co-occurrences patterns in the whole corpus (Yan et al., Reference Yan, Guo, Lan and Cheng2013). For example, when the words economy, recession, and crisis frequently co-occur in headlines, irrespective of where and in what order, the algorithm identifies these terms as belonging to the same topic.

As with other unsupervised topic models, it is necessary to specify the number of topics (K) in advance. K = 50 was set as a good trade-off between the level of aggregation and specificity for each topic. As shown in Online Appendix E, sensitivity tests with K = 25 and K = 100 emphasize that the former identifies too many mixed topics and with the latter, it becomes difficult to differentiate between topics. For the algorithm to run, the conjugate priors α and β must be defined. I followed the specification in Yan et al. (Reference Yan, Guo, Lan and Cheng2013) for short text by setting α = 50/K and β = 0.01. The algorithm ran using Gibbs sampling with 2000 iterations.

Next, each topic was labeled by interpreting the top 15 terms per topic.Footnote ⁴ Table 2 shows the Top 10 topics. These topics reflect widely discussed news in 2017 and 2018: sanctions, elections, migration, and the killing of Óscar Pérez, a former elite soldier who aimed to overthrow the government. The fact that the term Venezuela often appears is that the monitored news websites report on worldwide news but unsurprisingly mostly about issues within Venezuela.

Table 2. Top 10 identified topics

Note: Words are translated and unstemmed. P(z) shows the distribution of the topics over the whole corpus. The word order reflects the importance of the words.

To investigate the validity of the topics, I examined their semantic validity, checking whether the generated topics are coherent and overlap with the respective headlines, as well as predictive validity by investigating whether the assigned headlines reflect real-world developments (Grimmer and Stewart, Reference Grimmer and Stewart2013). Both evaluations confirm that the model performs quite well in finding valid topics (see Online Appendix E for details).