Technically, New York Magazine didn't get hacked

Late Sunday night, New York Magazine was taken down by an attacker who overwhelmed the magazine’s website with bot traffic, in what is called a distributed denial of service attack, or DDoS attack. On Monday morning, many news reports claimed that New York had been “hacked.” But actually, it hasn’t been hacked — at least, not that we know of.

Hacks and digital attacks seem to be happening all the time these days, so let’s use the proper terminology. A hack involves breaking into a network and stealing information. In the case of New York , the attack involved making information inaccessible; it’s the opposite of a hack.

DDoS attackers often claim that taking down websites is an act of protest, the online equivalent of standing in front of a business and not letting people enter it. New York had published a story on Sunday about 35 women who were alleged sexual assault victims of Bill Cosby, so many people assumed the magazine was being punished by a Cosby defender. But “ThreatKing,” the person claiming credit for the DDoS, told the Daily Dot that the attack was his (or her) response to a bad trip to New York, during which ThreatKing got pranked and everyone laughed. ThreatKing claims to have plans to DDoS other New York-related sites.

However, while an offline protest is considered a constitutionally-protected act of free speech, a DDoS attack is considered illegal. The U.S. members of the “Paypal 14,” who were among the Anonymous members who DDoSed Paypal after it cut off funds to Wikileak, were charged with violating the Computer Fraud and Abuse Act (CFAA); 11 of them pled guilty.

This is why taxonomy matters. The CFAA is considered an “anti-hacking law;” it prohibits “intentionally accessing a computer without authorization or exceeding authorized access, and thereby obtaining information from any protected computer.” Some legal experts, such as Mike Masnick of Techdirt, don’t think a DDoS should be considered a CFAA felony.

“I think DDoS attacks are dumb, counterproductive and immature,” wrote Masnick after the PayPal 13 were charged. “But I have trouble seeing how they’re criminal acts, that could lead to five years in jail.”

DDoS attacks are more annoying than damaging in the long term. If you’re a media site, it interferes with your raison d’être (and your traffic numbers), as your readers can’t read your news. If you’re a site that sells things, it means you’re losing sales for however long you’re down. But they do tend to be short-term annoyances, thanks to the many start-ups out there now that offer relatively cheap DDoS mitigation packages.

As of Monday morning, New York‘s site was still down, though it’s put the Cosby story up on Tumblr. One small silver lining for the magazine is that the DDoS attack might have boosted newsstand sales for this issue.