Russia: Election Day DDoS-alypse

This post is part of our special coverage Russia Elections 2011.

Election day in Russia has come. And with it, DDoS attacks and falsifications.

Oppression before the elections

The crackdown on independent websites began several days before the elections. Part of the campaign against the Election Violation Map, DDoS attacks began against LiveJournal, (an election monitoring association) and (a crowdsourced election violation map). Up until late night of December 3, 2011, these websites were functional, but on election day, December 4, their defenses were broken.

On December 2, Alexey Sochnev, an editor of (a site that accumulates blog posts, tweets, and social media) was arrested. The police broke in without a court order, arrested Sochnev and searched his apartment. Sochnev was also a representative of Eduard Limonov‘s campaign headquarters. On December 11, Limonov had been planning to announce his decision to run for president of the Russian Federation. Several other people were arrested along with Sochnev: Nikolay Avdyushenkov, Andrei Gorin, Nina Silina, and Maria Zinchenko. They were all accused under Article 282 of the Russian Criminal Code – “Incitement of National, Racial, or Religious Enmity.” Marina Litvinovich, head of tweeted [ru] that the police had also searched the apartment of the website's chief programmer.

Late at night on December 3, Lilia Shibanova, head of the association was detained at Moscow's Sheremetyevo Airport. Border security service would not let Shibanova out for 12 hours, until she finally agreed to surrender her laptop, which was suspected to contain “a dangerous piece of software.” Twitter followers recommended changing all passwords immediately, but expect to eventually see the contents of Shibanova's inbox on some “-leaks” website.

Not only members of the Russian opposition were affected. The website of a pro-Kremlin showman Sergey Minaev was hacked [ru] and its content deleted., the website of a popular daily newspaper, was hacked and defaced [ru].

"Their time is over. People's rally against fake elections." Screenshot by

"Their time is over. People's rally against fake elections." Screenshot by

DDoS Day

It turned out these were just the preparations for a massive DDoS attack against most of the digital platforms seeking to provide independent coverage of the elections.

One by one, they fell. A wave of requests with traffic of more than 10 gigabytes per second swept the blogosphere:

  • 18:50 (Moscow time, here and further on), December. 1 – the attack began on the St. Petersburg version of Novaya Gazeta,, and (a popular political website in St. Petersburg). All three websites were down [ru] by 14:00 December 2. moved to a special blog [ru] at Echo of St. Petersburg.
  • 23:18, December 3 – an attack against (Election Violation Map) and was reported. On election day, the Election Violation Map was not accessible. Golos had exported it's materail to a number of Google spreadsheets [ru], which were updated on the go.
  • “Around midnight,” December 3 – the Russian News Service reported [ru] an attack and a subsequent blackout.
  • 02:57, December 4 –, a popular portal in Tula, was taken down [ru]. Pryaniki moved to LiveJournal [ru] and Twitter [ru].
  • 06:40, December 4 – Echo of Moscow radio station ( became inaccessible [ru]. Echo tripled its content on GoogleDocs [ru], on Google+ [ru] and at a special ‘temporary blog‘ [ru] hosted by another DDoS-ed medium, Novaya Gazeta. It is important to note that Novaya Gazeta had installed a rather good security system following the previous attacks and now was able to provide a safe haven for another indepenent news outlet.
  • 11:05, December 4 – LiveJournal became temporarily inaccessible for Russia-based users.
  • 12:05, December 4 –,, Bolshoi Gorod (, (the election commission of Sverdlovsk region),, and were reported inaccessible [ru]., while inaccessible, used to keep track of the elections. became accessible again around 16:08. A report [ru] written by a journalist, Zlata Nikolaeva, in Russian, appeared on's home page.
  • 12:21, December 4 – reported [ru] an attack and moved into basic mode.
  • 15:00, December 4 – the website of the Communist Party's Novosibirsk branch,, went down [ru].

The DDoS-wave was over several minutes before the end of the elections in central Russia (where most of the voters live):

  • 19:43, began functioning again
  • 19:50, attack against stopped [ru]
  • 21:18, started working [ru]

An Echo of Moscow reporter Vladimir Varfolomeev wrote [ru]:

А вот и сайт Эха вроде заработал. Сразу после окончания выборов. Конечно, это совпадение, правда, Владислав Юрьевич?

And Echo's website is working again. Right after the end of the elections. It is a coincidence? Of course, isn't it, Vladislav Yurievich [addressing Vladislav Surkov, First Deputy Chief of Staff of the Russian President].

Ilya Sachkov, director of a cybercrime investigation company, IB Group, described [ru] the nature of the attack against Echo of Moscow:

Атака ведется с крупного ботнета, рассредоточенного по всему миру – множество атакующих компьютеров находятся на территории США, Китая и других стран. Российских IP-адресов мало. Мы также фиксируем нечто похожее на атаку в адрес “Голоса”, но здесь преимущественно российские IP-адреса и адреса стран ближнего зарубежья

The attack is being conducted from a big botnet [a network of infected computers] distributed all around the world – a lot of attacking computers are located in the United States, China, and other countries. There are only a few Russian IP addresses. We're also witnessing something that is close to an attack against Golos, but here are mainly Russian IP addresses and those from the [countries of the former Soviet Union].

Silencing “The Voice”

The persecution of (‘golos’ means ‘voice’ in Russian) and did not end with election day.

On December 4, Mikhail Kotov, editor-in-chief of (a media partner of the Election Violation Map) was invited [ru] to Roskomnadzor, a Russian regulatory body for the mass media, for a talk about their map, during which was accused [ru] of illegal electioneering and a biased attitude towards the United Russia party.

In the middle of the day a fake twitter account, @goIos_org, was launched in order to confuse readers. At 19:47, Twitter user @deniskin reported hashtag spamming for #охотанажуликов (‘crooks hunt’) and #наблюдатель (‘observer’). Both were being used to coordinate the work of election observers.

This post is part of our special coverage Russia Elections 2011.


Join the conversation

Authors, please log in »


  • All comments are reviewed by a moderator. Do not submit your comment more than once or it may be identified as spam.
  • Please treat others with respect. Comments containing hate speech, obscenity, and personal attacks will not be approved.