This post was written by Oiwan Lam and originally published in Chinese on 6 October 2014 on citizen media platform inmediahk.net. It was translated by Loki Chu and Ronald Yick and republished on Global Voices as part of a content-sharing agreement.
The conflict between citizens and government authorities over suffrage in Hong Kong has been reflected not only at massive sit-ins across the city, but also in attacks on independent media sites and citizen organizing platforms that have been carried out an an unprecedented scale since Sept. 27.
These attacks have thus far gone largely unreported by mainstream media, despite the fact that nearly all the major pro-democracy citizen media have been knocked offline over the past ten days.
Just after students occupied the Civic Plaza at Hong Kong's government headquarters on Sept. 27, several independent pro-democratic websites, including Passion Times, Post852, HKDash and inmediahk.net all suffered a frenzy of attacks by hackers that have left them highly unstable. Some sites have spent long periods of time entirely offline. Even the official website of the civic group behind the massive sit-in action, Occupy Central with Love and Peace (OCLP), was taken down by malicious attackers for over two days.
Pro-establishment sites and organizations have also been disrupted by hacker organization, “Anonymous Asia”. For example, the website of Democratic Alliance for the Betterment of Hong Kong (DAB), a pro-Beijing political party, was paralyzed for about two days and the Hong Kong government News portal had a latency disruption for about 12 hours. However as the pro-establishment sites have strong influence on mainstream media outlets, the disruption has no effect on their information dissemination.
The impact of cyber war on independent citizen sites are destructive, as they have a small budget and limited staff resources, the attacks have been detrimental to their ability to disseminate information on the latest development of massive protests, making it more difficult to build collective consensus on campaign direction and strategy.
Apart from web servers, these full-force attacks on independent media sites also targeted specific content in their database systems, as well as at the domain name system (DNS).
Inmediahk.net Battles Multi-Pronged Attacks
Over the past week, independent media platform inmediahk.net has faced attacks of an unprecedented scale. On Sept. 27, server lag time escalated and the group's server went offline on a regular basis. Editors could not post new articles to the website, and had to resort to posting full articles to its Facebook page. A technical team was formed first thing the next morning. They worked to migrate the server, setup a service provided by CloudFlare to protect the DNS servers, which helped to alleviate the HTML request attack, though only temporarily.
On October 3, the scale of the attack became much more vigorous. The website received 60MB of queries per second. According to Google Pagespeed service, in-out bandwidth reached 12GB, about 24 times of the normal everyday amount of 500MB. Additional RAM had to be added to upgrade the speed of the CPU.
On Oct. 4, in addition to attacks coming from overseas IPs, an attack from a Hong Kong local IP address 184.108.40.206 was spotted. Between the start of the attack and the morning of Oct. 6, a total of 2,300,000 queries were sent from this local IP. The DNS server received 10M queries every hour, dragging the response time up to 461 milliseconds (versus around 20-50 milliseconds for a reasonably fast DNS server.) The technical team had to upgrade the site's DNS server, and also contacted CloudFlare for dealing with the DNS query latency problem. Furthermore, some of the attacks were aimed at the database system, e.g. visits to articles relating to the tag “social movement” were intercepted and blocked. The in-out bandwidth of the website quickly jumped to 40GB, 80 times of the amount before the attack.
On Oct. 5, attacks began emanating from various nearby countries including China, South Korea, and Vietnam. Hackers also began attacking the add-on web application used by the inmediahk's content management system, making the website very unstable. In the latest development on Oct. 6, hackers used a latest DDoS attack method known as “http flood” to attack the server, making it hard for a normal defense system to distinguish whether visits are from normal browsing or from malicious attacks.
Since Sept. 27, the technical team has monitored the status of the website around the clock every day and worked hard to customize their defensive methods to fend off attacks.
Mainstream Media Are Silent on Cyberwar
In this cyberwar, several independent news media outlets and the OCLP website have been suffering from a prolonged attacks and been knocked off the Internet. The intention is obvious: to destroy information flow during the movement. However, mainstream media, while witnessing the downfall of these citizen websites, have gone totally quiet, with not a single enquiry or report on the issue. This may be a sign that cyber attacks are being perceived as commonplace and thus not worthy of media attention. This is a terrible development towards Hong Kong's free speech environment.
Counter Attacks by Anonymous Asia Do Not Help the Cause of Democracy
In an attempt to retaliate against police violence towards peaceful demonstrators, “Anonymous Asia” started attacking multiple websites owned by the Hong Kong government and the pro-Beijing political groups. The hacker collectives brought down DAB website from the Internet on October 3 and continued to target at other pro-establishment and Hong Kong government websites. The government's news portal was disrupted briefly on October 4.
Although some were supportive of Anonymous Asia’s action, the counter-attack is not helpful to the struggle for democracy in Hong Kong at all. The pro-Beijing groups and the Hong Kong government mainly depend on television news programs and channels for their press release and pro-Beijing printed newspapers for spreading their opinions, the online disruption has no real effect. On the contrary, the cyber-war declaration by Anonymous Asia seems to have scaled up the attack on local independent news sites since October 3.
In contrast to the relative silence around attacks on pro-democracy and indy media sites, the Anonymous Asia’ attacks on DAB and the government news protal was highlighted in various mainstream news reports and has reflected negatively on the OCLP movement. During the early hours on Oct. 6, police arrested five people in connection with the Anonymous Asia attacks. They may face charges of accessing a computer with criminal or dishonest intent.
While the government and the pro-establishment camp can employ public resources and even the police to fend off invasions, citizen media have no choice but to resist large-scale attacks on their own. The reason for their survival in this increasingly harsh environment is the awareness that online independent platforms are an essential element of a free society and the tireless, round-the-clock work of their technical teams. Without support from citizens who care about free speech and democracy, citizen independent sites will not be able to sustain this level of technical assault in the longer term.