Anti-censorship activist site Greatfire.org under DDoS attack, bandwidth costs skyrocket

Updated at 18:35 Beijing time, added quotes from Smith and made some revisions to more accurately reflect the situation.

Greatfire.org, the outspoken activist website that openly fights against web censorship in China, reported yesterday it is under a distributed denial of service (DDoS) attack. Greatfire representative Charlie Smith (a psuedonym) says the attack began shortly after the website was cited in a Wall Street Journal article describing tactics used to circumvent China’s censors and make mirrors of blocked websites accessible from the mainland.

“Traffic is coming both from inside and outside of China,” Smith says, explaining that the Chinese government isn’t necessarily the culprit. “We are gathering evidence. We are also asking the Cyberspace Administration of China to help us figure out who is behind this attack. We are redirecting some to the attack traffic to CAC’s website so that they will have the evidence firsthand.”

In a DDoS attack, the attacker floods the target website with requests to its server, slowing or even crashing the server and driving up maintenance costs. A blog post by Greatfire posted yesterday says the attacks started on March 17 and the site is now "receiving up to 2.6 billion requests per hour, which is about 2,500 times more than normal levels."

As a result, Greatfire’s bandwidth costs skyrocketed to US$30,000 per day, putting "a significant squeeze on our operations," the blog post reads. GreatFire is a fairly well-known but small outfit with no major revenue streams, so it would appear that the attackers are trying to DDoS the website into bankruptcy.

When asked how long GreatFire can hold out before the bills get too high, Smith replied, “Not very long, I am afraid.”

“We had some protection in place but I think only a relatively small number of websites actually prepare for an attack of this magnitude,” he explains. “To be honest, we did not think that we would actually get ‘cyberattacked’. I guess that shows our naïveté more than anything. Here we are tracking and blogging about other attacks and steps the authorities are taking and then all of a sudden we are the target. It was unexpected and likely a test of our strength.”

Greatfire.org is hosted on Amazon Web Services servers. Greatfire is asking supporters to tell Amazon, on Twitter or elsewhere, to forgo the hefty fee and support free speech.

Smith says the site has upgraded to faster servers and used "other techniques" to bring the site back online and manage the load, but he fears the attack could intensify at any time.

All or nothing

Greatfire says this is its first ever DDoS attack, which is frankly surprising. In the Wall Street Journal article, spokespeople for several anti-censorship companies like Greatfire, Lantern, and Tor spoke on the record about how they make blocked websites available to people on the Chinese mainland.

Blocking these mirror sites – the copies of blocked websites like Google and some news outlets – would require censors to block entire servers and networks, disrupting hundreds of legally operating businesses and having a serious economic impact.

Greatfire.org now runs 10 of these websites, and other activist groups like Reporters without Borders have followed suit. The current DDoS attack could be an act of retribution by the Chinese government, aiming to make an example of those who threaten to undermine the ruling party.

Cloud hosting services like Amazon’s and Microsoft’s have collaterally been brought into the crossfire between Chinese authorities and free speech activists.