computer-misuse-act
Is Running an Amplified DNS Attack on a Consenting Person Legal?
<p>I wasn't sure whether to put this in the legal or security stack exchange because this will take someone with considerable computer knowledge to answer. </p>

<p>Amyways, I want to try out an amplified DDOS attack using either an NTP server (which I think is public) or public DNS server. I know that running a DDOS attack on someone who is okay with it is legal, but this is using a public server to amplify the attack. The attack doesn't do any damage to the public server and only uses it as a middleman, but it doesn't use the server for what it's designed to do. </p>

<p>To be totally clear, this is for educational and not malicious purposes only. </p>

<p>"Public" DNS servers are public in the sense that they are available for the public to use by the adminstrator of each server. But each DNS server is run by either a government entity (or semi-government, such as a university or a government run corporation) or a private telecom company. And as such, each entity that runs a DNS server will have TOS (terms of service) that dictates the use of that server.</p>

<p>And each - I'd assume - forbids DNS access in for form of high-volume, repeated accesses such as would be used in a DDOS attack test. You should find the administrative domain and website of the DNS server you want to use from public-dns.info and read their TOS to determine their policies about access to their DNS services.</p>

<p>But there are many other factors involved in a DDOS attack test other than the one DNS service: you need to consider each ISP, each upstream provider, each network between the DNS service and the target server, in each country, as a DDOS attack - even a controlled stress test - creates huge amounts of traffic all across each network and as such costs time and money to each. And each services' TOS may very well forbid such use for a DDOS stress test.</p>

<p>You don't think a DDOS test will inflict "damage." It will: "damage" outlined in a TOS will be defined as CPU and network loads that cause slowness and network latency to other customers, time spent by admins to mitigate the issues, and more.</p>

<p>It doesn't matter that you are educational and not malicious.</p>

<p>Don't think that a DNS server administrator, the ISP, upstream providers, etc. can't track you down.</p>

<p>In the US at least, DDOS attacks are illegal: <a href="https://www.law.cornell.edu/uscode/text/18/1030#a_5" rel="nofollow noreferrer">https://www.law.cornell.edu/uscode/text/18/1030#a_5</a></p>

<p>I am assuming this is in the UK, so we are talking about the <a href="http://www.legislation.gov.uk/ukpga/1990/18/contents" rel="nofollow noreferrer">Computer Misuse Act 1990</a>, as amended by the <a href="http://www.legislation.gov.uk/id/ukpga/2006/48" rel="nofollow noreferrer">Police &amp; Justice Act 2006</a>. Also note that I am not a lawyer.</p>

<p>The act prohibits any act or sequence of acts that "impairs" a computer. There is a bunch of clauses around this, but basically if you intentionally make the computer work slowly or cause any delay in access to it then you are guilty. You are also guilty if you are "reckless" about the impact.</p>

<p>"Reckless" means showing <a href="https://www.collinsdictionary.com/dictionary/english/reckless" rel="nofollow noreferrer">a complete lack of concern</a> about the impacts of your actions. So I think that if you take positive steps to prevent or mitigate any impacts on the public server then you would have a defense against any charge of intent or recklessness. Good steps would be to estimate the available bandwidth of the server you are planning to use, limit the bandwidth of your simulation to a tiny fraction of that, and monitor the actual bandwidth during your demonstration so you can abort if anything goes wrong. You should document this ahead of time in a lesson plan or something.</p>

<p>The fact that you are using the public server for a purpose that the operator didn't have in mind is not (as far as I know) relevant.</p>

<p>In practice if you don't cause any problems then the likelihood of any police coming calling are very low.</p>
