Hot topics: What type of reporting attracts cyberattacks in autocracies?

Most authoritarian governments censor the press. Many independent outlets respond by moving online. But the internet is not as safe as it used to be. In an article in Political Science Research and Methods, I explore what type of reporting attracts Denial-of-Service (DoS) attacks on news websites in autocracies. It is the paper I worked the longest on (and the one I am proudest of), and here is the short version.

The theory: censorship through friction

DoS attacks flood a server with traffic until the website becomes unreachable. As a censorship tool, they have two attractive properties. They work against websites hosted anywhere in the world. And they are covert. Users just see a website that will not load, and attribution is notoriously difficult.

Building on Molly Roberts' fear, flooding, and friction framework, I argue that DoS attacks censor primarily through friction: they raise the costs of accessing and distributing undesirable information. The paper’s core theoretical contribution is to unpack these friction costs along two dimensions. Costs fall on news consumers and on news providers, and they materialize both immediately and over time:

• Consumers, temporary. During an attack, the website is unreachable at a potentially critical moment. Most readers will not wait or investigate. They move on.
• Consumers, long-term. Frequent outages train readers to switch to more stable sites. Unreliability also erodes the outlet’s credibility.
• Providers, temporary. Outlets must hire IT experts and DoS mitigation services. While offline, they lose advertising revenue, their main income.
• Providers, long-term. Accumulated costs and shrinking readership can push outlets toward self-censorship. Attacks can also serve as a signal that harsher censorship will follow if the content does not change.

This framework explains why DoS attacks are used selectively rather than constantly. Their value as a covert friction tool diminishes if a site is permanently down, since readers would start asking why. If the goal is friction, attacks should follow the publication of undesirable content. That is the observable implication the paper tests.

The measurement

Reported attack data is of little use here. Attacks on independent outlets in autocracies mostly go unreported. So I measured them myself.

• I monitored 19 private and independent Venezuelan news websites every 30 minutes for seven months (November 2017 to June 2018), a period spanning municipal and presidential elections.
• Server status codes reveal likely attacks: repeated 503 errors indicate a server overloaded by traffic.
• In parallel, I scraped each site’s headlines daily and used topic models to classify what they reported on.

This design avoids two classic problems in cyber conflict research: selection bias (only looking at attacked sites) and reporting bias (only counting attacks that made the news).

The findings

Attacks were rare but patterned. Six websites were hit, on 19 attack days, clustering around the elections.

Reporting on certain topics raised the likelihood of being attacked:

• Protest and repression. In line with what we know from censorship in China.
• Regime-delegitimizing topics. Reports on exiled opposition figures, resignation demands, and elections. These showed the most robust associations.
• Clearly non-political topics showed no relationship.

Who is behind the attacks is harder to establish. Attribution is an inherent limitation in studying cyberattacks. The perpetrators may be state units, state-sponsored proxies, or pro-government groups acting on their own. What the patterns show is that the attacks follow the logic of censorship: they concentrate on content that threatens the regime.

The Venezuelan case extends the China-focused censorship literature. In an electoral autocracy, it is not just collective action potential that draws censorship attempts. Anything that questions the regime’s legitimacy appears to raise the likelihood of being targeted.

Why it matters

The internet made it easier for the press to evade traditional censorship. This paper shows the countermove. Cyberattacks make it possible to disrupt news websites globally, cheaply, and deniably. DoS attacks are one tool in a growing kit of authoritarian information control that includes filtering, flooding, and harassment.

The article is open access. Read the full version here. Replication materials are on Dataverse.