Cyberattacks | Philipp M. Lutscher

Hot topics: What type of reporting attracts cyberattacks in autocracies?

Sat, 18 Jul 2026 00:00:00 +0000

Most authoritarian governments censor the press. Many independent outlets respond by moving online. But the internet is not as safe as it used to be. In an article in Political Science Research and Methods, I explore what type of reporting attracts Denial-of-Service (DoS) attacks on news websites in autocracies. It is the paper I worked the longest on (and the one I am proudest of), and here is the short version.

The theory: censorship through friction

DoS attacks flood a server with traffic until the website becomes unreachable. As a censorship tool, they have two attractive properties. They work against websites hosted anywhere in the world. And they are covert. Users just see a website that will not load, and attribution is notoriously difficult.

Building on Molly Roberts' fear, flooding, and friction framework, I argue that DoS attacks censor primarily through friction: they raise the costs of accessing and distributing undesirable information. The paper’s core theoretical contribution is to unpack these friction costs along two dimensions. Costs fall on news consumers and on news providers, and they materialize both immediately and over time:

Consumers, temporary. During an attack, the website is unreachable at a potentially critical moment. Most readers will not wait or investigate. They move on.
Consumers, long-term. Frequent outages train readers to switch to more stable sites. Unreliability also erodes the outlet’s credibility.
Providers, temporary. Outlets must hire IT experts and DoS mitigation services. While offline, they lose advertising revenue, their main income.
Providers, long-term. Accumulated costs and shrinking readership can push outlets toward self-censorship. Attacks can also serve as a signal that harsher censorship will follow if the content does not change.

This framework explains why DoS attacks are used selectively rather than constantly. Their value as a covert friction tool diminishes if a site is permanently down, since readers would start asking why. If the goal is friction, attacks should follow the publication of undesirable content. That is the observable implication the paper tests.

The measurement

Reported attack data is of little use here. Attacks on independent outlets in autocracies mostly go unreported. So I measured them myself.

I monitored 19 private and independent Venezuelan news websites every 30 minutes for seven months (November 2017 to June 2018), a period spanning municipal and presidential elections.
Server status codes reveal likely attacks: repeated 503 errors indicate a server overloaded by traffic.
In parallel, I scraped each site’s headlines daily and used topic models to classify what they reported on.

This design avoids two classic problems in cyber conflict research: selection bias (only looking at attacked sites) and reporting bias (only counting attacks that made the news).

The findings

Attacks were rare but patterned. Six websites were hit, on 19 attack days, clustering around the elections.

Reporting on certain topics raised the likelihood of being attacked:

Protest and repression. In line with what we know from censorship in China.
Regime-delegitimizing topics. Reports on exiled opposition figures, resignation demands, and elections. These showed the most robust associations.
Clearly non-political topics showed no relationship.

Categorization of the 50 identified news topics. Bold topics display significant positive correlations with the likelihood of DoS attacks. Source: Political Science Research and Methods, CC-BY 4.0.

Who is behind the attacks is harder to establish. Attribution is an inherent limitation in studying cyberattacks. The perpetrators may be state units, state-sponsored proxies, or pro-government groups acting on their own. What the patterns show is that the attacks follow the logic of censorship: they concentrate on content that threatens the regime.

The Venezuelan case extends the China-focused censorship literature. In an electoral autocracy, it is not just collective action potential that draws censorship attempts. Anything that questions the regime’s legitimacy appears to raise the likelihood of being targeted.

Why it matters

The internet made it easier for the press to evade traditional censorship. This paper shows the countermove. Cyberattacks make it possible to disrupt news websites globally, cheaply, and deniably. DoS attacks are one tool in a growing kit of authoritarian information control that includes filtering, flooding, and harassment.

The article is open access. Read the full version here. Replication materials are on Dataverse.

Iranian cyberattacks: A likely retaliation scenario?

Mon, 20 Jan 2020 00:00:00 +0000

This article was originally published at Political Violence @ A Glance on 20 January 2020. It is reposted here with the original wording largely preserved. The working paper referenced below has since been published in the Journal of Global Security Studies.

Following the lethal drone strike against the Iranian general Qassem Soleimani on 3 January 2020, many experts, pundits, and news outlets outlined different scenarios predicting how the Iranian government might respond. Experts agreed that Iran would retaliate. The only remaining questions were how and when.

Recent missile strikes against Iraqi bases housing American military forces showed that Iran was ready to use conventional weapons in response, albeit in a limited capacity. But as Navin Bapat noted at PV@G, the Iranian government might also opt for more irregular responses. Iran could ramp up activities to disrupt shipping in the Strait of Hormuz or support Houthi rebels in targeting oil facilities on the Arabian Peninsula. Both tactics would impose severe economic costs on the United States and the world economy.

Cyberspace as a response

Another scenario put forward by security pundits was that Iran would respond in cyberspace. Iran and the United States have a long history of cyber conflict, and some cyberattacks appear linked to foreign policy events. In 2012, for example, Iran-based hackers targeted US banks with Denial-of-Service attacks, in which servers become unavailable to users. The attacks were reportedly a response to newly issued sanctions. Denial-of-Service attacks are not particularly sophisticated. They simply overload servers with data traffic. But the economic costs can be substantial, running into millions of dollars for banks and other companies when servers are taken offline. Telecommunication server outages can be even more costly.

How common are these attacks after foreign policy events?

In a working paper (later published in the Journal of Global Security Studies), I explore this question empirically. I ask whether Denial-of-Service attacks against the United States and the European Union rise after threats or impositions of sanctions. Unlike earlier empirical work, I use internet traffic data to measure Denial-of-Service attacks. This allows me to include covert and failed attacks that never make it into the media.

The main finding is that, in most cases, sanction threats or impositions are not associated with Denial-of-Service attacks in the short or medium term.

There is evidence of a large-scale increase during some incidents. At the beginning of the Crimean crisis in 2014, Denial-of-Service attacks against servers in the United States and the European Union rose sharply. But qualitative accounts suggest the likely perpetrator was not the state. Patriotic groups and citizens appear to have used cyberattacks to express displeasure and protest. Attribution in cyberspace is hard, and governments may still have been involved directly or through sponsorship of patriotic hacker groups. Studies on the large-scale Denial-of-Service attacks against Georgia in 2009 and Estonia in 2007 reach similar conclusions.

What this means for the Iranian case

Cyber operations have features that make them a poor substitute for conventional coercion. They are covert, hard to attribute, temporary, and impose only limited damage. This makes it unlikely that the Iranian government will initiate large-scale disruptive cyberattacks as a foreign policy response to recent events. We are more likely to see continued low-level conventional responses such as the missiles fired at military bases in Iraq.

That said, we may also see dynamics similar to Crimea in 2014, where citizens and pro-government groups launch Denial-of-Service attacks to protest. Recent defacements of government websites condemning the drone strike and praising the Iranian regime point in this direction.

To be clear, this does not mean Iran is inactive in cyberspace. It is very active, and its future operations will likely be more sophisticated and part of a longer-term strategy. But while Iran expands its espionage and infiltration capacity, my analysis shows no systematic evidence of a link between aggressive foreign policy events and direct responses in cyberspace. States still tend to rely on conventional means in these scenarios.

Originally published at Political Violence @ A Glance, 20 January 2020. The working paper referenced above is now published as Lutscher, P. M. (2022), “Digital Retaliation? Denial-of-Service Attacks after Sanction Events”, Journal of Global Security Studies.