During recent years, Distributed Denial of Service (DDoS) attacks have developed from singular disturbances to a persistent problem within online publishing. They have grown in strength to an extent that even large web hosting companies are struggling to protect their clients from them. At the same time, the level of technical knowledge and financial resources required to administer these attacks is continually decreasing. Often based on variants of the Mirai virus that recruits vulnerable Internet of Things devices into botnets, the so-called booter and stresser community offers powerful attack capabilities as a web service, complete with user-friendly interfaces and flexible payment options.

A range of larger media organisations have already been exposed to DDoS attacks, e.g. the BBC in 2015 and Newsweek in 2016. In Sweden, several Swedish publishing companies were put offline during a weekend in 2016. In countries where investigative journalists and independent media organisations work under harsher conditions, DDoS attacks are seen as one among many threats faced both online and offline on a daily basis. Thus, media organisations’ websites are in increasing danger of being blocked by minor actors. In order to stay accessible in spite of attacks, websites have to be protected by sophisticated technical solutions based on algorithmic filtering of server requests. However, when faced with severe attacks, these kinds of solutions often become prohibitively expensive for individuals and small organisations, leaving freelance journalists and smaller media organisations particularly exposed – a situation that IT journalist Brian Krebs (2016) has described as the ”democratization of censorship”.

This paper presents preliminary results from an interview study investigating media organisations’ responses to DDoS attacks. The study involves both journalists and IT professionals working in media organisations and focuses on their strategies for handling attacks as well as their conceptualisations of threats. This involves the question who the threats’ targets are presumed to be – an organisation, the profession, society? Another key question concerns attribution, since DDoS attacks by their nature rarely can be traced back to a single source. How is responsibility allocated and what motivations are ascribed to the assumed perpetrators? Based on these findings, the presentation attempts to disentangle the antagonistic relationships between the involved actors – DDoS providers, DDoS mitigation services and media organisations – and to discern how their respective discursive constructions of threats are interwoven with the different economies they embody.