FloodNet: Deliberate Error as Protest and Performance

Ignotus_Mago · February 2020

Before I begin, I want to note that this code critique is a collaborative effort of Shawné Michelain Hollaway and myself, Paul Hertz. We have a common interest in the performative and social aspects of algorithms and code: how social interactions are encoded in culture and how artists can create coded performances as a social (inter)action.

I am going to start things off by introducing our topic. Shawné will respond. Then I'll post some code examples. Following that, we hope to engage in an open-ended dialog, which we invite CCSWG participants to join.

FloodNet was developed in 1998 by the Electronic Disturbance Theater (EDT), a group of artists and activists working in the area of Electronic Civil Disobedience (ECD). FloodNet enabled activists to hold "virtual sit-ins." Using HTML pages and some minimalist Java code, participants could stage an online protest by flooding a targeted server with repeated requests for pages. Typically, a time would be set for the protest, participants would open the FloodNet home page during the protest and an applet embedded in the page would send out requests from the client page to the targeted server every 7 seconds. Participants could also send "personal messages" encoded as URLs to the server. The client would request a non-existent page, causing the server to generate and log a "404 Page Not Found" error, for example: "welcome//impartiality/_and_respect not found" or "welcome//human_rights/_and_dignity not found". If enough people participated, they would have a noticeable impact on the server response time, potentially flooding it with so many requests that it would crash. In other words, FloodNet operated as a DDoS (Distributed Denial of Service) attack.

DDoS as protest was controversial from the start. As Geert Lovink notes, "...hackers were divided over the effectiveness of the Floodnet software[...]. Libertarian minded hackers suggested that the 'flooding' of corporate and government servers was ending up nowhere. Massive hit attacks, directed at the enemy site were getting lost in the general net, thereby mostly harming others, in particular your local ISP." Governments also took notice and began taking steps to make such attacks illegal, conflating political DDoS with terrorist attacks on the Internet. [Lovink 2002, pp. 254-274]

The most well-known use of FloodNet was in a series of protests in support of the Zapatista social movement (or "insurgency" as sources in the Mexican government would have it) in the state of Chiapas, Mexico. Without going into the depth that the topic deserves, I would note that the Zapatista Movement, which continues to the present day, offered models of decentralized organization both in its political philosophy (i.e., having as its public face "Sub-Comandante" Marcos, who functioned more as a spokesperson than a leader meting out decisions) and in its cultural roots as an indigenous movement protesting among other injustices the latifundio system of land ownership brought by the Spanish colonists, which saw shared ownership and cultivation reduced to single ownership over vaste expanses and cultivation ordered "a dedo," by pointing to whomever would be given work in a pool of marginally employed day-laborers. The Zapatista Movement was very savvy in its use of media, and in many respects centered its strategies around defensive or non-violent protest actions, community organization, and occupation of lands. The style and open organization of the Zapatistas appealed to many political activists outside Mexico.

Our concern in examining the FloodNet codebase, however, is not with its historical setting so much as with two concepts within its form of social activism that are embedded in the code. First, as artists who have worked within the Chicago Dirty New Media and international Glitch Art movements (where #Chicago is a non-locative hashtag), we are fascinated by intentional error as a tactic and specifically by the creative use of 404 errors. These errors present themselves in server logs, where they will eventually be read by a human operator, and are performed, captured, and spread on the client side as an ironic souvenir or token to be passed around. Secondly, we want to foreground the ways in which DDoS as Electronic Civil Disobedience is distinct from malicious DDoS, ways that are embedded in the codebase and the performed actions: activists do not hide their identities and may well sign their names; servers are not anonymized.

Regarding the FloodNet codebase: the source code for the Java applets is missing. The original developers from EDT could not find it. However, opening the .class files in a text editor reveals embedded strings scattered through the non-ASCII, and these strings tell a story. The HTML pages also provide clues, but for the sake of focus, we will dig into the .class files, viewed as texts.

Source for a "developer's kit" version of FloodNet can be downloaded from http://www.thing.net/~rdom/ecd/jan99ddk.zip. FloodNet's Zapatista protest is running in emulation in the Rhizome net.art archive, at https://sites.rhizome.org/anthology/floodnet.html. I have also downloaded the Rhizome HTML and .class files, so we will occasionally cite them.

Lovink, Geert, An Insider's Guide to Tactical Media. from Dark Fiber, MIT Press, 2002, pp. 254-274

cleogirl2525 · February 2020

In following Paul's text - I wanted to suggest that we can also look at this code through the lens of performance art.

In breaking down the layers of the complex performativity from within and surrounding the FloodNet code, we see there is a multiplicity of narratives, functions, and relationships revealed by the outcome of running the code itself; the networks, bodies, risks and desires of each body involved circuitously being made aware of themselves and each other as the attack is performed, creating a set of baseline poetics from which both many persons and machines are positioned to con or di -verge.

Diving into the layers we find that performativity in the following :

Organizing around protest as a response to a dissonance.
The human act(s) of creating the code for FloodNet.
Computer operatives performing tasks, sending and receiving information.
The birth of many fake identities (urls) and the sharing of a few real ones (the organizers'.)
The planned birth of an error (or signifier for divergence.)
The sustained existence of that error.
The residue of traces left inside the server logs.
The disappearance of that error.
The observation of the successes of the instance.
The failure and vulnerability of each systems.
The networks, effected.
More organization of the aftermath.

The above is a simplified breakdown of FloodNet order of operations as they unravel in time-space.

Prolific conceptual artist Chloë Bass's 2013 article suggests writing, without code, is a kind of performance as it is inherently attached to interactivity and by extension a social practice. From the editing process, to the consumption, writing is always already acting and enacting on all who see it. Unlike a static written text, however, the FloodNet code is interactive and also active, as it is a device that produces a visual result that is something entirely other than its original text-base form. Albeit, this text still needs to be activated but user-views, but they wouldn't typically activate that through parsing each character in the code. Instead, a click of a button and the will of a human provide the catalyst for this applet to act on its own - as, from that moment, an independent but networked (en)actor (+ networked as in - connected with others) - and go on to birth multiples (of the server requests with fake generated URLs and other info) of itself and in the name of those multiples producing a child (the denial of service), that is an error, of its very own.

Aria Dean's 2016 essay for the Net Art Anthology entitled Tactical Poetics: FloodNet's Virtual Sit-Ins investigates this unique code-specific element of text (en)action through an investigation into reflections on FloodNet from its designers. Her article begins:

"What is the relationship between data bodies and real bodies? Electronic Disturbance Theater co-founder Ricardo Dominguez cites this as a fundamental question for the group at the time of its founding, and even though this was twenty years ago, it still strikes me as pressing, and unresolved. It is fundamentally a question of presence, a question of the relationship between the real and the virtual." (Dean, 2016)

She continues to tell us about the Electronic Disturbance Theatre's desire for gathering "networks of solidarity," and finding new methods of civil disobedience.

Finally, as we reflect on the DDOS attack as the birth of an error out of the seeds of a collective gesture making, we see many layers of its incubation that all require a set of instructions interdependent on various players (machine or operator) to be completed as a careful orchestration of actions by a single author or group. In this way, we are taking both about the form of these actions, as an complete library, as the medium of a performance; alongside it, the applet as a performative preset (yet also a means of machine-centered performance).

Outside of the form, the poetic arc of these "virtual sit-ins," lies mapped across the miasma of content of these actions taken, signals received, and reverberations felt. For example, in the messages cum mini-poems users were prompted to leave in the error logs playing on the "404 not found" text traditionally displayed as a result of a common DDOS. For the Electronic Disturbance Theatre made space for this user input that begat results like, "human rights not found," and "equality not found." See Aria Dean's essay for a further analysis on these program content-specific gestures.

_

REFERENCE

Dean, Aria. “Tactical Poetics: FloodNet's Virtual Sit-Ins.” Rhizome.org, Dec 01 2016. https://rhizome.org/editorial/2016/dec/01/tactical-poetics-floodnets-early-1990s-virtual-sit-ins/.

Bass, Chloë. “How Writing Is Like Performance.” Hyperallergic, November 21, 2013. https://hyperallergic.com/94735/how-writing-is-like-performance/.

Ignotus_Mago · February 2020

Since we only have .class files to to examine, our approach is bound to be forensic: looking for human-readable clues in the machine-readable binary code. I captured the binaries from the Rhizome Net Art Anthology (RNAA) version of FloodNet with a little Console sleuthing and the UNIX curl command or downloaded them as part of the "developer's kit" version on thing.net (TN).

Here for example is part of the FormURLzapsNet.class file from RNAA, with non-ASCII character replaced with a "•" character:

Exceptions•••FormURLzapsNet•••LineNumberTable•••LocalVariables•••SendSpamZapsNet••
SourceFile•••append••
detachment•••dignity•••disinterest•••egalitarianism•••equality•••equitableness•••error•••fair-mindedness•••fairness•••floor•••getBadExtend••    getstring•••honor•••http://•••human_rights•••humility•••impartiality•••java/lang/Math•••java/lang/Object•••java/lang/String•••java/lang/StringBuffer•••justice•••justness•••nonpartisanship•••objectiveness•••objectivity•••random•••respect•••toString•••valueOf•••zapsNetTactical•••zapsNetTactical.java•

The embedded strings and the name of the class imply that this is the code that would piece together URLs to send as a page request to the targeted server. They reveal the concerns of the developers and participants.

Our second example comes from the messageForward.class file from RNAA. It is not part of the TN codebase. MessageForward provides a form that allows participants to send "personal messages" encoded as URLs to the targeted server.

•••AbsoluteSourcePath•••BGCOLOR_BLUE•••BGCOLOR_GREEN•••BGCOLOR_RED•••Banamex•••Banco de Mexico•••Bolsa Mexicana de Valores••
Click Send•••Code•••ConstantValue•••Context••
Exceptions•••Grupo Financiero Bancomer•••Grupo Financiero Bital•••I••   LContext;•••LineNumberTable•••Ljava/awt/Button;•••Ljava/awt/Choice;•••Ljava/awt/Color;•••Ljava/awt/Event;•••Ljava/awt/TextField;•••Ljava/lang/Object;•••Ljava/lang/String;•••LmessageForward;•••LocalVariableTable•••LocalVariables••'SOMOS TODOS INDIOS! SOMOS TODOS MARCOS!•••Send Message••

Again, the concerns of the developers and participants are revealed in the string values embedded in the binary. The human-readable strings, embedded in machine code, function as markers of resistance performed within a machinic social order. Closer in spirit to graffiti than to sabotage, they affirm the presence and continuity of resistant networks, social and electronic.

Finally, two selections in zapsFloodNetPublic1.class from TN:

getstringhttp://(http://www.HotBot.com/?MT=brett+stalbaum(http://www.HotBot.com/?MT=carmin+karasic+http://www.HotBot.com/?MT=ricardo+dominguez%http://www.HotBot.com/?MT=stefan+wray

bbs.thing.net•••bot.fringeware.com:80•••burn.ucsd.edu•••c5.sjsu.edu•••cadre.sjsu.edu•••ccwf.cc.utexas.edu•••clinamen.ff.tku.ac.jp•• drawImage•••easter••
easterChar•••engage•••equals•••evade•••flag.blackened.net•••formurl•••gallery.sjsu.edu•••getAppletContext•••getCodeBase•••getDocumentBase•••getImage•••getParameter••   getstring•••http://••(http://www.HotBot.com/?MT=brett+stalbaum••(http://www.HotBot.com/?MT=carmin+karasic••+http://www.HotBot.com/?MT=ricardo+dominguez••%http://www.HotBot.com/?MT=stefan+wray•••image•••image100x75.gif•••indexOf•••init•••java/applet/Applet•••java/awt/Graphics•••java/lang/Runnable•••java/lang/String•••java/lang/StringBuffer•••java/lang/Thread•••java/net/URL•••keyDown•••lanic.utexas.edu:70•••lib.nmsu.edu•••mouseUp•••odysseus.sjsu.edu•••on•••paint•••planet.com.mx•••profmexis.sar.net:70•••protectedURLs•••run•••runner•••sendspam•••serpiente.dgsca.unam.mx••
showStatus•••spin.com.mx•••start•••stop••   substring•••switch.sjsu.edu••   targetUrl•••thing.at•••toLowerCase•••toString•••unam.netgate.net•••valueOf•••vela.acs.oakland.edu•••vivaldi.nexus.it•••www.actlab.utexas.edu•••www.anet.fr•••www.aurorablue.org••
www.c5.com•••www.cais.com•••www.chiapasmediaproject.org•••www.communinet.org•••www.contrast.org•••www.cooke.net••
www.dds.nl•••www.echonyc.com•••www.ecn.org•••www.eco.utexas.edu:80•••www.ezln.org•••www.fakeshop.com•••www.freespeech.org•••www.fringeware.com••
www.icf.de•••www.igc.apc.org•••www.imaginet.fr•••www.indians.org••
www.inx.de•••www.ipsnet.it•••www.nodo50.ix.apc.org•••www.nonviolence.org•••www.nyu.edu•••www.pangea.org•••www.peak.org•••www.pericles.org•••www.pixelyze.com•••www.rhizome.org•••www.rz.uni-frankfurt.de•••www.sjsu.edu•••www.soaw.org•••www.teleport.com•••www.thing.Desk.nl•••www.thing.de•••www.thing.net•••www.tmcrew.org•••www.utexas.edu•••www.xensei.com•••www2.sfmt.org

Here we apparently have a list of servers/organizations that participated in FloodNet in one way or another. Once more, the desire of the developers (in the first code sample) and other participants to make their presence public is evident. It becomes a public record, even though it is embedded in a machine-executable file.

Temkin · February 2020

Thanks Paul and Shawné; this is a fascinating project. The context about dds attacks is fascinating, and the controversy around it as an approach for protest.

@Ignotus_Mago said:
Here we apparently have a list of servers/organizations that participated in FloodNet in one way or another. Once more, the desire of the developers (in the first code sample) and other participants to make their presence public is evident. It becomes a public record, even though it is embedded in a machine-executable file.

I've decompiled the class files to look at how that list was used. While we lose any comments that might have been in the code, it is not obfuscated, so we get the original variable names, etc. They are a list of domains it refuses to be run against.

From zapsFloodNetPublic1.java:

line 23:
String[] protectedURLs = new String[]{"cadre.sjsu.edu", "www.thing.net", "switch.sjsu.edu", "www.sjsu.edu", "bbs.thing.net", "www.xensei.com", "www.fringeware.com", "gallery.sjsu.edu", "odysseus.sjsu.edu", "www.rhizome.org", "www.eco.utexas.edu:80", "www.teleport.com", "burn.ucsd.edu", "spin.com.mx", "www.igc.apc.org", "www.contrast.org", "www.pangea.org", "www.nodo50.ix.apc.org" ...

line 39:

for (int i = 0; i < this.protectedURLs.length; ++i) {
  if (!this.protectedURLs[i].equals(this.UrlParam)) continue;
  this.UrlParam = this.getDocumentBase().toString();
}
this.showStatus("Viva la Zapatistas! Never forget Chiapas!");

I've attached the three java files, but renamed to .log as this message board doesn't allow .java attachments.

Ignotus_Mago · February 2020

@Temkin said:
I've decompiled the class files to look at how that list was used. While we lose any comments that might have been in the code, it is not obfuscated, so we get the original variable names, etc. They are a list of domains it refuses to be run against.

Thanks, Daniel. This clarifies what is going on in the code considerably, and gives a more nuanced picture of what the code set out to accomplish. It maintains a list of protected sites that will not be affected by DDoS, including thing.net and others that were clearly supportive. It also randomly picks and reveals one of the four developers websites in the applet frame in response to a keypress (or so I deduce after a quick stroll through the code). The developers' do not conceal their presence, but they've made showing any one of their websites into an Easter Egg, an undocumented surprise feature.

Ignotus_Mago · February 2020

Electronic Disturbance Theater (from thing.net)

Ricardo Dominguez- Organizer, Agitator, Artist, Theorist
Carmin Karasic- Artist, Interface design and testing, Graphic Design
Brett Stalbaum- Java Programmer, Artist and author of FloodNet Applet
Stefan Wray- Theorist, Writer, and Agitator

Bibliography

Bazzichelli, Tatiana. Networking: The Net as Artwork. Digital Aesthetics Research Center
www.digital-aestetik.dk. English edition 2008, Digital Aesthetics Research Center, Aarhus University.
Cox, Joseph. The History of DDoS Attacks as a Tool of Protest, online book review of Molly Sauter's The Coming Swarm: DDoS Actions, Hacktivism and Civil Disobedience, Motherboard (2014). https://www.vice.com/en_us/article/d734pm/history-of-the-ddos-attack
Dreher, Thomas. History of Computer Art. First published online, IASLonline Lessons/Lektionen in NetArt. URL: http://iasl.uni-muenchen.de/links/GCA_Indexe.html German edition (2012), English edition (2015).
Greene, Rachel. Internet Art, Thames & Hudson, Ltd., London (2004).
Harmon, Amy. "Hacktivists" of all Persuasions Take Their Struggle to the Web, New York Times (Oct. 31, 1998). https://www.nytimes.com/1998/10/31/world/hacktivists-of-all-persuasions-take-their-struggle-to-the-web.html
Media Art Net entry "Electronic Disturbance Theater", with links to additional material: http://www.medienkunstnetz.de/artist/electronic-disturbance-theatre/biography/
Nettime.org: many discussions of FloodNet in the Nettime mailing lists, searchable. Note in particular:
-- The ABC of Tactical Media, Geert Lovink and David Garcia. https://www.nettime.org/Lists-Archives/nettime-l-9705/msg00096.html

For further reading

The Concept of Tactical Media:
http://www.tacticalmediafiles.net/collections/41572/The-Concept-of-Tactical-Media. An extensive chronological list of publications on tactical media, with links.
Rhizome Net Art Anthology
https://sites.rhizome.org/anthology/floodnet.html
Old website of EDT co-founder Ricardo Dominguez
https://www.thing.net/~rdom/
Essay by EDT co-founder Brett Stallbaun on FloodNet
https://www.thing.net/~rdom/ecd/ZapTact.html
List of texts on Electronic Civil Disobedience
https://www.thing.net/~rdom/ecd/archives.html
The "developer kit" edition of FloodNet. Note that FloodNet is generally non-functional in current browsers.
http://www.thing.net/~rdom/ecd/jan99ddk.zip

jeremydouglass · February 2020

@Ignotus_Mago -- thank you for this context and this resource-sleuthing.

@Temkin thanks for sharing this! Which Java decompiler did you use?

For those not familiar with Java .class decompiling, you can install your own such as JDProject ("Java Decompiler Project"), Procyon, or Fernflower -- or do a quick single-file using web services that let you upload a file and select a decompiler. The differences between decompilers matter much more when dealing with deobfuscation or with code that uses more contemporary (Java 8+) language features.

Here is the result when I ran FormURLzapsNet.class through javadecompilers.com using CFR:

/*
 * Decompiled with CFR 0.145.
 */
class FormURLzapsNet {
    public String getstring(String string) {
        String string2 = null;
        string2 = String.valueOf(string) + "/" + this.getBadExtend();
        return string2;
    }

    private String getBadExtend() {
        String string = "";
        int n = (int)Math.floor(Math.random() * 21.0);
        for (int i = 0; i < n; ++i) {
            string = String.valueOf(string) + this.getRandomChar();
        }
        return string;
    }

    private String getRandomChar() {
        String string = new String();
        short s = (short)Math.floor(Math.random() * 222.0);
        s = (short)(s + 33);
        string = String.valueOf(string) + (char)s;
        return string;
    }

    FormURLzapsNet() {
    }
}

Decompiling the same file with Procyon gives the same method names and logic, but presented in a very different style -- for example a one-line method rather than a five-line method:

    private String getRandomChar() {
        return String.valueOf(new String()) + (char)(short)((short)Math.floor(Math.random() * 222.0) + 33);
    }

Temkin · February 2020

@jeremydouglass said:
@Temkin thanks for sharing this! Which Java decompiler did you use?

I used CFR 0.148

Temkin · February 2020

@Ignotus_Mago said:
FloodNet was developed in 1998 by the Electronic Disturbance Theater (EDT), a group of artists and activists working in the area of Electronic Civil Disobedience (ECD). FloodNet enabled activists to hold "virtual sit-ins." ... Typically, a time would be set for the protest, participants would open the FloodNet home page during the protest and an applet embedded in the page would send out requests from the client page to the targeted server every 7 seconds. Participants could also send "personal messages" encoded as URLs to the server.

Denial-of-service attacks were pretty new when this came out, with the first widely-reported one, the Panix service attack only a few years prior, in Sep 1996.

I love how this is not fully automated; it's not a botnet that relies on passive infected machines, like most ddoses. FloodNet asks users to actively participating by visiting the page and activating the applet -- and to coordinate that action in an attack that only works when many do it at the same time.

Ignotus_Mago · February 2020

@Temkin said:

I love how this is not fully automated; it's not a botnet that relies on passive infected machines, like most ddoses. FloodNet asks users to actively participating by visiting the page and activating the applet -- and to coordinate that action in an attack that only works when many do it at the same time.

The deliberate generation of a 404 error to propagate meaningful texts of protest, in a context of exposed identities, seemed to us to encapsulate the attitude of collective action with faces and names, a kind of glitch petition nailed to the server log. "Here we stand" for the Internet Age, a "network of solidarity" as Shawné points out. The controversy on NetTime and other discussion forums reveals that everything was not so simple, but the gesture and its repeated performances endures long after any putative disturbance either to "foes" (the targeted servers) or "friends" (your local ISP).

FloodNet was instrumental in the legal battle of the Swiss artists' group etoy against the American toy shipper eToy over the rights to etoy.com. Thomas Dreher noted: "The virtual sit-ins were combined with a successful press campaign. Both together damaged the image of eToys. The share price decreased dramatically and in February 2001 eToys filed for bankruptcy protection after disappointing Christmas sales." [Dreher, Thomas. History of Computer Art, 2015]

I'd also point out the simple, classic "hack value" of the the 404 error strings. Intentionally or not, FloodNet enters into a long tradition of twisting the tail of code for fun.

jeremydouglass · February 2020

Just a note that some news articles and government documents appear to index "FloodNet" 1999-2001 but are in fact referencing an entirely different denial of service software, Tribe Flood Network (or TFN) aka Tribal Flood Network aka Tribal Flood Net, which was not for performative civil disobedience, but instead used exploits to compromise hosts and then use them to deliver automated, coordinated attacks.

For example, searching congressional hearing documents for "FloodNet" returns five matches from Feb 2000 to April 2001 -- however they are all for "Tribal Flood Net" -- not FloodNet.

If FloodNet is a citizen protest tool and "Tribal Flood Net" is a black hat weapon, another interesting contrasting ethos is the Great Cannon of China, which the nation state uses to suborn live viewers around the world into personally participating in a DDOS through browsing -- but without their knowledge. It works by injecting JavaScript into page requests that cross the Great Firewall of China, and those JavaScripts then execute the attack from around the world using the client-side browsers. For example, if you loaded a Chinese webpage since late November of last year (2019) then you might have been selected to participate in a distributed attack on sites like LIHKG, a key forum for organizing Hong Kong protests.

patricia_s · February 2020

Thank you for this @cleogirl2525 and @Ignotus_Mago.

Thank you @Temkin for decompiling that, I am now completely fascinated by the list of domains the code was not set to run against. Here's a screenshot of the list of protected domains:

Temkin · February 2020

@patricia_s said:
Here's a screenshot of the list of protected domains

It's an interesting list of sites, including many popular messageboards. Just noticed that Echo and (several different domains for) the Thing both made the cut, but the Well didn't. Hmmm. vivaldi.nexus.it looks probably exactly as it did then. Echo too.

Howdy, Stranger!

Categories

In this Discussion

FloodNet: Deliberate Error as Protest and Performance

Comments