San Francisco Chronicle - (Sunday)
Hacktivist has ‘no regrets’ for alleged cyberattacks
“Those protests were held to defend and give voice to the most disenfranchised people.”
On the evening of June 11, 20c21, Mexican immigration authorities entered Christopher Doyon's home in Mexico City and put him in handcuffs. His two dogs were left running in the street, he said, and by noon the next day, he found himself alone in a cell at Alameda County's Santa Rita Jail.
After 10 years of running from the law, Doyon's time was up.
A hacktivist with ties to the hacking collective Anonymous, Doyon, 57, has a dedicated following among some internet freedom and human rights advocates who know him as Commander X. As Doyon hunkered down in Canada and Mexico for the better part of the past decade, and as he has spent much of the past year in jail, his supporters have clamored for his freedom, echoing his own belief that his incarceration is unjust and an affront on freedoms of expression.
The former Mountain View resident, voluntarily homeless for much of his life, pleaded guilty Tuesday to cyberattack charges out of California and Florida — hackings in Santa Cruz in 2010 and Orlando in 2011 that temporarily shut down several local government websites. Doyon describes the cyberattacks as nothing more than “peaceful protests” against local ordinances that he says targeted homeless people.
In a recent interview with The Chronicle from Santa Rita Jail, he said he shudders at the implications his prosecution will have on the right of people to demonstrate peacefully. He believes his conviction could set dangerous precedents for how the internet is used and regulated.
“Is the internet the public commons, or is the internet the private estate of corporations and governments whereby they can simply brutally crush even the slightest dissent that takes place on it?” he said through a jail phone. “That's where we're at, that's what they're doing and that's the question.”
Doyon believes the law at the heart of his case — the Computer Fraud and Abuse Act of 1986 — is outdated and no longer applicable because it was written before the advent of the modern internet. Whether his cyberattacks merit the kinds of penalties he's up against — possibly months in prison and thousands of dollars in restitution — should be up for debate, he said. His sentencing is scheduled for late June.
“Just because what I did is being claimed by the government to be illegal does not mean it shouldn't be free speech,” Doyon said. “This is a hill we're dying on.”
But cybersecurity and computer law experts say that despite the intentions behind the cyberattacks, Doyon appears to have broken the law; the CFAA prohibits accessing a computer without authorization when such access causes losses, which Orlando and Santa Cruz reported, according to prosecutors. It doesn't matter that the cyberattacks were “peaceful” or in
support of the needy, experts said, they were still illegal, and the charges appear warranted.
Doyon was indicted on seven counts of intentional damage to a protected computer stemming from the 2011 cyberattacks in Orlando, as well as two similar charges following his participation in the 2010 cyberattack in Santa Cruz County. In both cases, prosecutors said, Doyon and others temporarily shut down local websites in retribution for local officials enforcing existing ordinances that affected homeless people.
In December 2010, Doyon joined Operation Peace Camp 2010, a local movement formed in response to a Santa Cruz ordinance that prohibited camping within the city. Operation Peace Camp 2010 occupied the Santa Cruz County Courthouse for months, and several protesters were charged with misdemeanors. In response, as part of the movement, the People's Liberation Front — which Doyon helped found and which was associated with hacking groups such as Anonymous — executed a distributed denial of service attack on the county's computer servers, shutting down the county website. The website crashed for about an hour, said Jason Hoppin, a county spokesperson.
Distributed denial of service attacks are designed to shut down a website or network by essentially overwhelming it with traffic, causing it to crash.
Six months later, Doyon and others carried out a series of cyberattacks in Orlando. Law enforcement in the city had arrested members of an activist group called Food Not Bombs for feeding a large group of homeless people, violating a city ordinance that prohibited the distribution of food to large groups in city parks without a permit, case records show.
In an act of retribution, prosecutors said, Doyon and others targeted computer networks associated with government agencies in Orange County, Fla. They targeted websites such as cityoforlando.net and downtown orlando.com, according to case
records.
The Orlando websites were down for a few periods of 15 minutes or less each, and were not damaged. The city of Orlando did not incur financial losses as a direct result of the attacks, but officials did report hundreds of hours of staff time and a cost of roughly $100,000 for “additional technology solutions to shore up our defenses,” said Cassandra Bell, a spokesperson for the Orlando mayor's office.
“Those protests were held to defend and give voice to the most disenfranchised people in our entire society, the homeless,” Doyon said. “I have no regrets at all, whatsoever.”
Doyon was released following his arraignment, pending his trial, but he skipped out on court dates in 2012 and quietly moved to Canada. He spent much of his time in Montreal and Toronto, in “self-imposed exile,” unable to gain asylum status, he said. He wrote two books during that time about his involvement in Anonymous.
After seven years in Canada, Doyon decided to resettle in Mexico, believing he would have a better chance of getting asylum status there. He took all the royalties from his books, bought supplies, walked across the U.S.-Canada border and biked from North Dakota to New Mexico before crossing the southern border on foot, he said.
He turned himself in to Mexican officials, was granted political asylum, and a few months later was given refugee status and a green card, he said. He spent time in Mexico City, Guanajuato, San Miguel de Allende and other cities over the course of three years, until his arrest last June.
The case from Florida was recently transferred to the Northern District of California and combined for prosecution by the U.S. Attorney's Office for the Northern District of California. Legal proceedings have been delayed by the pandemic, Doyon said.
He previously pleaded not guilty, but this month reluctantly accepted a plea agreement with
prosecutors wherein he pleaded guilty to seven counts of intentional damage to a protected computer; one count of intentional damage to a protected computer, aiding and abetting; one count of conspiracy to commit intentional damage to a protected computer and one count of failure to appear after pre-trial release. The charges out of Santa Cruz, originally felonies, were reduced to misdemeanors after the losses to the county were determined to be just under $5,000.
Doyon and his supporters have raised questions about people's right to use the internet as a medium for peaceful protest, and Doyon has equated the hackings to sit-ins or unpermitted street marches — they can be annoying and disruptive, he said, but they don't typically result in federal charges.
But experts say there are legal limits to what can and cannot be done on the internet, and that Doyon's cyberattacks rightfully crossed legal lines.
Allison Berke, director of advanced technology at California 100, a think tank based at the University of California and Stanford University, said Doyon's case appears to be “well in the strike zone” of how the CFAA was designed, since he deliberately rendered a government agency's computer or computer system inoperable, essentially sabotaging it.
“Launching a DDoS attack against the whole of a municipality's web presence can't reasonably be expected to be interpreted as a protest against one particular statute,” Berke told The Chronicle.
Other experts said that while Doyon did have a right to peacefully protest, the way he went about it was against the law.
“You can protest government policy by expressing your opinion against it, but that expression doesn't give you a right to damage someone else's property,” said Orin Kerr, a law professor at UC Berkeley who helped develop the field of computer crime law. “All of us have many complaints about government
“Hacktivist” Christopher Doyon
policy, but we resolve those disagreements by voting rather than through vandalism. You don't have a right to damage government property, and to stick the taxpayers with the bill, to express your dissatisfaction.”
ACLU guidelines on protest and demonstration law indicate that protests that symbolically express a viewpoint are protected by the Constitution, until they involve “illegal conduct.”
“While sitting in a road may be expressing a political opinion, the act of blocking traffic may lead to criminal punishment,” the ACLU guidelines state.
Doyon's future, to be decided at an upcoming sentencing hearing, is at Judge Beth Labson Freeman's discretion. He could be released from jail or serve months in prison and be ordered to pay restitution.
“He's a man of conviction with a good heart who stood up for the hungry and the homeless and for those being persecuted and jailed for helping them,” his sister, Amy-Beth Doyon, said in a statement to The Chronicle. “It's been a decade of hell. I pray this judge will show mercy and leniency and save my brother's life.”
Doyon insists that the cyberattacks were harmless and that they did not cause any damage to the website or servers. He hopes Freeman, the judge, will take that into consideration and that she will be lenient in deciding his sentence.
“Please have mercy on me, Your Honor,” he wrote in a letter to Freeman in January. “I am just a little old man who desperately wants to be with my little doggies again.”
He said he is cautiously looking forward to a future in which he is neither behind bars nor hiding from law enforcement. He is now too old for that, he said, and wants “nothing more than to retire from my activism” and move to Idaho to live with and help his sister, who has a disability, according to the letter.
Once out of jail, Doyon said, he will try to recover his dogs from a friend in Mexico who has been caring for them. He will try to finish writing his third book, visit Buddhist monasteries and temples — he is a practicing Buddhist — and sell the rights to his life story to a streaming platform, for which negotiations are already underway, he said.
After 10 years of running from the law, Doyon hopes he is close to getting a fresh start.
“There is upside to being the greatest fugitive activist in history,” he said. “I think my future is bright if I can just get out of here.”