FCC site overrun by public comment
HBO’s John Oliver may be behind surge; site also hit in online attack
Nearly 200,000 people have already commented on Net neutrality to the Federal Communications Commission — many likely spurred on by HBO’s John Oliver.
The comedian and host of the premium pay-TV channel’s Last Week Tonight With John Oliver on Sunday urged viewers to go to the FCC’s website to voice their support for current Net neutrality regulations passed in 2015. The FCC had prepared for a new round of public comment after FCC Chairman Ajit Pai last month began the process of reconsidering the Net neutrality rules, which require ISPs to treat all legal content equally.
When the rules were being debated three years ago, Oliver’s encouragement to file comments to the FCC during a June 2014 episode crashed the agency’s site. On his latest episode, which debuted Sunday night, Oliver urged viewers with a Shakespearean, “Once more into the breach.”
They apparently responded, with Net neutrality comments rising from about 30,000 Monday morning to more than 184,650 by midday Tuesday.
It’s possible that more comment might have been filed, except that the FCC site was hit with an online attack Sunday about the same time Oliver urged viewers to the site. The FCC’s comment system remained operational, FCC Chief Information Officer David Bray said Monday, but attacks “tied up the servers and prevented them from responding to people attempting to submit comments.”
The FCC.gov site is hosted by Akamai, a content delivery and cloud provider which provides robust DDoS (distributed denial of service) attack prevention to its clients. DDoS attacks generally spring from the cyber underground and are used to knock websites offline. Typically networks of maliciously-controlled computers called botnets are deployed to send hundreds of thousands of requests to a site a second, so many and so fast that it cannot respond to any of them and ceases to function.
An external actor deciding to launch its botnets on the FCC’s comment site at exactly the same time as John Oliver made his request to views seemed unlikely, says Justin Monti, a security expert with MKACyber, a security consulting firm based in Fairfax, Va.
Akamai’s involvement suggests that the FCC’s site should have had adequate system strength to support a large upsurge in traffic, he says. “Akamai has a tremendous amount investing in DDoS prevention and mitigation; it would take an extraordinarysized DDoS to really bring Akamai down,” Monti said, though he added the caveat that it’s impossible to know what specific services Akamai was providing the FCC.
The FCC says that it had already improved its system to handle up to 250,000 in a day near the end of the 2014 comment period.
The FCC said Tuesday that a similar DDoS attack in 2014 caused what was publicly thought to be a crash. At the time, the FCC did not want to say there was such an attack out of concern for copycats, said Mark Wigfield, the FCC’s deputy director of media relations.