When the hacker collective Anonymous launched distributed denial-of-service attacks against Mastercard and PayPal in late 2010, in retaliation for those companies cutting off donations to WikiLeaks, it marked a turning point in digital activism. It also caught the attention of California defense attorney Jay Leiderman, who would go on to become one of the most prominent legal advocates for accused hacktivists in the United States.
Leiderman represented several high-profile figures in the hacktivist world, including Commander X, who faced federal charges for a DDoS action against a Santa Cruz county website in protest of a ban on public sleeping, and Raynaldo Rivera, a suspected LulzSec member accused of breaching Sony computer systems. Both faced potential sentences of up to 15 years in prison. Leiderman took many of these cases pro bono.
DDoS as Digital Protest
Central to Leiderman’s legal philosophy was the argument that certain DDoS actions should be recognized as a form of protected speech rather than categorized uniformly as criminal attacks. He drew a direct parallel to the civil rights era sit-ins at Woolworth’s lunch counters.
In the PayPal case, he argued, individuals simply wanted to process donations to WikiLeaks, much as civil rights protesters wanted to buy lunch at a segregated counter. PayPal was willing to process donations for organizations far more controversial than WikiLeaks, yet it chose to block WikiLeaks transactions. The protesters occupied bandwidth temporarily and then left. In that context, Leiderman contended, DDoS functioned as a form of digital civil disobedience.
The Santa Cruz case presented what he considered an even more compelling argument. The city had effectively criminalized homeless people sleeping in public. When government officials refused to engage with public concerns, and people were dying from exposure, an activist used a DDoS action to force the local government to pay attention. Leiderman argued this was the digital equivalent of petitioning the government for a redress of grievances, a right with deep constitutional roots.
Distinguishing Protest from Attack
Leiderman was careful to distinguish between different types of DDoS activity. A DDoS action used as cover to penetrate servers and steal credit card information was fundamentally different from a temporary bandwidth occupation intended to make a political point. He advocated for narrowly drawn laws that would excise legitimate protest activity from criminal prosecution while maintaining penalties for genuinely malicious intrusions.
The distinction he proposed was between a DDoS attack, which causes harm for personal gain, and a DDoS protest, which temporarily disrupts access to make a political statement. He argued that the legal system needed to develop more nuanced categories rather than treating all such actions identically.
The Problem of Disproportionate Sentencing
One of Leiderman’s strongest criticisms was directed at the sentencing framework applied to hacktivist cases. Many of the individuals charged in Anonymous-related operations were young, legally unsophisticated first-time offenders who did not fully understand the criminal consequences of their actions. Slapping them with sentences designed for sophisticated cybercriminals was, in his view, both counterproductive and unjust.
He contrasted the typical Anonymous participant with someone like Sabu, the LulzSec leader who operated under the name Hector Monsegur. Sabu had a decade of experience in hacking, was involved in credit card fraud for personal profit with no ideological motivation, and actively recruited younger participants into illegal activity, pressuring them to commit specific acts so they would be more deeply compromised and easier to control. When Sabu was eventually caught, he became an FBI informant, turning against the same people he had recruited.
For rank-and-file participants, Leiderman argued that criminal convictions alone, combined with probation, community service, and in some cases temporary restrictions on internet access, would be far more effective than incarceration. The conviction itself was a significant consequence: it made employment difficult and blocked access to security clearances in technology fields.
Ethics of Representation
Leiderman approached legal defense with a philosophy rooted in the principle that everyone deserves vigorous representation, regardless of the nature of their alleged crimes. He noted that as a Jewish attorney, he had represented neo-Nazis during his time as a public defender without hesitation. The more reprehensible a defendant appeared, the more entitled they were to a strong defense.
However, he drew a personal line at pro bono work: he would not donate his time and energy to causes he did not believe in. And he was unequivocal about one category of client he would never represent. He refused to take on cooperating witnesses who, like Sabu, had thrown others into legal jeopardy to protect themselves. The damage caused by that kind of betrayal, turning on people once called brothers to soften personal consequences, was something he found indefensible.
The Larger Question
The cases Leiderman handled raised questions that extended well beyond individual defendants. As digital activism became an increasingly common form of political expression, the legal system faced a fundamental challenge: how to distinguish between criminal hacking and legitimate protest in a medium that did not exist when most cybercrime statutes were written.
Leiderman believed the legal profession had a rare opportunity to shape how courts and legislatures would ultimately address privacy, emerging technology, and civil rights in the digital age. Whether society would treat DDoS actions as inherently criminal or develop more nuanced frameworks that recognized their potential as political speech remained an open question, one that continued to play out in courtrooms across the country.
