Is a DDoS attack illegal?

02What the law says, by jurisdiction

Four legal regimes illustrate the position. Each criminalises unauthorised impairment of a computer system, and each reaches both the person launching the attack and, in most cases, the people supplying the tools.

03What exactly do the statutes prohibit?

In the United States, the CFAA punishes whoever "knowingly causes the transmission of a program, information, code, or command, and as a result... intentionally causes damage without authorization, to a protected computer". "Damage" is defined broadly as "any impairment to the integrity or availability of data, a program, a system, or information" — availability being exactly what a DDoS attacks. The ten-year ceiling applies where the harm crosses a statutory threshold, such as at least $5,000 of loss in a year; below it, the maximum is one year. The statute also allows civil suits by victims under § 1030(g).

In the UK, s.3 of the Computer Misuse Act covers unauthorised acts done with intent, or recklessness, as to impairing a computer's operation; conviction on indictment carries up to ten years. Where an attack causes or risks serious damage to human welfare or national security, s.3ZA raises the ceiling to fourteen years or life.

In Germany, § 303b StGB (Computersabotage) criminalises seriously disrupting data processing of substantial importance, with a higher range when a business or public authority is hit and a six-month-to-ten-year band for especially serious cases such as organised or commercial offending.

The EU's Directive 2013/40/EU does not punish individuals directly; it obliges member states to set minimum maximum penalties. Article 9 requires at least two years for serious system interference, at least three years "where a significant number of information systems have been affected through the use of a tool" designed for that purpose — the botnet clause — and at least five years for attacks on critical infrastructure or committed within a criminal organisation.

04Booters and stressers: the 'legal' label is marketing

Booter and stresser services sell DDoS attacks by the minute through a web page. Many wrap themselves in terms of service that claim they are legitimate network-testing tools and that the customer promises to attack only their own systems. Enforcement agencies have rejected this framing directly.

The US Department of Justice has said these disclaimers ignore that most booter services rely on constantly scanning the Internet to "commandeer misconfigured devices", and KrebsOnSecurity, reporting on the 2023 US seizures, noted that "none of the services seized by the government required users to demonstrate that they own the Internet addresses being stress-tested, something a legitimate testing service would insist upon". The FBI's 2017 public advisory warns that using these services against a site without the owner's permission is investigated as a crime under the CFAA.

The practical point: renting an attack is the same offence as writing one. The disclaimer on a booter's homepage protects the operator's story, not the customer. Several jurisdictions also criminalise supplying or obtaining the tools themselves — the UK's s.3A and the EU directive's Article 7 both reach the people who make and distribute attack tooling.

05Enforcement is active: Operation PowerOFF

These laws are enforced. Operation PowerOFF, coordinated by Europol with the FBI, the UK's National Crime Agency and partners, has repeatedly seized booter platforms, arrested their administrators and traced their customers, most recently in an April 2026 action week that took down 53 domains and warned more than 75,000 users. The dated takedowns, the decoy booter sites and the deterrence evidence are set out in what an IP stresser is.

None of this makes defending your own systems a grey area. Filtering hostile traffic, absorbing a flood, or running DDoS mitigation in front of a service you operate is entirely lawful — the offence is impairing someone else's system, never protecting your own.

06What lawful load testing looks like

Lawful load testing differs from an attack by authorisation and ownership, not technique: you test systems you own or have written permission to test, follow your hosting provider's testing policy, and run controlled tools such as k6 or Locust against your own staging. The checklist, and the questions that tell a genuine testing firm from a booter, are in how to tell a lawful load test from a booter.