Can one be held liable for provoking a DDOS attack?
<p>Let's say I'm in a <a href="https://en.wikipedia.org/wiki/Internet_caf%C3%A9" rel="nofollow noreferrer">Internet Cafe</a> in <em>some place of the world</em>* and I buy their services to access some online instant messanging service.</p>

<p>Suppose I chat with a person online who decides they really dislike me, to the point that they find my IP address (which is, of course, the address of the computer I'm sitting on) and decides to launch a DDOS attack on that address, by sending a large amount of traffic through the internet, which as a result floods my connection and doesn't allow me to use the internet.</p>

<p>Let's also assume that the IP address is static and that the attacker is not willing to ever stop, which means that <strong>the specific internet cafe machine will stay flooded for quite a while, causing a lot of damage and money loss.</strong></p>

<p>Could I be held responsible for the damage caused to that computer, just because someone decided to DDOS me?</p>

<hr>

<p>* If <em>some place of the world</em> is too general, let's say I'm in the <strong>US</strong>.</p>

<h1>Doubtful.</h1>

<p>Focusing on the US, DDoSing someone is illegal. It is a criminal (and possibly civil) wrong under the CFAA. It may also violate some other statute or be in breach of some contract signed by the DDoSer. However, the question was whether the person <em>being</em> DDoSed is legally in the wrong, so: There are a variety of ways an action can be "illegal." It could:</p>

<h3>Violate some criminal statute</h3>

<p>This looks promising; after all, US law regarding internet activities is obscenely broad. That said, I can't think of any state or federal statute prohibiting the conduct in question, <em>unless</em> some aspect of it were prohibited under a term of the internet cafe's ToS (more on this possibility later), in which case using the internet cafe's computer in violation of that term might constitute "unauthorized access" under the CFAA, a federal crime. All of that said, state laws are weird, so there's a very slim outside chance the conduct in question might violate some state law.</p>

<h3>Constitute some kind of civil tort</h3>

<p>This doesn't really hold up either. A civil tort requires that you owe some duty to the person against whom you are allegedly committing the tort and that you cause them damage by violating that duty; I don't see one here.</p>

<h3>Breach of Contract</h3>

<p>Presumably, you agreed to some policy of some flavor when you started using the internet cafe's services. There's an outside chance that it prohibited some conduct (racial epithets, harassment, etc), and that, if your engaging in said conduct caused the other person to DDoS the internet cafe, the cafe could sue you for special damages. This would be the most likely way, in my opinion, for your conduct to violate US law; even it is extremely unlikely at best.</p>

internet liability