By 2026, forget the picket lines. The fastest-growing form of protest won’t be on the streets; it will be a decentralized, digital flash mob we call Citizen-led Denial of Service (cDOS). They have always been about overwhelming a system with so many requests that it collapses. It’s digital gridlock. But historically, it was the domain of shadowy, technically savvy hackers using giant botnets of compromised devices. We’ve filled our homes and our businesses with these friendly, conversational AIs. They’re our secretaries, our information hubs, our digital butlers. But what if millions of ordinary people, armed with simple, shared scripts and a collective purpose, ask those virtual assistants—the ones you’ve integrated into your corporate phone system, your support chat, your API endpoints—to do a single thing, simultaneously, non-stop, for hours? According to Gartner, by 2026, citizen-led denial of service (cDOS) attacks, using virtual assistants to shut down operations, will become the fastest-growing form of protest.^[1] This is cDOS. It’s the virtual sit-in. It’s non-violent, simple, and the barrier to entry is virtually zero. It doesn’t require hacking expertise. It requires a shared outrage and an easily shareable prompt.

Business owners are trapped in a new kind of crisis where their online systems become the frontline of social protest. You used to worry about hackers stealing data; now, you have to worry about activists using thousands of genuine visitors to shut you down. This Citizen-led Denial-of-Service (cDOS) is a huge problem because it uses legitimate traffic, fooling your security tools designed to spot malicious bots. The central dilemma is agonizing: Is this a sudden, massive surge of desirable customer traffic, or a calculated attack meant to silence you? Defending against it is expensive, often demanding massive infrastructure upgrades. Worse, if you successfully block the attack, you risk being publicly accused of censorship, damaging your brand’s reputation, and alienating future customers. Businesses are forced to spend money defending against social dissent, taking funds away from innovation. This conflict forces companies to choose between operational stability and the public’s perception of their ethics. The new reality is that every business must prepare for its systems to be the next target of a keyboard-led revolution.

On February 28, 2018, GitHub, the world’s largest host of source code, was the victim of a Distributed Denial-of-Service (DDoS) attack that peaked at 1.35 Terabits per second (Tbps). At the time, this was the largest publicly reported DDoS attack in history, eclipsing the previous record-holder, the Mirai botnet attack on Brian Krebs.The attack was a volumetric amplification attack that exploited misconfigured memcached servers across the internet. Due to the high amplification factor of this technique, the attackers were able to launch an unprecedented amount of malicious traffic without needing a massive botnet of compromised IoT devices.The core of the attack leveraged a critical security flaw: thousands of memcached servers that were inadvertently exposed to the public internet with the User Datagram Protocol (UDP) enabled and no authentication required. When exposed to the internet via UDP port 11211, an attacker can send a small request (a few bytes) to a memcached server to retrieve a large cached data payload (up to 1MB). Amplification factor was the key element. Researchers observed an amplification factor of up to 51,200x, meaning a tiny 15-byte request from the attacker could trigger a massive 750KB response directed at the victim. The attacker spoofed the victim’s (GitHub’s) IP address and sent small requests to thousands of publicly exposed memcached servers. The servers, believing the requests came from GitHub, amplified the traffic and flooded GitHub’s network with huge data responses.The significant volumetric attack began at 17:21 UTC on February 28th.GitHub.com experienced service unavailability from 17:21 to 17:26 UTC and intermittent unavailability until 17:30 UTC. The total primary disruption lasted about 9 minutes.At the first signs of anomaly, GitHub’s operations team made the decision to immediately shift their traffic. At 17:26 UTC, they began routing their traffic to Akamai’s Prolexic Routed platform, their DDoS mitigation partner. While GitHub experienced a temporary outage, the incident provided critical lessons for the entire technology industry. The attack proved that massive DDoS assaults no longer rely solely on compromised end-user devices (botnets), but can leverage widely used, yet misconfigured, business services. GitHub’s ability to quickly divert traffic to a high-capacity DDoS scrubbing service (Akamai) was instrumental in minimizing downtime. This highlighted the necessity of having a prepared, external DDoS mitigation strategy capable of handling Terabit-scale attacks. ^[2]

The internet promised to level the playing field, but too much power remains concentrated. Traditional protest is challenging: it requires organization, attendance, and the risk of arrest. cDOS is a one-click civil disobedience. The virtual assistant is the ultimate accelerant. It allows a global, simultaneous, coordinated effort that scales instantly. The motive is clear: when a company’s policies, ethics, or actions outrage the digital public, they can now strike at the most vulnerable part of its existence—its constant availability. In a world where, if you’re not online, you don’t exist, attacking a company’s uptime is hitting it directly in its soul. It’s forcing the company to pay attention to the little guy, the citizen, who now has a voice louder than any bullhorn.

While GitHub experienced a temporary outage, the incident provided critical lessons for the entire technology industry. The attack was only possible because system administrators had failed to adhere to the fundamental best practice of keeping memcached servers (and other similar caching services) behind a firewall and/or disabling UDP support if not needed. The incident triggered a massive, global effort by security researchers and network operators to identify and secure the tens of thousands of vulnerable memcached servers that were exposed to the public internet, dramatically shrinking the potential attack surface for future memcached-based DDoS attacks.