GreatFire says China is behind the DDoS attacks on GitHub and its website in new report
Lorenzo Franceschi-Bicchierai / Motherboard :
Context & Ripple Effects
The attribution claim lands mid-crisis: GreatFire disclosed its own 2.6 billion-requests-per-hour attack, roughly 2,500 times normal traffic, earlier in March, and GitHub has spent days absorbing a related flood while mitigating some of the impact — with Baidu publicly denying any role. GreatFire's new report now names China as the source of both campaigns, converting what looked like anonymous traffic into an alleged act of state-directed targeting of censorship-circumvention tools.
Why it matters: GitHub is the main Western host for Chinese anti-censorship mirror sites like GreatFire's, so an attack traced to Beijing puts a US platform squarely inside China's domestic censorship apparatus.
First-order effects
- GitHub must sustain mitigation against an ongoing, allegedly state-backed flood rather than a one-off incident, raising the operational cost of simply staying online.
- Baidu faces reputational pressure to rebut the implication that it was hijacked as an attack vector, since GreatFire's attribution puts the company's name in the middle of a geopolitical dispute.
Second-order effects
- Other platforms hosting China-circumvention content face the same calculus GitHub does: host the mirrors and risk being attacked, or drop them and undermine their neutrality claims.
- Attribution shifts the response from network defense to policy — if a government is the attacker, GitHub and its peers may need legal and diplomatic cover, not just traffic filtering.
Third-order effects
- If the pattern holds, DDoS becomes an instrument of extraterritorial censorship, with states degrading foreign platforms that host blocked content instead of only filtering at the border — a template later visible in GitHub's record-setting 1.35Tbps memcached attack of February 2018 ([[a:927146]]).
The trend: State actors are extending censorship beyond national borders by attacking the foreign platforms that host circumvention tools, with attribution reports like GreatFire's becoming the countermeasure.