The internet is a haven for journalism in countries where press freedom is endangered. Exiled outlets report from abroad, beyond the reach of domestic regulators and press laws. But no space is truly safe: in recent years autocracies have innovated to promote their agendas online, exploit social media algorithms, and block critical media.

Cyberattacks are increasingly a weapon of choice for authoritarian governments targeting digital media. This year alone, at least seven exiled Belarusian media sites have been hit by distributed denial-of-service (DDoS) attacks. Staff at the targeted sites say the increasingly frequent attacks appear to be an extension of transnational repression linked to their coverage of political issues. In Serbia, a coalition of media freedom organizations recently warned that DDoS attacks on news websites have emerged as a new form of censorship, alongside coordinated bot attacks and online smear campaigns.

These attacks are not isolated incidents but reflect a broader worldwide pattern. They flood a server with traffic until the website becomes unreachable. Readers simply see a page that will not load and most will not wait or ask why the website is not loading.

But who attacks news websites, and why? My research, published in Political Science Research and Methods, offers systematic evidence from Venezuela on what type of reporting attracts these attacks and what that tells us about how censorship works in the digital age.

Censorship through friction

As a censorship tool, DDoS attacks have two attractive properties. They work against websites hosted anywhere in the world, making them very convenient for reaching exiled media beyond a government's borders. And they are covert: users just see a website that will not load, and attribution is notoriously difficult.

Building on political scientist Margaret Roberts' framework of fear, flooding, and friction, I argue that DDoS attacks censor primarily through friction: they raise the costs of accessing and distributing information. These costs fall on both readers and news providers, and they accumulate over time.

During an attack, the website is unreachable at a potentially critical moment. Frequent outages train readers to switch to more stable sites, and unreliability erodes an outlet's credibility. Providers, meanwhile, must hire IT experts and pay for mitigation services. While offline, they lose advertising revenue, which is often their main income. Accumulated costs and shrinking readership can push outlets toward self-censorship. The attacks may also serve as a signal that harsher censorship will follow if the content does not change.

This logic explains why attacks are selective rather than constant. A permanently offline site would ultimately raise questions and defeat the purpose of covert censorship. If the goal is friction, attacks should follow the publication of undesirable content. That is the observable implication I tested.

Measuring the unmeasurable

Media-reported attack data is of little use here. Attacks on independent outlets in autocracies mostly go unreported. So, I measured them myself.

I monitored 19 independent Venezuelan news websites every 30 minutes for seven months, a period spanning municipal and presidential elections from November 2017 until June 2018. Server status codes reveal likely attacks: repeated 503 errors indicate a server overloaded by traffic. In parallel, I scraped each site's headlines daily and used topic models to classify what they reported on.

Attacks were rare but patterned. Six websites were hit on 19 attack days clustering around the elections. Reporting on certain topics raised the likelihood of being attacked. First, in line with what we know from censorship research on China, coverage of protest and repression seems to increase the likelihood of attacks. Second, potentially regime-delegitimizing topics such as reports on exiled opposition figures, resignation demands, and elections were found to correlate with outages too. Clearly non-political topics showed no relationship.

The pattern shows that the attacks follow the logic of state censorship: they concentrate on content that threatens the regime. It is harder to establish who is behind the attacks. The perpetrators may be state organs, state-sponsored proxies, or pro-government groups acting on their own.

The Venezuelan findings mirror the recent Belarusian attacks, which journalists at targeted outlets linked to coverage of the exiled opposition. And they fit a broader pattern: related research shows that autocracies choose from a repertoire of censorship techniques that includes website filtering and technical attacks, and in earlier work my co-authors and I showed that DDoS attacks spike around contested elections in autocracies worldwide.

Why mitigation is not enough

The standard answer to DDoS attacks is commercial protection through mitigation. Services from Cloudflare, which offers free protection to civil society organizations through Project Galileo, can absorb and filter malicious traffic. In the recent Belarusian wave, Cloudflare blocked more than 99 percent of attack traffic against the outlet Pozirk.

But mitigation is not a full answer, for three reasons.

First, protection through mitigation is imperfect. In the Pozirk case, the roughly 41 million requests that bypassed Cloudflare's defenses were enough to cause a near-total outage. Attackers adapt, increasingly mimicking regular users and routing traffic through major cloud providers to evade filters.

Second, mitigation shifts costs rather than eliminating them. Editors of the targeted Belarusian outlets describe redirecting scarce technical resources from journalism toward infrastructure defense. One outlet moved from cloud hosting to a dedicated server simply to control costs in the event of an attack—reasoning that taking the site offline is cheaper than paying thousands of euros for protection. Qualitative correspondence with website editors in my study on Venezuela further supports this line of reasoning. This is exactly the friction logic at work: even when attacks fail to silence an outlet, they succeed in limiting its reach.

Third, dependence on a handful of private mitigation providers creates its own vulnerability. When the continued operation of exiled media depends on the goodwill and free-tier policies of a few US companies, press freedom rests on commercial and political decisions that can change.

What this means for supporting exiled media

For the growing community of funders, governments, and organizations supporting exiled and independent media, three implications follow.

Digital security support should be treated as core operational funding, not a technical add-on. The costs of defending against cyberattacks are recurring and rising, and they directly compete with editorial budgets.

Documentation matters. Because attacks are covert and attribution is hard, systematic monitoring of the kind digital security groups like RESIDENT.NGO or eQualitie provide is essential to establish patterns, inform protection strategies, and build the evidence base for policy responses.

Finally, expectations should be realistic. DDoS attacks are one tool in a growing kit of authoritarian information control strategies that includes filtering, spyware, and legal and nonlegal harassment. Defending a website is necessary but not sufficient when the strategy behind the attacks is to make independent journalism slowly unaffordable, foster self-censorship, or even make online outlets decide to halt their services as evidence from other online censorship tactics shows.

The internet made it easier for the press to evade traditional censorship. Cyberattacks are an authoritarian countermove: global, cheap, and deniable. For the exiled editor whose site goes dark on election day, the effect is the same as a website ban—except that no one has to admit to anything, the attacks can be launched within minutes, and, unlike standard website blocking, not even circumvention technology restores access.