Its not 1:1, but while its people coordinating its pretty easy to draw the comparison, only when its done by a botnet wrangler or extortionists do things start to diverge.

You just don't see the equivalence because operating on the internet you only see your susceptibility to a ddos, and it's always different when it can happen to you.

It's a nuisance you deal with until the protesting party gets board. In one case you call the cops, in the other case you pay someone with a fat pipe to absorb the hit and forward the legit traffic to you.

I am unaware of any successful DDOS (other than accidental ones) which food not make some use of unsuspecting people's computers, either by ping reflection, botnets or secret iframes. All of these sound less like a sit-in and more like an attack which should be prosecuted to me.

I am happy to hear of counterexample.

How many successful DDOS attacks do you know about and how can you find out if the participating nodes are part of a botnet or use iframes?

It's different in the technical details, but the aim is exactly and completely identical: to deny service to other customers as a way to punish the proprietor of a business.

Sitting at a lunch counter is legal, sending an HTTP request to a server is legal. In some cases sitting at a lunch counter for too long becomes illegal, and in some cases sending too many HTTP requests can become illegal (DDoS).

The difference here is that sitting at a lunch counter for too long got you a night in jail whereas participating in a DDoS can easily get you many years in prison and a felony conviction.

There is an imbalance here. Both of these things are acts of protest. Both do economic damage to their targets. Both involve collaboration with others. Why, then are the penalties so radically different?

We could debate the relative economic impact, but I think that's a moot point, just because a business is large does not mean that it should be immune from protest. Political freedom cannot be squelched just because we have decided to rely on fragile technology for day-to-day life.

You're making the (wrong) assumption that all those participating in a denial of service attack are doing so voluntarily. Typically it's a small number of perps that harness a large number of unwitting drones.

OK sure, so the law should prohibit harnessing a large number of unwitting drones.

And it should prohibit DDoS in general. But not as a felony.

Fine, then the felony should be hacking the bots, not the DDoS.