(CNN) — The Federal Communications Commission’s website did not fall victim last year to “deliberate attempts by external actors to bombard the FCC’s comment system,” a government investigation has determined.
The surge in traffic was actually due to viewers of comedian John Oliver.
An inspector general report dated Monday details the investigation into the traffic surge from May 2017, when Oliver, host of “Last Week Tonight” on HBO, urged his audience to weigh in on the net neutrality debate about whether internet service providers should be required to serve up all content equally. (Without the protections, service providers can, for example, make one video streaming service load more slowly than another.)
“I’m calling upon all of you, the internet’s time wasters and trouble makers, to join me once more in just five to 10 minutes of minor effort,” Oliver said on his May 7, 2017, show. “Simply go to this URL and tell the FCC to preserve net neutrality and Title II.”
Within minutes, traffic to the website spiked by 3,116%, “resulting in the disruption of system availability,” the investigation found. The disruption began on a Sunday evening and stretched into Monday.
A statement from the FCC issued that Monday described a coordinated series of cyberattacks: “multiple distributed denial-of-service attacks.”
“These actors were not attempting to file comments themselves; rather they made it difficult for legitimate commenters to access and file with the FCC,” read the statement from the commission’s chief information officer at the time, David Bray.
The investigation and FCC Chairman Ajit Pai blame the inaccurate information on Bray — whom Pai, a Republican appointee to the commission, insinuated may have had political motives.
“I am deeply disappointed that the FCC’s former Chief Information Officer (CIO), who was hired by the prior Administration and is no longer with the Commission, provided inaccurate information about this incident to me, my office, Congress, and the American people,” Pai said in a statement on the report Monday.
Bray did not respond to messages from CNN left on his voicemail and LinkedIn profile.
At the time, members of Congress asked for information about the attack, agency officials met with an FBI agent and the inspector general began an investigation.
The FCC issued the news release and letters to several members of Congress describing the incident as an attack. But inside the agency, staffers handled the episode differently.
“We discovered the FCC had not defined the event internally as a cyber security incident” and that officials had not followed their own cyberattack procedures, including contacting the Department of Homeland Security’s Computer Emergency Readiness Team, the investigation found.
Instead, analyses found “spikes in web traffic coinciding exactly with the timing of: (1) the release of information during the … episode; (2) the release of the episode on The Last Week Tonight with John Oliver YouTube channel; and (3) tweets about that release.”
