Launching a DDoS attack is a crime in the US, Canada, the UK and Australia. Stress testing your own server can be legal, but only with the right permission. Here's where the line is.
Short answer: Launching a DDoS (distributed denial-of-service) attack on someone else's website, server or game is a crime in the US, Canada, the UK and Australia. Paying a "booter" or "stresser" service to do it is also a crime. Load testing or DDoS testing your own systems can be legal, but only if you have written permission from everyone whose systems the traffic touches, including your hosting or cloud provider.
A DDoS attack floods a target with traffic from many sources until it slows down or goes offline. The law cares about two things: whether you had authorization, and whether you intended to disrupt the system. The same flood of traffic is a crime against a stranger's server and a legitimate test against your own.
DDoS testing (also called stress testing or load testing) is legal when all of these are true:
Testing a game server, school network or website you don't own is not testing. It's an attack, even if you didn't mean to cause damage.
The main law is the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. Section 1030(a)(5)(A) makes it a crime to knowingly send code or commands that intentionally cause damage to a protected computer without authorization. "Protected computer" covers almost any internet-connected device.
Penalties depend on the harm. A first offence that causes at least $5,000 in losses can bring up to 10 years in federal prison, and more if it causes physical injury or threatens public safety. Victims can also sue for damages.
The FBI and international partners regularly seize booter and stresser websites, and have charged both their operators and their customers.
The Criminal Code covers DDoS attacks in two places:
The Computer Misuse Act 1990, section 3, makes it an offence to do any unauthorized act intending to impair the operation of a computer, or being reckless about it. The maximum sentence is 10 years. The National Crime Agency has run campaigns targeting young people who buy booter services, warning that even a small attack on a gaming rival can lead to arrest.
The Criminal Code Act 1995 (Cth), section 477.3, makes it an offence to cause unauthorized impairment of electronic communication to or from a computer, with a maximum of 10 years. States have similar offences.
Internet LawCanada and most US states let you record a call you're part of without telling anyone. About a dozen states require everyone's consent. Here's the rule in the US, Canada, the UK and Australia.
Internet LawCalifornia is an all-party consent state. Under Penal Code 632 you need everyone's consent to record a confidential conversation. Here are the penalties, exceptions and rules for calls with out-of-state callers.