In a DDoS attack, an online service gets bombarded with traffic from networks of bots, to the point where it's overwhelmed and legit users get frozen out. In an explanation Wednesday, Telegram compared it to an "army of lemmings" jumping the line at a McDonald's and making innumerable "garbage requests."
"IP addresses coming mostly from China. Historically, all state actor-sized DDoS (200-400 Gb/s of junk) we experienced coincided in time with protests in Hong Kong (coordinated on @telegram). This case was not an exception," Durov wrote in a followup tweet.
Tens of thousands took to Hong Kong's streets to oppose a government plan that'd allow extraditions to mainland China. People are worried that it would bring the semiautonomous former British colony under the Chinese government's thumb.
These protesters relied on encrypted messaging services, which let them mask their identities from Chinese authorities, to communicate. Telegram and Firechat are some of the top trending apps in Hong Kong's Apple store, Bloomberg noted. Out in public, some people masked their faces to avoid facial recognition systems and wouldn't use public transit cards linked to their identities, according to Bloomberg.
Watch this: Inside a password-free future
If China was using a DDoS attack to disrupt the demonstrations, it'd be taking a similar approach to Russia, Iran and Indonesia. The governments in those countries have blocked Telegram, arguing that it was used for anti-government protests and terrorism.
Telegram didn't immediately respond to a request for comment.
First published at 2:49 a.m. PT. Updated at 4:08 a.m. PT: Adds more detail.