[nradov]

Denial of service attacks are explicitly illegal under the National Infrastructure Protection Act (NIIPA). I don't think a defendant has ever successfully challenged that law on First Amendment grounds, so the basic legal issues appear to be settled.

Of course as a practical matter it can be difficult to prosecute DDoS attackers under that statute. Either they don't leave hard evidence, or they hide in countries which don't extradite.