Logo
WritingReadingProjects

The good-faith DDOS

Every service that used effort as its rate limit now needs a real one.


In Chile there’s a debt lawyer turned influencer that people love to hate: Iván González. People send him questions about how to get out of debt, and sometimes his answer is blunt: if you stop paying this loan, you’re not going to jail. It’s commercial debt.

Iván González answering “Pregúntale al González” questions about debt

Iván González answering “Pregúntale al González” questions. Image: Página 7.

That answer scares a lot of people. His critics say he’s telling people not to pay. I don’t think he is. He’s pointing at a hole in the system.

The hole was always public. It’s in the law. But not everyone knew about it. People with lawyers, accountants and the right friends knew. Everyone else paid partly out of fear. The system worked because most people didn’t know where its edges were.

That’s a vulnerability. And you don’t fix a vulnerability by telling people to stop talking about it. Once the trick gets popular, the system has to patch it. Disclosure forces the patch. That’s why I think he’s doing the right thing.

The same bug, now in public services

Public services have the same kind of hole. Anyone can file a complaint, an appeal, a records request or a court filing. The only thing keeping the volume manageable was effort. Writing a decent complaint took an evening, so most people didn’t bother. The whole thing ran on good faith: the assumption that nobody would flood it.

That assumption is gone. We now have an unlimited generator of reasonable-sounding text, and the cost of one more filing is close to zero.

In July, Santiago’s civil courts received 38,477 filings in a single weekend, from one lawyer’s automated tool. That’s roughly 500 to 900 filings per court. The judges wrote to the Supreme Court saying they didn’t have the people or the systems to absorb it, and asked for limits on bulk submissions. It’s still not confirmed whether the tool used generative AI or was a plain script. For this argument it doesn’t matter. The rate limit was effort, and effort is gone.

It’s not just Chile. Sam Freedman shared a chart of 12 government agencies around the world, with a line marking when ChatGPT came out. Complaints to the UK Housing Ombudsman went from about 1.7K to 7K. The US consumer complaint database went from about 330K to 6.6M. The chart comes from the paper Characterizing Agentic Flooding of Government Services, and Freedman wrote it up in Drowning in slop.

Potential instances of agentic flooding across 12 government agencies

Nobody had to break anything

This is the uncomfortable part. Some of this is abuse. But a lot of it is probably real people with real complaints who finally had help writing them. That demand was always there, held back by friction. It’s a DDoS done in good faith: people doing something they were always allowed to do, just a lot more of it.

Patch it, don’t hide it

It’s the same lesson as the influencer. You can’t fix this by telling people not to use AI, just like you can’t fix commercial debt by telling him to shut up. The trick is out. Every service that used effort as its rate limit now needs a real one.