If it wasn't clear enough, DDoS attacks are indeed illegal in many places including the US,the person can be given a minimum of a 30 month prison sentence if the person is found guilty for the attacks, now I said a minimum, the number can increase, and it also goes with a fine.
That is of course you would need proof of the attacks.