Authors: (1) Anh V. Vu, University of Cambridge, Cambridge Cybercrime Centre (anh.vu@cl.cam.ac.uk); (2) Alice Hutchings, University of Cambridge, Cambridge Cybercrime Centre (alice.hutchings@cl.cam.ac.uk); (3) Ross Anderson, University of Cambridge, and University of Edinburgh (ross.anderson@cl.cam.ac.uk). Table of Links Abstract and 1 Introduction 2. Deplatforming and the Impacts 2.1. Related Work 2.2. The Kiwi Farms Disruption 3. Methods, Datasets, and Ethics, and 3.1. Forum and Imageboard Discussions 3.2. Telegram Chats and 3.3. Web Traffic and Search Trends Analytics 3.4. Tweets Made by the Online Community and 3.5. Data Licensing 3.6. Ethical Considerations 4. The Impact on Forum Activity and Traffic, and 4.1. The Impact of Major Disruptions 4.2. Platform Displacement 4.3. Traffic Fragmentation 5. The Impacts on Relevant Stakeholders and 5.1. The Community that Started the Campaign 5.2. The Industry Responses 5.3. The Forum Operators 5.4. The Forum Members 6. Tensions, Challenges, and Implications and 6.1. The Efficacy of the Disruption 6.2. Censorship versus Free Speech 6.3. The Role of Industry in Content Moderation 6.4. Policy Implications 6.5. Limitations and Future Work 7. Conclusion, Acknowledgments, and References Appendix A. 4.2. Platform Displacement The natural behaviour of online communities when their usual gathering place becomes inaccessible is to seek alternative places or channels to continue their discussions. The second graph in Figure 4 illustrates an initial shift of forum activity to Telegram that occurred on 27 August 2022, right after the ISP blackholing. This was accompanied by thousands of emoji reactions on the admin’s announcements since commenting was not allowed at that time. Community reactions (e.g., replies, emojis) seem to have been consistent with the overall Telegram posting activity, which increased rapidly afterwards and even occasionally surpassed the forum’s activity, especially after the publicity given to the Cloudflare and DDoS-Guard actions. At some point, for instance in early October and November 2022, the total number of messages on KIWI FARMS and its Telegram channels significantly exceeded the pre-disruption posting volume on the forum. However, significant displacements only occurred when all domains were completely inaccessible on 18 September 2022, and again when Zayo blocked the second incarnation of the forum on 22 October 2022. The shift to the Telegram channels appears to be rapid yet rather temporary: KIWI FARMS users quickly returned to the primary forum when it became available, while discussion activity on the Telegram channels gradually declined. There was no significant shift in activity from the forum to its primary competitor LOLCOW FARM (see the third graph of Figure 4), however, there was an increase in posting on LOLCOW FARM about the incident, indicating a minor change of discussion topic (see more in §5.4). It is unclear if these posting users migrated from KIWI FARMS, as LOLCOW FARM do not use handles, making user counts unavailable. LOLCOW FARM also experienced downtime on 17 and 18 September 2022 (the same day as KIWI FARMS) yet we have no reliable evidence to draw any convincing explanation. Another drop occurred around Christmas 2022 in sync with KIWI FARMS, perhaps because of the holiday. The activity of LOLCOW FARM returned to its previous level quickly after these drops, suggesting that the campaign did not significantly impact LOLCOW FARM or drive content between the rival ecosystems; the displacement we observed on KIWI FARMS was mostly ‘internal’ within its own ecosystem, rather than an ‘external’ shift to other forums. While the disruption impact on KIWI FARMS and its Telegram channels is highly significant with a very large effect size, it is not significant for LOLCOW FARM (the effect size is small), see Table 2. 4.3. Traffic Fragmentation Before Cloudflare’s action, traffic towards KIWI FARMS (measured by Similarweb) was relatively steady, mostly occupied by the primary domain. However, we see the Streisand effect with an immediate peak in traffic of around 50% more visits and 85% more visitors once the site was disrupted. The publicity given by the takedown presumably boosted awareness and attracted people to visit both the primary and alternative domains. Traffic to the primary domain was then significantly fragmented to other previously abandoned domains, resulting in the kiwifarms.net accounting for less than 50% one day after Cloudflare’s intervention, as shown in Figure 5. Following the unavailability of kiwifarms.net, most traffic was directed to kiwifarms.ru, which was under DDoS Guard’s protection (accounting for around 60% total traffic on 4 September 2022). The DDoS-Guard’s action on 5 September 2022 reduced traffic towards kiwifarms.ru sharply, while traffic towards kiwifarms.top peaked. The suspension of kiwifarms.top on the following day led to increased traffic towards kiwifarms.cc (a Pleroma decentralised web instance), but it only lasted for a couple of days before traffic shifted again to kiwifarms.is. The seizure of kiwifarms.is later led to the traffic shifting to kiwifarms.st, but it was also short-lived. The forum recovery on 27 September 2022 gradually directed almost all traffic back to the primary domain, and by 22 October 2022, kiwifarms.net mostly accounted for all traffic, albeit at about half the volume. This effect is highly consistent with what has been found in our forum data, indicating a reliable pattern. Overall, our evidence suggests a clear traffic fragmentation across different domains of KIWI FARMS, in which people attempted to visit surviving domains when one was disrupted. While the observed fragmentation is clear, the impact on two domains is not significant enough when assessing the period as a whole. However, it is highly significant on the total traffic, notably the substantial drops of the primary domain kiwifarms.net (see Table 3). This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Anh V. Vu, University of Cambridge, Cambridge Cybercrime Centre (anh.vu@cl.cam.ac.uk); (2) Alice Hutchings, University of Cambridge, Cambridge Cybercrime Centre (alice.hutchings@cl.cam.ac.uk); (3) Ross Anderson, University of Cambridge, and University of Edinburgh (ross.anderson@cl.cam.ac.uk). Authors: Authors: (1) Anh V. Vu, University of Cambridge, Cambridge Cybercrime Centre (anh.vu@cl.cam.ac.uk); (2) Alice Hutchings, University of Cambridge, Cambridge Cybercrime Centre (alice.hutchings@cl.cam.ac.uk); (3) Ross Anderson, University of Cambridge, and University of Edinburgh (ross.anderson@cl.cam.ac.uk). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2. Deplatforming and the Impacts 2. Deplatforming and the Impacts 2.1. Related Work 2.1. Related Work 2.2. The Kiwi Farms Disruption 2.2. The Kiwi Farms Disruption 3. Methods, Datasets, and Ethics, and 3.1. Forum and Imageboard Discussions 3. Methods, Datasets, and Ethics, and 3.1. Forum and Imageboard Discussions 3.2. Telegram Chats and 3.3. Web Traffic and Search Trends Analytics 3.2. Telegram Chats and 3.3. Web Traffic and Search Trends Analytics 3.4. Tweets Made by the Online Community and 3.5. Data Licensing 3.4. Tweets Made by the Online Community and 3.5. Data Licensing 3.6. Ethical Considerations 3.6. Ethical Considerations 4. The Impact on Forum Activity and Traffic, and 4.1. The Impact of Major Disruptions 4. The Impact on Forum Activity and Traffic, and 4.1. The Impact of Major Disruptions 4.2. Platform Displacement 4.2. Platform Displacement 4.3. Traffic Fragmentation 4.3. Traffic Fragmentation 5. The Impacts on Relevant Stakeholders and 5.1. The Community that Started the Campaign 5. The Impacts on Relevant Stakeholders and 5.1. The Community that Started the Campaign 5.2. The Industry Responses 5.2. The Industry Responses 5.3. The Forum Operators 5.3. The Forum Operators 5.4. The Forum Members 5.4. The Forum Members 6. Tensions, Challenges, and Implications and 6.1. The Efficacy of the Disruption 6. Tensions, Challenges, and Implications and 6.1. The Efficacy of the Disruption 6.2. Censorship versus Free Speech 6.2. Censorship versus Free Speech 6.3. The Role of Industry in Content Moderation 6.3. The Role of Industry in Content Moderation 6.4. Policy Implications 6.4. Policy Implications 6.5. Limitations and Future Work 6.5. Limitations and Future Work 7. Conclusion, Acknowledgments, and References 7. Conclusion, Acknowledgments, and References Appendix A. Appendix A. 4.2. Platform Displacement The natural behaviour of online communities when their usual gathering place becomes inaccessible is to seek alternative places or channels to continue their discussions. The second graph in Figure 4 illustrates an initial shift of forum activity to Telegram that occurred on 27 August 2022, right after the ISP blackholing. This was accompanied by thousands of emoji reactions on the admin’s announcements since commenting was not allowed at that time. Community reactions (e.g., replies, emojis) seem to have been consistent with the overall Telegram posting activity, which increased rapidly afterwards and even occasionally surpassed the forum’s activity, especially after the publicity given to the Cloudflare and DDoS-Guard actions. At some point, for instance in early October and November 2022, the total number of messages on KIWI FARMS and its Telegram channels significantly exceeded the pre-disruption posting volume on the forum. However, significant displacements only occurred when all domains were completely inaccessible on 18 September 2022, and again when Zayo blocked the second incarnation of the forum on 22 October 2022. The shift to the Telegram channels appears to be rapid yet rather temporary: KIWI FARMS users quickly returned to the primary forum when it became available, while discussion activity on the Telegram channels gradually declined. There was no significant shift in activity from the forum to its primary competitor LOLCOW FARM (see the third graph of Figure 4), however, there was an increase in posting on LOLCOW FARM about the incident, indicating a minor change of discussion topic (see more in §5.4). It is unclear if these posting users migrated from KIWI FARMS, as LOLCOW FARM do not use handles, making user counts unavailable. LOLCOW FARM also experienced downtime on 17 and 18 September 2022 (the same day as KIWI FARMS) yet we have no reliable evidence to draw any convincing explanation. Another drop occurred around Christmas 2022 in sync with KIWI FARMS, perhaps because of the holiday. The activity of LOLCOW FARM returned to its previous level quickly after these drops, suggesting that the campaign did not significantly impact LOLCOW FARM or drive content between the rival ecosystems; the displacement we observed on KIWI FARMS was mostly ‘internal’ within its own ecosystem, rather than an ‘external’ shift to other forums. While the disruption impact on KIWI FARMS and its Telegram channels is highly significant with a very large effect size, it is not significant for LOLCOW FARM (the effect size is small), see Table 2. 4.3. Traffic Fragmentation Before Cloudflare’s action, traffic towards KIWI FARMS (measured by Similarweb) was relatively steady, mostly occupied by the primary domain. However, we see the Streisand effect with an immediate peak in traffic of around 50% more visits and 85% more visitors once the site was disrupted. The publicity given by the takedown presumably boosted awareness and attracted people to visit both the primary and alternative domains. Traffic to the primary domain was then significantly fragmented to other previously abandoned domains, resulting in the kiwifarms.net accounting for less than 50% one day after Cloudflare’s intervention, as shown in Figure 5. Following the unavailability of kiwifarms.net, most traffic was directed to kiwifarms.ru, which was under DDoS Guard’s protection (accounting for around 60% total traffic on 4 September 2022). The DDoS-Guard’s action on 5 September 2022 reduced traffic towards kiwifarms.ru sharply, while traffic towards kiwifarms.top peaked. The suspension of kiwifarms.top on the following day led to increased traffic towards kiwifarms.cc (a Pleroma decentralised web instance), but it only lasted for a couple of days before traffic shifted again to kiwifarms.is. The seizure of kiwifarms.is later led to the traffic shifting to kiwifarms.st, but it was also short-lived. The forum recovery on 27 September 2022 gradually directed almost all traffic back to the primary domain, and by 22 October 2022, kiwifarms.net mostly accounted for all traffic, albeit at about half the volume. This effect is highly consistent with what has been found in our forum data, indicating a reliable pattern. Overall, our evidence suggests a clear traffic fragmentation across different domains of KIWI FARMS, in which people attempted to visit surviving domains when one was disrupted. While the observed fragmentation is clear, the impact on two domains is not significant enough when assessing the period as a whole. However, it is highly significant on the total traffic, notably the substantial drops of the primary domain kiwifarms.net (see Table 3). This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv
