Authors: (1) Anh V. Vu, University of Cambridge, Cambridge Cybercrime Centre (anh.vu@cl.cam.ac.uk); (2) Alice Hutchings, University of Cambridge, Cambridge Cybercrime Centre (alice.hutchings@cl.cam.ac.uk); (3) Ross Anderson, University of Cambridge, and University of Edinburgh (ross.anderson@cl.cam.ac.uk). Table of Links Abstract and 1 Introduction 2. Deplatforming and the Impacts 2.1. Related Work 2.2. The Kiwi Farms Disruption 3. Methods, Datasets, and Ethics, and 3.1. Forum and Imageboard Discussions 3.2. Telegram Chats and 3.3. Web Traffic and Search Trends Analytics 3.4. Tweets Made by the Online Community and 3.5. Data Licensing 3.6. Ethical Considerations 4. The Impact on Forum Activity and Traffic, and 4.1. The Impact of Major Disruptions 4.2. Platform Displacement 4.3. Traffic Fragmentation 5. The Impacts on Relevant Stakeholders and 5.1. The Community that Started the Campaign 5.2. The Industry Responses 5.3. The Forum Operators 5.4. The Forum Members 6. Tensions, Challenges, and Implications and 6.1. The Efficacy of the Disruption 6.2. Censorship versus Free Speech 6.3. The Role of Industry in Content Moderation 6.4. Policy Implications 6.5. Limitations and Future Work 7. Conclusion, Acknowledgments, and References Appendix A. 4. The Impact on Forum Activity and Traffic On 3 September 2022, Cloudflare discontinued its DDoS prevention service, which attracted major publicity. This intervention led to a sudden and significant increase in global search interest about KIWI FARMS with a seven-fold spike, along with the web traffic to the six major domains doubling on 4 September 2022 (see Figure 3). This phenomenon, known as the Streisand effect, might be caused by people’s curiosity about what happened to the platform, which is relatively rare but mainly seen with ‘freedom of speech’ issues [11]. It suggests that attempts at censorship may eventually end up being counterproductive [75]: disruptive effort aiming to reduce user interactions instead led to the unintended consequences of increased attention, despite lasting for only a few days before declining sharply. We examine in detail the impacts of the disruption and the forum recovery on KIWI FARMS within 6 months from July to December 2022. This timeframe provides a sufficient understanding, as the campaign was mostly over and the forum was growing stably before the disruption. To assess the impacts, we separate the observed data points into the post-disruption period (first group) and pre-disruption period (second group), split by 3 September 2022. We then use the Mann–Whitney U test (as the samples are not paired and the data does not follow a normal distribution) to compare the difference between mean ranks of the two populations. The effect size – indicating the magnitude of the observed difference – is assessed by Cliff’s Delta, ranging [-1, 1]. 4.1. The Impact of Major Disruptions While some DDoS attacks were large enough to shut the forum down, their impact was temporary. For example, the DDoS attack on 23 August 2022 – which was probably associated with the Twitter campaign the previous day – led to a drop of roughly 35% in posting volume, yet the forum activity recovered the next day to a slightly higher level (see the first graph of Figure 4). The DDoS attack during Christmas 2022 was also short-lived. The ISP blackholing on 26 August 2022 was more critical, silencing the forum for two consecutive days, yet it again recovered quickly. The most significant, long-lasting impact was caused by the substantial industry disruption that we analyse in this paper. While forum activity immediately dropped by around 20% after Cloudflare’s action on 3 September 2022, the forum was still online at kiwifarms.ru, hosting the same content. Activity did not degrade significantly until DDoSGuard’s action on 5 September 2022, which took down the Russian domain. By 18 September 2022, all domains were unavailable, including .onion (presumably their hosting was identified); forum activity dropped to zero and stayed there for a week. The operator managed to get the forum back online for the first time on 27 September 2022, after which it ran stably on both the dark web and clear web for roughly one month until Zayo – a Tier-1 ISP – blocked it on 23 October 2022. This led to another silent week before the forum eventually recovered a second time on 30 October 2022. It has been stable since then without serious downtime except for the ISP blackholing on 22 December 2022 which led to a 70% drop in activity. In general, although the forum is now back online stably, hosted on 1776 Solutions – a company also founded by the forum’s owner – it has (at the moment) failed to bounce back to the pre-disruption level, with the number of active users and posting volume roughly halved. The concerted effort we analysed was much more effective than previous DDoS attacks, yet still could not silence the forum for long. This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Anh V. Vu, University of Cambridge, Cambridge Cybercrime Centre (anh.vu@cl.cam.ac.uk); (2) Alice Hutchings, University of Cambridge, Cambridge Cybercrime Centre (alice.hutchings@cl.cam.ac.uk); (3) Ross Anderson, University of Cambridge, and University of Edinburgh (ross.anderson@cl.cam.ac.uk). Authors: Authors: (1) Anh V. Vu, University of Cambridge, Cambridge Cybercrime Centre (anh.vu@cl.cam.ac.uk); (2) Alice Hutchings, University of Cambridge, Cambridge Cybercrime Centre (alice.hutchings@cl.cam.ac.uk); (3) Ross Anderson, University of Cambridge, and University of Edinburgh (ross.anderson@cl.cam.ac.uk). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2. Deplatforming and the Impacts 2. Deplatforming and the Impacts 2.1. Related Work 2.1. Related Work 2.2. The Kiwi Farms Disruption 2.2. The Kiwi Farms Disruption 3. Methods, Datasets, and Ethics, and 3.1. Forum and Imageboard Discussions 3. Methods, Datasets, and Ethics, and 3.1. Forum and Imageboard Discussions 3.2. Telegram Chats and 3.3. Web Traffic and Search Trends Analytics 3.2. Telegram Chats and 3.3. Web Traffic and Search Trends Analytics 3.4. Tweets Made by the Online Community and 3.5. Data Licensing 3.4. Tweets Made by the Online Community and 3.5. Data Licensing 3.6. Ethical Considerations 3.6. Ethical Considerations 4. The Impact on Forum Activity and Traffic, and 4.1. The Impact of Major Disruptions 4. The Impact on Forum Activity and Traffic, and 4.1. The Impact of Major Disruptions 4.2. Platform Displacement 4.2. Platform Displacement 4.3. Traffic Fragmentation 4.3. Traffic Fragmentation 5. The Impacts on Relevant Stakeholders and 5.1. The Community that Started the Campaign 5. The Impacts on Relevant Stakeholders and 5.1. The Community that Started the Campaign 5.2. The Industry Responses 5.2. The Industry Responses 5.3. The Forum Operators 5.3. The Forum Operators 5.4. The Forum Members 5.4. The Forum Members 6. Tensions, Challenges, and Implications and 6.1. The Efficacy of the Disruption 6. Tensions, Challenges, and Implications and 6.1. The Efficacy of the Disruption 6.2. Censorship versus Free Speech 6.2. Censorship versus Free Speech 6.3. The Role of Industry in Content Moderation 6.3. The Role of Industry in Content Moderation 6.4. Policy Implications 6.4. Policy Implications 6.5. Limitations and Future Work 6.5. Limitations and Future Work 7. Conclusion, Acknowledgments, and References 7. Conclusion, Acknowledgments, and References Appendix A. Appendix A. 4. The Impact on Forum Activity and Traffic On 3 September 2022, Cloudflare discontinued its DDoS prevention service, which attracted major publicity. This intervention led to a sudden and significant increase in global search interest about KIWI FARMS with a seven-fold spike, along with the web traffic to the six major domains doubling on 4 September 2022 (see Figure 3). This phenomenon, known as the Streisand effect, might be caused by people’s curiosity about what happened to the platform, which is relatively rare but mainly seen with ‘freedom of speech’ issues [11]. It suggests that attempts at censorship may eventually end up being counterproductive [75]: disruptive effort aiming to reduce user interactions instead led to the unintended consequences of increased attention, despite lasting for only a few days before declining sharply. We examine in detail the impacts of the disruption and the forum recovery on KIWI FARMS within 6 months from July to December 2022. This timeframe provides a sufficient understanding, as the campaign was mostly over and the forum was growing stably before the disruption. To assess the impacts, we separate the observed data points into the post-disruption period (first group) and pre-disruption period (second group), split by 3 September 2022. We then use the Mann–Whitney U test (as the samples are not paired and the data does not follow a normal distribution) to compare the difference between mean ranks of the two populations. The effect size – indicating the magnitude of the observed difference – is assessed by Cliff’s Delta, ranging [-1, 1]. 4.1. The Impact of Major Disruptions While some DDoS attacks were large enough to shut the forum down, their impact was temporary. For example, the DDoS attack on 23 August 2022 – which was probably associated with the Twitter campaign the previous day – led to a drop of roughly 35% in posting volume, yet the forum activity recovered the next day to a slightly higher level (see the first graph of Figure 4). The DDoS attack during Christmas 2022 was also short-lived. The ISP blackholing on 26 August 2022 was more critical, silencing the forum for two consecutive days, yet it again recovered quickly. The most significant, long-lasting impact was caused by the substantial industry disruption that we analyse in this paper. While forum activity immediately dropped by around 20% after Cloudflare’s action on 3 September 2022, the forum was still online at kiwifarms.ru, hosting the same content. Activity did not degrade significantly until DDoSGuard’s action on 5 September 2022, which took down the Russian domain. By 18 September 2022, all domains were unavailable, including .onion (presumably their hosting was identified); forum activity dropped to zero and stayed there for a week. The operator managed to get the forum back online for the first time on 27 September 2022, after which it ran stably on both the dark web and clear web for roughly one month until Zayo – a Tier-1 ISP – blocked it on 23 October 2022. This led to another silent week before the forum eventually recovered a second time on 30 October 2022. It has been stable since then without serious downtime except for the ISP blackholing on 22 December 2022 which led to a 70% drop in activity. In general, although the forum is now back online stably, hosted on 1776 Solutions – a company also founded by the forum’s owner – it has (at the moment) failed to bounce back to the pre-disruption level, with the number of active users and posting volume roughly halved. The concerted effort we analysed was much more effective than previous DDoS attacks, yet still could not silence the forum for long. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv
