Authors: (1) Anh V. Vu, University of Cambridge, Cambridge Cybercrime Centre (anh.vu@cl.cam.ac.uk); (2) Alice Hutchings, University of Cambridge, Cambridge Cybercrime Centre (alice.hutchings@cl.cam.ac.uk); (3) Ross Anderson, University of Cambridge, and University of Edinburgh (ross.anderson@cl.cam.ac.uk). Table of Links Abstract and 1 Introduction 2. Deplatforming and the Impacts 2.1. Related Work 2.2. The Kiwi Farms Disruption 3. Methods, Datasets, and Ethics, and 3.1. Forum and Imageboard Discussions 3.2. Telegram Chats and 3.3. Web Traffic and Search Trends Analytics 3.4. Tweets Made by the Online Community and 3.5. Data Licensing 3.6. Ethical Considerations 4. The Impact on Forum Activity and Traffic, and 4.1. The Impact of Major Disruptions 4.2. Platform Displacement 4.3. Traffic Fragmentation 5. The Impacts on Relevant Stakeholders and 5.1. The Community that Started the Campaign 5.2. The Industry Responses 5.3. The Forum Operators 5.4. The Forum Members 6. Tensions, Challenges, and Implications and 6.1. The Efficacy of the Disruption 6.2. Censorship versus Free Speech 6.3. The Role of Industry in Content Moderation 6.4. Policy Implications 6.5. Limitations and Future Work 7. Conclusion, Acknowledgments, and References Appendix A. 5. The Impacts on Relevant Stakeholders We have looked at the impacts of the disruption on KIWI FARMS itself. This section examines the effects on relevant stakeholders, including the harassed victim, the community leading the campaign, the industry, the forum operators, and active forum users who posted at least once. As our ethics approval does not allow the study of individuals, all measurements are conducted collectively on subsets of users. Besides quantitative evidence, we also qualitatively look at statements made by tech firms about the incident. 5.1. The Community that Started the Campaign There were 3 886 users in the online community involved in starting the campaign. Of these, 1 670 users (42.97%) were responsible for around 80% of tweets. There was a sharp increase in tweets and reactions at the beginning (see Figure 6). The first peak was on 25 August 2022 with nearly 900 tweets by around 600 users. However, this dropped rapidly to less than 100 per day after a few weeks when Cloudflare and DDoS-Guard took action, and almost to zero two weeks later. The number of tweets specifically mentioning Cloudflare (such as their official account, as well as those for jobs, help, and developers) was around 200 in the beginning but decreased over time, and dropped to zero after they took action. This lasted for roughly one month until after the forum recovered: we see around 400 tweets mentioning Cloudflare, twice the previous peak, and accounting for almost all such tweets that day. However, these tweets appeared to be primarily associated with another campaign counted by the hashtag #stopdoghate, suggesting a short-lived outlier instead of a genuine peak. The trans activist who launched the campaign was engaged at the beginning but then became much less active in posting new tweets, although she still replied to people. Her posting volume was, however, trivial compared to the overall numbers: she made only four tweets on the day the campaign started, the number then dropped quickly to only one on 4 September 2022 after Cloudflare took action, and zero thereafter. It suggests that although she sparked the campaign, she might not be the primary maintainer. We see no notable peak of tweets after the forum was completely shut down, suggesting a clear loss of interest in pursuing the campaign, both from people posting tweets and people reacting to tweets. The community seemed to get bored quickly after a few weeks when they appeared to have gotten what they wanted – ‘Kiwi Farms is dead, and I am moving on to the next campaign’, tweeted the activist. 5.2. The Industry Responses Unlike measurement of forum activity, there is no such quantitative data to cover the impact on industry actors, so we switch to qualitative analysis of public statements made by those who directly attempted to terminate the forum. We first compile a list of involved tech firms seen from the takedown incidents, then look at their websites, news, and blogs to spot their official statements if available. We repeated the search regularly, and the final list consists of four firms: Cloudflare, DDoS-Guard, DiamWall, and Harica. We then took a deductive approach to understand (1) their hosting policy, (2) their perspective on KIWI FARMS, and (3) their reactions to the community pressure. Cloudflare stated their abuse policies on 31 August 2022 without directly mentioning the Twitter campaign [76]. In summary, the firm offers traffic proxy and DDoS protection to lots of (mostly non-paid) sites regardless of the content hosted, including KIWI FARMS. The firm maintains that abusive content alone is not an issue, and the forum – while immoral – still deserves the same protection as other customers, as long as it does not violate US law. Although Cloudflare are entitled to refuse business from KIWI FARMS, they initially took the view that doing so because of its content would create a bad precedent, leading to unintended consequences on content regulation and making things harder for Cloudflare. This could affect the whole Internet, as Cloudflare handles a large proportion of network traffic. They did not want to get involved in policing online content, but if they had to do it they would rather do so in response to a court order instead of popular opinion. The firm previously had dropped the neo-Nazi website DAILY STORMER [12] and the extremist board 8CHAN [13] because of their links with terrorist attacks and mass murders, and a false claim about Cloudflare’s secret support. They also claimed that dropping service for KIWI FARMS would not remove the hate content, but only slow it down for a while. Nevertheless, Cloudflare did a U-turn a few days later on 3 September 2022, announcing that they would terminate service for KIWI FARMS [24]. They explained that the escalation of the pressure campaign led to users being more aggressive, which might lead to crime. They reached out to law enforcement in multiple jurisdictions regarding potential criminal acts, but as the legal process was too slow compared to the escalating threat, they made the decision alone [24]. They still claimed that following a legal process would be the correct policy, and denied that the decision was the direct result of community pressure. Cloudflare’s action also inadvertently led to the termination of a neoNazi group in New Zealand, as it was hosted by the same company as the forum [77]. DDoS-Guard’s statements about the incident told a similar story [25]. Although they can restrict access to their customers if they violate the acceptable use policy, content moderation is not their duty (except under a court order) so they do not need to determine whether every site they protect violates the law. DiamWall took the same line; they claimed that they are not responsible, and are unable to moderate content hosted on websites [26]. They also maintained that terminating services in response to public pressure is not good policy, but the case of KIWI FARMS was exceptional due to its ‘revolting’ content. They also noted that their actions could only delay things but not fix the root cause, as the forum could find another provider. DiamWall’s statement was removed afterwards without any clear explanations; it is now only accessible through online archives. Unlike the three firms above, Harica – a Greek Authority providing certificates for .onion sites – took a different line. They confirmed their support for freedom of speech and stated that they will not censor any website, but are obligated to investigate complaints about websites violating the law, the Certificate Policy (CP) and the Certificate Practice Statement (CPS). After a review process, on 15 May 2023 they announced they would revoke the .onion certificates issued to KIWI FARMS due to concerns about harassment connecting to suicides. After setting a 3-day timeframe for KIWI FARMS to seek a new authority, their support team were targeted by various threats and harassment, but based on one ‘kind and polite’ message highlighting that Harica is one of the only two authorities issuing .onion certificates, they postponed the decision the day after and waited for further law enforcement investigation as KIWI FARMS has very limited alternatives to protect their site [78]. Whether blocking KIWI FARMS or not, it is understandable that infrastructure and certificate providers may not want to get involved in content regulation the way Facebook and Google have to, as moderation is complex, challenging, contentious and expensive [79]. This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Anh V. Vu, University of Cambridge, Cambridge Cybercrime Centre (anh.vu@cl.cam.ac.uk); (2) Alice Hutchings, University of Cambridge, Cambridge Cybercrime Centre (alice.hutchings@cl.cam.ac.uk); (3) Ross Anderson, University of Cambridge, and University of Edinburgh (ross.anderson@cl.cam.ac.uk). Authors: Authors: (1) Anh V. Vu, University of Cambridge, Cambridge Cybercrime Centre (anh.vu@cl.cam.ac.uk); (2) Alice Hutchings, University of Cambridge, Cambridge Cybercrime Centre (alice.hutchings@cl.cam.ac.uk); (3) Ross Anderson, University of Cambridge, and University of Edinburgh (ross.anderson@cl.cam.ac.uk). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2. Deplatforming and the Impacts 2. Deplatforming and the Impacts 2.1. Related Work 2.1. Related Work 2.2. The Kiwi Farms Disruption 2.2. The Kiwi Farms Disruption 3. Methods, Datasets, and Ethics, and 3.1. Forum and Imageboard Discussions 3. Methods, Datasets, and Ethics, and 3.1. Forum and Imageboard Discussions 3.2. Telegram Chats and 3.3. Web Traffic and Search Trends Analytics 3.2. Telegram Chats and 3.3. Web Traffic and Search Trends Analytics 3.4. Tweets Made by the Online Community and 3.5. Data Licensing 3.4. Tweets Made by the Online Community and 3.5. Data Licensing 3.6. Ethical Considerations 3.6. Ethical Considerations 4. The Impact on Forum Activity and Traffic, and 4.1. The Impact of Major Disruptions 4. The Impact on Forum Activity and Traffic, and 4.1. The Impact of Major Disruptions 4.2. Platform Displacement 4.2. Platform Displacement 4.3. Traffic Fragmentation 4.3. Traffic Fragmentation 5. The Impacts on Relevant Stakeholders and 5.1. The Community that Started the Campaign 5. The Impacts on Relevant Stakeholders and 5.1. The Community that Started the Campaign 5.2. The Industry Responses 5.2. The Industry Responses 5.3. The Forum Operators 5.3. The Forum Operators 5.4. The Forum Members 5.4. The Forum Members 6. Tensions, Challenges, and Implications and 6.1. The Efficacy of the Disruption 6. Tensions, Challenges, and Implications and 6.1. The Efficacy of the Disruption 6.2. Censorship versus Free Speech 6.2. Censorship versus Free Speech 6.3. The Role of Industry in Content Moderation 6.3. The Role of Industry in Content Moderation 6.4. Policy Implications 6.4. Policy Implications 6.5. Limitations and Future Work 6.5. Limitations and Future Work 7. Conclusion, Acknowledgments, and References 7. Conclusion, Acknowledgments, and References Appendix A. Appendix A. 5. The Impacts on Relevant Stakeholders We have looked at the impacts of the disruption on KIWI FARMS itself. This section examines the effects on relevant stakeholders, including the harassed victim, the community leading the campaign, the industry, the forum operators, and active forum users who posted at least once. As our ethics approval does not allow the study of individuals, all measurements are conducted collectively on subsets of users. Besides quantitative evidence, we also qualitatively look at statements made by tech firms about the incident. 5.1. The Community that Started the Campaign There were 3 886 users in the online community involved in starting the campaign. Of these, 1 670 users (42.97%) were responsible for around 80% of tweets. There was a sharp increase in tweets and reactions at the beginning (see Figure 6). The first peak was on 25 August 2022 with nearly 900 tweets by around 600 users. However, this dropped rapidly to less than 100 per day after a few weeks when Cloudflare and DDoS-Guard took action, and almost to zero two weeks later. The number of tweets specifically mentioning Cloudflare (such as their official account, as well as those for jobs, help, and developers) was around 200 in the beginning but decreased over time, and dropped to zero after they took action. This lasted for roughly one month until after the forum recovered: we see around 400 tweets mentioning Cloudflare, twice the previous peak, and accounting for almost all such tweets that day. However, these tweets appeared to be primarily associated with another campaign counted by the hashtag #stopdoghate, suggesting a short-lived outlier instead of a genuine peak. The trans activist who launched the campaign was engaged at the beginning but then became much less active in posting new tweets, although she still replied to people. Her posting volume was, however, trivial compared to the overall numbers: she made only four tweets on the day the campaign started, the number then dropped quickly to only one on 4 September 2022 after Cloudflare took action, and zero thereafter. It suggests that although she sparked the campaign, she might not be the primary maintainer. We see no notable peak of tweets after the forum was completely shut down, suggesting a clear loss of interest in pursuing the campaign, both from people posting tweets and people reacting to tweets. The community seemed to get bored quickly after a few weeks when they appeared to have gotten what they wanted – ‘Kiwi Farms is dead, and I am moving on to the next campaign’, tweeted the activist. 5.2. The Industry Responses Unlike measurement of forum activity, there is no such quantitative data to cover the impact on industry actors, so we switch to qualitative analysis of public statements made by those who directly attempted to terminate the forum. We first compile a list of involved tech firms seen from the takedown incidents, then look at their websites, news, and blogs to spot their official statements if available. We repeated the search regularly, and the final list consists of four firms: Cloudflare, DDoS-Guard, DiamWall, and Harica. We then took a deductive approach to understand (1) their hosting policy, (2) their perspective on KIWI FARMS, and (3) their reactions to the community pressure. Cloudflare stated their abuse policies on 31 August 2022 without directly mentioning the Twitter campaign [76]. In summary, the firm offers traffic proxy and DDoS protection to lots of (mostly non-paid) sites regardless of the content hosted, including KIWI FARMS. The firm maintains that abusive content alone is not an issue, and the forum – while immoral – still deserves the same protection as other customers, as long as it does not violate US law. Although Cloudflare are entitled to refuse business from KIWI FARMS, they initially took the view that doing so because of its content would create a bad precedent, leading to unintended consequences on content regulation and making things harder for Cloudflare. This could affect the whole Internet, as Cloudflare handles a large proportion of network traffic. They did not want to get involved in policing online content, but if they had to do it they would rather do so in response to a court order instead of popular opinion. The firm previously had dropped the neo-Nazi website DAILY STORMER [12] and the extremist board 8CHAN [13] because of their links with terrorist attacks and mass murders, and a false claim about Cloudflare’s secret support. They also claimed that dropping service for KIWI FARMS would not remove the hate content, but only slow it down for a while. Nevertheless, Cloudflare did a U-turn a few days later on 3 September 2022, announcing that they would terminate service for KIWI FARMS [24]. They explained that the escalation of the pressure campaign led to users being more aggressive, which might lead to crime. They reached out to law enforcement in multiple jurisdictions regarding potential criminal acts, but as the legal process was too slow compared to the escalating threat, they made the decision alone [24]. They still claimed that following a legal process would be the correct policy, and denied that the decision was the direct result of community pressure. Cloudflare’s action also inadvertently led to the termination of a neoNazi group in New Zealand, as it was hosted by the same company as the forum [77]. DDoS-Guard’s statements about the incident told a similar story [25]. Although they can restrict access to their customers if they violate the acceptable use policy, content moderation is not their duty (except under a court order) so they do not need to determine whether every site they protect violates the law. DiamWall took the same line; they claimed that they are not responsible, and are unable to moderate content hosted on websites [26]. They also maintained that terminating services in response to public pressure is not good policy, but the case of KIWI FARMS was exceptional due to its ‘revolting’ content. They also noted that their actions could only delay things but not fix the root cause, as the forum could find another provider. DiamWall’s statement was removed afterwards without any clear explanations; it is now only accessible through online archives. Unlike the three firms above, Harica – a Greek Authority providing certificates for .onion sites – took a different line. They confirmed their support for freedom of speech and stated that they will not censor any website, but are obligated to investigate complaints about websites violating the law, the Certificate Policy (CP) and the Certificate Practice Statement (CPS). After a review process, on 15 May 2023 they announced they would revoke the .onion certificates issued to KIWI FARMS due to concerns about harassment connecting to suicides. After setting a 3-day timeframe for KIWI FARMS to seek a new authority, their support team were targeted by various threats and harassment, but based on one ‘kind and polite’ message highlighting that Harica is one of the only two authorities issuing .onion certificates, they postponed the decision the day after and waited for further law enforcement investigation as KIWI FARMS has very limited alternatives to protect their site [78]. Whether blocking KIWI FARMS or not, it is understandable that infrastructure and certificate providers may not want to get involved in content regulation the way Facebook and Google have to, as moderation is complex, challenging, contentious and expensive [79]. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv
