Hi, my name is Anh. I'm a PhD student at Cambridge. I'm going to be talking about a concerted effort by industry to take down hate & harassment forums. This is the work that Jin (?) mentioned yesterday, and this is a joint work with [
Alice Hutchings] and [
Ross Anderson].
So we published this paper a couple weeks ago at Auckland (??), and Ross* was the person who wanted to talk about this today. I do have a plan to talk about another paper, but I will try my best to do what Ross wanted to do.
So the forum we looked at is Kiwifarms. How many of you have heard about Kiwifarms before? (pause)
Well, half of you? For the rest of you, Kiwifarms is probably the largest forum known for online harassment, where you can also find unpleasant content about cyber bullying, doxings, and a lot of information of users reviewed on that forum.
So this forum has over one decade of lifetime with over 15 million posts in total, and it had been been using Cloudflare protection services for years until September 2022. There was an incident which happened with a Canadian activist in London, Ontario, where it is believed that she was harassed by forum members so seriously by a swatting incident. And then she started a campaign on Twitter in order to pressure Cloudflare and the other tech firms to drop the forum.
And Cloudflare took actions very shortly. So it blocked Kiwifarms, and in their public statement, it is said that they blocked the content because of immediate threat to human life. Then Kiwifarms quickly moved to another service called DDoS-Guard, which is a Russian-based one, but just one day after, DDoS-Guard also dropped the forum. And the forum then moved to another platform, but it got blocked very shortly afterward.
It was not just about three of these tech firms, but many others also tried to block the forum, including some T1 networks. This is very extraordinary, because we have just about fifteen T1 networks in the world, and three or four, four or five of them blocked that forum.
And because this case is very special, we wanted to evaluate how effective this take-down campaign is. Our method is that we collected the entire forum data spanning over a decade and the Telegram channel used by the forum users, because they tend to move to other platforms when the forum was not accessible. And we also collect web traffic to the forums and also the showed interest of Internet users about Kiwifarms.
So here is our first impressions. So, there was an unintended consequence. As you can see here, the showed interest of Internet users and web traffic to the six major domains of Kiwifarms increased dramatically - like 7 times and twice higher than before, just right after Cloudflare's actions. That means more people are more interested in searching Kiwifarms and also to visit the forum.
Here is the forum activity over time, and you can see a very big drop here just right after Cloudflare's actions. And the second big drop was after a T1 network blocked the forum. But eventually, after all, after a couple of months the forum recovered. So this figure is until December 2022 when we submitted the paper. And at this moment, the forum activities fully recovered, and it is even higher than before.
Then we ask the question: Where did the users move to? Well, they moved to Telegram. And here you can see a very big spike of activities on the channels, and you can see the scale here - it was even higher than the forum itself.
Here is the number of postings on Lolcow.farm, which is the primary competitor of Kiwifarms. So we do see some drop here in sync with Kiwifarms, but what interested me - users did not move to that forum. So they tend to move within their ecosystem.
And here is the traffic to six major domains of Kiwifarms. You can see here - the traffic was to the main domain of Kiwifarms, dropped rapidly. And it was fragmented to all domains that were previously not used. And you can see the very messy stuff here is when the traffic was fragmented. But eventually, after a couple months, the traffic returned back to the primary domains.
So there are a lot of other things in the paper. We built a network of forum users, and we found that they were actually more connected after the tech (?) that happened. We also discuss the details of industry response and also the reactions of the leading community, where we found that they lost their interest quickly over time - just after a few weeks. And also the user discussion about the campaign tailed off very quickly.
So this very special case teaches us some valuable lessons. Even with a concerted effort by a series of tech firms - many tech firms - it may not be enough to shut down that hate community. And it can be quite challenging to do so, because one thing is missing. Because the Kiwifarms owner was not arrested. For example, when the FBI takes down a website, the playbook is that they seize the website, they arrest the owners, and they hope the combination may work. But in this case, the forum operator was not arrested, and he was very technically competent. He tried many things to recover the forum.
And we know from previous work that government actions may be less effective than a tech firm's, because they need to go through all the complicated paperwork, and they need to go through all legal processes before seizing any website. So the open question here is: How effective law enforcement and government action could be in that case? For example.
Yeah, I would like to spend my last word to say thank you to Ross. Because yeah, he was the one who changed my life in many ways. Thank you, Ross, for all the inspirations - all the things he has done for the community and for the generations and generations of students. And I have made a website. I collect all the public tribute of people that write about Ross - with consent of course - and I also collect some private messages by our department members, and I put them online. Because I believe that many people - including myself - will learn a lot of lessons by reading through people's memories. Thank you very much,
*clapping*
I wonder if he requested that it not be posted?
