Front Burner - The takedown of harassment site Kiwi Farms

Episode Date: September 21, 2022

Notorious stalking and harassment site Kiwi Farms has been hacked and taken offline again, less than a month after the website security and hosting provider Cloudflare dropped it, citing an "unprecedented emergency and immediate threat to human life." Kiwi Farms had risen to prominence after Canadian trans activist and Twitch streamer Clara Sorrenti was swatted in her London, Ont. home this past summer. Sorrenti organized a pressure campaign to remove Kiwi Farms from the internet, calling it "a matter of public safety for every single person online." Today, Alejandra Caraballo of the Harvard Law Cyberlaw Clinic explains how Kiwi Farms was able to operate for so long, and outlines the efforts to keep it offline.

In the Dragon's Den, a simple pitch can lead to a life-changing connection. Watch new episodes of Dragon's Den free on CBC Gem. Brought to you in part by National Angel Capital Organization, empowering Canada's entrepreneurs through angel investment and industry connections. This is a CBC Podcast. Hi, I'm Jonathan Mompitsy. By now, maybe you've heard of Kiwi Farms. It's this online community, if you can call it that,

best known for harassing, doxing, and stalking targets of their choosing. They've been at it for years, at least until they went after Clara Sorrenti. That's Clara, better known online as Keffels, recounting the terrifying moment when she was arrested at gunpoint at her home in London, Ontario this summer. Online trolls had called local police, falsely claiming that Clara was threatening to shoot up City Hall. It's a tactic known as swatting. I'm a high-profile transgender activist.

There's a big target on my back, and for the past year, transgender people have been at the focal point of a culture war. Clara is a Twitch streamer who, after being ruthlessly targeted by Kiwi Farms, led a campaign to take the site offline. A campaign that's largely been successful. Cloudflare has finally dropped KiwiFarms.net. When we put all of our collective energy together, we managed to get a multi-billion dollar corporation to drop this hate site. Kiwi Farms has been popping up and going down like whack-a-mole ever since. Just this weekend, Kiwi Farms owner Joshua Moon said the latest incarnation of the site was hacked and taken offline again.

As of Tuesday afternoon, it's still down. But how was it able to operate for so long? And will its users be able to find a new online home? Today, Alejandra Carballo is with us. She's a clinical instructor at the Harvard Law School Cyber Law Clinic and was also a supporter of the campaign to get KiwiFarms offline. To give us a sense of what this forum is all about, she started by telling us what KiwiFarms users mean when they refer to a lol cow. Yeah, I mean, basically what it means is someone, you know, in the way that they describe it as someone that can be quote unquote milked for entertainment, which is just kind of a gross way to view things. Like basically it's the way that they call someone the target, right. Um, and it's someone that they can go after. Um, and again, cyber stock harassed docs, threatened, um, all kinds of stuff. I mean,

there is some kind of perverse stuff that they would do to people they would target under that name. They'd call employers, make spurious allegations that the person is a pedophile or all kinds of stuff to get them fired. They would game the Google search SEO so that whenever someone would Google this person's name, that would be the first thing that would pop up or at least high on the rankings. So that if, you know, Hey, this person's trying to get a new job, you know, the employer Googles them. And then they find this random forum that's like making all these like horrendous allegations and has docs, like everything about them, you know, they, they're like, I don't want to hire this person. And so they would do that. They would also docs anyone that was associated with the,

with the target. So basically friends, family members, coworkers, basically anyone, oftentimes it was just anyone who happened to be in a picture with them. And so oftentimes people would then distance themselves from the target because they didn't want to become targets themselves or they didn't want to have their information doxed on the internet. And so it was a means of just completely isolating people from any sort of support, from friends, from family, from having a job to be able to sustain themselves. Even at times they would even call their landlords to make accusations to get them kicked out of housing. And at this point, it was just this kind of sick internet game where literally the point of it was to strip anyone of any kind of sense of support so they get so low that they end up killing themselves. And this is something that's happened three times that has been widely documented.

I mean, I guess my next question is why? What is the point of all this? I mean, it's just sick entertainment. It's a group of sociopaths sitting around with nothing better to do. Part of it is a lot of them don't have anything going on in their lives, they just view tearing other people down as a, as a means to, to get revenge. I just, um, but also the targets that they tend to go after tend to be people that society already doesn't have favorable views upon typically like trans people, neurodivergent people, people with autism, anyone that they, they, you know, quote unquote view as, as eccentric would become primary targets.

Uh, but it really was the most vicious eccentric would become primary targets. But it really was the most vicious with trans folks. I mean, it became to a point where basically any trans person with any sort of platform online would be almost an immediate target for these people. And so that, that's really, you know, a part of it is a hatred of trans people. It's a kind of nihilistic sense of just chaos and destruction and tearing down people. And just, again, like a sense of trying to get entertainment out of destroying people's lives in a systematic, organized way. I've seen the site called the Voldemort of anti-trans sites, which I guess is a play on the fact that you aren't supposed to say Voldemort's name in the Harry Potter series. Can you explain that reference a bit more? Yeah. I mean, I track a lot of far right and extremist sites, also anti-trans sites.

And I don't think there's any site that I've ever encountered in the online extremism researcher groups or even among journalists and particularly among the vulnerable groups that were targeted themselves, trans folks that just kind of evoked such fear that no one would dare mention their name, at least publicly. I mean, if you talk to anyone in the trans community, way before this kind of broke through into the mainstream, like most trans folks had a pretty strong familiarity because if they hadn't been targeted, someone they knew had been targeted. And so there was a lot of familiarity with what this site did and you know people like ben collins who reported for nbc news and wrote the kind of long article that really broke this into

the mainstream um you know he had said he had known about the site for years but he was told that he shouldn't report on it and so like this is already like it becomes a safety risk for even reporters and so no one dare uttered the name. And then the problem is, is that the victims themselves would often be told, don't talk about this. Don't bring it up. It's only going to make it worse. Right. And as we saw with Clara or, you know, known as Keffels, she did talk about it and look what happened to her. She got swatted. She got doxxed at various hotels. She got threatened in Ireland. Like her entire life was completely turned upside down because she spoke out and, you know, and she had tremendous courage and bravery to do what she did, but not many people have the

resources, means, and platform to be able to carry on that kind of campaign against this site. And most people would have folded long before that. And I don't think there's any other site that's even come close to this. I know there's other sites that are very infamous, like 4chan and 8chan and others. But by the way those forums work, there's a constant refresh because nothing is being archived, whereas this is constantly being built upon. So this is a site that's just been so extreme that most people were afraid to even mention its name publicly. Yeah. And I just, I guess, you know, based on what you were just describing to me, like really there's no holds barred here. There's no one is off limits. I

understand that even a child as young as nine was at once doxxed on the site. Yeah. One of the things that this campaign has exposed is so many trans people, friends and family of trans people have now shared their stories publicly because the fear has been lifted in many ways now that the site is functionally down. Debbie Jackson and her child Avery were like, was featured on National Geographic in 2017. And she shared how immediately they doxed her. They stalked her. They would go after employers because in their view, she was a pedophile groomer that was transing her kid.

And this is a mother with a nine-year-old child, right? And you're trying to get her fired and all these things. It just shows how vile it is. And like, you're right, like, nobody was off limits, right? Like, and some people think that's just far right folks that go on here and just target people on the left or things like that. But like, they targeted people on the right too. You know, even like Marjorie Taylor Greene was allegedly swatted by someone associated with the site. She says police showed up at her home in Rome, Georgia, early this morning. Officers claimed that someone had been shot there multiple times. Officers spoke with Green, who told them it was a false report.

Authorities say that somebody. So it has a broader sense of nihilism that kind of unifies the user base. And it's just really they just don't care about anyone. They view a target and they dehumanize them to such a point that anything and everything is acceptable to do to them. What recourse has been available to people who have found themselves targeted by these Kiwi farm threats? The frank reality, and this is what I've been trying to convey to people, especially people like Cloudflare and others that say, well, just go to law enforcement. There really is no recourse. Like I've been assisting people with this for, for nearly a

year because people have come to me and I've had so many friends and others go through this is that like the reality is that if you go to local law enforcement, like your local police department, they don't have the resources, they don't have the expertise. And so everyone would just point, you go, I'll go to the FBI. You go to the FBI. They don't exactly have a file complaint form. They have a tips form. And then other than that, you try to have to call or have connections that can get you to someone at the FBI. And so even if you do manage to get ahold of someone at the FBI, they'll tell you, well, thanks for letting us know. And, and, you know, try and let your local law enforcement. So it's basically like that Spider-Man meme where everyone's pointing their fingers at each other. And it's like, why don't you go to this person? And it's just a circle of not being able to get any help from

law enforcement. And then beyond that, the civil remedies from lawsuits for defamation, for harassment, cyber-stalking, all of those things, good luck. Because most people immediately find it's going to cost tens of thousands of dollars to litigate this. And even if you manage to have that kind of resource, good luck finding an attorney willing to take this on. Because the problem is that attorneys wouldn't want to take this on. And I've spoken to so many trying to get people connected to legal resources that just won't take this on because of fear for their own personal safety. So when you can't go to law enforcement, you can't go to the civil courts and have lawyers represent you. And if you talk about it publicly, it's just going to make the harassment orders of

magnitude worse. There is no recourse. And this is exactly why people went after Cloudflare to get them to drop because there was no other pressure point because lawmakers generally are not taking this seriously. I'm hoping that as unpopular as Marjorie Taylor Greene is like, you know, maybe she can try to be constructive and come up with a way to protect people from swatting, you know, and how she's experienced it herself. Because nobody should go through that. And so there really needs to be, I think, a broader understanding of this kind of digital networked harassment, and better ways to tackle it. And it's going to take a federal response. And until

federal lawmakers and federal law enforcement actually start taking these things more seriously and not writing it off as just mean words on the internet, this is just going to get worse. And we're seeing it, you know, outside of this particular concentrated forum aspect with KiwiFarms, like we're seeing this with accounts like Libs of TikTok on Twitter, talking about children's hospitals that provide services to trans youth, and they're getting bomb threats. And so this isn't just limited to these forums where it's just kind of concentrated at individuals. Like this is becoming a de facto tactic for political violence, particularly in this kind of reactionary right. So that's what makes it particularly difficult to tackle.

Like this is just the most acute, very like extreme example of this, but these kinds of tactics are really becoming more mainstream. In the Dragon's Den, a simple pitch can lead to a life-changing connection. Watch new episodes of Dragon's Den free on CBC Gem. Brought to you in part by National Angel Capital Organization. Empowering Canada's entrepreneurs through angel investment and industry connections. Hi, it's Ramit Sethi here.

You may have seen my money show on Netflix. I've been talking about money for 20 years. investment and industry connections. That's not a typo. 50%. That's because money is confusing. In my new book and podcast, Money for Couples, I help you and your partner create a financial vision together. To listen to this podcast, just search for Money for Couples. So you were saying that, you know, so many people are afraid to speak publicly about what was happening on Kiwi farms, fearing the backlash, fearing the retaliation. But things have changed, right? Like in large part because of Canadian trans activists and Twitch streamer Clara Sorrenti. Can you tell us how she became a target of Kiwi farms? At the end of March, that's when things quickly escalated. They doxed her family members. The first thing that they did was find the

obituary for my dead father and use it to find his memorialized Facebook page. They were able to find a picture of my dad on the front porch of my childhood home. And from that, use Google Maps and figure out where that was located. Someone made a fake account on Twitter pretending to be her late father. I don't know how to put this mildly, but the theme of the account was the father was sexually attracted to his own daughter. And it was reposting explicit sexual content that Claire had produced previously. She tried staying quiet for a while, but then her mods on her Twitch channel were getting doxxed. People on her Discord chat, her followers were getting doxxed and attacked. There were spinning insane conspiracy theories about her. It just kept getting worse and worse and worse and worse

until finally she went public about it on Twitch, which then caused a mass reporting campaign and got her Twitch account banned for 30 days. And then she ended up taking a break from streaming. And while she was taking a break and getting, you know, some help from therapists, things still escalated. And so that's when she got swatted. And that's when things really got much, much worse. She ended up having to go to a hotel for her safety and they doxed the hotel by checking the bedsheets that were in a picture of her cat against all the other hotels in the city. They were able to cross-reference what they saw on the bedsheets with every other hotel in the city until they found out that the specific bedsheets only had a pattern in this one hotel

that I was staying at. Her Uber account was hacked, which then gave them the location of her next hotel. I mean, at that point, it became so incredibly unsafe that she decided to leave the country. She left Canada and she went to Northern Ireland. And I thought that if I got far away and went to a different continent, they wouldn't be able to do the same thing. And then it turned out I was wrong. And then at that point, they doxed her in Northern Ireland.

Somehow, her harassers tracked her down in Belfast. One of them even came to the apartment building she was staying at, taking this chilling photo full of trans slurs and posted it online. Clara was in the middle of a... You know, when she was forced to flee, like, that's when she really started the Drop Kiwi Farms campaign because, you know, what else did she have to lose at that point?

She'd been driven away from her own country. And this is not the first time. I know several trans people who have had to leave the United States as a result of just the severe stalking that resulted from KiwiFarms. So this Drop KiwiFarms campaign, it eventually works. Cloudflare reluctantly drops the site earlier this month.

And for those of you who aren't familiar, Cloudflare is this truly enormous company that provides security and hosting services to websites. Anyway, after Cloudflare cuts them off, Joshua Moon posts, quote, there has never been a violent incident in our history, which cannot be said for many other sites still on Cloudflare, end quote. So briefly, Alejandra, what effect did Cloudflare dropping KiwiFarms have on the site? You mentioned earlier that it's functionally down at this point. them against what's called distributed denials of service, which is like the best way to visualize this is imagine like 100 people trying to get into a door. It's basically the virtual equivalent where everyone tries to get into a server all at the same time or website. And so what Cloudflare does is basically makes like 20 copies of the door so that more people can get through and it mitigates the ability for them to do it. And so when they lost them, it became much more difficult to keep

the site up and deal with potential cyber attacks and cyber threats against them. They quickly tried to pivot to DDoS Guard in Russia, which quickly dropped them. And afterwards, they started hopping between different providers. They went to DMWall in Portugal, which immediately dropped them within hours of learning who they are. And basically, they had been unable to maintain much uptime outside of their Tor server, which is a kind of dark web protocol that obscures users and where the website is located. And so basically outside of Tor, they were inaccessible on what's called the clear net, which is the more publicly accessible internet. We did it. We actually did it. So many people have tried for so long to do this, and we actually got KiwiFarms down. It's not bad.

Not bad at all. Not bad at all. And so, as a result, they basically have hemorrhaged users and, you know, it's been one hit after another. And then it was revealed this past weekend that the site itself had been compromised through a proxy server that the site utilized based out of Ukraine. said, like assume for any of the users that their emails, passwords are potentially compromised and could be released. So right now the site is functionally dead and probably for the longest amount of time since 2017, with no indication of when it could even possibly return. Alejandra, you spoke earlier about the lack of recourse for people facing this kind of online stalking and harassment, and also that it's becoming a more commonly used political weapon. Given that, do you think making it harder for this one site to stay online will be enough to actually stop these kinds of vicious, coordinated, targeted online harassment campaigns? Absolutely not. I mean, KiwiFarms was an extreme outlier in how central it was to the functioning of the site and how pervasive the culture was of this kind of cyber stalking. But the bigger problem remains far too much data about people's private lives is readily

available through data brokers. This stuff can be easily mined. It's also a lack of understanding of what even minute details shared about your life on social media, everything from just pictures of your house to just even where you're eating and going to restaurants can tell about your life. And so we really need to have much more protections at the federal level. I know Senator Elizabeth Warren and Ed Markey pushed a digital privacy bill that would restrict the types of data that data brokers can sell on the open market and create more protections. It remains to be seen whether that bill will pass. But this is the kind of steps that we need to take to help protect people. needs to take these kinds of threats more seriously and develop mechanisms so that people who find themselves at the receiving end of this kind of networked harassment can actually

get some kind of recourse and assistance. Because right now, for most people who find themselves in this situation, there really is none. Alejandra Caballo, thanks so much for joining us. Thanks for having me. That's all for today. I'm Jonathan Mopetzi. Jamie will be back with you tomorrow. For more CBC Podcasts, go to cbc.ca slash podcasts.