Its interesting that being unable to find a legal route to dig up dirt on archive.is, they're going the route of CSAM allegations.

I first heard of this technique on a discussion on Lowendtalk from a hoster discussing how pressure campaigns were orchestrated.

The host used to host VMs for a customer that was not well liked but otherwise within the bounds of free speech in the US (I guess something on the order of KF/SaSu/SF), so a given user would upload CSAM on the forum, then report the same CSAM to the hoster. They used to use the same IP address for their entire operation. When the host and the customer compared notes, they'd find about these details.

Honestly at the time I thought the story was bunk, in the age of residential proxies and VPNs and whatnot, surely whoever did this wouldn't just upload said CSAM from their own IP, but one possible explanation would be that the forum probably just blocked datacenter IPs wholesale and the person orchestrating the campaign wasn't willing to risk the legal fallout of uploading CSAM out of some regular citizen's infected device.

In this case, I assume law enforcement just sets up a website with said CSAM, gets archive.is to crawl it, and then pressurize DNS providers about it.

They have plausible deniability, but the fact of the matter is: this also erases evidence of past crimes from public records. If bad things already happened then we should keep the evidence that they happened.

The root problem of CSAM is child trafficking and abuse in physical space. But for whatever reason enforcement efforts seem to be more focused on censoring and deleting the images rather than on curbing the actual act of child trafficking and rape. It's almost as if viewing (or this case, merely archiving) CSAM is considered a worse crime than the physical act of trafficking and sexually abusing children, which is apparently okay nowadays if you're rich or powerful enough.

When I accessed archive.ph (ordinary everyday content) during a visit to Italy last week, a legal notice loaded instead from Italy’s cyber authority saying they had blocked access domain-wide over CSAM. I suspected the same M.O. as parent comment describes was operative. I took a screenshot of the notice in case anyone’s interested. Edit: uploaded & available here https://drive.google.com/file/d/1WdSlZK6q1EjdRWzWeKANbjOZV03...

https://saucenao.blogspot.com/2021/04/recent-events.html

Mildly related incident where a Canadian child protection agency uploads csam onto a reverse image search engine and then reports the site for the temporarily stored images.

I've spent enough time on telegram to see this happening more times to ban groups. Csam shit storm, content gets flagged, the group gets banned (or at least, unavailable for some time)

> KF/SaSu/SF

SaSu: Sanctioned Suicide [1]

But I don't know what KF and SF are supposed to stand for.

[1] https://en.wikipedia.org/wiki/Sanctioned_Suicide

That would work but it is a very risky technique. For the mere mortal in your example this means possible jail time just to get some site closed down.

For law enforcement personnel, at the very least would mean an end of a career if caught (also possible jail time)

It’s the digital equivalent of a dirty cop planting a gun after shooting a suspect. Of course it happens. Three letter agencies probably do things like this all the time. Half of their legitimate work is probably illegal to begin with.

I doubt they’d have to. If the site truly doesn’t remove CSAM automatically I’ve no doubt plenty of it would end up there organically. You wouldn’t have to upload any anywhere, you’d only need to know some URLs to look for which presumably any major law enforcement agency would.

> gets archive.is to crawl it

Does archive.is actually do any crawling? I thought they only archived pages on request.

KF/SaSu/SF ?

The owner of the KiwiFarms goes into detail how the attack against his site works and where the residential IPs are from:

"The bot spammer

- Started his attack by simply DDoS attacking the forum.

- Uses thousands of real email addresses from real providers like gmail, outlook, and hotmail.

- Uses tens of thousands of VPN IPs.

- He also uses tens of thousands of IPs from "Residential Private Networks", which are "free" VPN services that actually sell your IP address to spammers so that their activity cannot be identified as coming from a commercial service provider.

- Is able to pass off all CAPTCHA providers to CAPTCHA solvers to bypass anti-bot challenges.

- Is completely lifeless and dedicated to this task. Publicly posted invites were found and used by him, and after a full month of no engagement he noticed registrations were open within hours."

Source: https://kiwifarms.st/threads/the-gay-pedophile-at-the-gates....

It's the same technique that people on Reddit use to take down subreddits that don't agree with the carefully curated "hive mind".

> Its interesting that being unable to find a legal route to dig up dirt on archive.is, they're going the route of CSAM allegations.

This looks like someone in US (because FBI + CSAM) does not like them.

A lot of "sensitive" content is behind paywalls in the "free press" so someone, possibly FBI, wants to suppress this info.

[flagged]

It's unlikely law enforcement would take the risk to handle CSAM just to make a case against a Russian pirate, jeopardizing their careers and freedom, when the copyright case is pretty strong already.

These are the doings of one of the myriad freelance "intelectual rights enforcement agents", which are paid on success and employed by some large media organization. Another possibility is that a single aggrieved individual who found themselves doxed or their criminal conviction archived etc. took action after failing to enforce their so called "right to be forgotten".

Unfortunately, archive.is operating model is uniquely vulnerable to such false flag attacks.