About the Internet Takedown Index

What counts as a takedown

The inclusion rule is carried in the dataset itself, not written for this page. This is it, unedited.

An incident enters the verified core when a law-enforcement agency, prosecutor, court, or other government-backed authority materially seized, redirected, sinkholed, disabled, covertly took control of, remotely remediated, or compelled the shutdown of internet infrastructure serving an illicit online service. Arrest-only cases, indictment-only cases, sanctions-only actions, ordinary platform moderation, and purely private civil takedowns are excluded from the core and recorded separately.

Outcomes for the people attached to an incident use a fixed vocabulary, so incidents can be compared across years, jurisdictions, and case types. Every label below is a group of action types recorded against a named person, never an aggregate figure quoted by an agency. Official aggregate counts are kept in separate fields and are never added to these.

Unknown does not mean zero. A blank count means the public record does not establish a number. Zero appears only where a source explicitly establishes that the number is zero.

Counting incidents

One entry is one enforcement action against one target. Where a single operation is announced by several agencies it is recorded once, with every participating organization listed against it. Follow-on actions against the same target are separate entries linked back to the original, so a long-running operation does not inflate the totals.

The counting rules below are recorded in the dataset and applied to every figure on this site.

• record_kind=umbrella_campaign records are excluded from incident totals.
• reported_* fields carry official aggregate counts; named_* fields carry counts derived from normalized person records. These are never added together.
• Extradition is recorded as a distinct person_action and is never counted as a second apprehension.
• Superseding indictments do not create new person records.
• null means unknown. 0 is used only where a reliable source explicitly establishes zero.

Verification tiers

Not every record was checked to the same depth, and the record says which is which. Every takedown page carries its tier, so an extended-pass entry cannot pass for a verified one.

The dataset's own note on the verified core:

The 'verified_core' subset (38 incidents/4 umbrellas, IDs td_2013_silk_road through td_2026_poweroff_apr plus the four um_* umbrella records) underwent a dedicated source-verification and inline-embedding pass confirming publisher, title, publication date, and docket/case numbers for each record; several date and figure conflicts were explicitly resolved (Genesis Market = 11 official domains; Fitzpatrick arrest 2023-03-15 and 2025-09-16 resentencing to 36 months; Cazes docket 1:17-CR-00144-LJO, E.D. Cal.).

And on the extended pass:

All remaining takedown records were added in a second, broader aggregation pass drawing on three independent deep-research reports covering roughly 75-78 worldwide incidents each. These records were NOT independently re-verified source-by-source to the same standard as the verified core: source_quality for extended-pass sources is capped at P2/S2, URLs are not yet populated, and several dates/figures may need reconciliation (e.g. td_2026_poweroff_apr_offsides may be a duplicate report of the same action as td_2026_poweroff_apr under a different domain count -- flagged, not merged, pending confirmation). Treat extended-pass records as a prioritized research queue for the same verification workflow already applied to the core.

One figure in the snapshot does not add up. The snapshot stores the extended pass as 66 records. Counted directly from the records it is 70, because the stored figure subtracts the 4 umbrella campaigns from the incident total, and every umbrella campaign is in the verified core. The counted figure is the one used across this site.

Classification labels

Where a service or a group is documented operating again after an action, that later activity is recorded as its own row against the original entry. Two vocabularies describe it: what the successor's relationship to the original is, and how strongly the sources support that reading. Both are defined in the dataset. Silence is not read as a shutdown, and a reused name is not read as a return.

On the return class letters

Some records also carry a return class, a single letter from A to G. That grading comes from the source dataset and its scale is published nowhere in the data, so this site does not translate the letters into words. Where a letter appears it is shown as it is, labeled "Return class B" and nothing more.

To judge whether something came back, read the relationship and the confidence above, the date the successor was first seen, and whether it was seized again in a later action. Those fields are defined. The letter is not, and inventing a definition for it would be the same kind of guess this index exists to avoid.

Sources

Every claim in an entry is tied to at least one cited source, and each source is a full bibliographic record: publisher, title, publication date, and where available a docket or case number. Official records take precedence. Charging documents, seizure notices, and agency statements set the facts. Reporting is used to establish timing and aftermath. Where accounts conflict, the entry follows the official record and marks the remainder as not established. Every source is listed on the Sources page.

Each source also carries a provenance grade. The grading scale is the dataset's own, not this site's. The letter is the class of source, P for primary and official, S for secondary, T for tertiary, and the digit is the dataset's confidence in the record, with 0 the strongest. The dataset does not publish a fuller definition than that, so the table below reports what actually carries each grade in this corpus rather than a definition nobody wrote down.

The grades are applied unevenly. Prosecutor and law enforcement releases appear under both P1 and S2, and participating company reports sit at T1 rather than in the S range. The grades are reported as the dataset recorded them and have not been reassigned here, because rewriting them would put this site's judgment over the record's.

Only 4 of the 152 sources carry a URL. The rest were recorded with publisher, title, and date so they can be retrieved from the publisher. No URL was reconstructed from memory, because a plausible invented link is worse than no link.

Known limitations

These are the dataset's own recorded limitations. They are published in full rather than summarized, because a summary is where the inconvenient ones go missing.

• Not exhaustive. No complete global registry of law-enforcement internet takedowns exists in the public record.
• Corpus is weighted toward US-led and Europol/INTERPOL-coordinated actions documented in English.
• Extended-pass records (added in this consolidation) require a dedicated verification pass equivalent to the one already applied to the original 38-incident core before their source_quality can be upgraded from P2/S2.
• Source URLs are recorded with publisher, title, and publication date where known; exact URL strings were not re-opened and verified character-for-character for extended-pass records. No URL has been invented.
• Unnamed CSAM services, routine piracy and counterfeit-domain waves, national blocking actions, terrorist-content referrals, and infrastructure disconnected quietly at police request are materially undercounted.
• Non-English national records (BKA.de, Politie.nl, Gendarmerie, Japanese NPA, Korean National Police, Latin American prosecutors, Italian Polizia Postale) were consulted only through English-language relays.
• Aggregate official arrest counts are never summed with counts of publicly named people. Placeholder person records were not created.
• Several final legal outcomes remain open as of the cutoff and are recorded as pending rather than resolved.
• td_2026_poweroff_apr (53 domains/21 countries/4 arrests, Europol-sourced) and td_2026_poweroff_apr_offsides (8 domains, USAO Alaska-sourced) may describe the same April 2026 PowerOFF wave reported through two different agency channels with different domain counts; both are retained separately pending reconciliation rather than merged or dropped.
• A second people-and-person_actions pass (after initial consolidation) added named individuals present in the source deep-research reports but initially omitted from the extended-pass incidents (e.g. the 17 named ANOM distributors, DanaBot's two named lead defendants, Backpage's Carl Ferrer, Megaupload's co-defendants, BTC-e's Alexander Vinnik, Bitzlato's Anatoly Legkodymov, ChipMixer's Minh Quốc Nguyễn, Z-Library's Napolsky and Ermakova, Kingdom Market's Alan Bill, Dridex's Andrey Ghinkul, and RedLine's Maxim Rudometov). Where a source described an arrest or charge without naming the individual (e.g. Wall Street Market's three German administrators, Ragnar Locker's Paris arrestee, Samourai Wallet's founders), the record was deliberately left as an aggregate reported_apprehended_count rather than a placeholder person record, per the project's own counting rules.

Coverage gaps

A coverage gap is something this index knows it is missing. Each one records the dimension it sits on, what is absent, why the pass did not reach it, and the search that would close it. Publishing the gaps is the only way a count of 104 incidents can be read for what it is: what was found, not what happened.

Excluded candidates

These are the actions that were considered and deliberately left out, with the reason for each. Most fail the inclusion rule on a single point: a sanctions designation that did not touch infrastructure, an indictment with no seizure beside it, a disruption carried out by someone other than a government authority. A handful are marked unresolved, meaning they probably do belong here and were not promoted because their primary sources were not opened in this pass.

This list is part of the record, not an appendix to it. A corpus that only shows what it included cannot be checked.

Corrections and updates

Entries are revised whenever new public records appear. Each takedown page carries the date it was last reviewed and the tier it was verified to, so a correction is visible as a change in both. Corrections are applied to the entry itself rather than appended as a note, and the review date advances with them.

A useful correction names three things: the entry it concerns, the field that is wrong, and the document that shows it. Official documents carry the most weight, in the same order used everywhere else here: court filings first, then agency releases, then reporting. A correction that changes a count will also change what the entry says is not established, since a figure moving out of unknown is itself a substantive edit.

A submission address is not published yet. Until it is, the fastest way to see what would need correcting is the coverage gaps table above, which already names the searches this index has not run.

Data download

The full text of every page on this site is published as Markdown, regenerated at each research cutoff, and that is currently the complete export. It carries the same fields as the entries themselves, including source references, status labels, and verification tiers.

Structured CSV and JSON exports of the underlying tables are coming and are not available yet. Reuse of what is published is permitted with attribution. This is a research record, not a legal reference.

Download the full site text or the page index.