Methodology

# Coverage gaps

A coverage gap is something this index knows it is missing. Each one records the dimension it sits on, what is absent, why the pass did not reach it, and the search that would close it. Publishing the gaps is the only way a count of 102 incidents can be read for what it is: what was found, not what happened.

| Dimension | What is missing | Why | Recommended next search |
| --- | --- | --- | --- |
| Activity type Child sexual abuse material | Only one CSAM takedown is represented despite this being one of the most frequent categories of hidden-service seizure. Playpen, Boystown, and numerous unnamed services are absent. | Many CSAM operations are announced without naming the service, and details are frequently sealed to protect victims. | Search DOJ, BKA, and Europol releases for hidden-service CSAM seizures, accepting that service names will often be withheld and recording them as unnamed targets. |
| Activity type Piracy and IP | No piracy or counterfeit-goods domain seizures are included, despite recurring US operations such as Operation In Our Sites seizing hundreds of domains annually. | These are high-volume, low-individuation waves that were deprioritized in this pass. | Search HSI and IPR Center releases by year for In Our Sites waves and model each annual wave as a linked incident under an umbrella campaign. |
| Activity type Terrorism and extremism | No terrorism or violent-extremism infrastructure takedowns are included. Europol referral-action days and the Amaq and Rocket.Chat server seizures are absent. | Referral actions often amount to voluntary provider removal, which is excluded, but several Europol operations did involve server seizures that would qualify. | Search Europol EU Internet Referral Unit action-day releases and distinguish referral-based removals from actual server seizures. |
| Activity type Criminal hosting and proxies | Bulletproof hosting takedowns beyond Avalanche are underrepresented, including the Lolek Hosted seizure and various VPN service seizures such as DoubleVPN and Safe-Inet. | Not searched systematically in this pass. | Search Europol and DOJ releases for bulletproof hosting and criminal VPN seizures between 2018 and 2026. |
| Current case status worldwide, 2010-2026 | Current status was updated where a reliable later official source was located. Records lacking a later outcome source retain their last verified public status rather than assuming dismissal, conviction or closure. | Many foreign proceedings are not indexed in English and some cases remain sealed or pending. | Run periodic outcome checks against official court/prosecutor sources using each legal\_case identifier and named defendant. |
| Docket numbers worldwide, all | Some official releases confirm charges, warrants or seizures but omit a public docket number, especially sealed seizure warrants and non-U.S. proceedings. | A press release is not the court docket; access may require PACER, a national court registry, or an unsealed warrant application. | Use the prosecutor, defendant name, filing date and court fields in legal\_cases to retrieve the original docket. Keep docket\_number null until directly confirmed. |
| Language | Nearly all sources in the corpus are English. German, Dutch, French, Belgian, Korean, and Japanese official releases are cited but their original-language titles and URLs were not captured. | This pass relied on English-language relays of national announcements. | Query bka.de, politie.nl, gendarmerie.interieur.gouv.fr, om.nl, and police.go.kr directly in the local language and record original titles with translation notes. |
| Named people | Several incidents have official charge counts materially higher than the number of named person records, notably ANOM (17 charged, 1 named), the DanaBot indictment (16 charged, 1 named), and the December 2022 PowerOFF wave (6 charged, 0 named). | Names were published but were not individually captured in this pass. Placeholder people were deliberately not created. | Retrieve the relevant DOJ releases and indictments and create one person record per named defendant, deduplicating against existing records. |
| Named person rosters Multi target campaigns, all | High-volume campaigns often publish only aggregate arrests or unidentified aliases. Named-person records are deliberately limited to publicly identified natural persons; no placeholders were created. | The public record does not expose a complete name-by-name roster, or privacy laws prevent publication. | Retrieve national charging documents and court registers jurisdiction by jurisdiction; do not infer identities from aggregate counts. |
| Legal outcomes | Several legal outcomes remain unresolved, including US sentencing for Vasiliev and Astamirov, the Panev trial, Coelho's extradition status, Fitzpatrick's resentencing, and the reported Russian prosecution of Matveev. | Outcomes postdate the original announcements and require targeted docket checks. | Check the District of New Jersey and Eastern District of Virginia dockets, and seek an official Russian source for the Matveev report before treating it as established. |
| Time period pre-2013 | The corpus begins in 2013. Significant earlier operations including Mariposa (2010), Waledac (2010), Rustock (2011), Coreflood (2011), DNSChanger (2011), and the Bredolab server seizure (2010) are absent. | Research effort in this pass concentrated on the period with the richest official documentation. Older press releases are frequently delinked or archived only. | Search DOJ and Europol archives plus the Internet Archive for 2008 to 2012 botnet and domain seizure releases, then verify each infrastructure action against a contemporaneous official source. |
| Possible duplicate US/EU, DDoS for hire, 2026-04 | td\_2026\_poweroff\_apr (Europol-sourced: 53 domains, 21 countries, 4 arrests, 25 search warrants) and td\_2026\_poweroff\_apr\_offsides (USAO Alaska-sourced: 8 domains) both describe an April 2026 PowerOFF wave. These may be the same action reported through two different agency press channels with different domain counts, or genuinely separate concurrent waves. | The two source reports describing this period were not cross-reconciled against a single primary document in this pass. | Retrieve the underlying USAO Alaska press release and the Europol April 2026 release side by side and determine whether the 8-domain figure is a subset of, or distinct from, the 53-domain figure. |
| Unannounced actions | Infrastructure disconnected quietly at police request, provider-compelled shutdowns without public announcement, and sealed matters are structurally invisible to this method. | These actions produce no public record by design. | Consult academic and NGO synthesis literature and hosting-provider transparency reports, and treat any resulting entries as probable edge cases rather than verified core. |
| Region | Latin America, Africa, South Asia, Southeast Asia, the Middle East, and China are almost entirely absent as lead jurisdictions. INTERPOL-coordinated operations in these regions are not represented. | The pass indexed heavily on US and EU sources. | Search INTERPOL operation releases including Africa Cyber Surge, Operation Serengeti, Operation HAECHI, and Operation Synergia, then verify whether each involved a qualifying infrastructure action. |
| Source quality | Most sources in this corpus are graded P1 or P2 press releases. Only three records cite a P0 court document, and two of those lack a docket number. | Court dockets require targeted retrieval that was not performed in this pass. | Retrieve indictments and judgments from CourtListener and PACER for each named defendant and attach docket numbers to every charge and sentence action. |
| Source verification | Most source records carry a publisher, title, and date but a null URL, flagged in notes as not re-verified in this pass. | URLs were deliberately left null rather than reconstructed from memory, since fabricating plausible URLs would violate the source rules. | Run a verification pass that opens every source, records the canonical URL and an archive URL, corrects any title drift, and downgrades to U any source that cannot be retrieved. |
| Verification depth | 62 takedown records (added in the August 2026 consolidation pass drawing on three deep-research reports) have not undergone the docket-level, inline-source-embedding verification pass applied to the original 38-incident core. Dates, agency attributions, and figures are believed accurate but are sourced from aggregated secondary research rather than re-opened primary documents. | Time-boxed consolidation prioritized breadth of coverage over per-incident verification depth in this pass. | Apply the same source-verification and inline-embedding methodology used for the original core (see the project's source-verification pass) to each extended-pass record, starting with state-sponsored and ransomware incidents where legal/technical precision matters most. |