{"table":"coverage_gaps","columns":["dimension","jurisdiction","activity_type","period","description","reason","recommended_next_search"],"row_count":17,"research_cutoff_on":"2026-08-21","generated_on":"2026-08-21","terms":"Free to reuse with attribution to the Internet Takedown Index. A research aggregation of public reporting, not a legal reference.","rows":[{"dimension":"period","jurisdiction":null,"activity_type":null,"period":"pre-2013","description":"The corpus begins in 2013. Significant earlier operations including Mariposa (2010), Waledac (2010), Rustock (2011), Coreflood (2011), DNSChanger (2011), and the Bredolab server seizure (2010) are absent.","reason":"Research effort in this pass concentrated on the period with the richest official documentation. Older press releases are frequently delinked or archived only.","recommended_next_search":"Search DOJ and Europol archives plus the Internet Archive for 2008 to 2012 botnet and domain seizure releases, then verify each infrastructure action against a contemporaneous official source."},{"dimension":"language","jurisdiction":null,"activity_type":null,"period":null,"description":"Nearly all sources in the corpus are English. German, Dutch, French, Belgian, Korean, and Japanese official releases are cited but their original-language titles and URLs were not captured.","reason":"This pass relied on English-language relays of national announcements.","recommended_next_search":"Query bka.de, politie.nl, gendarmerie.interieur.gouv.fr, om.nl, and police.go.kr directly in the local language and record original titles with translation notes."},{"dimension":"region","jurisdiction":null,"activity_type":null,"period":null,"description":"Latin America, Africa, South Asia, Southeast Asia, the Middle East, and China are almost entirely absent as lead jurisdictions. INTERPOL-coordinated operations in these regions are not represented.","reason":"The pass indexed heavily on US and EU sources.","recommended_next_search":"Search INTERPOL operation releases including Africa Cyber Surge, Operation Serengeti, Operation HAECHI, and Operation Synergia, then verify whether each involved a qualifying infrastructure action."},{"dimension":"activity_type","jurisdiction":null,"activity_type":"csam","period":null,"description":"Only one CSAM takedown is represented despite this being one of the most frequent categories of hidden-service seizure. Playpen, Boystown, and numerous unnamed services are absent.","reason":"Many CSAM operations are announced without naming the service, and details are frequently sealed to protect victims.","recommended_next_search":"Search DOJ, BKA, and Europol releases for hidden-service CSAM seizures, accepting that service names will often be withheld and recording them as unnamed targets."},{"dimension":"activity_type","jurisdiction":null,"activity_type":"piracy_ip","period":null,"description":"No piracy or counterfeit-goods domain seizures are included, despite recurring US operations such as Operation In Our Sites seizing hundreds of domains annually.","reason":"These are high-volume, low-individuation waves that were deprioritized in this pass.","recommended_next_search":"Search HSI and IPR Center releases by year for In Our Sites waves and model each annual wave as a linked incident under an umbrella campaign."},{"dimension":"activity_type","jurisdiction":null,"activity_type":"terrorism_extremism","period":null,"description":"No terrorism or violent-extremism infrastructure takedowns are included. Europol referral-action days and the Amaq and Rocket.Chat server seizures are absent.","reason":"Referral actions often amount to voluntary provider removal, which is excluded, but several Europol operations did involve server seizures that would qualify.","recommended_next_search":"Search Europol EU Internet Referral Unit action-day releases and distinguish referral-based removals from actual server seizures."},{"dimension":"activity_type","jurisdiction":null,"activity_type":"criminal_hosting_proxy","period":null,"description":"Bulletproof hosting takedowns beyond Avalanche are underrepresented, including the Lolek Hosted seizure and various VPN service seizures such as DoubleVPN and Safe-Inet.","reason":"Not searched systematically in this pass.","recommended_next_search":"Search Europol and DOJ releases for bulletproof hosting and criminal VPN seizures between 2018 and 2026."},{"dimension":"source_quality","jurisdiction":null,"activity_type":null,"period":null,"description":"Most sources in this corpus are graded P1 or P2 press releases. Only three records cite a P0 court document, and two of those lack a docket number.","reason":"Court dockets require targeted retrieval that was not performed in this pass.","recommended_next_search":"Retrieve indictments and judgments from CourtListener and PACER for each named defendant and attach docket numbers to every charge and sentence action."},{"dimension":"named_people","jurisdiction":null,"activity_type":null,"period":null,"description":"Several incidents have official charge counts materially higher than the number of named person records, notably ANOM (17 charged, 1 named), the DanaBot indictment (16 charged, 1 named), and the December 2022 PowerOFF wave (6 charged, 0 named).","reason":"Names were published but were not individually captured in this pass. Placeholder people were deliberately not created.","recommended_next_search":"Retrieve the relevant DOJ releases and indictments and create one person record per named defendant, deduplicating against existing records."},{"dimension":"outcomes","jurisdiction":null,"activity_type":null,"period":null,"description":"Several legal outcomes remain unresolved, including US sentencing for Vasiliev and Astamirov, the Panev trial, Coelho's extradition status, Fitzpatrick's resentencing, and the reported Russian prosecution of Matveev.","reason":"Outcomes postdate the original announcements and require targeted docket checks.","recommended_next_search":"Check the District of New Jersey and Eastern District of Virginia dockets, and seek an official Russian source for the Matveev report before treating it as established."},{"dimension":"verification","jurisdiction":null,"activity_type":null,"period":null,"description":"Most source records carry a publisher, title, and date but a null URL, flagged in notes as not re-verified in this pass.","reason":"URLs were deliberately left null rather than reconstructed from memory, since fabricating plausible URLs would violate the source rules.","recommended_next_search":"Run a verification pass that opens every source, records the canonical URL and an archive URL, corrects any title drift, and downgrades to U any source that cannot be retrieved."},{"dimension":"quiet_actions","jurisdiction":null,"activity_type":null,"period":null,"description":"Infrastructure disconnected quietly at police request, provider-compelled shutdowns without public announcement, and sealed matters are structurally invisible to this method.","reason":"These actions produce no public record by design.","recommended_next_search":"Consult academic and NGO synthesis literature and hosting-provider transparency reports, and treat any resulting entries as probable edge cases rather than verified core."},{"dimension":"verification_depth","jurisdiction":null,"activity_type":null,"period":null,"description":"62 takedown records (added in the August 2026 consolidation pass drawing on three deep-research reports) have not undergone the docket-level, inline-source-embedding verification pass applied to the original 38-incident core. Dates, agency attributions, and figures are believed accurate but are sourced from aggregated secondary research rather than re-opened primary documents.","reason":"Time-boxed consolidation prioritized breadth of coverage over per-incident verification depth in this pass.","recommended_next_search":"Apply the same source-verification and inline-embedding methodology used for the original core (see the project's source-verification pass) to each extended-pass record, starting with state-sponsored and ransomware incidents where legal/technical precision matters most."},{"dimension":"possible_duplicate","jurisdiction":"US/EU","activity_type":"ddos_for_hire","period":"2026-04","description":"td_2026_poweroff_apr (Europol-sourced: 53 domains, 21 countries, 4 arrests, 25 search warrants) and td_2026_poweroff_apr_offsides (USAO Alaska-sourced: 8 domains) both describe an April 2026 PowerOFF wave. These may be the same action reported through two different agency press channels with different domain counts, or genuinely separate concurrent waves.","reason":"The two source reports describing this period were not cross-reconciled against a single primary document in this pass.","recommended_next_search":"Retrieve the underlying USAO Alaska press release and the Europol April 2026 release side by side and determine whether the 8-domain figure is a subset of, or distinct from, the 53-domain figure."},{"dimension":"named_person_rosters","jurisdiction":null,"activity_type":"multi_target_campaigns","period":"all","description":"High-volume campaigns often publish only aggregate arrests or unidentified aliases. Named-person records are deliberately limited to publicly identified natural persons; no placeholders were created.","reason":"The public record does not expose a complete name-by-name roster, or privacy laws prevent publication.","recommended_next_search":"Retrieve national charging documents and court registers jurisdiction by jurisdiction; do not infer identities from aggregate counts."},{"dimension":"docket_numbers","jurisdiction":"worldwide","activity_type":null,"period":"all","description":"Some official releases confirm charges, warrants or seizures but omit a public docket number, especially sealed seizure warrants and non-U.S. proceedings.","reason":"A press release is not the court docket; access may require PACER, a national court registry, or an unsealed warrant application.","recommended_next_search":"Use the prosecutor, defendant name, filing date and court fields in legal_cases to retrieve the original docket. Keep docket_number null until directly confirmed."},{"dimension":"current_case_status","jurisdiction":"worldwide","activity_type":null,"period":"2010-2026","description":"Current status was updated where a reliable later official source was located. Records lacking a later outcome source retain their last verified public status rather than assuming dismissal, conviction or closure.","reason":"Many foreign proceedings are not indexed in English and some cases remain sealed or pending.","recommended_next_search":"Run periodic outcome checks against official court/prosecutor sources using each legal_case identifier and named defendant."}]}